Credit risk reduction

As stated above, the hazard and risk assessment and allocation may be concurrent activities or allocation may in some circumstances take place prior to hazard and risk assessment. Decisions on the allocation of safety functions to safety layers are often taken on the basis of what has been found to be practicable by the user organization. Established industry good practice should also be taken Into account. Decisions will then be taken on the safety instrumented systems, assuming credit for the other safety layers. For example, where relief valves have been installed and these have been designed and installed according to industry codes, it may then be decided that these are adequate on their own to achieve adequate risk reduction. Safety instrumented systems would then only limit pressure where size or performance of the relief valve(s) was insufficient for the application or release to the atmosphere is to be prevented. 

NOTE When considering how much risk reduction credit to be given to a BPCS, consideration should be given to the fact that a part of the BPCS may also be an initiating source for an event. 

When credit for a risk reduction equal to or greater than 10 for a single operator action is proposed, the following should be considered ... 

Operator actions that are implemented through the BPCS, in response to process conditions, can be credited with a risk reduction of less than 10 under the following conditions ... 

A risk reduction equal to or greater than 10 can be claimed where an operator, as a result of an alarm, takes action to place the process in a safe state. To take credit for a risk reduction equal to or greater than 10, a risk analysis should be performed to verify its feasibility. It is especially important to determine whether there is sufficient human response time. Refer to Annex B.5 for more discussion on human response time. 

NOTE 2 Where a detailed hazard analysis of the BPCS demonstrates that the control and protective elemertts within the BPCS are functionally independent, it may be possible to conclude that a failure in the controlling part has a sufficiently low probability of causing the failure of the protective function. In such cases, it may be appropriate to take credit for the BPCS as a protection layer, even if the BPCS can initiate the process hazard. In accordance with ANSI/ISA-84.00.01-2004-1, Clause 9, the risk reduction claimed for the BPCS as a protection layer must be less than or equal to 10. 

All of these can also be seen from the examples of fire (e.g., detection parts are proactive whereas protection parts are reactive). In fact, the safety barriers can be categorized according to their influence of safety. Safety barriers need to be evaluated before selection. These safety barriers actually are provided by layers of protection. From the discussions on layers of protection analysis (LOPA), it is known that safety barriers or independent protection layer (IPL) can be credited with risk reduction if they are ... 

SIL = Risk Reduction (Severity-Likelihood matrix) — IPL credit. 

As per lEC 61511-3 2003 Clause 9.4.3, operator action as part of safety instrument functions (SIFs) can be credited with a level of risk reduction greater than 10 when the system from the sensor to the final element can be designed and evaluated as an SIS per the requirements of lEC 61511. A typical automated SIS, popularly known as an industrial automation and control system (LACS), from the sensor to the final element can be conceived, as shown in Fig. VIII/1.4-1 or Fig. VII/1.3-1 where the main constituents are sensor, logic solver, and final element. When an operator action such as through the display/alarm is necessary this needs to be as shown in Fig. XI/2.4.3-1. 

In a simple LOPA using a conservative approach, unless there is complete independence in how basic process control functions are implemented through the BPCS, no credit can be taken for any risk reduction provided by a control or alarm function implemented through the BPCS as a protection layer if a BPCS failure also forms part of an initiating event. However, this conservative approach may be relaxed if it can be demonstrated that there is sufficient independence to allow credit to be taken for both. This issue is discussed in Sections 9.4 and 9.5 of BS EN 61511-1 and BS EN 61511 -2. The reader is referred to these sources for a more detailed discussion. Systematic factors such as security, software, design errors and human factors should also be considered. 

The upset in Event 4 is similar to the upset in Event 1. Operator intervention can stop this runaway by starting the steam turbine driven water pumps, or adding Shortstop. While this operator action was judged to be very effective, no risk reduction credit was taken because of operator availability. The analysis shown in Table 7 led to safety integrity level 3 for SIF S-1. 

---