2.2 Preliminary Risk Assessment, Process Safety & Environmental Constraints

Process Safety Lifecycle and Feasibility-Stage Hazard Screening

In industrial automation engineering, safety cannot be treated as an add-on or retrofitted after control architecture selection. Under the safety lifecycle framework formalized by ANSI/ISA-84.00.01 (IEC 61511) and IEC 61508, safety begins in the earliest feasibility and conceptual phases. Attempting to design control systems without identifying process hazards, chemical toxicity thresholds, and environmental emission constraints results in catastrophic regulatory violations, unbudgeted capital expenditures, and unacceptable human risk.

During conceptual feasibility, the automation professional must participate in early hazard evaluations, identify regulatory jurisdictions (such as OSHA PSM and EPA RMP), screen for required Safety Integrity Levels (SIL), and evaluate automated environmental monitoring constraints.

Hazard Identification Methodologies in Feasibility Studies

Before piping and instrumentation diagrams (P&IDs) are fully developed, engineers use qualitative hazard screening methods to discover high-consequence operational hazards:

During feasibility, a Preliminary Hazard Analysis (PHA) or high-level What-If review is standard. It screens for toxic releases, run-away exotherms, overpressurization, combustible dusts (NFPA 652), and flammable vapor cloud explosions (NFPA 30 / NFPA 497).

---

Regulatory Safety Frameworks: OSHA PSM & EPA RMP

In the United States, and across international jurisdictions modeling equivalent statutory frameworks, automation engineers must evaluate two primary chemical process safety regulations during project screening:

Loading diagram...

OSHA 29 CFR 1910.119: Process Safety Management (PSM)

The Occupational Safety and Health Administration (OSHA) PSM standard applies to facilities handling listed toxic and reactive chemicals above specified Threshold Quantities (TQ) in Appendix A, or flammable liquids and gases stored in quantities of $10{,}000\text{ lbs}$ ($4{,}536\text{ kg}$) or greater in a single process.

Key chemical threshold examples critical for the CAP exam:

• Flammable Gases and Liquids ($F_p < 100^\circ\text{F} / 37.8^\circ\text{C}$): $10{,}000\text{ lbs}$
• Anhydrous Ammonia: $10{,}000\text{ lbs}$
• Chlorine: $1{,}500\text{ lbs}$
• Hydrogen Fluoride (anhydrous): $1{,}000\text{ lbs}$

When a facility triggers PSM coverage, the automation design is bound by 14 mandatory elements. For automation engineers, the most critical elements are:

1. Process Safety Information (PSI): Must document electrical classifications, relief system design bases, ventilation design, and safety systems (interlocks, detection, and suppression).
2. Process Hazard Analysis (PHA): Must be revalidated every 5 years using structured methodologies (HAZOP, What-If).
3. Operating Procedures: Must detail automated startup sequences, manual trip steps, and emergency shutdown parameters.
4. Mechanical Integrity: Requires proof testing, calibration tracking, and preventative maintenance for all critical instruments, automated emergency isolation valves (AOV/ESV), and safety logic solvers.
5. Management of Change (MOC): Mandates that any modification to control software, hardware setpoints, alarm limits, or instrument types undergo rigorous safety review before commissioning.

EPA 40 CFR Part 68: Risk Management Program (RMP)

While OSHA PSM protects workers within the facility boundary fence, the Environmental Protection Agency's Risk Management Program (RMP) protects the surrounding community and environment:

• Off-site Consequence Analysis (OCA): Requires quantitative modeling of chemical release footprints.
  • Worst-Case Release Scenario: Assumes instantaneous failure of the largest single vessel or pipe inventory, release of the entire volume over $10\text{ minutes}$, calm atmospheric conditions (atmospheric stability class F, wind speed $1.5\text{ m/s}$), and failure of all active mitigation systems.
  • Alternative Release Scenario: Models a more probable event (e.g., pipe rupture, seal failure, relief valve discharge) with active automated mitigation systems credited.
• Program Tiers: Facilities are categorized into Program 1 (no off-site impact), Program 2 (streamlined compliance), or Program 3 (identical to OSHA PSM requirements plus additional community emergency response coordination).

