16.3 LOPA, IPLs, and SIF Identification
Key Takeaways
- Spec 5.B allocation uses LOPA, IPL requirements, and SIF identification to decide which protection layers are credited and whether a SIF is needed.
- An IPL must be independent of the initiating event and of other credited layers, effective for that specific scenario, and auditable.
- A SIF is one instrumented detect–decide–act function; an SIS implements one or more SIFs; a BPCS performs basic process control and is not automatically a SIF.
- In a teaching LOPA, mitigated frequency equals initiating frequency times the product of credited IPL PFDs; compare that result to a clearly labeled example tolerable frequency.
- Typical IPL PFD order-of-magnitude values used in LOPA teaching examples are not NCEES-published criteria.
The second half of spec 5.B is allocation of safety functions to protection layers. The spec’s examples are safety layer matrix, risk graph, LOPA, QRA, IPL requirements, identification of SIFs, and the purpose and outcomes of that work. After hazard identification, the question is no longer “what can go wrong?” It is “which independent layers already reduce this scenario, and is an instrumented safety function still required?”
Purpose. Allocate the required risk reduction so that no single layer is asked to do everyone else’s job, and so that any instrumented safety function is identified before an SRS is written. Outcome. A documented set of credited independent protection layers (IPLs) for each scenario, plus a list of SIFs with the additional integrity they must provide. That list is the input to the SRS. Allocation that ends with “buy SIL 2 transmitters” has skipped the outcome.
SIF versus SIS versus BPCS
Keep the three names separate on every 5.B item.
A SIF is one instrumented function: specific sensors, logic, and final elements that detect a specific hazardous condition and drive a specified safe state within the process safety time. “Close XV-101 and XV-102 on high pressure at PZT-101/102/103 2oo3” is a SIF. “The plant SIS” is not a SIF.
An SIS is the instrumented system that implements one or more SIFs—sensors, logic solver, final elements, and support systems designed and managed to the allocated integrity. Several SIFs may share a logic solver; they remain separate functions with separate SRS entries.
A basic process control system (BPCS) regulates normal operation: PID pressure control, level control, throughput. It is not a SIF by renaming the cabinet. A BPCS loop can sometimes be credited as an IPL for a scenario whose initiator is not that loop, if independence, effectiveness, and auditability hold. Converting BPCS control into a SIF means moving that function into the SIS lifecycle, not attaching a SIL label to a DCS faceplate.
IPL requirements: independence, effectiveness, auditability
An IPL is a safeguard you are willing to multiply into the risk arithmetic. Spec 5.B lists IPL requirements because not every existing safeguard on a HAZOP worksheet survives that test.
Independence. The layer must be independent of the initiating event and of other credited IPLs. Shared sensors, shared logic, shared final elements, shared utilities, or the same operator action counted twice all break independence. If BPCS PIC-101 failure starts the overpressure scenario, PIC-101 is the initiator, not an IPL. An alarm that uses PIC-101’s transmitter is not independent of that initiator.
Effectiveness. The layer must be able to prevent the specific consequence, in time, with enough capacity. A dike does not stop a vapor rupture. A PSV that is not sized for the blocked-outlet case is not effective for that case. An operator response is not effective if process safety time is shorter than the time to detect, decide, and act, or if the indication is unclear.
Auditability. Someone other than the original analyst must be able to find the design basis, inspection or test evidence, and operating procedure. A “the operator will notice” layer with no independent alarm, no written response, and no drill record is not auditable. Unauditable layers do not get a PFD in LOPA.
When those three tests pass, the layer may be credited. When they fail, keep it on the HAZOP as a safeguard if you wish, but do not multiply it into the allocation.
