How to manage two control loops as safety when BPCS is shared?

Question

I am trying to wrap my head around some excerpts from:

• CCPS Layer of Protection Analysis
• CCPS Guidelines for Independent Protection Layers and Initiating Events
• IEC 61511

I am trying to understand how to apply Approach B and use two functions in the BPCS (e.g. a control loop and an alarm) as independent Protection Layers (IPLs) in a LOPA, when the CPU is shared.Guidelines are very vague about it.

What parameters should be looked at, to decide to apply Approach B?

Note: I understand that, if the guidelines are not clear to me, I should not apply Approach B. The request comes from a client who is trying to consider as many safeguards as possible before having to update their BPCS and SIS.

Answer 1

You are allowed to claim 2 BPCS IPL's but not from the same BPCS, eg you will need a PLC and a DCS with an IPL in each to claim both of them, plus they must be adequately independent.

Additionally, you will be capped at a RRF of 10 for each, giving 100 for both, but that could be the difference between a SIL 3 SIF and a SIL 1 SIF in the SIS, potentially.

Answer 2

ok, I just notice your reply, probably too late but, LOPA requires full independance, so for any given unwanted event you sort of get to claim one thing per logic solver, is one way of looking at it I have endured.

You can argue modern logic solvers contribute so little to overall failure rate that as long as the instruments and final elements re not shared then indpendance is adequate.

If you have some shared aspects, then you need to apply a more quantitative assessment to understand your overlap on common cause failure, popular method is fault tree analysis.

Make sure not to fall into the "an instrument is a SIF" trap - while some SIF's have only one instrument, it does not mean every instrument is a SIF on it's own neccesarily, SIFs are based around detection of process conditions, which may be by one or more instruments.