---

Preliminary Safety Integrity Level (SIL) Screening & Functional Safety

Under IEC 61511 / ISA-84, a Safety Instrumented System (SIS) is engineered to take a process to a safe state when predetermined conditions are violated. The SIS is composed of one or more Safety Instrumented Functions (SIF), each consisting of sensors, logic solvers, and final control elements.

The Fundamental Independence Mandate

A fundamental rule tested heavily on the ISA CAP exam is the strict separation between the Basic Process Control System (BPCS) and the Safety Instrumented System (SIS):

• The BPCS executes continuous modulating control, automated sequences, and routine operations.
• The SIS executes emergency trips, interlocks, and hazardous energy isolation.
• The Independence Rule: A single control platform cannot serve as both the BPCS and the SIS unless certified for shared use under strict architectural separation rules. Crucially, an initiating event caused by a failure within the BPCS cannot be mitigated by an Independent Protection Layer (IPL) residing within that same BPCS.

Layer of Protection Analysis (LOPA) & Risk Reduction

In early feasibility studies, teams conduct preliminary screening using Layer of Protection Analysis (LOPA) to establish target Safety Integrity Levels. LOPA determines the mitigated event frequency ($f_i^C$) from an initiating event frequency ($f_i^I$) across $m$ independent protection layers:

$f_i^C = f_i^I \times \prod_{j=1}^m PFD_{ij}$

Where $PFD_{ij}$ is the Probability of Failure on Demand of the $j$-th protection layer. If the mitigated frequency exceeds the corporate tolerable risk frequency target ($f_{\text{tolerable}}$), an instrumented safety function is required with a target Risk Reduction Factor (RRF):

$RRF = \frac{f_i^C}{f_{\text{tolerable}}} = \frac{1}{PFD_{\text{avg}}}$

Quantitative Safety Integrity Levels (Low-Demand Mode)

Under IEC 61511, for safety functions operating in low-demand mode (demand frequency $\le 1\text{ per year}$):

---

Environmental Monitoring & Compliance Constraints

Automation feasibility studies must incorporate automated environmental monitoring required by the Clean Air Act, Clean Water Act, and regional operating permits:

Continuous Emission Monitoring Systems (CEMS)

Facilities with industrial combustion sources (boilers, cracking furnaces, gas turbines, incinerators) must comply with EPA 40 CFR Part 60 and Part 75 regulations governing stack emissions of sulfur dioxide ($\text{SO}_2$), nitrogen oxides ($\text{NO}_x$), carbon monoxide ($\text{CO}$), and greenhouse gases:

• Sample Conditioning and Transport: Flue gas must be extracted through a heated probe and transported across heated sample umbilicals maintained at $120^\circ\text{C to }150^\circ\text{C}$ to prevent acid gas dew-point condensation. The feasibility study must account for electrical tracing loads ($30\text{ to }50\text{ W/m}$) and maximum transport distances.
• Automated Calibration Solenoids: CEMS analyzers mandate automated daily zero and span calibration gas injection routines controlled by the automation system.
• Data Acquisition and Handling System (DAHS): Automation engineers must specify the DAHS interface to log continuous 15-minute averages, calculate rolling 30-day emission averages, and flag analyzer downtime.

Additional Automated Environmental Controls

• Flare Management (EPA 40 CFR 63.670 - Subpart CC): Requires continuous automated calculation of net heating value in the combustion zone ($\text{NHV}_{\text{cz}}$) by monitoring vent gas flow, BTU heating value via online calorimeters or gas chromatographs, and automated assist steam/fuel gas injection.
• Wastewater Neutralization & Spill Containment (NPDES): Feasibility must plan for redundant pH analyzers, automated acid/caustic dosing loops, and emergency spill diversion gates integrated into stormwater runoff basins.