1.2 Vessel-By-Vessel or Line-By-Line Risk Analysis

Vessel-by-Vessel or Line-by-Line Risk Analysis

Dr. Samir I Abu-Eishah CHE - UAEU 1

Contents: • The Risk Analysis Process • Vessel-by-Vessel or Line-by-Line Risk Analysis • Following up the Analysis • Plant Disturbance Phenomena: • • • • • • • •

High pressure, high temperature, high Level Low temperature, low pressure, low level Too high or too low concentration Runaway reactions Blockage Wrong substance Breach of vessel boundaries Columns, Heat exchangers, Valves

• References

2

The Risk Analysis Process The overall risk analysis process (Figure 1) involves: 1. Describing the scope and objectives of the analysis

2. Identifying the potential hazards 3. Quantifying the probability or frequency of accidents 4. Quantifying the consequences of accidents (damage, injury, and fatality) 5. Integrating the information derived into an overall picture of risks

6. Assessing whether the risks are acceptable or tolerable 7. Revising or improving plant designs and operations

3

Figure 1: The Risk Assessment Process System Description Hazard Identification

Accident Probabilities Estimation

Risk Determination Risk Acceptance

Accident Consequences Estimation

No

Modify System

Yes Operate System

4

Vessel-by-Vessel or Line-by-Line Risk Analyses • Risk analyses may be made vessel-by-vessel, or line-by-line, or both. There is a good deal of overlap between analysis types, if both approaches are used, for example a high rate of flow through a pipeline will generally result in high level or build up of pressure in a vessel.

• For this reason, it is reasonable to choose a mixed approach. If just a line-by-line approach is used, many accident types will be overlooked. Examples are reactions, overheating, lack of mixing, scumming, leftover products, etc. • A vessel-by-vessel analysis is usually much faster to perform. If a lineby-line analysis is not made, however, some types of accidents may also be overlooked.

5

Vessel-by-Vessel or Line-by-Line Risk Analyses ...  A list of problems, which are specifically related to pipes, for example, is as follows.          

Liquid Hammer Two-phase flow, and resulting vibration (vertical two-phase flow, in particular) Pipe and flange leaks Air or gas sucked into lines Over pressure due to liquid expansion with shut in lines Siphoning Reverse flow Freezing Air locks Pressure reduction failure, especially due to low flow or zero flow.

 For these reasons, line-by-line analysis should be carried out at least to identify each line specific problems.  Also, when there are branched lines, a line-by-line analysis of the network is almost essential.

6

Following up the Analysis • Once analyses are completed, it is the actions, which ensure that decisions have been undertaken, and safety improvements are made. • Modifications may in some cases be marked in red on drawings during Hazop meeting, if someone with sufficient design authority is present. • This may be necessary if changes are major, in order to allow Hazop study to be completed. • The Hazop drawing in this way becomes an important design document, and should be dated and initialed. Copying of modifications to master drawings is essential. 7

Following up the Analysis ... • Following up the Hazop analysis is fairly straight forward. The solution to all action requirements must be known, and can be checked on the plant drawings. • Additionally, it should be possible to check the actions recommended on the plant itself. • The first stage in the overall hierarchy of risk assessment is risk analysis, that is, the identification of hazards associated with the activity in the context of which that activity is being carried out. • To assist in the process of hazard identification it is helpful to categorize hazards into broad causation types, as shown in Table 1.

8

Table 1: General Hazard Categories Process Hazards 1. Hydrocarbons under pressure 2. Pressurized liquids or gases 3. High temperature or cryogenic fluids 4. Chemical reactions 5. Exothermic reactions 6. Flammability 7. Toxic substances 8. Inventory of hazardous substances 9

Table 1: General Hazard Categories A- Physical Hazards 1. 2. 3. 4. 5. 6. 7. 8. 9. 10.

