is it really an independent protection layer?psrgroup.com/wp-content/uploads/2012/03/psrg-psm... ·...
TRANSCRIPT
![Page 1: Is It Really an Independent Protection Layer?psrgroup.com/wp-content/uploads/2012/03/PSRG-PSM... · • Center for Chemical Process Safety (CCPS),](https://reader036.vdocuments.us/reader036/viewer/2022081420/5ac3475b7f8b9a2b5c8bb9f5/html5/thumbnails/1.jpg)
Is It Really an Independent Protection Layer?
A. M. (Art) Dowell, III, PEChemical Process Safety Consultant
Copyright © 2011 A M Dowell III PE1
![Page 2: Is It Really an Independent Protection Layer?psrgroup.com/wp-content/uploads/2012/03/PSRG-PSM... · • Center for Chemical Process Safety (CCPS),](https://reader036.vdocuments.us/reader036/viewer/2022081420/5ac3475b7f8b9a2b5c8bb9f5/html5/thumbnails/2.jpg)
Art Dowell Bio Sketch
• Principal, AM Dowell III PE
• 42 years, Rohm and Haas Company, now Dow
• BA/BS ChE, Rice University, 1966/1967
• Fellow, AIChE. Member, ISA
• Bill Doyle Award, 1991
• 2002 Albert F. Sperry Founder’s Award from ISA for “outstanding contribution in the development of layer of protection analysis”
2
![Page 3: Is It Really an Independent Protection Layer?psrgroup.com/wp-content/uploads/2012/03/PSRG-PSM... · • Center for Chemical Process Safety (CCPS),](https://reader036.vdocuments.us/reader036/viewer/2022081420/5ac3475b7f8b9a2b5c8bb9f5/html5/thumbnails/3.jpg)
Agenda
Why is Independence Important?
• How LOPA math works
• IPL Characteristics & Core Attributes
• Examples
• Conclusion
4
![Page 4: Is It Really an Independent Protection Layer?psrgroup.com/wp-content/uploads/2012/03/PSRG-PSM... · • Center for Chemical Process Safety (CCPS),](https://reader036.vdocuments.us/reader036/viewer/2022081420/5ac3475b7f8b9a2b5c8bb9f5/html5/thumbnails/4.jpg)
5
How LOPA Works -- Unmitigated
Freq
Initiating Cause Consequence
![Page 5: Is It Really an Independent Protection Layer?psrgroup.com/wp-content/uploads/2012/03/PSRG-PSM... · • Center for Chemical Process Safety (CCPS),](https://reader036.vdocuments.us/reader036/viewer/2022081420/5ac3475b7f8b9a2b5c8bb9f5/html5/thumbnails/5.jpg)
6
Inherently Safer
LAH1
I
LAH1
I
•Reduce or eliminate hazards •Intensify•Moderate•Apply inherently safer concepts to the process design and chemistry.
![Page 6: Is It Really an Independent Protection Layer?psrgroup.com/wp-content/uploads/2012/03/PSRG-PSM... · • Center for Chemical Process Safety (CCPS),](https://reader036.vdocuments.us/reader036/viewer/2022081420/5ac3475b7f8b9a2b5c8bb9f5/html5/thumbnails/6.jpg)
7
LOPA Model -- Mitigated
Freq
RVsSIFsControls
Freq
Potential Consequence FrequenciesReduced
Initiating Cause
![Page 7: Is It Really an Independent Protection Layer?psrgroup.com/wp-content/uploads/2012/03/PSRG-PSM... · • Center for Chemical Process Safety (CCPS),](https://reader036.vdocuments.us/reader036/viewer/2022081420/5ac3475b7f8b9a2b5c8bb9f5/html5/thumbnails/7.jpg)
8
Event Tree Model
Copyright © 2001 by the American Institute of Chemical Engineers, and reproduced by permission of AIChE
Initiating EventEstimatedFrequency
fi = xPFD1 = y1
ConsequenceFrequency,f3 = x * y1 * y2 * y3
Safe Outcome
Safe Outcome
Safe Outcomesuccess
PFD2 = y2
PFD3 = y3
f1= x * y1
f2=x * y1 * y2
success
success
IPL1 IPL1 IPL1 ConsequenceInitiating Event
![Page 8: Is It Really an Independent Protection Layer?psrgroup.com/wp-content/uploads/2012/03/PSRG-PSM... · • Center for Chemical Process Safety (CCPS),](https://reader036.vdocuments.us/reader036/viewer/2022081420/5ac3475b7f8b9a2b5c8bb9f5/html5/thumbnails/8.jpg)
LOPA Math
• The mitigated consequence frequency is given by
where – fi is the frequency of the initiating cause,
– PFDn is the probability of failure on demand of the nth
independent protection layer,
– fc is the mitigated frequency of the consequence.
