Hydrocarbon Processing - December 2021 - 65

Environment
and Safety
H. J. PATEL, Fluor, New Delhi, India
Assessment of independent protection layers
in an LOPA study-Part 2
Industrial facilities, especially those operating in the chemical,
oil and gas and petroleum industries, contain inherent
risks in operations due to the processing of materials that are
hazardous in nature. Hazards, operability issues, associated
risks and their consequences must be accurately identified
and analyzed to ensure safe operations. Safety instrumented
systems (SISs) are deployed to reduce risk to tolerable or acceptable
levels to achieve safe operations.1
safety functions implemented in an SIS are determined by the
magnitude of risk reduction required and is expressed in terms
of safety integrity level (SIL).
A layer of protection analysis (LOPA) is one of the methods
used to determine the SIL of the safety instrumented
function (SIF). During the LOPA study, the design is thoroughly
examined for one or more independent protection layers
(IPLs) in the design to assess whether the required risk
reduction has been achieved. The success of the LOPA study
depends on proper assessment of the protection layers and
their contribution to risk reduction.
In Part 1 of this article (November 2021), three attributes
of a LOPA study were discussed: independence, functionality
and integrity. The contribution of the remaining three attributes-reliability,
access security and auditability-will be
discussed here.
Reliability. This core attribute defines the reliability of an
IPL, which means that the IPL performs its intended function
completely without fail when needed. For an IPL to be
reliable, it must be rigorously designed, operated, maintained
and tested as per the guidelines/procedures mentioned in the
safety lifecycle according to IEC 61511.2,3
Any gaps that are
discovered must be fixed with proper management of change
(MoC) procedures.
In the LOPA process, IPLs are rarely challenged, meaning
that an IPL operates in low-demand mode (e.g., less than once
per year). If an IPL is required to operate more than once per
year, then it cannot be considered as an IPL and probability
of failure on demand (PFD) credit cannot be claimed. In
such scenarios, these IPLs should be considered as initiating
events, and the impact consequences of such IPLs must be
further analyzed in the LOPA study.
Consider an example for an independent core attribute, an
IPL of an SIL-3 rated safety SIF used in the burner manageThe
reliability of
ment system, to manage the start and shutdown sequence and
controls of the entire incinerator burner system. The question
is: how to ensure the reliability of this IPL?
The designer of the SIS must select the appropriate instruments,
check their reliability using SIL verification calculations,
determine the best proof test frequency for each
instrument, and verify the SIL certificate submitted by the
manufacturer for each device in a particular SIF.
As a result, when choosing such safeguards (e.g., an SIF
with SIL-1/2/3) as a credible IPL-which can reduce the SIL
target by a magnitude of 1, 2 or 3-the LOPA team should
place a greater emphasis on maintaining such an IPL in accordance
with IEC 61511's safety lifecycle. The team should
clearly document in the LOPA report that such IPLs must adhere
to strict enforcement and meet the IEC 61511 functional
safety lifecycle phases.
Access security. An access security core characteristic is
the use of physical and/or administrative controls with procedures
to reduce the possibility of unauthorized changes to the
system that could compromise the safety function.
The basic process control system (BPCS) is traditionally
used to control process parameters within acceptable limits.
Process design and operator actions on alarms play an important
role in controlling the processes. Additional layers
of protection are available, such as SISs and other mitigation
layers like fire and gas, pressure relief valves, dikes and community
emergency plans. In any process industry, systems like
the BPCS, SIS and FGS form the complete automation system
that controls the plant automatically throughout its lifecycle,
considering the safety of people, assets and environment.
Technological advancements and increased operational
efficiency have enabled most companies to interface operation
technology (OT) with enterprise-level information
technology (IT) systems, potentially exposing the OT or
automation system to cyber threats. Even a robust automation
system is vulnerable. These cyber threats, intentional
or unintentional, can ultimately result in an abnormal and
undesirable shutdown of the plant. Recently, cyber-attacks
have caused numerous industrial incidents, so it is essential
to study these cyber threats in detail and apply cybersecurity
to the automation system.
Apart from automation cybersecurity, various methodoloHydrocarbon
Processing | DECEMBER 2021 65
Hydrocarbon Processing - December 2021

Table of Contents for the Digital Edition of Hydrocarbon Processing - December 2021
