Using LOPA for Sil Assignment: A Tale of Two Plants

Two plants operated by the same company have “identical” ammonium nitrate (AN) solution pump installations. Yet the LOPA teams concluded that the safety instrumented functions to protect those pumps needed different safety integrity levels (SILs). Despite the similarity of the installations, the teams discovered legitimate differences that warranted different conclusions about what SIL assignment should be. For those with a specific interest in AN, this paper reviews the consequences of AN pump hazards, their initiating causes, and the types of independent layers of protection (IPL) that can be brought to bear. Of more general interest will be the discussion of the impact of risk tolerance criteria, frequency modifiers, and IPLs on final SIL assignment, and why dictating a fixed SIL assignment to certain types of hazards or installations is inappropriate, especially in the development of industry standards or government regulations.