You must assess the independence of the safeguards to determine if the safeguard can be qualified as an IPL. You must create one Safeguard for each layer of protection that exists. In the IPL Checklist section of the Safeguards and IPLs workspace, a set of criteria appear as questions. To be classified as an IPL, a Safeguard must meet all the criteria listed in the IPL Checklist section. These criteria can be modified in the administrative settings for LOPA.
By default, the following criteria are defined for the IPL Checklist and are required to be true for a safeguard to be considered as an independent protection layer:
The safeguard must be independent of the initiating event such that a failure associated with the risk will not cause the safeguard to fail.
The safeguard must be testable and verifiable using an industry standard (e.g., a risk based inspection).
The safeguard must be specific in detecting a potential hazard and taking action to prevent the hazard from occurring.
The safeguard must be capable and available at least 90 percent of the time.
The safeguard must increase the Risk Reduction Factor (RRF) of the LOPA to a value greater than or equal to 10.
To determine if a Safeguard is an IPL, you must select the criteria that are true for the Safeguard. If all the criteria are true for a Safeguard, the Safeguard is classified as an IPL. The IPL Type field, IPL Sub Type field, and PFD field are enabled. When you select the IPL Type and the IPL Sub Type, the corresponding PFD value for the IPL is automatically populated.
When the IPL is saved, the Total IPL PFD field in the LOPA is updated with the calculated PFD value. If there are more than one IPLs for the same LOPA, then the Total IPL PFD is calculated by multiplying the values in the PFD fields of each Safeguard associated with the LOPA. These values also modify the unmitigated and mitigated consequence frequency values in the LOPA.
Suppose that in a hazardous scenario a high pressure separator releases liquid to downstream equipment. If the liquid level in the high pressure separator decreases to a certain level, pressure could be released to downstream equipment and cause it to rupture. In this scenario, a controller monitors the liquid level. If the level gets too low, the controller closes a valve so that the pressure is not released to downstream equipment.
The low level alarm is an independent layer of protection for this scenario because it meets all of the following criteria:
The safeguard is independent because if the first controller fails, the low level alarm has independent process connections and independent BPCS hardware from the failed controller.
The safeguard is auditable because the low level alarm can be routinely inspected.
The safeguard is capable because it is available at least 90 percent of the time.
The safeguard is specific because the alarm detects potential hazards by measuring the liquid level and will alert the operator when the potential failure is detected.
The low level alarm coupled with an operator response can reduce the risk associated with the hazards scenario and can be considered an IPL.
For the above example, in GE Digital APM, the following IPL related information would be stored in the record for the low level alarm Safeguard:
