Protection layers operator action

Many never consider a person to be part of a safety instrumented function. When reviewing the definitions used in functional safety standards, there is little indication that this was ever intended. A process operator takes action when normal process operating conditions are violated. The operator normally responds to these violations from alarms. The operator action is, therefore, normally considered as being part of the alarm layer of protection, not the SIS. 

Annex B - Operator action as an Independent Protection Layer (IPL)... 

Alarms for which an operator or facility worker is required to evacuate an area (e.g., fire and gas alarms) and are not intended to direct the operator to take action on the process are generally not considered safety instrumented functions. These alarms should not be allocated to the BPCS but may be allocated to the SIS or to another independent protection layer. Refer to Annex F, Figure F.1, for an overview of protection layers. These alarms are generally classified as safety-related and are designed and managed in a manner that supports the allocated risk reduction. 

NOTE - Layer of protection analysis (LOPA) is often implemented as an order-of-magnitude assessment. Consequently, it is typical for the purpose of the LOPA calculation to assume a rounded off risk reduction factor of 10 for an operator action IPL implemented in the BPCS layer when it has met the other criteria discussed in this Annex and in Annex F. 

Table B.1 provides an example of criteria that can be established for operator action as an IPL. According to this example, the risk reduction allocation is related to the protection layer allocation, human response time and the complexity of the action. The human response time should be less than the available prooess safety time, when an operator response to an alarm is being considered for reducing the risk of a specified hazard scenario. The available process safety time is the time it takes the process to go from the alarm condition to the hazardous condition. Human error occurs when an operator fails to respond oorreotly within the available process safety time.

ANSI/ISA-84.01-1996 excluded systems where the operator was the sole means of returning the process to a safe state. ANSI/ISA-84.00.01-2004-1 did not specifically exclude this type of system, but did not explicitly include it either. ANSI/ISA-84.00.01-2004-1 Clauses 11.3.1 through Clauses 11.3.3 provide requirements where the operator is required to take specific action in response to safety critical alarms and diagnostic alarms. When the Hazard and Risk Analysis (H RA) identifies a critical alarm as a protection layer, the detection and response may include many different components, such as sensor(s), logic solver, operator HMI, and final element(s). It is important that all elements, including the operator, be capable of achieving the required risk reduction. ISA-TR84.00.04-1 Annex B provides additional discussion on this subject. 

SIS This is the first automatic protection layer to BPCS and second overall layer of protection. It is desired that this shall be independent of BPCS. Even if these are combined it is necessary to ensure that single failure does not take toll of safety. SIS may stop part of plant operation and/or diverts some flow safely, etc. It may have separate set of instrumentation to detect and take safety action in the event of instrument/system failure. It has to be more aggressive than BPCS for safety functions. Under SIS, there will be several interlocks and protections to save the system and in many places like off shore design, ESD is considered as last resort or emergency plan achievable through PEs. 

Operator action twice that is, operator action at hi is same as hi hi so should not be considered twice an independent protection layer. 

Operator Action Protection Layer and Risk Reduction... 

From Clause 2.2 it is seen that operator action plays an important role both in protection layer and in risk reduction. Fdence this has direct influence on PFD and therefore SIL. In this clause this will be briefly discussed. 

Note that management system and standard operating procedures cannot be claimed as a protection layer in their own right. On their own, procedures do not meet the requirement of effectiveness for a protection layer because they cannot identify a hazard or perform an action. Instead, procedures are incorporated in the performance claimed for a protection layer because they define requirements for the conduct of activities and therefore are included implicitly rather than explicitly within the analysis. 

In hazardous industries, human actions may determine whether a major accident can be avoided or not. In this Section, we will look closer into the role of the operators in the control of major accidents. We have in Chapter 7 identified the different barriers applied in the prevention of fires and explosions in a plant for processing of hydrocarbons. They represent an engineering solution, based on the defences-in-depth philosophy. The idea is to minimise the system s vulnerability to human and technical errors by providing independent and diverse layers of protection. Whereas the operator has a distinct role in maintaining production, the safety systems will take over in cases where the system transgresses certain defined limits. There are many examples, however, where these different barriers are dependent on and vulnerable to operator actions. 

The final protection layer is the safety shutdown system in which automatic and independent action is taken by the shutdown system to protect the personnel and plant equipment against potentially serious harm. The essence of a shutdown system is that it is able to take direct action and does not require a response from an operator. 

Once the evidence has heen collected and a timeline or sequence diagram developed, the next phase of the investigation involves identifying the causal factors. These causal factors are the negative occurrences and actions that made a major contrihution to the incident. Causal factors involve human errors and equipment failures that led to the incident, hut can also he undesirable conditions, failed harriers (layers of protection, such as process controls or operating procedures), and energy flows. Causal factors point to the key areas that need to he examined to determine what caused that factor to exist. 

Leading metrics are forward-looking and indicate the performance of the key work processes, operating discipline, or layers of protection that prevent incidents. They are designed to give an early indication of problems or deterioration in key safety systems early enough that corrective actions may be taken to avoid a major process safety incident. 

In situations where the SIS is the only layer of protection and is used for a safety function operating in the continuous mode of operation, then the diagnostic test interval will need to be such that faults in the SIS are detected in time to ensure the integrity of the SIS and to allow action to be taken to ensure a safe state in the event of a failure occurring in the process or the basic process control system. 

---