(167a) Dependent, Independent and Pseudo-Independent Protection Layers in Risk Analysis

Risk analysis is an important tool to provide support for decision making in hazardous industries.  For the last decade, the semi-quantitative layer of protection analysis (LOPA) methodology has been the dominating risk analysis technique in the process industry.  One basic assumption in LOPA is that all the protection layers are independent from each other and from the initiating event, otherwise no risk reduction credit should be taken in the LOPA. However, many processes do have protection layers, which are dependent to some extent. For these systems, assuming independency may be too optimistic, whereas disregarding risk reduction from one protection layer may be too pessimistic.

In this paper, we consider processes with dependent protection layers (with shared component), independent protection layers and pseudo-independent protection layers (subject to common cause failure). A long distance gas pipeline system is used as an example.  By using event tree for incident scenario modeling, fault tree for protection layers, and solving them in a coupled environment, we show how protection layer dependency is treated in risk analysis to obtain the overall risk reduction without being too optimistic or pessimistic.