Safety, Health, and Environment

A. Hazardous properties of materials, including SDS

Material Hazards, Flammability and Industrial Hygiene

Read flash point, autoignition and LFL/UFL off an SDS, rate hazards with the NFPA diamond, apply TLV/PEL limits, and add noise on the decibel scale.

Unlocks with an access pass — one-time payment, no auto-renew. View passes

Pass holders

C. Process safety, risk assessment, and hazard analysis

Process Safety: HAZOP, LOPA and Risk Assessment

Generate deviations with HAZOP guide words, multiply independent-protection-layer PFDs in LOPA, and combine fault- and event-tree gates with the AND-multiply, OR-add rules.

Process safety is where chemical engineering stops being about yield and starts being about preventing the low-probability, high-consequence event — the runaway, the toxic release, the vapor-cloud explosion. The discipline is structured: HAZOP finds the deviations, LOPA counts whether enough independent barriers stand between an initiating event and an intolerable consequence, and fault/event trees put numbers on the combinations. The FE Reference Handbook — Safety section frames risk as

\text{Risk} = \text{Hazard}\times\text{Probability}

, and every method in this concept is a disciplined way of estimating one side of that product. The exam-critical reflex is Boolean: redundant (parallel) failures (an AND gate, all must fail) multiply, while series failure paths (an OR gate, any one suffices) add. Confuse the two and the answer is off by orders of magnitude.

HAZOP: guide words crossed with parameters

A Hazard and Operability study walks a process node by node and systematically multiplies a set of guide words against each process parameter to force the team to imagine every credible deviation. The guide words — NO/NONE, MORE, LESS, AS WELL AS, PART OF, REVERSE, OTHER THAN — cross with parameters like flow, pressure, temperature, level, and composition. 'MORE pressure' on a reactor node prompts the team to ask what raises it, what consequence follows, and what safeguard exists. The power of HAZOP is completeness: it is a structured brainstorm that exposes scenarios a checklist would miss, and it feeds the candidate scenarios that LOPA then quantifies.

\text{Deviation} = \text{Guide word} \times \text{Process parameter}

Independent protection layers

An Independent Protection Layer (IPL) is a safeguard that is effective in preventing the scenario from reaching its consequence, independent of the initiating cause and of the other layers, and auditable. The onion model stacks them outward from the process: inherent design, the basic process control system (BPCS), critical alarms with operator response, the safety instrumented system (SIS/interlocks), physical relief (relief valves, rupture disks), then dikes, and finally emergency response. Each genuine IPL earns credit only if it is truly independent — a sensor shared between the BPCS control loop and an alarm is one layer, not two — which is the single most-tested judgment in LOPA.

LOPA: multiplying PFDs

Layer of Protection Analysis is a semi-quantitative bridge between a qualitative HAZOP and a full fault tree. The mitigated event frequency is the initiating-event frequency multiplied by the probability of failure on demand (PFD) of every independent protection layer that can stop the scenario. Because the layers are independent, their PFDs multiply: two layers each with

\mathrm{PFD}=0.1

give a combined demand-failure probability of

0.01

, a hundred-fold reduction. You then compare the mitigated frequency to a tolerable target (often

10^{-4}

to

10^{-6}

/yr depending on consequence severity); if the gap remains, you add a layer — typically a safety instrumented function of the required SIL.

f_{\text{mitigated}} = f_{\text{initiating}} \times \prod_{j} \mathrm{PFD}_j

PFD, risk reduction factor and SIL

The probability of failure on demand is the fraction of demands on a safety function that it fails to answer; its reciprocal is the Risk Reduction Factor,

\mathrm{RRF}=1/\mathrm{PFD}

. A safety instrumented function is graded by Safety Integrity Level: SIL 1 spans

\mathrm{PFD}

from

10^{-1}

to

10^{-2}

(RRF

10

–

100

), SIL 2 from

10^{-2}

to

10^{-3}

, SIL 3 from

10^{-3}

to

10^{-4}

. When LOPA leaves a residual gap of, say, a factor of

100

between the mitigated frequency and the tolerable target, you specify a function whose RRF closes it — here a SIL 2 interlock, whose band guarantees

\mathrm{PFD}<10^{-2}

(the bands are half-open: a PFD of exactly

10^{-2}

, RRF

=100

, is only the bottom of SIL 1).

\mathrm{RRF} = \dfrac{1}{\mathrm{PFD}}\;(\text{one layer}), \qquad \mathrm{RRF}_{\text{req}} = \dfrac{f_{\text{unmitigated}}}{f_{\text{tolerable}}}\;(\text{total})

Fault trees and event trees

A fault tree works backward from a single top event (the loss of containment) through Boolean gates to its basic causes. An AND gate fires only if all inputs fail, so the top probability is the product of the input probabilities; an OR gate fires if any input fails, so for small, independent probabilities the top probability is approximately their sum (exactly

1-\prod(1-p_i)

). An event tree works the other direction: it starts from an initiating event and branches success/failure at each safeguard, multiplying along each path to assign a frequency to every outcome. Together they let you trace a number from root causes through to consequence likelihood.

