Executive Summary
A specialty chemical manufacturer with a centralized solvent handling and distribution system — receiving, storing, and distributing multiple Class I flammable solvents to several downstream production units — required a structured LOPA exercise to evaluate whether existing safeguards provided adequate risk reduction for the facility's solvent transfer and storage hazard scenarios. The facility's HAZOP register had identified several solvent handling scenarios as high-severity, but safeguarding adequacy had been assessed only qualitatively, leaving the facility's engineering team without a quantified basis for prioritizing safeguard investment. This representative example illustrates LOPA methodology applied specifically to solvent handling and bulk transfer operations — a hazard category distinct from reactive process chemistry but carrying significant fire and explosion consequence potential.
Facility Background
The facility's solvent handling system comprised bulk storage tanks for four Class I flammable solvents (toluene, methanol, acetone, and ethyl acetate), a tank farm transfer pump system, and a distribution piping network supplying six downstream production units across the site. Solvent receipt occurred via tanker truck offloading approximately twice weekly per solvent, with transfer pump operation occurring continuously during production hours. The system had been designed with standard safeguards — high-level alarms, nitrogen blanketing on select tanks, bonding and grounding for tanker offloading, and tank farm fire detection — but these had been specified at original design without a documented LOPA quantifying whether the combination of safeguards provided adequate risk reduction for the facility's specific scenario set and risk tolerance criteria.
Hazard Profile
- —Tank overfill during tanker offloading, with potential for liquid release, vapor cloud formation, and — if ignited — flash fire or pool fire consequences
- —Transfer piping failure (gasket, valve, or pump seal failure) during continuous distribution operation, with consequence severity dependent on detection time and isolation response
- —Loss of nitrogen blanket integrity on blanketed tanks, increasing flammable atmosphere risk in the tank vapor space
- —Static ignition during tanker offloading if bonding/grounding integrity is compromised, particularly relevant given the facility's use of low-conductivity solvents with elevated static accumulation risk
Study Methodology
- 1.Scenario selection from the HAZOP register, screening for the four highest-severity solvent handling scenarios based on consequence categories
- 2.Initiating event frequency assignment using recognized industry data sources, calibrated against the facility's solvent throughput and equipment age/maintenance history
- 3.Independent Protection Layer identification for each scenario, distinguishing safeguards that qualified as genuine IPLs from those providing risk reduction without meeting formal independence criteria
- 4.Mitigated event frequency calculation, comparing combined credited risk reduction against the facility's defined risk tolerance criteria for each scenario
- 5.Gap identification and SIL target recommendation where mitigated frequency exceeded tolerance, specifying additional risk reduction required
Key Findings
- —The tank overfill scenario showed an adequate mitigated frequency, with the high-level alarm correctly credited as an IPL given its independence and documented response procedure
- —The transfer piping failure scenario showed an inadequate mitigated frequency — the only credited safeguard was operator detection via routine inspection, which did not meet IPL independence and reliability criteria for the consequence severity involved
- —The nitrogen blanket pressure indication did not qualify as an IPL because it lacked an independent alarm function, requiring active operator monitoring rather than providing an alarmed, auditable safeguard
- —The static ignition scenario showed adequate risk reduction from the bonding/grounding interlock, but the LOPA exercise revealed no independent verification/testing schedule was documented for it
Risk Reduction Measures
- —An automatic flow-deviation-triggered isolation system installed on the transfer piping network, providing the independent protection layer the gap analysis identified as missing
- —A low-pressure alarm with defined operator response added to the nitrogen blanket system, converting a passive indication into a genuine, auditable IPL
- —A periodic test and verification schedule established for the bonding/grounding interlock, closing the latent reliability gap
- —The facility's safeguard register revised to explicitly document IPL qualification status for every credited safeguard
Lessons Learned
Solvent handling hazards are frequently under-quantified relative to reactive process chemistry hazards.
The consequence pathway (fire, not runaway reaction) feels more familiar and the safeguards feel more standard — but LOPA analysis in this case showed real, previously unquantified gaps specifically in the transfer and blanket integrity scenarios.
Continuous indications are not safeguards unless paired with an alarm and a defined response.
The nitrogen blanket pressure indication had existed for years and was monitored by attentive operators, but without a formal alarm and documented response requirement, it could not be credited as an IPL.
A well-designed safeguard with no verification schedule is a latent gap, not a closed item.
The bonding/grounding interlock was correctly designed and had never failed, but the absence of a periodic test schedule meant the facility had no documented basis for confidence it would still function correctly years into its service life.
Technical Takeaways
- —Apply LOPA explicitly to solvent handling and bulk transfer scenarios, not only to reactive process chemistry
- —Maintain an explicit safeguard register distinguishing IPL-qualifying safeguards from those providing risk reduction without meeting formal independence criteria
- —Require a documented alarm and response procedure before crediting any continuous indication as a protection layer
- —Establish periodic verification and test schedules for all safety-critical interlocks, regardless of design adequacy or historical reliability