– Each protection layer is independent
nic PFDPFDPFDff ×××= 21
9
![Page 9: Is It Really an Independent Protection Layer?psrgroup.com/wp-content/uploads/2012/03/PSRG-PSM... · • Center for Chemical Process Safety (CCPS),](https://reader036.vdocuments.us/reader036/viewer/2022081420/5ac3475b7f8b9a2b5c8bb9f5/html5/thumbnails/9.jpg)
IPL Characteristics
• Independent protection layers (IPLs) should be– unique and applicable,
– independent,
– dependable, and
– auditable
CCPS [2001], Layer of Protection Analysis: Simplified Process Risk Assessment
10
![Page 10: Is It Really an Independent Protection Layer?psrgroup.com/wp-content/uploads/2012/03/PSRG-PSM... · • Center for Chemical Process Safety (CCPS),](https://reader036.vdocuments.us/reader036/viewer/2022081420/5ac3475b7f8b9a2b5c8bb9f5/html5/thumbnails/10.jpg)
IPL Core Attributes
• Independence
• Functionality
• Integrity
• Reliability
• Auditability
• Access Security
• Management of Change
CCPS [2007] Guidelines for Safe and Reliable Instrumented Protective Systems
11
![Page 11: Is It Really an Independent Protection Layer?psrgroup.com/wp-content/uploads/2012/03/PSRG-PSM... · • Center for Chemical Process Safety (CCPS),](https://reader036.vdocuments.us/reader036/viewer/2022081420/5ac3475b7f8b9a2b5c8bb9f5/html5/thumbnails/11.jpg)
Core Attributes
• Independence– the performance of a protection layer is not
affected by the initiating cause of a hazardous event or by the failure of other protection layers;
• Functionality– the required operation of the protection layer in
response to a hazardous event;
12
![Page 12: Is It Really an Independent Protection Layer?psrgroup.com/wp-content/uploads/2012/03/PSRG-PSM... · • Center for Chemical Process Safety (CCPS),](https://reader036.vdocuments.us/reader036/viewer/2022081420/5ac3475b7f8b9a2b5c8bb9f5/html5/thumbnails/12.jpg)
Core Attributes, Continued
• Integrity– related to the risk reduction that can
reasonably be expected given the protection layer’s design and management;
• Reliability– the probability that a protection layer will
operate as intended under stated conditions for a specified time period;
13
![Page 13: Is It Really an Independent Protection Layer?psrgroup.com/wp-content/uploads/2012/03/PSRG-PSM... · • Center for Chemical Process Safety (CCPS),](https://reader036.vdocuments.us/reader036/viewer/2022081420/5ac3475b7f8b9a2b5c8bb9f5/html5/thumbnails/13.jpg)
Core Attributes, Continued
• Auditability– ability to inspect information, documents and
procedures, which demonstrate the adequacy of and adherence to the design, inspection, maintenance, testing, and operation practices used to achieve the other core attributes;
• Access Security– use of administrative controls and physical
means to reduce the potential for unintentional or unauthorized changes; and 14
![Page 14: Is It Really an Independent Protection Layer?psrgroup.com/wp-content/uploads/2012/03/PSRG-PSM... · • Center for Chemical Process Safety (CCPS),](https://reader036.vdocuments.us/reader036/viewer/2022081420/5ac3475b7f8b9a2b5c8bb9f5/html5/thumbnails/14.jpg)
Core Attributes, Continued
• Management of Change– formal process used to review, document, and
approve modifications to equipment, procedures, raw materials, processing conditions, etc., other than “replacement in kind,” prior to implementation.