P_{\text{AND}} = \prod_i p_i, \qquad P_{\text{OR}} = 1-\prod_i (1-p_i) \approx \sum_i p_i

Consequence and dispersion basics

The consequence side of risk estimates how far harm reaches. A neutrally buoyant continuous ground-level release disperses by a Gaussian-plume model in which the centerline downwind concentration falls as the source strength divided by the wind speed and the spreading parameters

\sigma_y,\sigma_z

— concentration is inversely proportional to wind speed, so a calm day is the worst case (an elevated source adds a

\exp(-H^2/2\sigma_z^2)

factor at ground level). Toxic endpoints are tied to ERPG/AEGL thresholds, flammable endpoints to the LFL contour, and overpressure to TNT-equivalent blast curves. For the FE the key qualitative points are that heavier-than-air gases slump and travel low, releases are worst in stable, low-wind conditions, and consequence times probability gives the risk you compare against tolerability.

C(x,0,0) = \dfrac{\dot{m}}{\pi\,u\,\sigma_y \sigma_z}\quad(\text{ground-level centerline, continuous plume})

Exam strategy

Decide the gate first: 'all of these must fail' is AND (multiply), 'any one of these fails' is OR (add for small probabilities). In LOPA, list only genuinely independent layers — strike any that shares a sensor, logic solver, or final element with another — then multiply their PFDs by the initiating frequency. Compare the result to the tolerable target and, if short, divide to get the required RRF and read off the SIL. Keep frequencies (per year) distinct from probabilities (dimensionless per demand): the initiating event is a frequency, each IPL contributes a dimensionless PFD, and their product is again a frequency.

Key equations

Risk definition

\text{Risk} = \text{Hazard}\times\text{Probability}

Risk combines the inherent capacity to harm with the likelihood (and severity) of the harmful event.

HAZOP deviation

\text{Deviation} = \text{Guide word}\times\text{Parameter}

Guide words (NO, MORE, LESS, REVERSE, etc.) crossed with flow, pressure, temperature, level, composition generate credible deviations.

LOPA mitigated frequency

f_{\text{mit}} = f_{\text{init}}\prod_{j}\mathrm{PFD}_j

$f_{\text{init}}$ in events/yr; each independent IPL contributes a dimensionless PFD. Result in events/yr is compared to a tolerable target.

Risk reduction factor

\mathrm{RRF} = \dfrac{1}{\mathrm{PFD}}

Demand-failure reciprocal; an $\mathrm{RRF}=100$ layer has $\mathrm{PFD}=0.01$ , the bottom of the SIL 1 band — to guarantee a factor of 100 you specify SIL 2 ( $\mathrm{PFD}<10^{-2}$ ).

Required risk reduction

\mathrm{RRF}_{\text{req}} = \dfrac{f_{\text{unmitigated}}}{f_{\text{tolerable}}}

Total reduction the protection layers must collectively supply; product of all IPL RRFs must meet or exceed it.

Fault-tree AND gate

P_{\text{AND}} = \prod_i p_i

Top event needs all inputs to fail (redundant safeguards). Independent probabilities multiply.

Fault-tree OR gate

P_{\text{OR}} = 1-\prod_i(1-p_i)\approx \sum_i p_i

Top event needs any one input to fail (series). Approximate sum valid for small, independent $p_i$ .

Event-tree outcome frequency

f_{\text{outcome}} = f_{\text{init}}\prod_k p_k

Multiply the initiating frequency by the branch probability (success or failure) along each path.

Gaussian plume centerline

C = \dfrac{\dot{m}}{\pi\,u\,\sigma_y \sigma_z}

Ground-level downwind concentration for a continuous neutral release; inverse in wind speed $u$ — calm air is worst case.

Worked examples

LOPA layer count and SIL selection

Problem. A loss-of-cooling initiating event occurs at $f_{\text{init}} = 0.1\,\mathrm{yr^{-1}}$ . Two independent protection layers exist: a high-temperature alarm with operator response ( $\mathrm{PFD}=0.1$ ) and a BPCS-based trip ( $\mathrm{PFD}=0.1$ ). The tolerable frequency for this consequence is $1\times10^{-5}\,\mathrm{yr^{-1}}$ . Is the protection adequate, and if not, what SIL interlock is required?

Solution. Mitigated frequency with the two existing layers:

f_{\text{mit}} = 0.1\times 0.1\times 0.1 = 1\times10^{-3}\,\mathrm{yr^{-1}}

. Compare to tolerable: the gap factor is

1\times10^{-3}/1\times10^{-5} = 100

, so the existing layers fall short by

100\times

. Required added

\mathrm{PFD} = 1\times10^{-5}/1\times10^{-3} = 0.01

, i.e.

