Hydrocarbon Processing - December 2021 - 66

Environment and Safety
gies are used in the process industries to reduce or prevent the
possibility of unauthorized changes to the system, including:
* When changing any parameter of the BPCS and
SIS, the security password should be used. Access is
limited to those who have been given permission.
* Utilize lock and car seals for valves and/or equipment/
devices. This includes the provision of locking the
valve or device in the required position.
* Key locking systems are used to ensure that valves or
devices are operated in a pre-defined manner and in
sequence. A main key is first released from a device
or valve from a required position, and then inserted
to any remaining devices in the sequence to alter its
position as per the predefined sequence documented.
* Use open, close and intermediate position limit
switches on isolation or bypass valves that are
displaying the actual position to the operator on
a human-machine interface (HMI) screen.
* Key lock-type switches should be provided
for maintenance override switches and emergency
shutdown switches on an operator console to
avoid inadvertent operation.
* SIS marshalling panels and system panels should
be provided with a unique type of door key and cannot
be opened with the door keys of other panels.
During the LOPA study, the team must verify that the facility
under consideration has access security systems like those
defined here, which must be used under strict administrative
controls with proper documentation to be effective. In the
LOPA study, such administrative control is examined when a
particular safeguard is considered as a credible IPL. Various
examples of consequence mitigation systems (CMS) with related
risk reduction factors (RRF) and probability of failure
on demand are given in IEC 61511-3, Table G7 (PFD).
An interesting example can be seen from that table: an
overflow line can be credited as a consequence mitigation
system with a risk reduction factor of 100, provided that the
overflow line is built to discharge into a containment area that
is large enough to handle the hazardous situation. Also, any
valves in the line must be administratively regulated for the
CMS to be available when needed.
Auditability. Safeguards that can be claimed as an IPL in the
LOPA study must be auditable. This requires a robust safety
management plan implemented throughout the facility. The
audit must be performed to confirm whether the design,
operation, maintenance and testing are being implemented
as per the guidelines and the procedures mentioned in the
functional safety standards. An audit can also help measure
the effectiveness of the system and procedure implementation
and can be corrected for any gaps. In process industries,
the LOPA process is also audited to verify its contents and
alignment with the advancement in technologies, reliability
data and standards. In this way, the entire LOPA process can
be re-validated.
As a result, the team should refer to the Safety Plan document
for a specific project during the LOPA study to see
whether the requirement for an audit process is specified or
not. If an audit requirement is listed, the team should review
66 DECEMBER 2021 | HydrocarbonProcessing.com
the content for appropriateness-if not, the team should
make a recommendation.
Considering human action as an IPL. Opinions vary
when considering human action as a credible IPL in a LOPA
study. This includes operator action in response to an alarm
within the required time duration, which may depend on
various factors like operator experience, operator alertness in
response to the alarm, an operator's positive state of mind,
documented procedures and the number of multiple tasks
being performed by the operator at a time. The overall effectiveness
of human action is often less reliable than the automatic
actions performed by other means. However, it is too
conservative not to consider well-defined human action as a
credible IPL.
In the LOPA analysis, human response to an alarm should
be considered a reliable IPL. During an actual plant procedure,
the operator must monitor many important process parameters
to ensure that the process runs smoothly. When all
process parameters are normal and within reasonable limits,
the operator can relax and observe the process. However, if
one of the process parameters reaches the permissible control
limits, the operator is under pressure to correct the situation,
including conducting comprehensive research. The BPCS
system begins sending warnings and alarms to the operator,
increasing the difficulty for the operator to control an incident.
The operator must take the required measures to ensure
that the process returns to its normal operating parameters
and that an unwanted shutdown is avoided.
As a result, the operator's function and actions become
crucial to restore the process to a safe state. When a human
action is considered a reliable ILP in a LOPA analysis, the
operator's actions must be carefully observed, evaluated and
recorded. That operator's knowledge and awareness should be
shared through a robust mechanism such as theoretical training
and realistic demonstration through simulation softwares.
PFD values for IPLs. Once the safeguards have been properly
analyzed and identified as credible IPLs, the next question
is how much credit should be considered as risk reduction
measures. The international standard IEC 61511-3 provides
examples for the PFD values to be considered for IPLs. However,
the final values to be considered in the LOPA study will
depend on each organization and its tolerable risk criteria.
This will further vary from one process plant to another, as
each process has its unique hazards and consequences. Some
industrial data are available to consider the PFD value for
IPLs, but these should be verified and documented by an organization
before conducting the HAZOP/LOPA study.
PFD value data are available for IPLs, documented in literature
from industry experience and good engineering practices.
For example, one such source of literature is from the
Center for Chemical Process Safety (CCPS)4
, which has documented
the ranges for PFD values of IPLs used in different
companies. For example, the passive IPL like Dike can have
PFD values ranging from 1 × 10-2
to 1 × 10-3
to 1 × 10-5
PFD credit ranging from 1 × 10-1
; another example
would be an active IPL relief valve with PFD values that vary
from 1 × 10-1
; and a BPCS as an IPL can claim the
to 1 × 10-2
.
http://www.HydrocarbonProcessing.com
Hydrocarbon Processing - December 2021

Table of Contents for the Digital Edition of Hydrocarbon Processing - December 2021