LOPA arithmetic and SIF identification
Layer of protection analysis takes one initiating event and one consequence from the hazard study and writes an order-of-magnitude frequency balance:
mitigated frequency ≈ initiating frequency × (PFD of IPL 1) × (PFD of IPL 2) × …
Compare that mitigated frequency with a tolerable frequency for that consequence class. If mitigated frequency is still too high, the gap is additional risk reduction. If that gap is assigned to instrumented protection, you have identified a SIF and the order of magnitude of its required average probability of failure on demand (PFD). That PFD band is what later becomes a SIL target in the SRS. LOPA does not design the loop; it decides whether a SIF exists and how much integrity allocation it must carry.
Enabling conditions and conditional modifiers appear in some LOPA procedures. For exam working, do not invent extra factors the stem does not give. Multiply the frequencies and PFDs that are stated, and state that the tolerable frequency you use is an example, not a legal corporate or NCEES criterion.
Worked numeric example (labeled teaching numbers)
Scenario: V-101 overpressure to rupture, taken from the HAZOP node in the previous section.
- Initiating event: BPCS PIC-101 fails, fuel-gas valve travels open. Example frequency 1.0×10⁻¹ per year.
- Do not credit PIC-101 as an IPL—it is the initiator.
- IPL 1 (if independent): operator response to a high-pressure alarm on a separate transmitter, with time and a written action. Example PFD 1.0×10⁻¹.
- IPL 2: PSV-101 sized and tested for this relief case. Example PFD 1.0×10⁻².
- Example tolerable frequency for this consequence class: 1.0×10⁻⁵ per year. This is a teaching number, not a legal corporate criterion and not an NCEES-published value.
Mitigated frequency = (1.0×10⁻¹) × (1.0×10⁻¹) × (1.0×10⁻²) = 1.0×10⁻⁴ per year.
That result is ten times the example tolerable frequency. The additional PFD needed from a new IPL is about 1.0×10⁻¹, which is the order of magnitude of a SIL 1 SIF in low-demand service. Identification outcome: SIF-101 “isolate fuel gas to V-101 on high pressure,” allocated at that integrity band, with an SRS still to write.
Wrong credit, same numbers. If the analyst also multiplies a PFD of 1.0×10⁻¹ for PIC-101, mitigated frequency appears to be 1.0×10⁻⁵ and the SIF “disappears.” That is the independence trap from 16.2, now visible in arithmetic. The exam will offer that fake tenth. Do not take it.
Low-demand SIL bands themselves are order-of-magnitude PFDavg ranges in the supplied ISA/IEC 61511 standard (SIL 1 around 10⁻² to 10⁻¹, SIL 2 around 10⁻³ to 10⁻², SIL 3 around 10⁻⁴ to 10⁻³). Use those bands to translate a LOPA gap into a SIF integrity target. Do not treat typical IPL screening PFDs as if NCEES printed them in the spec.
| IPL (teaching illustration only — not NCEES-published values) | Typical PFD order of magnitude |
|---|---|
| BPCS control loop, only if independent of the initiator and auditable | 10⁻¹ |
| Operator response to alarm, with time, indication, and procedure | 10⁻¹ |
| Spring-loaded PSV in the specific relief case, inspected and tested | 10⁻² |
| Passive liquid containment (dike) for a liquid-release scenario | 10⁻² |
| SIF claimed at SIL 1 (standard low-demand band) | 10⁻¹ to 10⁻² |
| SIF claimed at SIL 2 (standard low-demand band) | 10⁻² to 10⁻³ |
| SIF claimed at SIL 3 (standard low-demand band) | 10⁻³ to 10⁻⁴ |
A LOPA uses these labeled example numbers, not a legal corporate criterion: initiating frequency 1.0×10⁻¹ per year, credited independent alarm-and-operator IPL PFD 1.0×10⁻¹, credited PSV PFD 1.0×10⁻², example tolerable frequency 1.0×10⁻⁵ per year. The BPCS loop that failed is not credited. What additional SIF PFD is needed, to an order of magnitude, to meet the example criterion?
Which statement correctly distinguishes a SIF, an SIS, and a BPCS?