Home

Products

Solutions

Support

Contact Us

About Us

Philosophy
History
Clients
Partners
Resources
News
Newsletters
January 2006 -
February 2006 -
March 2006 -
April 2006 -
May 2006 -
June 2006 -
July 2006 -
August 2006 -
September 2006 -
October 2006 -
November 2006 -
December 2006 -
January 2007 -
February 2007 -
March 2007 -
April 2007 -
May 2007 -
June 2007 -
July 2007 -
August 2007 -
September 2007 -
October 2007 -
November 2007 -
December 2007 -
Subscribe -

Event Calendar
Careers
Privacy Policy

About Us

 

 

<- BACK to Newsletters Home

TiPS Newsletter - April 2006


The Operator as IPL


Following is an abstract of a paper recently written by Ian Nimmo, President of User Centered Design Services. You can access the full paper below. Read and post your feedback at www.alarmmanagement.com:

Plant designers endeavor to minimize risk using multiple independent protection layers (IPLs). The first layer is the process design and involves special designs, layouts, equipment, and management systems such as procedures and training. The second layer focuses on higher reliability and greater consequences in the event of failure of the basic process control system (BPCS), together with critical alarms, operator supervision, and manual intervention. The next layer has even higher reliability but should require no operator intervention: the automatic SIS. Other layers exist but they are generally physical, such as relief valves and containment dykes.

In recent years, operator supervision has declined and become more of an administrative function, while alarms have become an Achilles heel to this protective layer. Emphasis is placed elsewhere as engineers are more comfortable designing the physical or automated SIS layers. AIChE CPPS Guidelines state that 'the BCPS...fails the test of specificity...should not be considered an IPL'. If the BPCS is not considered an IPL, the supervisor is not supervising, and the alarms are not functioning as designed, then the IPL must be left to operator intervention. This is highly variable due to the reliability of people and the factors that impact human performance.

Poor design, gaps in supervision, undetected manufacturing defects or failures, unworkable procedures, clumsy automation, shortfalls in training, and less than adequate tools and equipment may be present for many years before they combine with local circumstances and active failures to penetrate the many layers of defense. Hence, people live with many of these conditions and suffer the consequences. Why?

How do you feel about the operator being considered an IPL?

Read the entire article here

Post your feedback here

What's Inside

The Operator as IPL