Journal of Loss Prevention in the Process Industries 23 (2010) 446e454

Contents lists available at ScienceDirect

Journal of Loss Prevention in the Process Industries

journal homepage: www.elsevier.com/locate/jlp

Uncertainty aspects in process safety analysis

Adam S. Markowski a, *, M. Sam Mannan b,1, Agata Kotynia (Bigoszewska) a, Dorota Siuta a
a b

Process Safety and Ecological Division, Faculty of Process and Environmental Engineering, Technical University of Lodz, 90-924 Lodz, ul. Wolczanska 213, Poland Mary Kay O'Connor Process Safety Center, Artie McFerrin Department of Chemical Engineering, Texas A&M University System, 3122 TAMU, College Station, TX 77843-3122, USA

a r t i c l e i n f o
Article history: Received 1 September 2009 Received in revised form 15 February 2010 Accepted 19 February 2010 Keywords: Process safety analysis Quantitative risk analysis Risk assessment Accident scenario Uncertainty Fuzzy sets

a b s t r a c t
Uncertainties of input data as well as of simulation models used in process safety analysis (PSA) are key issues in the application of risk analysis results. Mostly, it is connected with an incomplete and uncertain identication of representative accident scenario (RAS) and other vague and ambiguous information required for the assessment of particular elements of risk, especially for determination of frequency as well as severity of the consequences of RAS. The authors discuss and present the sources and types of uncertainties encountered in PSA and also methods to deal with them. There are different approaches to improve such analysis including sensitivity analysis, expert method, statistics and fuzzy logic. Statistical approach uses probability distribution of the input data and fuzzy logic approach uses fuzzy sets. This paper undertakes the fuzzy approach and presents a proposal for fuzzy risk assessment. It consists of a combination of traditional part, where methods within the process hazard analysis (PHA) are used, and fuzzy part, applied quantitatively, where fuzzy logic system (FLS) is involved. It concerns frequency, severity of the consequences of RAS and risk evaluation. In addition, a new element called risk correction index (RCI) is introduced to take into account uncertainty concerned with the identication of RAS. The preliminary tests conrmed that the nal results on risk index are more precisely and realistically determined. 2010 Elsevier Ltd. All rights reserved.

1. Introduction Process industry has been continually developing its design methods and operating techniques to overcome the hazards which pose signicant risks to life safety, environment, and economy. This development is especially experienced in the renery and petrochemical industry, which handles a wide range of ammable and toxic materials that are potentially hazardous. However, recordable losses due to major accidents have indicated a continuing increase over the last few years (Mannan, 2005; Coco, 2003). Therefore, scientic organizations and academia have increased activity in research related to process safety in the chemical industry. Also, local governments and international organizations have established regulations and programs that require manufacturers to demonstrate to the competent authorities that they have identied existing major accident hazards and adopted appropriate safety measures (SEVESO, SMS-OSHA, and RMP-EPA). The centerpiece of these regulations and programs is the assessment of risk from natural and technological hazards. Such

a task can be fullled by process hazard analysis (PHA). It requires the application of appropriate risk analysis techniques which should demonstrate that measures both for prevention and mitigation employed by the establishment result in a level of risk that is as low as reasonably practicable (ALARP). In majority of cases this demonstration will relay on some form of risk analysis and assessment. Chemical process plant as a complex system requires good scientic knowledge on different issues including process safety. When a system becomes complex, Zadeh in his Principle of Complexity observed that as complexity of the system increases, our ability to make precise and yet signicant statements about its behavior diminishes until a threshold is reached beyond which precision and signicance (or relevance) become almost mutually exclusive characteristics (Zadeh, 1965). Of particular interest in risk assessment for the complex system is the use of subjective information obtained from experts. This conclusion seems to be the case for present process plants and needs to be taken into account in uncertainty aspects of the process hazard analysis. 2. Sources of uncertainty in process safety analysis Process safety analysis (PSA) is focused on the prediction of future accident scenario of risk related to an unwanted release of

* Corresponding author. Tel./fax: 48 426313745. E-mail addresses: markowski@wipos.p.lodz.pl (A.S. Markowski), mannan@tamu. edu (M.S. Mannan). 1 Tel.: 1 979 862 3985; fax: 1 979 458 1493. 0950-4230/$ e see front matter 2010 Elsevier Ltd. All rights reserved. doi:10.1016/j.jlp.2010.02.005

A.S. Markowski et al. / Journal of Loss Prevention in the Process Industries 23 (2010) 446e454