Hot or cold surfaces Ignition sources Energy sources Ejected or falling objects Unintended or premature discharge of any gas, dust, liquid or other hazardous substance Utility failure High pressure, vacuum, depressurization High, low temperatures Fire, explosion, overheating Thermal movement 10

General Hazard Categories … B- Chemical Hazards 1. Radio-chemicals 2. Explosive substances 3. Explosive and toxic gas producers 4. Heat producers 5. Corrosive substances 6. Contamination

11

General Hazard Categories … C- Mechanical Hazards 1. Moving plant and equipment 2. Hazardous rotating parts 3. In-running nips 4. Guillotines and cutting edges 5. Sliding and reciprocating motions 6. Friction 7. Vibration

D- Electrical Hazards 1. Electrical energy 2. Energized equipment 3. Ignition source

12

General Hazard Categories … E- Biological Hazards 1. Toxic substances 2. Biological hazards 3. Lack of oxygen or asphyxiating atmosphere 4. Ionizing radiation 5. Thermal exhaustion conditions 6. Hypothermic conditions

13

General Hazard Categories … F- Environmental Hazards 1. Ground conditions 2. Earthquakes 3. Noise 4. Dust/other emissions 5. Hot-cold weather 6. Operations in water 7. Poor lighting 8. Contaminated ground 14

General Hazard Categories … G- Ergonomic Hazards 1. Work location 2. Work position 3. Work at heights 4. Manual handling 5. Elevated objects 6. Restricted access 7. Confined space work

15

Plant Disturbance Phenomena • Many of the disturbances, which can affect a plant, are fairly obvious, but some are very obscure.

• Many of the following accident phenomena have been found by studying accident records, particularly, Manufacturing Chemical Association Records and Loss Prevention Bulletins.

16

High Pressure High pressure in a vessel can be caused by high inflow to the vessel. Typical causes of high inflow are • • • •

Continued pumping, after the vessel is full Too high a pumping rate Control failure on a pump Loss of pressure-reduction facilities

Typical safety measures here are • Use of centrifugal pumps with a maximum pressure less than the design pressure of the vessel. • Use of a safety valve to "spill" the pump flow back to the inlet of the pump. • Use of additional pressure sensors as a pump trip. 17

High Pressure ...  Reduction of pressure is often done by throttling the flow (through, for example, a control valve).

 If either the valve or the controller fails, then the downstream pressure may be dangerously high.  A similar, but less obvious cause of high pressure arises from liquid level controls in gas liquid separators.  If the level controller, or the valve, fails then liquid level may fall to zero and gas then flows through the level control valve.  Even though the mass rate of flow of gas will be lower than for liquid, the volume may be too high for the outflow from the downstream vessel, allowing pressure to rise.

18

High Pressure ... Typical safety measures for high-pressure problems are

1.

Providing orifice plates that limit maximum flow.

2.

Providing shut-off valve (s) (so called slam shut valves, which close rapidly) and additional pressure trip (s) to drive it (them).

3.

Providing a safety valve on the downstream vessel that can take the maximum flow.

4.

Making the downstream vessel so robust, that it can take the full upstream pressure.

19

High Pressure ... Other causes of high pressure are 

5. Blockage of vents, particularly if there are condensing vapors, or liquids which can solidify after an overflow. Animals and birds sometimes block vents. Painters and welders sometimes deliberately block vents to prevent entry of dirt into a tank, then forget to remove the blockage.

 

High temperature (see below). Low outflow: In some processes, pressure control depends on a balance between inflow and outflow. If the outflow is blocked (see below) then flow into the vessel may be restricted. This may result in loss of pressure reduction by throttling. Scumming: If scum forms in a gas or vapor flow, resistance to flow rises considerably and can cause over pressure. Gas generation: Some liquids decompose, generating gas, which can overpressure a vessel in which it is enclosed. Acid in tanks, in particular, can corrode tank walks (generally very slowly if the design is well done) and overpressure a tank with hydrogen. Liquid expansion: If a tank is filled completely with liquid, and then closed in, a small temperature rise can cause over pressures. Runaway reactions (see below). Reverse flow.

 

  

20

High Pressure ... • Over pressures in a downstream vessel can cause back flow and over pressures. Typical causes are blockage in a common closed drain, or over pressure in a blow down line or flare line. Less common is reverse flow from a common receiving vessel or reaction vessel. • Over pressures can be caused by pumping the wrong liquid into a vessel, pumping hot water or hot oil into a cold vessel containing light oil, leak of water from a cooling or heating oil into hot oil or fat, or pumping light oil into a vessel containing hot water or hot oil. • A special mechanism, roll over, is associated with liquefied gases, and oil, of different densities and temperatures, in the same vessel. A hot, heavy fraction at a low level is accompanied by a cool, light fraction at a higher level. If these layers are disturbed, or the temperatures change, then the layers may tend to change place. When the layers mix, boiling takes place and both the rates of mixing and boiling becomes violent. Just a few degrees temperature difference can in some cases destroy a vessel.

