Independent layers of protection

Individual companies use different criteria to establish the boundary between acceptable and unacceptable risk. The criteria may include frequency of fatalities, frequency of fires, maximum frequency of a specific category of a consequence, and required number of independent layers of protection for a specific consequence category. 

Adjust the failure frequency to include the probabilities of failure on demand (PFDs) for each independent layer of protection. 

Most facilities are designed around layers of protection commonly referred to as Independent Layers of Protection (ILP). A protection layer or combination of combination of protection layers qualifies as a ILP when one of the following conditions are met (1) the protection provided reduces the risk of a serious event by 100 times, (2) the protective function is provided with a high degree of availability (i.e., greater than 0.99) or (3) it has the following characteristics - specificity, independence, dependability, and auditability. 

The most commonly encountered Independent Layers of Protection (ILPs) are shown in Table 1 ... 

Generally by increasing the independent layers of protection (IPLs), which are applied to a potential hazardous event, the SIL number can be reduced. It should be noted that a SIL Level of 4 is seldom used in the petroleum or related industries but is common throughout the avionics, aerospace and nuclear industries. 

Fortunately in most situations in the process industries, especially when independent layers of protection (Ref. 6 and 7) are properly designed and considered in the demand rate analysis, average demand intervals are very high. Often the average demand interval wiU exceed one hundred years. 

Most designers would choose a completely separate BPCS and SIS as shown in Figure 15-1. In this design option, the BPCS could be used as an independent layer of protection, assuming that a shutdown function was included in the control logic. Although the BPCS can only provide a risk reduction factor of 10, it effectively lowers the SIL requirement for the SIF. The SIF itself can be analyzed for risk reduction. For comparison, a combined risk reduction factor can be calculated. The results are shown in Table 15-5. 

In the next design option, the transmitter signal will be used as a second shutdown input with loo2 voting and the control valve will be used as a second shutdown mechanism. This is shown in Figure 15-3. common equipment is used, the BPCS cannot be considered an independent layer of protection. 

Adherence to control hierarchy discussed, and suitable uniform distributions of control types such as engineering as well as administrative controls. Application of independent layers of protection matching the requirements. Identification of common mode failure. 

Layers of protection There are many independent layers of protection provided in the control measure in addition to the basic process control system. These layers of protection make the control measures more robust. Fig. 11/4.5.4-1 may be referred to for more detail. Detailed discussions are available in Chapter V. Common mode failure Common mode failure refers to the failure of more than one control system on account of a common cause, which underlines the importance of independent layers of protection. However, common cause can affect both engineering and administrative controls. So, while considering the adequacy of control measures used for risk prevention/reduction/mitigation, etc. it is necessary and important to see that all such control measures are not only independent but also do not suffer from common mode fculure—discussed in later part of the book. 

A Center for Chemical Process Safety (CCPS) publication gives the following definition An IPL is a device, system or action which is capable of preventing a scenario from proceeding to its undesired consequence independent of the initiating event or the action of any other layer of protection associated with the scenario. The effectiveness and independence of an IPL must be auditable [12]. Discussions on layer of protection analysis (LOPA) were covered in Chapter V, so they are not repeated here. However, a few characteristic features of protection layers are presented. Similar to fault tolerance and security, this is also important so that the control system is always safe. As per lEC 61511 standard the core idea for integrated safety and security is defense-in-depth with independent layers of protection to reduce process risk. The strategy behind this is that the BPCS, critical... 

Providing independent layers of protection with integrated safety systems L.M. Duran, Ron Johnson ABB Technical write up https //library.e.abb.com/public/ f3038ff4f251587585257658006fc0e7/1730%20Layers%20of%20protection%20VP.pdf. 

For each risk assessment/SIL determination study, dutyholders should be able to justify each claim, and data used in the risk assessment, and ensure that appropriate management systems and procedures are implemented to support those claims. For COMAEI top-tier sites this will form part of the demonstration required within the safety report. Of particular importance is the reliability and diversity of the independent layers of protection. To avoid common mode failures extreme care should be taken when claiming high reliability and diversify, particularly for multiple human interventions. 

The LOPA worksheet is presented below. Notice how the PFD, which determines the target SIL, is obtained in the worksheet from the ratio of the Target Risk Frequency to the Total Mitigated Event Frequency (MEF) . lEF is the Initiating Event Frequency and IPL is the Independent Layer of Protection. ... 

Most facilities are designed around layers of protection commonly referred to as independent layers of protection (ILP). A protection layer or combination of protection layers qualifies as an ILP when one of the following is met ... 

Table 3.1 provides a listing hierarchy of the independent layers of protection commonly found in the process industries. 

To achieve safety objectives and a philosophy of protection through independent layers of protection, a project or organization should define specific guidelines or standards to implement in its designs. Numerous industry standards are available (i.e., API, CCPS, NFPA) that provide options, general recommendations, or specific criteria once a design preference is chosen. It is therefore imperative to have company-specific... 

Aim is to develop independent layers of protection to prevent scenarios from changing in an undesirable scenario. Here it is important to ensure that all layers of protection are mutually independent. (Wei et al., 2008). Criteria for independency are given in (Gowland, 2006, Wei et al., 2008). 

The flare stack was also out of service for maintenance. In one sense it can be argued that the tower and the stack were a combined safety layer and hence were not to be considered as independent layers of protection. 

A large amount of protection against hazards can be often be performed by mechanical safety devices such as relief valves or overflow devices. These are independent layers of protection and play an important role in many protection schemes. 

Table 5 is a partial list of accident events and the associated prevention strategy used to propose interlock strategy and actions to help further identify or create additional independent layers of protection. 

---