Safety instrumented system responsibilities

The organizational structure associated with safety instrumented systems within a Company/Site/Plant/Project should be defined and the roles and responsibilities of each element clearly understood and communicated. Within the structure, individual roles, including their description and purpose should be identified. For each role, unambiguous accountabilities should be identified and specific responsibilities should be recognised. In addition, whom the individual reports to and who makes the appointment should be identified. The intent is to ensure that everyone in an organization understands their role and responsibilities for safety instrumented systems. 

Which measurements need to be taken to detect the onset of the hazardous conditions. A simple example could be that a pressure rise above a specified vaiue needs to be detected. The value of the parameter at which action shouid be taken wiii need to be outside the normal operating range and less than the value that will result in the hazardous condition. An allowance will need to be made for the response of the system and the accuracy of measurement. In setting the limit, there will therefore need to be a discussion with those responsible for the safety instrumentation system design and implementation. 

The response to emergency situations is often controlled by the Safety Instrumentation System and its associated Safety Integrity Levels (SILs). 

Alarms with defined operator response Critical alarms Safety instrumented systems Pressure relief devices Blast walls and dikes Deluge systems Flare systems... 

The lEC 61508 safety lifecycle prescribes that planning for all maintenance testing and maintenance activities must be accomplished in the realization phase. To a certain extent this work can proceed in parallel with safety instrumented system design. This lifecycle diagram also shows that operation and maintenance responsibilities focus on periodic testing and inspection as well as management of modifications, retrofits, and eventual decommissioning. 

Where the above actions depend on an operator taking specific actions in response to an alarm (for example, opening or closing a valve), then the alarm shall be considered part of the safety instrumented system (i.e., independent of the BPCS). 

PHA methods. Even from each of the PHA types there could be variety of results that is dependent on the outcome. These results could be just a list of hazards or accidents they could be a detailed list with priority of action or input for a further study of safety instrumentation systems with alternatives or input for a QRA. As all methods are not capable of providing all kinds of results it will be the responsibility of team leader and the team to decide on the issue. From the discussions in Clause 1.2 almost all PHA is capable of giving a list of hazards and recommendations for mitigation. If, however, further detailing such as prioritization of risk or quantitative analysis is necessary then the team needs to opt for ETA, ETA, etc. 

Final element This represents that part of a safety instrumented system which is responsible for implementation of the physical action necessary to achieve a safe state. 

Part 1 of 61511 describes the typical layers of risk reduction (namely control and monitoring, prevention, mitigation, plant emergency response, and community emergency response). All of these should he considered as means of reducing risk and their contributing factors need to be considered in deriving the safety requirement for any safety instrumented system, which form part of the PREVENTION layer. 

This replaces the former UKOOA document Guidelines for Process Control and Safety Systems on Offshore Installations. It was prepared by representatives of EIC, EEMUA, Oil and Gas UK (formerly UKOOA) and HSE and addresses the responsibility and deliverables of organizations involved in the specification, supply, and maintenance of Safety Instrumented Systems. 

The visualization system should not only show the integrity status of technical parts of the SCE/ SBS, but contain the names and duties of responsible personnel in the case of abnormal process conditions. Specific human activities are seen as operational barriers and as an integral part of the safety system. Automatic systems such as Safety Instrumented Systems (SIS) are an exception and may be seen as an SBS without an operational barrier element. The proposed concept of the visualization system is based on the generic accident model shown in Figure 1 and separates SCS and SBS (Fig. 10). 

As has already been stressed, some of the systems such as safety instrumented systems that are installed to handle normal risk may not be as effective in response to a malicious attack. However, other devices such as excess flow valves (see Chapter 13) could be particularly helpful, regardless of the source of the event. 

The simplicity of the GT-MHR is reflected in its instrumentation systems Total visibility of plant conditions, and all control and protection actions are provided with a relatively low number of instrumentation channels. Clear and concise operator information is provided. The passive safety of the reactor, its slow response, and the neutronic transparency and the absence of phase changes in the gas coolant eliminate many of the human factors complications found in other reactors. 

An operator-initiated SIF is often associated with a never exoeed never deviate alarm, where the operator is expected to mitigate risk in much the same manner as an automated SIF. Operator-Initiated SIFs are generally used when it is not possible to completely automate the function. The manually initiated action is typically comprised of the sensor detecting the hazardous condition, the logic solver that determines that the safety condition exists, alarm presentation, human response, and the equipment used by the operator to bring the process to a safe state. When risk reduction is taken for an operator-initiated SIF, the PFDavg should be determined for the instrumented system. This is discussed further in B.6. 

One of the most important lessons learned was the reaction of the Exxon Mobil company. Their management recognized that the causes went well beyond a single officer who had had too much to drink, or failure to maintain critical instrumentation. A fundamental rethink of safety management systems was needed. The company did go through this rethinking process and the results can be seen with respect to their response to the Blackbeard event, discussed in the next section. 

Demand mode SIF Demand mode safety instrumented function (SIF) where a specified action is taken in response to process conditions or other demands. In the event of a dangerous failure of SIF, a potential hazard only occurs in the event of a failure in the process or the basic plant control system. 

On this tank, the LAFIFI includes a trip function to terminate the transfer. For a well-designed and maintained safety instrumented protective system, a response time of two minutes between activation and complete cessation of flow into the tank is claimed. This includes the time needed to take urgent action in case the trip action is not successful - in this case to immediately close another remotely operated valve, readily accessible in the control room (the system having been designed for this emergency closure). 

On November 26, 1993, the USNRC issued Information Notice 93-89, "Potential Problems witii BWR Level Instrumentation Backfill Modifications," to alert licensees to potential problems that have been identified involving hardware modifications to the reactor vessel water level instrumentation system. This information involved the potential to pressurize the reference legs of the water level instrumentation if a backfill system is installed with the injection point on the instrumentation side of the manual isolation valve in the reference leg. If that valve is closed inadvertently during backfill system operation, the closure could result in a severe plant transient. At some plants, valve closure would cause all safety relief valves to open and potentially impact ECCS response. Licensees were advised to review the information for applicability to their facilities and consider actions, as appropriate, to avoid similar problems. 

A more expensive alternative is to use standard AutoAnalyser type systems, based on multichannel peristaltic pumps, to pump samples and reagents and/or diluents at the desired rates to give automatic mixing at the desired ratio. Flame photometric detectors have been used for many years with AutoAnalysers, especially in clinical laboratories. Curiously, in the past, this approach has less often been routinely used in environmental analytical laboratories employing flame spectrometry, perhaps because an attractive feature of flame spectrometry is the speed of response when used conventionally. Over the past few years, however, there has been an increasing tendency towards fully automated, unattended operation of flame spectrometers. This undoubtedly reflects, at least in part, the improvements in safety features in modern instruments, which often incorporate a comprehensive selection of fail-safe devices. It also reflects the impact of microprocessor control systems, which have greatly facilitated automation of periodic recalibration. 

---