447

dangerous substance encountered in chemical processes. It consists of three main process components: - identication of representative accident scenario (RAS), - the frequencies of RAS, and - severity of the consequences of RAS. The rst component comprises a typical qualitative analysis while the next two are typical quantitative ones. Models used in the PSA usually provide as their output a single value of risk level, whereas it is generally acknowledged that there are substantial uncertainties presented in every component of the PSA. In such a way a single value of risk represents only one possible output result, belonging rather to risk distribution that reects the uncertainties in the input data and models used in the PSA. Therefore, uncertainty in the process risk can be described as an imperfect prediction of risk in the PSA. Each component of the PSA has its own specic functions, models and input data required and so there are different uncertainty sources related to the above mentioned components. In terms of the PSA, consisting of some separate steps of analysis with different qualitative-quantitative approaches in each step, it is convenient to distinguish three types of uncertainties: 1. completeness uncertainty, 2. modeling uncertainty, 3. parameter uncertainty. The completeness uncertainty refers to the question whether all signicant phenomena and all relationships have been considered. This uncertainty is difcult to quantify but this type is a major contributor in a qualitative hazard analysis, especially with the identication of RAS. Modeling uncertainty refers to inadequacies and deciency in various models used to assess accident scenario probabilities and consequences. Availability and validity of these models may enable the assessment of different degrees of belief in each model. This is a major type of uncertainty in consequence assessment. This is a subjective type of uncertainty of knowledge elicited from experts, which is often incomplete, imprecise and fragmentary. The imprecision and inaccuracies in the parameters which are used as an input to PSA models are called parameter

uncertainties. Such uncertainties are inherent because the available data are usually unknown and inaccurate before an accident takes place and the inference process needs to be based on incomplete knowledge. However, there is an opinion that parameter uncertainty is the easiest to quantify. This type may exist in each step of the PSA. It is not easy to separate all these types. Table 1 gives a summary of the sources and types of uncertainty in the PSA. Each step of PSA is a potential source of uncertainty which comprises different type of uncertainty. For instance, doing HAZOP to identify the hazards involved, there are uncertainties concerned with the identication of all risk factors as well as with making the analysis fully comprehensive. Such difculties are found due to completeness uncertainty. Besides, mistakes in assessment of relations between risk factors and accident consequences can be made. Their appearance is called modeling uncertainty. Finally, it is important to select appropriate guideword and process parameter, however the accuracy of this selection is connected with parameter uncertainty. Similar remarks can be indicated for the other steps of PSA. Uncertainties in PSA can be divided according to their qualitative e quantitative nature. There are uncertainties with a typical classical qualitative type, especially in the process hazard analysis (PHA) and other with typical quantitative characteristics, especially in the next phase, quantitative risk analysis, QRA. Taking into account propagation of these types of uncertainties through each step of the PSA, there is a problem with combination of different uncertainties in order to provide an overall estimate of uncertainty on the nal risk index. There are many different approaches to uncertainty analysis: classical statistic, probabilistic, sensitivity analysis and possibility approach (Dubois, 2006; Dubois & Prade, 1988; Pate-Cornell, 1996; Quiech & Cameron, 1994; Siler & Buckley, 2005). Fig. 1 illustrates uncertainty approaches applied in the PSA. In risk analysis, it is traditional to deal with uncertainty through the use of probability theory, especially Monte Carlo simulation. This approach is frequently used for variability uncertainty connected with stochastic variability of different parameters or measurable quantity used for different PSA methods. However, this method requires generation of a probability density function which is difcult to obtain because usually there is not enough data available to determine appropriate probability density

Table 1 Sources and types of uncertainty in PSA. Step of PSA Main goal Main tool Types of uncertainty Completeness Hazard analysis Identication and logic structure of accident scenario (RAS) HAZOP PrHA Fault Tree (FT) Event Tree (ET) Consequence model Inability to identify all risk factors and all RAS as well as errors in screening of hazards Incorrectness in identication of all types of the consequences as well as of all interactions among consequences Wrong selection of events, safety function and number of accident outcome cases Limited assumptions in: external conditions, number of accident outcome cases and incorrectness in the interpretation of results Modeling Wrong interaction between different contributors and variables in accident scenario models Complexity phenomena and inadequacy and imprecision of the models for source terms, dispersion, physical effects, and consequences Wrong analysis of FT and ET leading to inadequate Minimum Cut Set (MCS) Inadequacy in the selection of appropriate risk measure as well as of risk acceptance criteria Parameter Imprecision or vagueness in characteristic properties of contributors and variables

