SIS Trip Left Bypassed for Nineteen Days

Required risk reduction

RRF_required = initiating frequency / tolerable frequency = 0.1 / 1e-3 = 100

Credit available

The SIS trip at PFD = 0.01 provides RRF = 1/0.01 = 100. It exactly meets the target - but it is the only credited layer, so there is zero margin, and the relief valve cannot be counted for this scenario (fire-only sizing).

During the 19-day bypass

RRF = 1, so the mitigated frequency equals the initiating frequency: 0.1/yr - 100 times the tolerable frequency.

Expected frequency during the bypass window = 0.1 × 19/365 ≈ 5 × 10⁻³, i.e. roughly a 1-in-200 chance of the consequence event in those 19 days. For a fatality-plus-major-damage consequence that is not a tolerable exposure, and no amount of shift-log notation changes the number.

Design adequacy note: meeting a target exactly with a single layer is fragile. Any degradation - plugged tap, failed solenoid, partial stroke fault - puts the site instantly over the target. A second independent layer should be considered even with the trip in service.

What should have happened

The bypass needs a formal management-of-change approval: hazard re-assessment, defined compensating measures, a time limit, an owner, and shift-level communication - not a logbook entry. Done properly, engineering would likely conclude the bypass should not have been granted for 19 days, or at all, without a shutdown of the feed or a reduction of inventory.

Can compensating measures close a 100× gap?

Roughly, no - but quantify it:

• A trained operator responding to a tested high-pressure alarm with >10 min to act, independent of the failed transmitter, is typically credited at PFD ≈ 0.1 → RRF 10.
• That leaves residual frequency 0.1/10 = 1e-2/yr, still 10× above the 1e-3 target.
• Adding a second independent measure (e.g. a hard-wired pressure switch trip plus a written procedure) would be needed just to approach the original credit.

So the defensible compensating measures are operational ones that remove the hazard, not administrative ones that watch it:

1. Reduce drum inventory and feed rate to lower the consequence severity and the initiating frequency.
2. Maintain continuous local monitoring with a dedicated independent pressure indication, backed by a temporary independent high-pressure trip.
3. Fix the impulse line - this is a days-scale repair, not a turnaround-scale one - or install a temporary diaphragm-seal transmitter.

If none of those can be done, the honest answer is to shut down or de-inventory the drum.

Proof-test interval

PFD_avg ≈ λDU × TI / 2. Solve for the interval that keeps PFD_avg ≤ 0.01.

If the transmitter and logic are assumed to contribute λDU ≈ 2 × 10⁻⁶/h:

TI ≤ 2 × 0.01 / (2 × 10⁻⁶) = 10,000 h ≈ 14 months

At the common 12-month interval (8,760 h): PFD_avg ≈ 2e-6 × 8760 / 2 = 0.0088, which is acceptable. Note that this assumes the proof test actually verifies the sensing path - a partial-stroke or logic-only test does not detect a plugged impulse line, and undetected plugging defeats the calculation entirely.

Design changes to reduce recurrence

1. Use a diaphragm seal or a direct-mount transmitter where the process is prone to plugging; eliminate the long small-bore impulse line.
2. Increase tap and line size and slope the line so it self-drains; add a rod-out/root valve for cleaning.
3. Heat trace / insulate if polymerization or condensation is the plugging mechanism.
4. Add diagnostics: a plugged-line detection feature on the transmitter, and a periodic comparison of the SIS pressure reading against the BPCS transmitter - a divergence beyond a set threshold raises a maintenance alarm instead of silently disabling the trip.
5. Proof-test procedure must include verifying the tap is clear and recording the as-found impulse-line condition; add 'plugged tap' to the failure-mode list in the SIS assessment so its detection is engineered rather than assumed.