For operations where application of standards, regulations, and/or Recognized and Generally Accepted Good Engineering Practices may not be sufficient to address a particular company's risk, several options exist. For qualitative assessment of process hazards, Hazard and Operability Studies (HAZOP) and What‐If reviews are two of the most common petrochemical industry methods used. Up to 80% of a company's process hazard analysis (PHA) may consist of HAZOP and What‐If reviews (Nolan, Application of HAZOP and What‐If Safety Reviews to the Petroleum, Petrochemical and Chemical Industries, William Andrew Publishing/Noyes, 1994, p. 1). After the PHA, Layer of Protection Analysis (LOPA) is commonly used throughout industry to evaluate the required safety integrity level for instrumented protection layers in a semiquantitative manner (Dowell, International Conference and Workshop on Risk Analysis in Process Safety, CCPS/AIChE, 1997). HAZOP, What‐If, and LOPA are all straightforward methods and are relatively easy to perform. However, much like a hammer, they are not always the best or most appropriate tool for a given job. At times, more advanced methodologies such as Fault Tree Analysis, Quantitative Risk Assessment, Event Tree, Failure Mode, and Effects Analysis and Human Reliability Analysis are necessary to properly assess risk. However, these more advanced tools come with a price. They are often more expensive, time consuming, and require a higher level of expertise. The decision to use these higher level methodologies is not taken lightly and different companies use different criteria for determining when to take this next step. This article will present approaches by four companies, BASF, Celanese, The Dow Chemical Company, and Eastman Chemical Company. Each company will outline criteria used to determine when to go beyond HAZOP, What‐If, and LOPA and will present examples where more advanced techniques were used. The intent of this article is to provide readers with real world examples that demonstrate the appropriate application of the “right” tool and to illustrate what criteria can be used to make informed decisions regarding selection of a PHA methodology. © 2016 American Institute of Chemical Engineers Process Saf Prog 36: 38–53, 2017

Layer of Protection Analysis is a powerful tool for quantitative risk assessments. If applied correctly, it can provide quick and efficient guidance on what additional safeguards are needed, if any, to protect against a given scenario. If misapplied, an overly conservative calculation of risk may result in over‐instrumentation, additional life‐cycle costs, and spurious trips. A nonconservative calculation of risk could result in an under‐protected system and unacceptable risk of an undesired consequence occurring. This article describes several categories of common errors, some overly conservative and some nonconservative. Case studies of actual plant scenarios are used to illustrate. © 2009 American Institute of Chemical Engineers Process Saf Prog 2009

The Deepwater Horizon drilling rig explosion on April 20, 2010, killed 11 workers, injured 16 others, and resulted in an offshore oil spill in the Gulf of Mexico that is considered the largest accidental marine oil spill in the history of the petroleum industry. As with all major incidents in industry, there are lessons to learn from systemic failures that resulted in the tragic loss of life, insult to the environment, and the equipment loss. Many companies, including The Dow Chemical Company, followed the subsequent investigation closely to determine which lessons could be leveraged to strengthen internal programs. Risk identification and management systems in Dow's Process and Occupational Safety programs are robust. Dow management systems are intended to meet or exceed Industry Standards with respect to design, operation, and layers of protection. The prevention of large scale accidents like Deepwater Horizon depends on an acute awareness of worst‐case scenarios and an unfailing vigilance to ensure that essential protection layers are not compromised. Dow management system reviews in 2011 on the same management systems involved in this incident identified opportunities for improvement and/or action plans in several areas. This article will focus on three programs that resulted from those management system reviews. The three programs are: a targeted High‐Consequence Emergency Response Drill program, a High Potential Process Safety Near Miss Program, and technology‐specific Process Safety Cardinal Rules. For each of the three programs, a description of the content of the program and how it was implemented at the company level is provided. Specific examples of how these programs were implemented at a facility level are included. Each of these programs play a key role in preventing a catastrophic event and have been a part of Dow's continuing process safety performance improvement over the last several years. © 2015 American Institute of Chemical Engineers Process Saf Prog 34: 335–344, 2015

Validating the effectiveness of safety instrumented systems (SISs) is an integral and vitally important part of maintaining protection layers and preventing a hazardous condition. However, deciding on the basis for what constitutes “sufficiently safe” can be difficult. For example, when considering valves used as the final element in SISs, many in industry are basing the Maximum Allowable Leakage Rate (MALR) on the valve tightness specification instead of the hazardous condition that is being prevented when these valves are closed. This article will review a pilot conducted at The Dow Chemical Company to compare using the valve tightness class as a basis for MALR versus a safety‐based calculated MALR. Economics and safety aspects are evaluated and the general types of safety based calculations used are reviewed. Key questions answered include: (1) what exactly is the requirement for estimating MALR, (2) how is MALR calculated using a safety basis, (3) are there differences in cost when basing MALR on valve tightness class versus a safety based calculation, (4) are time efficiencies realized when basing MALR on the safety case versus on the valve tightness class, and (5) which is usually more conservative, a valve tightness class‐based MALR or a safety‐based MALR? © 2015 American Institute of Chemical Engineers Process Saf Prog 35: 26–31, 2016

Although choosing an inherently safer alternative may seem straightforward, sometimes what seems to be the most obvious alternative may not provide the best risk reduction. The process designer must maintain a broad perspective to be able to recognize all potential hazards when evaluating design options. All aspects of operation such as start‐up, shutdown, utility failure, as well as normal operation should be considered. Choosing the inherently safer option is best accomplished early in the option selection phase of a project. However, recycle back to the option selection phase may be needed if an option is not thoroughly evaluated early in the process. This report reviews a project to supply ammonia to a catalytic reactor. During the course of the project, an “inherently safer” alternative was selected and later discarded because of issues uncovered during the detail design phase. The final option chosen will be compared to (1) the original design and (2) the initial “inherently safer” alternative. The final option was inherently safer than both the original design and the initial “inherently safer” alternative, even though the design team initially believed that it would not be. © 2006 American Institute of Chemical Engineers Process Saf Prog, 2006