Consequence assessment

Health, property and environmental consequences

Lack or inadequacy or vagueness in values for model variables

Frequency estimation

Frequency of RAS

FTA and ETA Bow-tie model

Lack of real time data for equipment failure rates and human errors Lack of real time data on weather conditions, ignition sources and population

Risk estimation

Risk index or risk category

QRA QRAS LOPA

448

A.S. Markowski et al. / Journal of Loss Prevention in the Process Industries 23 (2010) 446e454

Uncertainties in PSA Physical variability (objective) Lack of knowledge (subjective)

Type of uncertainty

Probability theory

Variation in the results

Expert knowledge

Possibility theory

Uncertainty measure

Statistical approaches

Sensitivity analysis

Rule-based system

Fuzzy sets theory

Uncertainty approaches

Classical methods

Probabilistic methods

Sensitivity analysis

Expert system

Fuzzy logic system

Uncertainty techniques

Best estimate

Probability distribution

Correlation coefficients

Certainty factor

Fuzzy set

Uncertainty representation

Fig. 1. Uncertainty approaches in PSA.

distribution of any type. Besides, the Monte Carlo simulation requires a large amount of computer time and this technique only considers one type of uncertainty, i.e. randomness. It does not work with knowledge uncertainty especially encountered in the accident scenario conguration (fault tree analysis (FTA) and event tree analysis (ETA)) and consequence assessment. Knowledge uncertainty is generally more difcult to handle than physical variability. One of the ways to deal with all the types of uncertainty including lack of knowledge and vagueness is fuzzy logic. The degree of membership function indicating a possibility that certain phenomena will occur is an ideal concept for representing vague issues in risk assessment where there is no sufcient information for the use of other probabilistic methods. The other major advantage of this method is that the analysis of uncertainty is not separated from the actual risk calculations but it is built in the model calculations and can be turned on or off depending on how the input parameters are dened. The use of fuzzy logic in different aspects of the process risk assessment was undertaken previously (Gentile, Rogers, & Mannan, 2003; Karwowski & Mital, 1986; Markowski, 2006; Nilsen & Aven, 2003; Quiech & Cameron, 1994; Salzano & Cozzani, 2006). Majority of these works usually concern frequency analysis. Uncertainty aspects are rarely considered in all other components of the risk assessment, especially in consequence analysis.

3. Risk assessment model with uncertainty aspects Process hazard analysis leads to risk assessment (RA) which can be viewed as a procedure that identies the process hazards which create the risk, the assessment of consequences, the estimation of likelihood, determination of the risk and nally the assessment whether the level of the latter one is acceptable or not. The identication of hazards is focused on the representative accident scenario (RAS) and further analysis concerns the frequency, consequence and risk estimation of the RAS. Therefore, risk assessment consists of a system of sub-models, describing the system on different levels. Models applied within risk assessment are of two categories: event-oriented models with typical qualitative assessment and physical models that provide quantitative prediction of the value of an observed variable. As it was stated before, the RA procedure is affected by different uncertainties, such as these concerning completeness of the list of events that cause the risk (RAS), uncertainty with initiating events for the calculation of frequency of RAS, and the evaluation of severity of the consequences. In order to apply fuzzy logic, there is a necessity to build-in a typical risk assessment procedure. It is achieved by inclusion of

PSA and RAS Traditional part Model for RAS

Inference engine Crisp input Knowledge base Models Rules Crisp output

FLS for F(RAS) Fuzzy part

FLS for S(RAS)

FLS for R0(RAS)

Fuzzification

Inference process Fuzzy arithmetic operations Fuzzy logic operations

Defuzzification

FLS for R(RAS)

FLS for RCI

Risk index R(RAS)

Fig. 3. Fuzzy risk assessment model (fRA).

Fig. 2. The structure of a typical fuzzy logic system (FLS).