21

High Pressure ... • The most obvious consequences of high pressure are bursting of vessels, or leakage. Less obvious consequences are formation of condensate compounds, and upset of vapor concentrations (e.g., light fractions in heavier fractions, LPG in gasoline, gasoline in fuel oil etc.) and dissolving of gases in liquid. These might later release toxic or flammable compounds downstream in the liquid flow, or cause over pressure. • Over pressure sometimes distorts vessels, without causing rupturing directly. One case is known of a butane tank "ballooning" slightly (rising a few inches from its foundation). The resulting distortion caused cracking of nozzle entries to the tank. 22

High Temperature The most frequent causes of high temperature are 1. Failure of temperature control, due to instrument failure (steam, heating oil, fuel supply). 2. Formation of hot spots due to flow blockage or formation of deposit. 3. Reduced flow in heat exchangers. 4. Too high flow rates for heating fluids, or, correspondingly, too low flow rates of reactants to be heated. 5. Reduced cooling flows (blockage, control failure, pumping failure). 6. Too high temperature in cooling flows (due to unusually warm weather, excess hot water flow to cooling ponds, failure of brine chillers or cooling towers).

23

High Temperature ... More obscure causes of high temperature are 1. Heating by the sun, or by radiation from furnaces or flares. 2. Heat tracing, when flows in pipelines are reduced. Electrical heat tracing, in particular, can suffer from control failure. 3. Continued agitation of shut in liquids 4. Pumping against a closed valve (dead head). Many pumps have a bypass to allow continued circulation in case of closed outlet valves or flow blockage. It is important, in such cases, to ensure either that pumping power cannot lead to overheating, or that the flow returns to a supply tank with sufficient heat capacity, and not to the pump inlet. 5. Stray electrical currents. 6. Blanketing with dust, product, rags, tarpaulins, coats, so that convective cooling is blocked. Applies particularly to electric motors. 24

High Temperature ... •

High temperatures make expansion of vessels and pipes. If the piping and supports are not designed for this, the expansion can cause overstressing, cracking, or distortion of supports, valves and pumps.

•

Distortion of pump piping may in turn cause misalignment of motors, vibration, and pump breakdown or rupture. The main causes of high temperature are 1. Friction, particularly in belt drivers, gears, transport belts, and mixers 2. Fire, is the most common cause of overheating

•

The main consequences from overheating are over pressures, runaway reactions, fire, and release of vapor.

•

Other problems are break down of equipment, coking of liquids (or evaporation) leading to blockage and/or hot spots; valve weakening; and expansion that might lead to overstressing. 25

High Level • The main causes of high level in a vessel are fairly obvious - too high inflow, or too low outflow. Other typical causes are 1. 2. 3. 4.

Control failure (particularly level sensors) Errors in depth measurements Errors in valves arrangement (so that liquid is pumped to the wrong vessel) Back flow from a common delivery pipeline, which has a high pressure or is partially blocked.

• More subtle causes of overflow are liquid expansion due to temperature rise, scumming and boiling.

• Level sensing is often made by measuring pressure differential between the top and bottom of a tank. • Pressure sensors, such as diaphragm type sensors, are generally much more reliable than level sensors, which tend to rely on floats of some kind, and tend to stick. \ • However, it should be recognized that such measurements are not a direct indication of level. A change in density, due to a change in liquid or in mixture, can lead to errors in level measurement, and to overflow.

26

High Level ... • Crushing or distortion of vessels can cause overflow directly. This can occur as a result of a vessel crash, or as a result of pipe expansion. • An insidious cause of overflow is reduction in vessel volume due to leakage of liquid (e.g., water) through the tank base, or cooling or heating coils, followed by filling with a constant volume of liquid. • Another is reduction in vessel volume due to sucking in (vacuum) so that the tank is distorted, followed by filling with a constant volume of liquid. • Transport vessels for liquefied gases are generally filled up to around 80% of volume -the actual degree of filling depends on the substance, and on temperature.

