Instrumented Protective System Design

The required safety integrity level of the instrumented function shall be derived by taking into account the required risk reduction that is to be provided by that function. For those SILs, the target PFDj,yg on demand and the target frequencies of dangerous failure are hsted in Table 3.8 [ANSI/ISA-84.00.01(2004) Part 3] for each SIF. Several risk analysis methods ranging from qualitative to fully quantitative can be deployed based on the severity and complexity of the scope, as listed in Table 3.9. 

---

It is important that personnel understand how to achieve safe operation, but not at the exclusion of other important considerations, such as reliability, operability, and maintainability. The chemical industry has also found significant benefit to plant productivity and operability when SIS work processes are used to design and manage other instrumented protective systems (IPS), such as those mitigating potential economic and business losses. The CCPS book (2007) Guidelines for Safe and Reliable Instrumented Protective Systems discusses the activities and quality control measures necessary to achieve safe and reliable operation throughout the IPS lifecycle. 

Safety systems such as relief valves, instrumented protective systems, and restriction orifices that protect the plant from loss of containment as a result of exceeding design conditions... 

First, the importance of learning lessons from past process safety incidents is highlighted in Section 3.2. The subsequent section presents preliminary hazard review procedure, risk matrix, what-if method, plot plan and layout review, pressure relief system review and fire safety design aspects. Section 3.4 presents PHA techniques and procedures hazards and operability analysis (HAZOP), failure modes and effects analysis (FMEA), instrumented protective system (IPS) design, fault trees, event trees, layer of protection analysis (LOPA) and finally SIS life eyele. The importanee of revision of PSI is highlighted in Seetion 3.5. 

In LOPA studies, the normal convention is that the need for SIS is determined when all other protection layers have been considered. If an existing SIS complies with BS EN 61511 then a reliability performance consistent with the SIL-rating of the SIS and its design and operation can be claimed. If any instrumented protection does not comply with BS EN 61511 then a risk reduction factor of no greater than 10 can be claimed for it. However, experience has shown that it is unlikely that an instrumented protection system that does not comply with BS EN 61511 would have a reliability assessment associated with it, and therefore an assessment would have to be made to determine the performance level that could be claimed. 

On this tank, the LAFIFI includes a trip function to terminate the transfer. For a well-designed and maintained safety instrumented protective system, a response time of two minutes between activation and complete cessation of flow into the tank is claimed. This includes the time needed to take urgent action in case the trip action is not successful - in this case to immediately close another remotely operated valve, readily accessible in the control room (the system having been designed for this emergency closure). 

In this way, the fault tree can be quantified, which makes this technique very powerful for the reliability analysis of protection systems. The prerequisite is the availability of statistical reliability data of the different devices and instruments that is often difficult to obtain for multi-purpose plants, where devices can be exposed to very different conditions when changing from one process to another. Nevertheless, if the objective is to compare different designs, semi-quantitative data are sufficient. 

The international standard IEC 61511 [2] gives advice on the design of safety instrumented systems (SIS) and presents a layer concept to achieve reliability of protection systems. These principles can be applied to the protection of chemical reactors [3]. Figure 10.3 represents this layer of protection principles. The first layer is the process itself, meaning that it should be designed in such a way that it cannot give rise to a runaway reaction. Some concepts for achieving this objective are reviewed in Section 10.3. 

In most situations, safety is best achieved by an inherently safe process design whenever practicable, combined, if necessary, with a number of protective systems which rely on different technologies (for example, chemical, mechanical, hydraulic, pneumatic, electrical, electronic, thermodynamic (for example, flame arrestors), programmable electronic) which manage any residual identified risk. Any safety strategy considers each individual safety instrumented system in the context of the other protective systems. To facilitate this approach, this standard... 

A number of measurements, principally electrical, are necessary in order to ensure that a cathodic-protection system is correctly designed and will provide full protection to the structure concerned, and to determine accurately the effect of such a system on other structures. This section deals with the instruments used for making these measurements and indicates in general terms the various types available to the corrosion engineer today. Brief details of instruments not directly connected with cathodic protection as such, but nevertheless associated with it, are also included. 

The instrumentation and control systems in the PHWR plant include a variety of equipment intended to perform display, monitoring, control, protection and safety functions. The concepts presented form the basis for the system design and development. General guide-lines followed are ... 

Designing the Nuplex 80+ instrumentation and controls to incorporate semi-automated and on-line testing features for the Plant Protection System and on-line monitoring of fluid and electrical systems, thus enhancing the detection of sabotage. 

Specifically, the accident monitoring instrumentation shall be designed such that the operator will be provided with sufficient information during accident situations to take pre-planned manual actions, and to determine whether safety systems are operating properly. In addition, the instrumentation will also provide sufficient data so that the operator can evaluate the potential for core uncovery, and gross breach of protective barriers, including the resultant release of radioactivity to the environment. 

NOTE 2 Where reasonably practicable, processes should be designed to be inherently safe. When this is not practical, risk reduction methods such as mechanical protection systems and safety instrumented systems may need to be added to the design. These systems may act alone or in combination with each other. 

The PMS is designed to prevent common mode failures between itself and the PLS. However, in the low probability case where a common mode failure does occur, the DAS provides diverse protection. The specific functions performed by the DAS are presented in Table 6.7-2. The DAS functional requirements are based on an assessment of the protection system instrumentation common mode failure probabilities combined with the event probability (see subsection 7.7.1.11 of Reference 6.1). 

---