A.S. Markowski et al. / Journal of Loss Prevention in the Process Industries 23 (2010) 446e454

449

Specific fuzzy number

Membership function
1

Normalized fuzzy scale

Membership function
1 Low Moderate Fairly high High Very high

0,5

0,5

lb

ub

10

-5

10-4

10

-3

10

-2

10

-1

10

10

Fig. 4. Fuzzication methods.

a fuzzy logic system (FLS). It realizes fuzzy modeling and fuzzy operation required by appropriate physical models used in RA. The basic structure of FLS is shown in Fig. 2. Fuzzy logic system (FLS) consists of the following components: 1. The fuzzier decomposes system input variables with their numerical values and maps them into fuzzy sets, which are determined by linguistic terms. It means that fuzzication is the formation of a fuzzy set A in some relevant universe of discourse X {x1,x2,x3,.} with assignments of the membership function m(x) to particular quantitative variable, to be represented by the order pair (x, m(x)). A degree of membership function varies from 0 to 1 which is opposite to traditional logic where it takes just one value e 0 or 1. 2. The inference engine of the FLS maps input fuzzy sets into fuzzy output sets. It follows if-then rules established on the basis of expert knowledge and/or mathematical calculus specically used in the analysis of a particular operation. Each rule consists of a condition and action, where the condition is interpreted from the input fuzzy set and the action is determined from the output fuzzy set. Each calculus represents mathematical algorithms describing certain analysis, e.g. consequence or frequency analysis. In other words, fuzzy inference is a method that interprets values in the input vectors and, based on a set of rules, assigns values to the output vectors. 3. The defuzzication is a process of weighting and averaging the output set from all of the individual fuzzy rules or calculus into one single output value e defuzzied, so-called crisp value which represents the output fuzzy set. In such a way, by means of FLS, one is able to map imprecise, uncertain input parameters of the particular model into output of this model that is exactly determined. This property is built in a typical risk assessment procedure forming fuzzy risk assessment model (fRA) which is shown in Fig. 3.

The fRA consists of a combination of traditional part, where appropriate classical methods within PSA are used and fuzzy part where fuzzy logic system (FLS) is applied for calculation of frequency, severity of consequence and risk of particular accident scenario RAS. 3.1. Traditional part of RA This is a typical qualitative part of analysis which may use different methods in order to identify the set of representative accident scenarios (RAS). The completeness and quality of that study will strongly affect the uncertainty connected with a nal risk assessment. This problem will be solved also with the help of fuzzy logic by risk correction index (RCI). The output from this part is a structure of accident scenario which is best represented by a combination of fault tree (FT) and event tree (ET) methods, called a bow-tie model. This model is used in further fuzzy part of RA. 3.2. Fuzzy part of RA Fuzzy part of RA applies FLS shown in Fig. 2 according to models used in particular further elements of risk analysis. 3.2.1. FLS for frequency of RAS Once a bow-tie accident scenario structure has been established, subsequently a quantitative analysis is carried out providing calculation of the frequency of a particular top event based on the minimal cut sets (MCS) approach. This requires failure rates of basic events (input data) which are rather scarce and difcult to receive. They are replaced by appropriate fuzzy sets using the two methods: 1. using linguistic terms which express failure rate in words for all basic events and assign them fuzzy triangular numbers

Method I Normalized fuzzy scale Linguistic term for BE Fault tree Fuzzy TE frequency fFTA Calculations according to MCSFT fFTE fETA Calculations according to MCSET fFOE Event tree Output fuzzy frequency

Method II Specific fuzzy number Literature data for BE

Fuzzy numbers scale for frequency Linguistic term for SF

Fig. 5. Fuzzy logic system for frequency estimation using bow-tie model.

450

A.S. Markowski et al. / Journal of Loss Prevention in the Process Industries 23 (2010) 446e454

Release

Dispersion

Physical effects

Vulnerability models

1
Evaporation

3
Consequences

Fig. 6. Consequence analysis for accidental releases of chemicals.

selected from normalized fuzzy number scale; this is an expert approach using subjective human knowledge on approximate failure rates data for all events of the bow-tie model; 2. using available reliability data on failure rates for all events of the bow-tie model and assigning limits for the formulation of specic triangular fuzzy numbers (mean value m, lower bound lb and upper bound ub); this method strongly depends on accuracy of the input data. The above methods are illustrated in Fig. 4. Further calculation will follow operations on fuzzy numbers using fuzzy arithmetic (addition and multiplication as required) for minimal cut set (MCS) determined in the bow-tie model of RAS. Fig. 5 shows the application of FLS for frequency estimation using the bow-tie model for identied accident scenario RAS. An example of this application was shown in our previous work (Markowski, Mannan, & Bigoszewska, 2007). 3.2.2. FLS for severity of the consequence Severity of consequence assessment of accidental releases of chemicals during RAS is a very complex task. A detailed consequence analysis contains a number of consequence models including release models, physical models and vulnerability models (AIChE, 1999; Casal, 2008). The scheme of consequence analysis is shown in Fig. 6. These models are interfaced which enables transfer of data from a previous model to a subsequent model in the chain representing an accident scenario (RAS). Each model, containing separate submodels for certain applications, must be calculated separately and has its own assumptions and different types of uncertainties. For example, an objective uncertainty can occur for certain variables, like the condition of released material (temperature, pressure) and meteorological conditions (wind speed and direction) used in released models. Subjective uncertainties refer to accuracy of the theoretical models used for the simulation of particular physical effects or vulnerability models, and so on.