15
![Page 15: Is It Really an Independent Protection Layer?psrgroup.com/wp-content/uploads/2012/03/PSRG-PSM... · • Center for Chemical Process Safety (CCPS),](https://reader036.vdocuments.us/reader036/viewer/2022081420/5ac3475b7f8b9a2b5c8bb9f5/html5/thumbnails/15.jpg)
16
Keywords
• “3 Ds”–Detect
–Decide
–Deflect
• “4 Enoughs”–Big Enough
–Fast Enough
–Strong Enough
–Smart Enough
The Big “I” –Independent
Of Initiating CauseOf Other IPLs
![Page 16: Is It Really an Independent Protection Layer?psrgroup.com/wp-content/uploads/2012/03/PSRG-PSM... · • Center for Chemical Process Safety (CCPS),](https://reader036.vdocuments.us/reader036/viewer/2022081420/5ac3475b7f8b9a2b5c8bb9f5/html5/thumbnails/16.jpg)
“3Ds” Example
• Pressure relief valve– Spring Detects rising pressure
– Spring Decides to open valve
– Open valve Deflects overpressure consequence, if sized correctly.
17
![Page 17: Is It Really an Independent Protection Layer?psrgroup.com/wp-content/uploads/2012/03/PSRG-PSM... · • Center for Chemical Process Safety (CCPS),](https://reader036.vdocuments.us/reader036/viewer/2022081420/5ac3475b7f8b9a2b5c8bb9f5/html5/thumbnails/17.jpg)
“4 Enoughs” Examples
• Pressure relief valve is– Big Enough
– Opens Fast Enough
• Pressure Isolation valve is– Strong Enough to stop the surge
• Purge system is – Smart Enough to purge the vessel and then isolate
vessel.
18
![Page 18: Is It Really an Independent Protection Layer?psrgroup.com/wp-content/uploads/2012/03/PSRG-PSM... · • Center for Chemical Process Safety (CCPS),](https://reader036.vdocuments.us/reader036/viewer/2022081420/5ac3475b7f8b9a2b5c8bb9f5/html5/thumbnails/18.jpg)
Frequent conflicts with the Big “I”
• Using the initiating cause sensor for the protection layer sensor.
• Using the same sensor for two protection layers.• Using the initiating cause valve for the protection layer
final element.• Using the same final element for two protection layers.• Using the initiating cause controller for the protection
layer logic solver.• Using the same logic solver for two protection layers (it
may be possible to use the same safety-certified PLC as the logic solver for two protection layers if its probability of failure on demand is low enough).
19Common Cause
![Page 19: Is It Really an Independent Protection Layer?psrgroup.com/wp-content/uploads/2012/03/PSRG-PSM... · • Center for Chemical Process Safety (CCPS),](https://reader036.vdocuments.us/reader036/viewer/2022081420/5ac3475b7f8b9a2b5c8bb9f5/html5/thumbnails/19.jpg)
Tank Overflow Example
Consequence: overflow of a flammable material Cause: failure of LIC loop (LT1, LIC1, LV1)
LAH Detect?Decide?Deflect?
20
![Page 20: Is It Really an Independent Protection Layer?psrgroup.com/wp-content/uploads/2012/03/PSRG-PSM... · • Center for Chemical Process Safety (CCPS),](https://reader036.vdocuments.us/reader036/viewer/2022081420/5ac3475b7f8b9a2b5c8bb9f5/html5/thumbnails/20.jpg)
Tank Overflow with Op Response?• “4 Enoughs”
– Big Enough?
– Fast Enough?
– Strong Enough?
– Smart Enough?
Ne
Need 10 minutes
• “The Big I”
– Independent of Initiating Cause
– Independent of other IPLs?
Density change?