27

High Level ... • Filling is generally checked by weighing. Errors in weighing lead to overfilling. Also, operators may try to overfill, through ignorance, or in order to minimize the number of vessels needed for a particular delivery. • A special phenomenon that causes overflow is “boilover”. This occurs when a tank (generally a floating-roof tank or cone roof tank which has opened in an explosion) is exposed to heat, typically from a fire. At some stage, the oil in the tank begins to boil. • If there are lighter fractions in a layer low down in the tank, then these may begin to boil first, and throw oil out. This kind of boilover can be very violent, throwing oil a long distance. • Less violent boilovers can throw oil out repeatedly. Another possibility is that boiling foam can leave the tank. This kind of boiling foam can flow very rapidly, and poses a threat to firefighters. 28

Low Temperature • Low temperature in a vessel may be caused by 1. Low temperature in a heating flow 2. Low temperature in a cooling flow (either of these may be caused by control failures) 3. Loss of heating (blockage, power failure, loss of heating fluid, valve closure) 4. Evaporation (especially of a liquefied gas or volatile liquid) 5. Cold weather 6. Dissolving salts.

• Cooling may also cause changes in concentration, for example for volatile gases such as ethane and propane in gasoline. Low temperatures may cause condensation of LPG in pipelines, something, which may be dangerous in LPG burners. A rather unusual problem of this type is condensation of oxygen from the air into liquid nitrogen exposed to air. • Low temperatures, below –20oC may cause changes in ordinary carbon steels, so that these become brittle. Piping which has become brittle in this way has been known to shatter as a result of vibration. 29

Low Pressure •

Low pressure may be caused by 1. 2. 3. 4.

Pumping liquid out of an unventilated vessel Blockage of vents or vacuum pressure valves Connection of a vessel to another in which there is a vacuum Cooling.

•

Operators of large closed tanks are for example obliged to take account of cooling during rainstorm. Long drain lines can cause considerable under pressure (corresponding to the height of the drain line) if draining takes place from an unventilated tank.

•

An unusual cause of low pressure is gas-absorbing reactions. Rusting on the inner surface of a closed vessel can cause under pressure sufficient to cause tank collapse. Ammonia gas, dissolving in water can cause very low pressures.

30

Low Pressure ... •

The most common consequences of low pressure are 1. Collapse of vessels 2. Sucking back liquids.

•

A case is known of a steam line, which was cooled by water. The condensing steam created a vacuum and sucked back condensate. The resulting water hammer resulted in pipe rupture. Several similar cases are known for ammonia gas pipelines taking return gas from ships.

•

Low pressure can cause air to be sucked into vessels, and, for example to be mixed with flammable vapors, with explosions as a possible result. A typical place for this is pump intakes, especially if intake filters become blocked. 31

Low Level • Low levels in vessels may be caused by 1. 2. 3. 4. 5.

Loss of inflow or low inflow due to blockage, closed valves, or control errors Loss of supply for an inflow Leakage or pipe bursts Too high outflow (control failure, erroneous opening of valves) Evaporation or boiling dry.

• Consequences of low level may be 1. Boiling dry, in boilers, evaporators, etc. 2. Disturbance of deposits, or water, at a tank bottom. 3. Break through of gas into a liquid drain or separation line. This can cause a high volume flow of gas into a low-pressure line resulting in overpressure or to twophase flow and vibration.

• Gas can be drawn into liquid drain or separation lines, even when the liquid level is above zero, through formation of a vortex. This can often be prevented by fitting a "vortex breaker", that is, one or two vertical plates, into the drain line. 32

Too High or Too Low Concentration • High or low concentration of a reactant can cause 1. High vapor pressure and overpressure 2. Too rapid reaction or runaway reaction 3. Wrong reaction giving toxic or flammable products 4. Toxic, acid, alkaline, oxidizing or flammable-end products 5. Toxic, acid, alkaline, oxidizing or flammable residues 6. Excessively viscous product which can cause pumping difficulties, or blockage.

33

Too High or Too Low Concentration ... High or low concentration of a substance can be caused by 1. Control failures 2. Blockage in addition lines 3. Delay in adding a component 4. Settling out of a solid component of a mixture 5. Insufficient mixing 6. Human error in addition of a component 7. Labeling error leading to addition of an inert component 8. Addition of a residue of one component from a previous batch, thus diluting the new addition.

34

Runaway Reactions •

A runaway reaction occurs typically when reaction rate increases with increasing temperature or increasing concentration of one reactant.