The models vary in the degree of complexity and detail, and have common tendency to describe a highly idealized situation. In such a way, uncertainty of the rst model will progress from one model to the next. This uncertainty propagation of different types through the consequence analysis will require the application of some integration methods with different techniques, depending on the expressed types of uncertainty (AIChE, 2000). Subsequently, the nal result of consequence analysis quantifying health, safety, environmental or economic impact of a particular accident scenario may be overestimated or underestimated with further serious consequences for the decisionmaking process. Whereas researches on uncertainty problems concerning frequency analysis are widely described in literature, the ones relating to consequence analysis are rather scarce (Markowski & Dobiech, 1999; Quiech & Cameron, 1994; Salzano & Cozzani, 2006). Due to similar arguments as used before, the fuzzy logic could be successfully applied to consequence analysis. All vague input problems and subjective assumptions encountered in the consequence analysis can be transformed into more certain output data by means of the fuzzy set theory. Due to complexity of the consequence analysis, each separate model is considered as a separate fuzzy logic system FLS and calculations are performed for the FLS according to appropriate model algorithms. Each model can be represented in the following general form:

Y f S; P
where S is the vector of state variables, P is the vector of parameters, and Y e output specic function of the model. State variables dene the type of scenario, such as type of substance, vessel temperature and pressure, while parameters are uncertain in the time of calculation, although in the time of scenario, they can have an exact value, e.g. the size of the release hole. Therefore, it is necessary to select these parameters which are particularly uncertain and take them into account in fuzzy modeling.

Fuzzification

fP1 Selection Consequence model Y = f(S, P) Sensitivity analysis Selection of the Pn parameters fP2

Fuzzy arithmetic on the model Defuzzification Output crisp value Y

fY

Fig. 7. Fuzzy logic system for consequence analysis.

...
fPn

A.S. Markowski et al. / Journal of Loss Prevention in the Process Industries 23 (2010) 446e454

451

4 kW/m 1

12.5 kW/m

37.5 kW/m

Membership function

0.5

200

400

600 800 Distance, m

1000

1200

1400

Fig. 8. Range of distance for different radiation levels.

FLS applied to the consequence analysis can be performed in two ways: 1. simplied method based on the distribution of severity of the consequences into separate categories using an expert opinion providing the size of released materials; a further process applies assignment of fuzzy set for that size of release (fuzzication) and this is an input data for risk matrix assessment (Markowski et al., 2007), 2. parameter method used for a particular consequence model, e.g. BLEVE model. The use of the parameter method is shown in Fig. 7. As can be seen, this is a typical FLS applied for a given consequence model. Before the fuzzication, the sensitivity analysis is made to identify potential major contributors (parameters, P) to an overall output. After the fuzzication in further calculations an appropriate formula of each consequence model is used where fuzzy arithmetic replaces the classical mathematical operation. It allows us to obtain a crisp exact output value of the consequence model Y. Fig. 8 shows an example of such application in the BLEVE calculation for a 600 m3 tank with LPG with the help of PHAST program (Markowski & Dobiech, 1999). Results refer to three threshold values for thermal radiation 4, 12.5 and 37.5 kW/m2 and relate to specic consequences which may occur. Input fuzzy sets for the sensitive parameters are in trapezoidal shape. As can be seen, the ranges of hazard zones are widespread over the universe of discourse, especially for membership function m (0) 0. This reects high uncertainty of the distance of hazard zones. It can be additionally noticed that the extent of intervals increases with the decrease of the threshold value of thermal radiation intensity. It is due to two reasons: 1. to the exponential distribution of thermal radiation intensity in relation to the distance where for the distances close to the tank thermal radiation intensity rapidly decreases and with the increase of the distance from the location of the failure the rate of thermal radiation intensity decrease is reduced; 2. to so-called effect of fuzzy output sets shape caused by the calculations on fuzzy numbers.

Fig. 9. Fuzzy risk matrix surface.

