Overfill LOPA With a Shared Impulse Line
A toluene storage tank at a distribution terminal is protected against overfill by a SIL 1 safety instrumented function: a high-level switch trips the inlet valve. The LOPA team credits the BPCS level controller as an IPL (PFD 0.1), an operator response to a high-level alarm on the same transmitter (PFD 0.1), and the SIS (PFD 1E-2). The initiating event is a failed fill-line regulator, frequency 0.1/year. Consequence is a tank-top fire with an estimated 0.2 fatality; the individual risk target is 1E-5/year. During design review it emerges that the SIS high-level switch and the BPCS transmitter are mounted on the same nozzle and share a single impulse line; the operator alarm uses the same transmitter. The project manager says the LOPA is already approved and asks you to sign the SIL 1 verification. The tank also has a bund and a remote-operated isolation valve, but the valve is not credited because its actuator is unreliable.
1. Recalculate the LOPA with correct independence and determine the required SIL. Show the arithmetic.
Read the worked answer
The BPCS controller and the operator alarm cannot be credited as independent protection layers. Both depend on the same transmitter and impulse line as the SIS high-level switch, so a common-cause failure such as a plugged impulse line, a nozzle blockage or a transmitter drift defeats all three. The BPCS is also not independent of the initiating event if it is the normal fill control. With those credits removed, the only remaining layer is the SIS at PFD 1E-2.
Mitigated event frequency = 0.1/year × 1E-2 = 1E-3/year. Individual risk = 1E-3/year × 0.2 fatality = 2E-4/year, which is twenty times the target of 1E-5/year. The required PFD is: target risk / (initiating frequency × consequence) = 1E-5 / (0.1 × 0.2) = 5E-4. A PFD of 5E-4 lies in the SIL 3 band (1E-4 to 1E-3). Therefore the existing SIL 1 claim is not valid; the function needs SIL 3, or additional genuinely independent protection layers, or a change in the initiating event or consequence assumptions.
I would not sign the SIL 1 verification. The approved LOPA is invalid because it credited non-independent layers.
2. What design changes would you evaluate to restore independence, and what evidence is needed?
Read the worked answer
I would evaluate a separate nozzle and impulse line for the SIS, with a different transmitter technology if practicable, so that the SIS does not share a common cause with the BPCS and the operator alarm. A hard-wired independent high-level switch on a separate nozzle is an option, but it still needs proof testing and common-cause review. If the operator alarm is retained as an IPL, it must be based on an independent sensor and have a validated operator response time, written procedure and competence evidence. A 2oo3 voting arrangement may improve availability but does not by itself solve common cause if all channels share one impulse line.
The remote-operated isolation valve is currently not credited because its actuator is unreliable. It could become an IPL if it is made sufficiently dependable, proof-tested, independent of the fill-line regulator and capable of closing against the maximum flow. The bund is mitigation, not prevention, and should not be credited as an IPL for overfill frequency.
Evidence needed: revised LOPA with IPL independence, specificity, dependability and auditability justified; common-cause beta analysis; proof-test procedures; response-time validation; MOC records; and revalidation of the SIS safety requirements.
3. The project manager argues the approved LOPA is binding. How do you respond?
Read the worked answer
An approved LOPA is a record of the assumptions at the time of approval, not a binding waiver of engineering judgment. New information that an IPL shares a sensor and impulse line with the SIS invalidates the independence credit. Continuing to rely on it would make the risk assessment knowingly wrong.
I would raise an MOC, document the technical basis for revisiting the LOPA, and escalate to the functional safety manager and the process safety authority. The LOPA must be revised before the SIL verification is signed. If production continues in the interim, the gap must be managed as a temporary risk with compensating measures and a time limit, not treated as acceptable because the document was approved. The decision and its rationale should be recorded so the assessor can see that the organization corrected the assumption rather than defended it.