Arthur M. Dowell

Layer of protection analysis for determining safety integrity level

Abstract This paper describes the Layer of Protection Analysis (LOPA) method for determining the needed SIL (Safety Integrity Level) of a SIS (Safety Instrumented System). The paper also shows the relationship of LOPA to other analysis methods for safety system requirements. Building on the CCPS (Center for Chemical Process Safety) Guidelines for Safe Automation of Chemical Processes , this paper shows how to determine if additional safeguards are needed and how to determine the needed SIL of a SIS. LOPA is a tool that can be used after the HAZOP (HAZard and OPerability Analysis), but before using fault tree analysis or quantitative risk analysis. Using a multi-disciplined team, the consequences identified in the HAZOP are listed as impact events and are classified for severity level. The initiating causes are listed for each impact event and a likelihood is estimated for each initiating cause. Independent Protection Layers (IPLs) are listed, including process design, basic process control system, alarms and procedures, safety instrumented systems, and additional mitigation. Each IPL is assigned a Probability of Failure on Demand (PFD). A mitigated event likelihood is calculated by multiplying the initiating cause likelihood by the PFDs for the applicable IPLs. The mitigated event likelihood is then compared to a criterion linked to the corporation’s criteria for unacceptable risk levels. Additional IPLs can be added to reduce the risk. The mitigated event likelihoods are summed to give an estimate of the risk for the whole process.

Advances in inherent safety guidance

The classic reference from CCPS “Inherently Safer Chemical Processes, A Life Cycle Approach”, 1st edition, 1996, was updated in 2006–2007. The goal of this book is to influence the future state of chemical process evolution by illustrating and emphasizing the merits of integrating process research, development, and design into a comprehensive process that balances safety, capital, and environmental concerns throughout the life cycle of the process. The authors hope that this book will influence the next generation of engineers and chemists as well as current practitioners and managers in the field of chemical processing.

How to design, verify and validate emergency shutdown systems

Abstract This paper describes one method to select equipment data and to use engineering tools to design, verify or validate Emergency Shutdown System (ESS) performance. The paper demonstrates “how to” in a manner that is easy to follow and understand, thus allowing users to duplicate the approach in a way that reflects their companys operating environment and needs. A hierarchy of equipment data sources is discussed as to desirability, applicability and selection. From quantitative methodologies and representative engineering tools, one is chosen and validated — a simple fault tree analysis software tool. The tool is used to illustrate how to evaluate hypothetical designs to develop validated qualitative “cookbooks” adhering to a selected set of Primary Integrity Parameters (PIPs). Developing qualitative “cookbooks” can speed up the design process for the majority of ESSs. Design verification is applying the tool to the actual equipment and the configuration proposed and can be used if the “cookbook” PIPs do not meet the operations needs. Validation is applying the tool to systems as installed and maintained, using actual documented equipment performance. Installed ESSs performance can be validated to support documented maintenance procedures, such as test frequencies.

Incident investigation: Process to identify root causes of mechanical failures

This paper describes an actual incident investigation into unexpected premature failure of sealed diaphragm pressure transmitters in a chemical process. Some nontypical investigation tools from the CCPS Guidelines for Investigating Chemical Process Incidents (2nd edition) were used.

Identify SIF and specify necessary SIL, and other IPLs, as part of PHA/HAZOP – or ‐ why it is not necessary to “boldly go beyond HAZOP and LOPA”

This article shows how to apply the qualitative definition of IPLs within the setting of a process hazard analysis (PHA) to get most of the gain from Layer of Protection Analysis (LOPA) without doing a LOPA (without using numerical values). The article includes an implementation path to develop PHA leader competencies to guide the qualitative approach. We also show the way we use a PHA team to identify when a SIF is needed and to select the proper target safety integrity level (SIL). This portion of the SIL evaluation and the identification and labeling of the IPLs during the PHA/hazard and operability analysis (HAZOP) does not take any longer than a normal PHA/HAZOP, once the right habits are established. Note that this approach eliminates the need for a separate SIL Evaluation Study to identify the SIFs and select the target SIL. Finally, the article ties together these two specific topics, along with the topic of making risk judgments, to show there is less than 5% need to go beyond HAZOP, and less than 0.01% need to go beyond LOPA.