1 0.5 0 0

Simple

Moderate

Complex

0.1 Poor

0.2

0.3

0.4

Degree of membership

0.5 0.6 Complexity Average

0.7

0.8

0.9 Good

1 0.5 0 0

0.1

0.2

0.3

0.4

0.5 0.6 Experience Medium

0.7

0.8

0.9

1 0.5 0 0

Low

High

0.1

0.2

0.3

0.4

0.5 RCI

0.6

0.7

0.8

0.9

Fig. 10. Fuzzy sets for development of FLS (RCI).

Table 3 Fuzzy rules for RCI. Experience of staff E Novice, experienced staff not available P Poor S Simple M Moderate C Complex M Medium L Low L Low Partially qualied staff A Average H High M Medium L Low Professional competence

Complexity of plan C Simple, Single unit plant Moderate complexity, Multiunit plant Advanced hightech, Multiunit plant, in dense location

G Good H High H High M Medium

Table 2 Comparison non-fuzzy results with fuzzy results for BLEVE model. Type of analysis Range of distance to radiation level [m] 4 kW/m Non-fuzzy Fuzzy 876 793
2

12.5 kW/m 506 467

37.5 kW/m 283 264

RCI sets: H e high quality PSA, Me standard PSA, and L e poor PSA.

452

A.S. Markowski et al. / Journal of Loss Prevention in the Process Industries 23 (2010) 446e454

nal risk index. The assessment of quality of the analysis is quite a complex task as there are numbers of causes which affect such an analysis, like imprecision in system denition, omissions in hazard analysis and errors in accident modeling. For simplication, only the two most important variables that affect the value of the RCI are selected: 1. experience of the analysts team in PSA, and, 2. complexity of the plant to be analyzed. This effect can only be assessed using fuzzy logic as all other methods are rather unsuitable. RCI is expressed as a numerical value of the risk index between 0 and 1 by an expert opinion and this value can change (reduce) the fuzzy risk index (R0) obtained with the use of fuzzy risk matrix (Markowski & Mannan, 2008b). According to the concept of FLS, all variables were fuzzied based on appropriate linguistic terms provided by an expert opinion. Complexity of a plant is categorized as simple, moderate or complex, of experience as poor, average or good and of risk correction index as low, medium or high. These linguistic terms are a basis for the assigning of the fuzzy membership function represented as fuzzy numbers in the range of 0e1 as shown in Fig. 10. The fuzzy logic system (FLS) for RCI applies fuzzy if-then rules. The fuzzy rules being a combination of 3 categories of complexity and 3 categories of experiences generate 9 rules providing 9 conclusions which represent 3 categories of RCI. It is shown in Table 3 and illustrated by risk correction index surface in Fig. 11. RCI sets: H e high quality PSA, M e standard PSA, and L e poor PSA. Fuzzy rules for RCI can be read as follows: if complexity of plant is simple-S and experience of staff is average-A then RCI is high-H which stands for high quality PSA. Based on the fuzzy rules for RCI, with the use of fuzzy sets for complexity, experience and RCI, fuzzy surface for RCI is created. Both, complexity and experience can be given as fuzzy number in the range of 0e1 and then from Fig. 11 fuzzy number for RCI is obtained. The application of RCI for nal risk category assessment is given in Fig. 12. As an example the distillation column unit presented in detail in (Coco, 2003) was selected. Four accident scenarios were identied representing a column rupture due to overpressure caused by loss of cooling RAS(R) and leak from a relieve valve (RV) due to high pressure caused by failure of cooling RAS(L). The unit complexity is of category C 0.8 (which is complex) whereas experience of the assessor was taken alternatively: E1 0.2 (which is poor) giving RCI 0.28 (which is low and medium), and E2 0.8 (which is good) giving RCI 0.5 (which is medium). Table 4 gives a comparison of results for the effect of RCI on the nal risk index.

Fig. 11. Fuzzy surface for RCI.