\mathrm{RRF}=100

— specify a SIL 2 safety instrumented function (

\mathrm{PFD}<10^{-2}

; a PFD of exactly

10^{-2}

would sit at the bottom of SIL 1). Sanity check: adding a

\mathrm{PFD}=0.01

layer gives

1\times10^{-3}\times0.01 = 1\times10^{-5}\,\mathrm{yr^{-1}}

, exactly the target.

f_{\text{mit}} = 0.1\times0.1\times0.1 = 10^{-3}\,\mathrm{yr^{-1}} \;\Rightarrow\; \text{add } \mathrm{PFD}\le 0.01

Fault tree with AND and OR gates

Problem. A reactor overpressures if its relief path fails. The relief path fails only if both a relief valve ( $p_1=0.02$ ) and a rupture disk ( $p_2=0.05$ ) fail (AND). Separately, a control failure ( $p_3=0.01$ ) can also cause overpressure (OR, combined with the relief-path failure). Find the top-event probability.

Solution. Redundant relief is an AND gate:

P_{\text{relief fail}} = p_1 p_2 = 0.02\times0.05 = 1.0\times10^{-3}

. The two independent ways to overpressure combine in an OR gate:

P_{\text{top}} = 1-(1-1.0\times10^{-3})(1-0.01) = 1.099\times10^{-2} \approx 1.10\times10^{-2}

. The small-probability approximation

P_{\text{top}}\approx 1.0\times10^{-3}+0.01 = 0.011

agrees to three figures. Sanity check: the AND gate (redundancy) drove the relief-path failure down to

10^{-3}

, while the single control failure at

10^{-2}

dominates the OR sum — the larger contributor controls, as expected.

P_{\text{top}} = 1-(1-p_1 p_2)(1-p_3) \approx 1.10\times10^{-2}

Required risk reduction factor

Problem. An unmitigated scenario has frequency $2\times10^{-1}\,\mathrm{yr^{-1}}$ and the tolerable frequency is $1\times10^{-4}\,\mathrm{yr^{-1}}$ . What total risk reduction factor must the protection layers supply, and could two SIL 1 layers achieve it?

Solution.

\mathrm{RRF}_{\text{req}} = f_{\text{unmit}}/f_{\text{tol}} = 2\times10^{-1}/1\times10^{-4} = 2{,}000

. Two SIL 1 layers each give

\mathrm{RRF}

between

10

and

100

, so together

100

to

10{,}000

. At the low end (

10\times10=100

) they fail; only if each approaches

\mathrm{RRF}\approx 45

or more (so the product

\ge 2{,}000

) do they suffice. Sanity check:

2{,}000

corresponds to a combined

\mathrm{PFD}=5\times10^{-4}

, achievable by two strong SIL 1 layers or one SIL 1 plus one SIL 2 — consistent with the SIL bands.

\mathrm{RRF}_{\text{req}} = \dfrac{2\times10^{-1}}{1\times10^{-4}} = 2{,}000

Common pitfalls

•Swapping the gate rules: AND (all must fail, redundancy) multiplies probabilities; OR (any one fails, series) adds them. Reversing the two changes the answer by orders of magnitude.
•Counting non-independent layers as separate IPLs — two functions sharing a sensor, logic solver, or final element are not independent and earn credit for only one layer.
•Mixing frequencies and probabilities: the initiating event is a frequency (per year), each IPL contributes a dimensionless PFD, and only their product is again a frequency.
•Adding PFDs instead of multiplying them in LOPA — independent layers multiply, so two $\mathrm{PFD}=0.1$ layers give $0.01$ , not $0.2$ .
•Confusing RRF and PFD: $\mathrm{RRF}=1/\mathrm{PFD}$ , so a larger RRF means a smaller (better) PFD; an $\mathrm{RRF}=100$ layer ( $\mathrm{PFD}=10^{-2}$ ) is only the top of SIL 1 — a factor-100 gap is closed by specifying SIL 2, whose PFD is below $10^{-2}$ .
•Assuming the windiest day is worst for a toxic plume — centerline concentration is inversely proportional to wind speed, so calm, stable air gives the highest concentrations.
•Treating HAZOP as quantitative — it generates and screens deviations qualitatively; LOPA or a fault tree supplies the numbers.

References

NCEES FE Reference Handbook — Safety
CCPS (AIChE), Guidelines for Hazard Evaluation Procedures and Layer of Protection Analysis
IEC 61511 Functional Safety — Safety Instrumented Systems for the Process Industry

D. Overpressure and underpressure protection

Overpressure Relief and Reactivity Hazards

Set relief pressure against MAWP and accumulation, size for the worst credible scenario, inert to dodge the flammable range, and bound runaway reactions with adiabatic temperature rise.

Unlocks with an access pass — one-time payment, no auto-renew. View passes

Pass holders

E. Waste minimization, waste treatment, and regulation

Waste Minimization, Treatment and Environmental Regulation

Climb the waste hierarchy from source reduction to treatment, compute series removal efficiency, classify generators under RCRA, and place CWA, CAA and OSHA correctly.

Unlocks with an access pass — one-time payment, no auto-renew. View passes

Pass holders