•

Typical causes of runaway reaction are 1. Poor temperature control or temperature control failure 2. Loss of cooling water, which can be caused by water supply or power failure, blockage, etc. 3. Loss of cooling surface due to encrustation, crud, etc. 4. Poor mixing or mixing failure, resulting in loss of cooling, hot spot formation, or errors in temperature measurement. 5. Temperature measurement is critical for such reactions, and typical failures are 6. Simple failure of the instrument 7. Coking or deposits on a thermowell so that the sensor becomes insulated 8. Placement of the sensor in an outflow line or recirculation line.

•

Measurement becomes incorrect when the flow stops or is reduced.

35

Runaway Reactions ... Typical safety measures for runaway reactions are 1. Emergency cooling (independent of normal cooling) 2. Burst discs to relieve pressure 3. Burst discs to provide cooling through boiling. 4. Addition of quenching water or solvent 5. Dumping of the reaction to a dump tank filled with water or solvent 6. Venting of the reaction to a scrubber 7. Depressurization, to provide cooling by boiling.

36

Runaway Reactions ... • Some reactions are autocatalytic, and accelerate with time. Holding a batch reaction for a period can then be hazardous e.g. nitration reactions, or the TCDD reaction which was put on hold over the weekend at Seveso. • Another typical cause on runaway reactions is disturbance of ratio control or mixing control in a continuous reaction feed. If one reaction component is interrupted in some way, its concentration will fall. When the supply is restored, most controllers will try to compensate for the low concentration and supply an excess of the reactant, which may then cause a runaway reaction. • An unusual but possible cause of a runaway reaction is over addition of catalyst, or presence of a stray catalyst. This may, in particular, enhance an unwanted unstable reaction such as a decomposition of a product. 37

Blockage Pipelines can be blocked in many ways, most of them are obvious, some obscure: 1. Valve closure, due to human error, control failure, or valve failure 2. Forgotten blanking plates, spades, etc. 3. Blockage with foreign material impurities in the flow 4. Sand 5. Broken parts from vessels internals 6. Column packing 7. Catalyst 8. Welding rods, welding slag 9. Paper from packing 10. Stray objects such as beer bottles, footballs, containers, packaging 11. Dead animals or insects 12. Tree roots (in drains) 13. Freezing/solidification 14. Emulsion formation 15. Crystallization 16. Solid forming reactions (e.g., isocyanate/water)

Blockage often occurs when pipe flow is shut down, and is very difficult to detect at this time (restart is then hindered).

38

Wrong Substance Stray or erroneously added substances can cause a wide range of disturbances or accidents such as 1. 2. 3. 4. 5.

Unwanted or unexpected reactions giving toxic, flammable, acid, alkaline, oxidizing, or high vapor-pressure substances Catalyzing effects, leading to runaway reactions Solidification, and over pressurization Impurities in a product, causing production of waste, or product discoloration Catalyzing effects, leading to spoilt product, decomposition, etc.

39

Wrong Substance Wrong substances or impurities can come from many sources such as 1. Erroneously added raw materials 2. Wrongly labeled materials 3. Back flow 4. Leakage from supply tanks 5. Corrosion products 6. Products or residues left from previous production batches 7. Inflow (sucking in) of air, due to vacuum 8. Leakage from heat exchangers, cooling coils etc. 9. Flooding 10. Absorption 11. Unwanted or unexpected reaction products.

40

Breach of Vessel Boundaries Many accidents are associated with the vessel itself in the initial stages. Breach of vessel boundaries can be caused by 1. Weakening of the Vessel due to high temperature, vibration fatigue, temperature or pressure cycling fatigue, vitrification (plastics), or creep. 2. Loss of Toughness due to aging (plastics) low temperature, or hardening (stress hardening, temperature, curing, crystal growth). 3. Loss of Strength due to change in crystal structure. 4. Growth of Cracks arising from lamination or impurities in original material or welds. 5. Corrosion: This can be superficial, crevice, electro-couple corrosion, stress corrosion, or pitting. Unusual or unexpected levels of corrosion can arise from unplanned operating conditions, impurities, or design using the wrong materials, or installation of the wrong materials.