21
![Page 21: Is It Really an Independent Protection Layer?psrgroup.com/wp-content/uploads/2012/03/PSRG-PSM... · • Center for Chemical Process Safety (CCPS),](https://reader036.vdocuments.us/reader036/viewer/2022081420/5ac3475b7f8b9a2b5c8bb9f5/html5/thumbnails/21.jpg)
Op Response NOT Independent
22
![Page 22: Is It Really an Independent Protection Layer?psrgroup.com/wp-content/uploads/2012/03/PSRG-PSM... · • Center for Chemical Process Safety (CCPS),](https://reader036.vdocuments.us/reader036/viewer/2022081420/5ac3475b7f8b9a2b5c8bb9f5/html5/thumbnails/22.jpg)
Tank Overflow Example
23
![Page 23: Is It Really an Independent Protection Layer?psrgroup.com/wp-content/uploads/2012/03/PSRG-PSM... · • Center for Chemical Process Safety (CCPS),](https://reader036.vdocuments.us/reader036/viewer/2022081420/5ac3475b7f8b9a2b5c8bb9f5/html5/thumbnails/23.jpg)
Auditability
• “If you never test your IPL, you will find out that it is broken when your plant blows up.”
24
![Page 24: Is It Really an Independent Protection Layer?psrgroup.com/wp-content/uploads/2012/03/PSRG-PSM... · • Center for Chemical Process Safety (CCPS),](https://reader036.vdocuments.us/reader036/viewer/2022081420/5ac3475b7f8b9a2b5c8bb9f5/html5/thumbnails/24.jpg)
Auditability
• Test equipment?
25
Instr.Air Supply
SIS Valve ALSH1
SIF
Fromprocess-wetted sensor element
toprocess-wetted final element
![Page 25: Is It Really an Independent Protection Layer?psrgroup.com/wp-content/uploads/2012/03/PSRG-PSM... · • Center for Chemical Process Safety (CCPS),](https://reader036.vdocuments.us/reader036/viewer/2022081420/5ac3475b7f8b9a2b5c8bb9f5/html5/thumbnails/25.jpg)
Auditability
• Test the operator response?– Every shift?
– Relief operators?
– Manual valve?
• Procedures available & current?
26
![Page 26: Is It Really an Independent Protection Layer?psrgroup.com/wp-content/uploads/2012/03/PSRG-PSM... · • Center for Chemical Process Safety (CCPS),](https://reader036.vdocuments.us/reader036/viewer/2022081420/5ac3475b7f8b9a2b5c8bb9f5/html5/thumbnails/26.jpg)
Auditability
• “Procedures are subject to a form of corrosion more rapid than that which affects steel; they can vanish without a trace once management stops taking an interest in them. . .”
-- Trevor Kletz
27
![Page 27: Is It Really an Independent Protection Layer?psrgroup.com/wp-content/uploads/2012/03/PSRG-PSM... · • Center for Chemical Process Safety (CCPS),](https://reader036.vdocuments.us/reader036/viewer/2022081420/5ac3475b7f8b9a2b5c8bb9f5/html5/thumbnails/27.jpg)
Access Security
• Who has access to the configuration of the logic solver that annunciates the high level alarm?
28
![Page 28: Is It Really an Independent Protection Layer?psrgroup.com/wp-content/uploads/2012/03/PSRG-PSM... · • Center for Chemical Process Safety (CCPS),](https://reader036.vdocuments.us/reader036/viewer/2022081420/5ac3475b7f8b9a2b5c8bb9f5/html5/thumbnails/28.jpg)
Access Security
• What are the procedures to ensure that the set point for an analogue high level alarm is not changed?
29
![Page 29: Is It Really an Independent Protection Layer?psrgroup.com/wp-content/uploads/2012/03/PSRG-PSM... · • Center for Chemical Process Safety (CCPS),](https://reader036.vdocuments.us/reader036/viewer/2022081420/5ac3475b7f8b9a2b5c8bb9f5/html5/thumbnails/29.jpg)
Access Security
• What are the procedures to ensure that the high level alarm is not disabled or inhibited?
30
LAH ___DisabledInhibited
![Page 30: Is It Really an Independent Protection Layer?psrgroup.com/wp-content/uploads/2012/03/PSRG-PSM... · • Center for Chemical Process Safety (CCPS),](https://reader036.vdocuments.us/reader036/viewer/2022081420/5ac3475b7f8b9a2b5c8bb9f5/html5/thumbnails/30.jpg)
Management of ChangeDon’t Increase the Risk!
