A Case Study in Human Reliability - Analysis to Support LOPA in Loading Hazardous Liquids

Several of Cargill’s operations involve transfer of liquids to or from transportation containers, such as portable tankers or truck tankers. Some liquids have benign characteristics while others have toxic or flammable properties such that they pose a safety risk if a loss of containment incident (LOC) occurs during transfer. The risk of these operations is typically evaluated through qualitative process hazard analysis (PHA) techniques, which can be supplemented with Layer of Protection Analysis (LOPA) if the consequence or perceived risks are higher than the acceptable threshold. A circumspective review of LOPA studies across the global organization for various liquid transfer LOC scenarios revealed different approaches to calculating the event likelihoods. The initiating event likelihood (IEL) was the primary parameter that varied among the studies. We found that differing assumptions and different underlying failure rates were applied among the studies to estimate the IEL. The IEL varied by as much as three orders of magnitude for seemingly identical processes. This paper discusses our approach to understanding and addressing this inconsistency.

LOPA was developed as a simplified risk assessment tool, and it relies heavily upon standardized rule sets. We found that the variability in IEL arose from a lack of solid rules upon which to assign the IEL for operator error in truck drive away incidents, i.e., where the driver moves the truck with one or more hoses still connected to the container. To address this variability, we undertook a Human Reliability Analysis (HRA) to develop a consistent IEL basis. Two specific chemical loading/unloading operations were analyzed:

1. Unloading of pressurized liquefied flammable and toxic liquid into a stationary tank, and

2. Replacement of storage totes of a volatile reactive and toxic chemical connected to a transfer hose

A team comprised of process safety personnel and operations staff from Cargill and experts in PHA and human factors used a HRA framework to quantify the failure rates for critical steps in the procedures that required human actions or verifications using the ‘Human Error Assessment and Reduction Technique’ (HEART). The failure probabilities were then introduced into an event tree diagram to estimate the probability of a driver pull-away scenario in the three procedures of interest.

The team reviewed the steps in the procedures and identified steps that were critical to prevention of an inadvertent driver pull-away while the hoses are still connected to the tanker or tote. Various assumptions and conditions were discussed to justify the failure rates and the effect of error-producing conditions on generic human unreliability conditions applicable to the critical steps.

Based on the event tree analysis, the probability of driver pull-away errors were calculated along with the error frequencies based on number of times the procedure was estimated to be conducted every year. The results are summarized in the table below.

Procedure	Driver pull-away - Human Error Probability (HEP) per event	Initiating Event Likelihood (IEL) for LOPA (per year)
Tanker unloading – all events	1.14 x 10-4	0.0137
Single hose attached	5.69 x 10-5	6.82 x 10-3
Both hoses attached	1.71 x 10-7	2.05 x 10-5
Driver has keys and both hoses attached	2.05 x 10-8	2.46 x 10-6
Storage tote replacement	3.97 x 10-6	4.76 x 10-5