The comparison of fuzzy and non-fuzzy calculations is shown in Table 2. The results of non-fuzzy calculation overestimate the hazardous zone distance by about 10% for all radiation levels. 3.2.3. FLS for risk index assessment The output fuzzy frequency and fuzzy severity of consequences in the form of output fuzzy sets, received in previous FLS, are used as inputs in fuzzy logic system of the fuzzy risk index assessment (R0). This FLS takes into account the fuzzy if-then rules and fuzzy logic operation to get nal output risk index result. This idea is described in detail in our previous work (Markowski & Mannan, 2008a). Fig. 9 presents three-dimensional plot which shows the relationship between frequency, severity of consequences and risk obtained by the mapping from two inputs (fuzzy frequency and severity) to one output (fuzzy risk). This is a risk surface used for risk assessment which presents different values of risk depending on input parameters. As a result, risk value in a form of fuzzy risk set can be obtained. After the defuzzication process it can provide an exact numerical value of risk index. This transformation is done to indicate the contribution of risk index in one or more risk category (A, TA, TNA and NA) (Markowski & Mannan, 2008a). These contribution may be of help in assigning more reliable and adequate safety function realized by particular layer of protection. 3.2.4. FLS for RCI Risk correction index (RCI) is introduced to take into account the quality of analysis concerning identication of RAS. This is a typical qualitative part, however very important, because a poor hazard analysis may overlook a number of RAS that may nally affect the

Fuzzy risk correction index, RCI

Fuzzy frequency, F Fuzzy risk index, R0 Fuzzy severity, S

Fuzzy final risk index, R R = R0 - RCI for R0 > 1

Defuzzified final risk index, R

Risk category (A, TA, TNA, NA)

Fig. 12. Final risk category assessment.

A.S. Markowski et al. / Journal of Loss Prevention in the Process Industries 23 (2010) 446e454 Table 4 A comparison of risk assessment results. Accident scenario Traditional risk assessment F RAS(R) 1 RAS(L) 2 RAS(R) 3 RAS(L) 4 1E-7 5E-6 1E-7 SE-6 S 5 5 5 5 R0 2 2 2 2 (TA) (TA) (TA) (TA) Fuzzy risk assessment Final fuzzy risk assessment RCI 0.28 (E0.2, C-0.8) F 1.44E-7 6.27E-6 1.44E-7 6.27E-6 S 4.35 4.08 4.55 4.28 R0 1.35 2.01 1.56 2.25 (TA-0.75, A-0.25) (TA-1.0) (TA-0.48, A-0.52) (TA-0.35, A-0.65) R 1,07 1,73 1,28 1,97 (A-0.9, TA-0.1) (A-0.01, TA-0.89, TNA-0.01) (A-0.75, TA-0.25) (A-0.02, TA-0.96, TNA-0.02) RCI 0.5 (E0.8, C-0.8) R 0.85 1.51 1,06 1.75

453

(A-1.0) (A-0.5, TA-0.5) (A-0.96, TA-0.04) (A-0.08, TA-0.90, TNA-0.02)

Table 4 presents results for four representative accident scenarios (RAS). Traditional risk assessment expresses risk level result, R0 as a risk category (one of A, TA, TNA, NA). Fuzzy risk assessment results in crisp risk index value, R0 and its membership to one (like RAS 2) or more risk categories (like RAS 1, 3 and 4). In the end, nal risk index (as a crisp value) is calculated by inclusion of RCI in calculation of R0 . Depending on assumed experience of the analysts team (E 0.2 and E 0.8) different risk index values are obtained. As can be seen the less experienced assessor produces the higher level of risk. Generally speaking the comparison of the crisp data received by the traditional risk assessment and fuzzy risk assessment with use of RCI, indicates that the results are more adequate and describe in detail. The possible contribution of each fuzzy set in a nal result is readable what conrm that this may be of help in understanding the issue of uncertainties and provide better insights in design of more effective risk control measures. Above concept has not been fully validated, however it illustrates the possibility to show the effect of quality of hazard analysis on nal risk assessment results.