• Tank LAH– In future, a process improvement specialist may ask,
“Why is the set point for this alarm so low? We could be using a lot more of the volume of this tank.”
• The management of change system must be able– to retrieve the specifications for the operator
response to high-level alarm IPL, – to recognize that the alarm set point provides
sufficient time for the operator to make the response, and
– to retain the required setting for a manual response or to automate the response for a higher set point.
31
![Page 31: Is It Really an Independent Protection Layer?psrgroup.com/wp-content/uploads/2012/03/PSRG-PSM... · • Center for Chemical Process Safety (CCPS),](https://reader036.vdocuments.us/reader036/viewer/2022081420/5ac3475b7f8b9a2b5c8bb9f5/html5/thumbnails/31.jpg)
Spreadsheet to Test IPL Attributes
• Do candidate protection layers (safeguards) meet the requirements?
• Consider a spreadsheet– characteristics of IPLs for each candidate IPL – Versus– scenarios
• Can be useful where – there are a number of existing safeguards, and – the historical culture has assumed that the safeguards
are sufficient.
32
![Page 32: Is It Really an Independent Protection Layer?psrgroup.com/wp-content/uploads/2012/03/PSRG-PSM... · • Center for Chemical Process Safety (CCPS),](https://reader036.vdocuments.us/reader036/viewer/2022081420/5ac3475b7f8b9a2b5c8bb9f5/html5/thumbnails/32.jpg)
Safeguard 1 Safeguard 2
Scenarios # of
Saf
egua
rds
that
mee
t IPL
crit
eria
Des
crip
tion
Det
ect?
Dec
ide?
Def
lect
?
Big
Eno
ugh?
Fast
Eno
ugh?
Stro
ng E
noug
h?
Smar
t Eno
ugh?
Inde
pend
ent o
f the
Initi
atin
g C
ause
?
Inde
pend
ent o
f oth
er IP
Ls?
Des
crip
tion
Det
ect?
Dec
ide?
Def
lect
?
Big
Eno
ugh?
Fast
Eno
ugh?
Stro
ng E
noug
h?
Smar
t Eno
ugh?
Inde
pend
ent o
f the
Initi
atin
g C
ause
?
Inde
pend
ent o
f oth
er IP
Ls?
1LIC loop failure overfills tank with release
1
Operator response to alarm
from level control
loop sensor
N1 Y Y Y Y Y Y N N2
Operator response to alarm
from fixed point level probe
Y Y Y Y Y3 Y Y Y Y
2
Fluid in tank has lighter density than specified in level transmitter design, overfills tank with release
1 N Y Y Y Y Y N N N2 Y Y Y Y Y3 Y Y Y Y
Notes: 1. If the LIC loop sensor fails, it cannot detect. If the LIC controller fails, it may not be able to annunciate the alarm.2. Not independent of the operator response to alarm from the fixed point level probe.3. Ensure there is at least 10 minutes for the operator to respond to the high level alarm at the maximum fill rate.
33
![Page 33: Is It Really an Independent Protection Layer?psrgroup.com/wp-content/uploads/2012/03/PSRG-PSM... · • Center for Chemical Process Safety (CCPS),](https://reader036.vdocuments.us/reader036/viewer/2022081420/5ac3475b7f8b9a2b5c8bb9f5/html5/thumbnails/33.jpg)
CCPS “IPL” Book 2011
• “It’s time to take our own data!”– Relief valves
• Inspect and document inlet and outlet nozzle
• “Pre-pop” test before rebuild
– SIS: “as found, as left”• Sensors
• Valves
• Logic
– Operator Response to Alarm• Annunciation
• Each operator
• Final element34
![Page 34: Is It Really an Independent Protection Layer?psrgroup.com/wp-content/uploads/2012/03/PSRG-PSM... · • Center for Chemical Process Safety (CCPS),](https://reader036.vdocuments.us/reader036/viewer/2022081420/5ac3475b7f8b9a2b5c8bb9f5/html5/thumbnails/34.jpg)
CCPS “IPL” Book 2011
• Audit features with potential to disable IPLs– Block valves around relief devices
• Tagged, locked, or “car sealed”
– Bypasses around SIF shut-down valves• Tagged, locked, or “car sealed”
• Record deviations from the required configuration
• Modify the calculated PFD (probability of failure on demand)
• If needed, add more protection layers.