41

Breach of Vessel Boundaries ... 6. High Temperature due to fire can give overpressure and vessel weakening at the same time, for example, giving a BLEVE. 7. Overstressing which can arise from over pressures, or thermal expansion or contraction. Supports should be designed to prevent significant overstressing, e.g., spring-loaded pipe supports, free sliding shoes. Overstressing then arises if temperature changes are larger than expected, or if supports jam or seize. In one case, an asphalt transport pipe was repeatedly subject to thermal expansion, and overstressing on cooling. The 30-m pipe had, over a period of years, extended by ½ m. 8. Collapse of Foundations can cause overstressing or collapse of a vessel. Foundation collapse can occur as a result of poorly designed foundations, flooding or washout of foundations, corrosion of supports, or impact from a vehicle crash. An unusual cause occurred in the case of a chlorine "bullet" vessel. A sudden gas flow caused a wave of liquid to form in the vessel, and the swash of liquid against the end of the tank knocked the vessel off of its foundations. A recent major foundation collapse of an oil tank resulted from a leak from a water pipe under the tank.

42

Breach of Vessel Boundaries ... 9.

10. 11.

12. 13.

14.

Unusual Weather Conditions: Tornadoes and hurricanes can cause vessels or columns to collapse, and can create missiles, which penetrate tanks. Flooding can wash away foundations, and can cause partially filled tanks to float away. Hurricanes can cause excessive pipe vibration and rupture. Lightning can cause holes in vessels, and can ignite fires. Earth quakes, tsunamis, and landslides can cause vessel collapse. Water hammer and steam hammer can cause rupture in pipelines, bellows etc. Twophase flow, particularly in vertical pipelines, can cause so much vibration that cracking is inevitable. Explosions and explosion fragments can cause vessel rupture. Mishandling of vessels can cause rupture. Examples are use of nozzles and pipelines as support or as scaffolding attachments. Welding on operating equipment, and illprepared repairs. More commons is attempted repair of the wrong vessel. Crashes of cranes, trucks, trains, and aircraft can damage vessels. A particularly common cause is a crane, which drives through a pipe bridge with a raised boom.

43

Columns Columns are subject to some special accident types such as 1.

2. 3.

Flooding of the column, when the reflux rate is too high can lead to overpressure, but more often to disturbance of, or damage to, column packing or trays. Steam explosions due to disturbance of water in traps in column trays, and pump around take-offs. Coking or build up of tar on the packing, leading to overpressure.

44

Heat Exchangers Heat exchangers are subject to some special disturbance types such as 1. Leakage across tube plates and tubes due to corrosion 2. Fretting (wear) between tubes due to vibration against foreign objects or loose baffle plates. 3. Fatigue cracking due to flow induced vibrations 4. Tube ruptures due to jamming of floating heads.

45

Valves Most valve failures can be described in terms of failure modes rather than plant disturbances. The kinds of valve failure are 1. 2. 3. 4. 5. 6. 7. 8.

Valve body leakage due to cracking or corrosion Valve seal packing leaks Body seal leaks in split body valves Broken valve items, leading to valve closure, or valve opening, depending on valve seat position Valve jamming in open or closed position (due to crud, overtightening, dried out packing, foreign bodies in the valve seat Valve spring breakage, leading to failure in open or closed position, or simply to failure to close on loss of activation Activator diaphragm leakage leading to fail open or fail closed Activator piston jamming. 46

References 1. F. P. Lees, Loss Prevention and Safety Promotion in the Process Industries, Butterworths, 1982. (This book is a very important reference book with a very complete list of references up to 1982). 2. Baker et al, Explosion Hazards and Evaluation, Elsevier, 1983. (This book gives a thorough treatment of explosion phenomena, including handbook style calculations). 3. International conferences on Loss Prevention and Safety Promotion in the Process Industries. (1974, 1977, 1980, 1983, 1986, 1989, and 1992). The conference proceedings give an unbroken and virtually complete record of process-plant risk analysis developments over 20 years. European Federation of Chemical Engineers. 4. F.A. Al-Ali, Concepts of Safety in Design Stage, 1st International Conference on Loss Prevention and Safety, 5-7 Oct. 1992, Bahrain, p. 33-43. 5. D.T. Davis, Hazardous Materials Information and Response, 1st International Conference on Loss Prevention and Safety, 5-7 Oct. 1992, Bahrain, p. 103-111. 6. J.M. Totterdell, Designing for Safety, 2nd International Conference on Loss Prevention and Safety, 16-18 Oct. 1995, Bahrain, p. 151-161. 7. Al Saif, Y.A., Safety Management, 2nd Int. Conference on Loss Prevention & Safety, 1618/10/1995, Bahrain. 8. Taylor, R.J., Risk Analysis for Process Plant, Pipelines and Transport, E & F.N. SPON, London, 1994.

47