Hydrocarbon Processing - November 2021 - 63

Environment and Safety
dures detailing necessary actions must be available to be credited
as an IPL. Time of operator action varies for different process
scenarios, but > 20 min is considered a reasonable period.
Demands on a process or system may impact personnel, assets
and the environment, and the severity of consequences vary.
If a scenario yielded a target SIL-2 for assets, an SIL-3 for the
environment and an SIL-1 for personnel protection, the total
target SIL would be SIL-3 due to the conservative values among
the three. Since environmental protection is the governing case
in this example, if the safeguard is considered a credible IPL and
can reduce the risk to the order of magnitude (OoM) of 1 or 2, its
function must be verified to determine whether it mitigates the
consequences associated with environmental protection or not.
If the over-pressure scenario is mitigated for a PRV as an IPL
for SIL-3 safety function (remember that the target SIL-3 is assigned
for environmental safety), then the function or intent
of this PRV must be to reduce the risk of environmental harm
when it operates. This means that rather than being vented open
to the atmosphere, the PRV should be controlled to closed containment
or sent to a knockout (KO) drum, and then released
through the stack after treatment at a safe location.
Integrity. IPL integrity is defined as the magnitude or effectiveness
by which the IPL reduces the risk, as expressed by
the probability of failure on demand PFD values or some time
OoM (e.g., if an IPL claimed a PFD of 0.01, the OoM is 2; if
the PFD claims 0.1, the OoM is 1). This OoM can be directly
related to the SIL number. For example, if the SIL of a particular
SIF loop (before being considered an IPL) is SIL-2, then it can
be reduced to SIL-1 for an OoM of 1 (i.e., a PFD credit of 0.1
for the IPL).
IPL integrity depends on the integrity of its components and
its intended function; for example, if the operator action on an
alarm is considered as an IPL and the PFD value claimed is 0.1,
then the IPL integrity depends on the reliability of the transmitter
and associated control system (BPCS) that generates the
alarm, as well as when and how the operator reacts. It is recommended
to perform frequent checks, such as functional testing,
proof testing, verification and validation, for sensors and the
control system. Similarly, the integrity of operator actions can
be ensured with written procedures, regular training and verification
of the training's effectiveness.
For some IPLs, functional testing, trial runs or simulations
are recommended to verify effectiveness. Ultimately, a proper
safety management plan should be implemented, reviewed and
audited as per the functional safety standards IEC 615082
Management is responsible to effectively impleand
IEC
61511.3
ment the safety plan throughout the organization.
The Center for Chemical Process Safety (CCPS) has provided
general PFD values for IPL credit, as well as the requirements
for applying these values to a specific IPL and its limitations.4
The
final decision to use the PFD values, however, is
subject to client approval.
Example. An example of considering the SIL-2/SIL-3 SIF as
a credible IPL is the LOPA study explained here. Consider an
incinerator package, which is commonly used in sulfur recovery
units (SRUs) in refineries. Full combustion in the incinerator is
vital to achieve the highest efficiency of this equipment.
Maintaining the air-to-fuel ratio in the incinerator is critical
for full combustion. Air-to-fuel control is typically implemented
in a distributed control system (DCS) with a robust ratio
controller and a sophisticated control algorithm. Other DCS
controls include main fuel gas control, incinerator temperature
controls, combustion air flow control, O2
trim controls, secondary
air flow control, and a variety of others. Aside from process
controls via a DCS, an SIS is used to implement safety functions.
The incinerator also has its own SIL-3 rated programmable
logic control (PLC)-based burner management system
(BMS) that oversees the entire process from burner start to safe
shutdown. Even with such sophisticated controls in place, a risk
remains that a demand can arise in the system that places the
plant in a dangerous situation.
If the air-to-fuel ratio fails due to various reasons, what happens
to the plant and the incinerator? The first obvious issue
is that proper fuel combustion is not taking place, potentially
putting the plant in duress. Combustion or primary air failure
can result in a flickering flame, which can cause an incinerator
flame-out condition. In the worst-case scenario, this could result
in an incinerator explosion. The most serious damage to an
incinerator is the possibility of an explosion in the furnace if the
incinerator is restarted without effectively purging out the combustible
hydrocarbon gases from the system.
In case of failure of primary air, the credit for the robust
SIL-3 SIF of the burner management system can be taken as an
active IPL with a risk reduction factor of OoM 3 with reference
to IEC 61511-3, Table G.6.3
The effective IPL would be, " Incinerator
start logic incorporates necessary purge time and volume
with combustion air before ignition sequence is permitted and
isolation of sour gases. " The temperature in the burner's combustion
zone would be between 1,400°C-1,700°C. To avoid
damage to the burner internals due to overheating from the hot
flue gases and radiation from the chamber, a positive purge flow
through the burner and incinerator is necessary. Combustion
air may be used to purge the incinerator unit. To avoid damage
to the refractory lining, the cooling of the device must be done
in a regulated manner.
As a result, the integrity of this BMS purging system now
becomes vital because it is being credited as an active IPL. During
the LOPA study, the team should thoroughly discuss and
document such IPLs to maintain IPL integrity. The LOPA team
should also recommend that this IPL complies with all functional
safety requirements according to safety lifecycle phases,
which begin with design and end with decommissioning.
The remaining attributes, reliability, access security and auditability
will be discussed in Part 2, which will appear in the
December issue.
LITERATURE CITED
Complete literature cited available online at www.HydrocarbonProcessing.com.
HEMANT J. PATEL has more than 21 yr of experience in field
instrumentation and plant automation in numerous global
projects in the oil and gas, refining, petrochemicals, chemicals,
power and metals industries, among others. He is certified by
TÜV SÜD as a Functional Safety Engineer, and as a Cybersecurity
Practitioner by Exida. He has expertise in SIL verification
calculation through exSILentia software, and has extensive
knowledge of project lifecycle activities, including proposals, conceptual design,
detailed engineering, construction support, inspection and testing (FAT/SAT),
startup and commissioning, operations and maintenance.
Hydrocarbon Processing | NOVEMBER 2021 63
http://www.HydrocarbonProcessing.com
Hydrocarbon Processing - November 2021

Table of Contents for the Digital Edition of Hydrocarbon Processing - November 2021