35
![Page 35: Is It Really an Independent Protection Layer?psrgroup.com/wp-content/uploads/2012/03/PSRG-PSM... · • Center for Chemical Process Safety (CCPS),](https://reader036.vdocuments.us/reader036/viewer/2022081420/5ac3475b7f8b9a2b5c8bb9f5/html5/thumbnails/35.jpg)
CCPS “IPL” Book 2011
• Does your experience support the risk reduction assumed in the LOPA?– If no, then add more layers
– Do root cause analysis to improve the performance of existing layers
36
![Page 36: Is It Really an Independent Protection Layer?psrgroup.com/wp-content/uploads/2012/03/PSRG-PSM... · • Center for Chemical Process Safety (CCPS),](https://reader036.vdocuments.us/reader036/viewer/2022081420/5ac3475b7f8b9a2b5c8bb9f5/html5/thumbnails/36.jpg)
CCPS “IPL” Book 2011
• Listen to the voice of the process– Log and investigate every activation of an IPL
• Relief valve opening
• SIF trip
• Operator response to alarm
• These are “near misses”
– Modify equipment and procedures to avoid challenges to the IPLs.
37
![Page 37: Is It Really an Independent Protection Layer?psrgroup.com/wp-content/uploads/2012/03/PSRG-PSM... · • Center for Chemical Process Safety (CCPS),](https://reader036.vdocuments.us/reader036/viewer/2022081420/5ac3475b7f8b9a2b5c8bb9f5/html5/thumbnails/37.jpg)
CCPS “IPL” Book 2011
• Avoid “high demand” on the IPLs– That is, challenges to the IPLs of more than
once/year, or more than twice in the test interval.
– In high demand mode, the safety system is being
used for basic control. – See details in CCPS 2001 “LOPA”, 2007 “IPS”, and
2011 “IPLs”.
38
![Page 38: Is It Really an Independent Protection Layer?psrgroup.com/wp-content/uploads/2012/03/PSRG-PSM... · • Center for Chemical Process Safety (CCPS),](https://reader036.vdocuments.us/reader036/viewer/2022081420/5ac3475b7f8b9a2b5c8bb9f5/html5/thumbnails/38.jpg)
Observations on Tsunami vsNuclear Plant
• Nuclear plant shutdown requires active cooling after trip.– We prefer IPLs that are
• Passive
• De-energize to trip
• Spring to move to trip state
39
![Page 39: Is It Really an Independent Protection Layer?psrgroup.com/wp-content/uploads/2012/03/PSRG-PSM... · • Center for Chemical Process Safety (CCPS),](https://reader036.vdocuments.us/reader036/viewer/2022081420/5ac3475b7f8b9a2b5c8bb9f5/html5/thumbnails/39.jpg)
Observations on Tsunami vsNuclear Plant
• Beware of common cause!– Earthquake caused trip of the reactors – no power
generated
– Earthquake damaged electric grid – no power from off-site
– Earthquake caused tsunami that damaged back-up generators (located in potentially vulnerable area).
40
![Page 40: Is It Really an Independent Protection Layer?psrgroup.com/wp-content/uploads/2012/03/PSRG-PSM... · • Center for Chemical Process Safety (CCPS),](https://reader036.vdocuments.us/reader036/viewer/2022081420/5ac3475b7f8b9a2b5c8bb9f5/html5/thumbnails/40.jpg)
Should LOPAs be Revalidated?
• US OSHA PSM rule requires PHAs (HAZOPs) to be revalidated every 5 years.
• What about the LOPA for my plant?– What has changed?
• Volume?
• Frequency?
• Training?
• Chemicals?
• Conditions?
41
LAH1
I LAH1
I
![Page 41: Is It Really an Independent Protection Layer?psrgroup.com/wp-content/uploads/2012/03/PSRG-PSM... · • Center for Chemical Process Safety (CCPS),](https://reader036.vdocuments.us/reader036/viewer/2022081420/5ac3475b7f8b9a2b5c8bb9f5/html5/thumbnails/41.jpg)
Conditional Modifiers
• Time at risk
• Probability of Ignition
• Probability of Person Present
• Probability of Injury
• Easy to double count!
