Understanding IPL boundaries. Issue 2 (25th November 2018)

• Record Type: Journal Article
• Authors: Dowell, Art M.
• Is Part Of: Process safety progress. Volume 38:Issue 2(2019)
• Page Start: n/a
• Page End: n/a
• Publication Date: 2018-11-25
• Subjects: LOPA -- IPLs -- boundaries -- relief valve -- dike -- alarm -- deflagration arrester; Chemical plants -- Management -- Periodicals; 660
• DOI: 10.1002/prs.12019
• Languages: English
• ISSNs: 1066-8527

Abstract

Abstract : Layer of protection analysis (LOPA) is a simplified risk assessment tool that has been in use for almost three decades. The technique has improved the focus on independent protection layers (IPLs) that can prevent the progression of an initiating cause to an undesired consequence (a scenario). An IPL must be capable of preventing the scenario from reaching the consequence. To execute the simplified LOPA approach, the IPL must be independent of the initiating cause and other IPLs. A potential pitfall in LOPA and in the management of IPLs identified in LOPA is misunderstanding the boundary of the IPL. For example, a pressure relief valve (PRV) is intended as an IPL to prevent the consequence of catastrophic rupture of the vessel with potential for fatality. In reality, for the PRV to prevent vessel rupture, the inlet piping from the vessel to the relief valve and the outlet piping from the relief valve to the ultimate destination must provide sufficient flow capability. The IPL boundary must include any block valves in the inlet and outlet piping, and any devices such as flame arrestors or back pressure controllers. The probability of failure on demand (PFD) must include everything in the expanded IPL boundary. If the IPL boundaries are not correctly understood, the LOPA is not correct and the organization is deluding itself on the risk reduction. In addition to being independent and effective in preventing the consequence, an IPL must also be auditable. If an IPL boundary does not include all the components to make the IPL effective, the audit (inspection and testing) program will be incomplete. The PFD of the excluded—but needed—components will be higher than the PFD of the same components that are audited. Narrow IPL boundaries give two problems in calculating the correct PFD: (1) Needed components are not included in the PFD calculation, and (2) The actual PFD of excluded components is higher than it would be if the components were inspected. The article provides examples and illustrations for several types of IPLs: safety instrumented functions, dikes, relief device with fire‐resistant insulation and cladding on the vessel, operator response to alarm, and deflagration arrester. The article includes diagrams to illustrate the concepts. © 2018 American Institute of Chemical Engineers Process Saf Prog 38: e12019, 2019