References
AIChE. (1999). Guidelines for consequence analysis of chemical releases. AIChE. (CCPS.N.Y). AIChE. (2000). Guidelines for chemical process quantitative risk analysis. AIChE. (CCPS.N.Y). Casal, J. (2008). Evaluation of the effects and consequences of major accidents in industrial plants. In: Industrial safety series, Vol. 8. Elsevier. Coco, J. C. (2003). The 100 largest losses 1972e2001 e Large property damage losses in the hydrocarbon e Chemical industries. (20th ed.) Texas: Marshs Risk Consulting Practice. Dubois, D. (2006). Possibility theory and statistical reasoning. Computational Statistics & Data Analysis, 51, 47e69. Dubois, D., & Prade, H. (1988). Possibility theory e An approach to computerized processing of uncertainty. New York: Plenum Press. Gentile, M., Rogers, W. J., & Mannan, M. S. (2003). Development of an inherent safety index based on fuzzy logic. AIChE, 49(4), 959e968. Karwowski, W., & Mital, A. (1986). Potential application of fuzzy sets in industrial safety engineering. Fuzzy Sets and Systems, 19(2), 105e120. Mannan, M. S. (2005) (3rd ed.).Lees's loss prevention for the process industries, Vol. IeIII Burlington, Massachusetts: Elsevier Butterworth-Heinemann. Markowski, A. S. (2006). Layer of protection analysis for the process industry. Lodz: PAN, ISBN 83-86-492-36-8. Markowski, A. S., & Dobiech, J. (1999). Modelling of hazard zones for BLEVE. In (2nd ed.). Proceedings of chemical industry and environment III, Vol. 2 (pp. 401e408), TU Lodz, ISBN: 83-87198-68-15. Markowski, A. S., & Mannan, M. S. (2008a). Fuzzy risk matrix. Journal of Hazardous Materials, 159(1), 152e157. Markowski, A. S., & Mannan, M. S. (2008b). Risk assessment for process industries. Prague: Congress CHISA. Markowski, A. S., Mannan, M. S., & Bigoszewska, A. (2007). Fuzzy logic for process safety analysis. Texas A&M University. MKOPSC Symposium 2007. Nilsen, T., & Aven, T. (2003). Models and model uncertainty in the context of risk analysis. Reliability Engineering and System Safety, 79, 309e317. Pate-Cornell, M. E. (1996). Uncertainties in risk analysis: six levels of treatment. Reliability Engineering and System Safety, 54, 95e111. Quiech, J., & Cameron, J. T. (1994). Uncertainty representation and propagation in quantied risk assessment using fuzzy sets. Journal of Loss Prevention in the Process Industries, 7, 463e473. Salzano, E., & Cozzani, V. (2006). A fuzzy set analysis to estimate loss intensity following blast wave interaction with process equipment. Journal of Loss Prevention in the Process Industries, 19, 343e352. Siler, W., & Buckley, J. J. (2005). Fuzzy expert system and fuzzy reasoning. J. Wiley. Zadeh, L. (1965). Fuzzy Sets: Information and Control, 8, 338e353.

4. Conclusions 1. The process safety analysis (PSA), being a basis for the decisionmaking process in chemical industry is a very complex task, including many uncertainties connected with information shortages and other inaccuracies which may lead to important overlooks in risk assessment of process plants. There is no common approach to deal with this aspect. 2. One of the promising methods for dealing with uncertainties in process safety assessment is fuzzy logic, which is a collective name for fuzzy set analysis and possibility theory. It allows us to use vague and approximate data which are typically encountered in process safety analysis and after application of the fuzzy logic system (FLS) quite accurate results may be obtained. 3. A fuzzy risk assessment model which consists of a traditional part typical of the qualitative hazard identication and fuzzy part used for the quantitative assessment of risk components (frequency, severity of consequences and risk index) is presented. For the fuzzy part the FLS is applied to each component of risk analysis (in different ways). 4. Application of the fuzzy approach for BLEVE consequence analysis indicates that the output results are more properly determined and indicate overestimation of hazardous zone using non-fuzzy traditional approach in comparison to fuzzy approach. 5. A novel risk correction index (RCI) concerning the effect of the quality of PSA on the overall risk index is proposed based on fuzzy logic. It may decrease the overall risk index depending on the quality of the PSA analysis.

Abbreviations and symbols

Accident scenario: RAS: representative accident scenario RAS(L): representative accident scenario for leak RAS(R): representative accident scenario for rupture Bow-tie analysis: ET: event tree FT: fault tree MCS: minimal cut set Consequence analysis: P: vector of parameters S: vector of state variables Y: function of the consequence model Events, E: BE: basic event OE: outcome event

454 SF: safety function TE: top event Fuzzy logic: A: fuzzy set f: fuzzy FLS: fuzzy logic system m(x): membership function X {x1,x2,x3,.}: universe of discourse Fuzzy number parameters: m: mean value lb: lower bound value ub: upper bound value Installation elements: RV: relief valve PHA methods: ETA: event tree analysis

A.S. Markowski et al. / Journal of Loss Prevention in the Process Industries 23 (2010) 446e454 FTA: fault tree analysis PHA: process hazard analysis RA: risk assessment Risk analysis: ALARP: as low as practicable reasonable F: frequency R: risk RCI: risk correction index R0: risk index before correction S: severity of consequences Risk categories: A: acceptable TA: tolerable acceptable TNA: tolerable not acceptable NA: not acceptable