• USE WITH GREAT CARE!!• Don’t kid yourself!
42
![Page 42: Is It Really an Independent Protection Layer?psrgroup.com/wp-content/uploads/2012/03/PSRG-PSM... · • Center for Chemical Process Safety (CCPS),](https://reader036.vdocuments.us/reader036/viewer/2022081420/5ac3475b7f8b9a2b5c8bb9f5/html5/thumbnails/42.jpg)
Conditional Modifiers
• CCPS is writing a guidance book this year.
43
![Page 43: Is It Really an Independent Protection Layer?psrgroup.com/wp-content/uploads/2012/03/PSRG-PSM... · • Center for Chemical Process Safety (CCPS),](https://reader036.vdocuments.us/reader036/viewer/2022081420/5ac3475b7f8b9a2b5c8bb9f5/html5/thumbnails/43.jpg)
When to go beyond LOPA
• Protection Layers and Initiating Cause share common elements. – Use Fault Tree Analysis
• Several safeguards can detect the beginning of a scenario but there is only one safeguard that can prevent the scenario from proceeding to the consequence. – Use Event Tree Analysis
44
![Page 44: Is It Really an Independent Protection Layer?psrgroup.com/wp-content/uploads/2012/03/PSRG-PSM... · • Center for Chemical Process Safety (CCPS),](https://reader036.vdocuments.us/reader036/viewer/2022081420/5ac3475b7f8b9a2b5c8bb9f5/html5/thumbnails/44.jpg)
References
• Center for Chemical Process Safety (CCPS),
• Layer of Protection Analysis, Simplified Process Risk Assessment,
• American Institute of Chemical Engineers, New York, NY, 2001.– www.AIChE.org
45
![Page 45: Is It Really an Independent Protection Layer?psrgroup.com/wp-content/uploads/2012/03/PSRG-PSM... · • Center for Chemical Process Safety (CCPS),](https://reader036.vdocuments.us/reader036/viewer/2022081420/5ac3475b7f8b9a2b5c8bb9f5/html5/thumbnails/45.jpg)
References
• ISA -TR84.00.04, Part 1,• Guideline on the Implementation of
ANSI/ISA 84.00.01-2004 (IEC 61511 Mod)• ISA, 67 Alexander Drive, P.O. Box 12277,
Research Triangle Park, North Carolina 27709– www.isa.org
46
![Page 46: Is It Really an Independent Protection Layer?psrgroup.com/wp-content/uploads/2012/03/PSRG-PSM... · • Center for Chemical Process Safety (CCPS),](https://reader036.vdocuments.us/reader036/viewer/2022081420/5ac3475b7f8b9a2b5c8bb9f5/html5/thumbnails/46.jpg)
References
• Center for Chemical Process Safety (CCPS),
• Guidelines for Safe and Reliable Instrumented Protective Systems,
• American Institute of Chemical Engineers, New York, NY, 2007.– www.AIChE.org
47
![Page 47: Is It Really an Independent Protection Layer?psrgroup.com/wp-content/uploads/2012/03/PSRG-PSM... · • Center for Chemical Process Safety (CCPS),](https://reader036.vdocuments.us/reader036/viewer/2022081420/5ac3475b7f8b9a2b5c8bb9f5/html5/thumbnails/47.jpg)
References
• Center for Chemical Process Safety (CCPS),
• Title to be Determined: “Initiating Event Frequencies and IPL PFDs”
• American Institute of Chemical Engineers, New York, NY, 2011.– www.AIChE.org
48
![Page 48: Is It Really an Independent Protection Layer?psrgroup.com/wp-content/uploads/2012/03/PSRG-PSM... · • Center for Chemical Process Safety (CCPS),](https://reader036.vdocuments.us/reader036/viewer/2022081420/5ac3475b7f8b9a2b5c8bb9f5/html5/thumbnails/48.jpg)
Conclusion
• Remember the core attributes of IPLs– 3Ds
– 4 Enoughs
– The Big I
• Use the core attributes to test the IPLs to ensure that the desired risk reduction is achieved.
• Document in the SRS.
49