(75b) Using IE and IPL Failure Rates to Establish Maximum out of Service Time and Deferral Time Limits for Critical Process Safety Features

Since the publication in the textbook on LOPA in 2001 and its subsequent wide acceptance, and subsequently the publication of Guidelines for Initiating Events and Independent Protection Layers in 2015, a great many companies have begun to maintain the components related to initiating events (IEs) and independent protection layers (IPLs) more rigorously. The inspection frequencies have been set from either plant experience or from the industry advice given in the 2015 textbook. The premise is that following this inspection, test, or prevent maintenance (ITPM) approaches and time / interval should reasonably ensure the average initiating event frequency (IEF) or probability of failure on demand (PFD), respectively, are sustained. But what if the IEs or IPL must be out of service for repair to testing / inspection? Or what if there is valid need to defer the scheduled ITPM listed for that LOPA factors? Is there industry data on how to manage the duration and the control the risk during these bypasses or deferrals?

This paper presents a standardized approach for determining the maximum time allowable for bypasses and deferrals, based on when the initiating frequency or the probability of failure on demand changes enough to make a statistically significant change to the stated IEF or PFD of the IE or IPL respectively. Bypasses and deferrals should of course be strongly discouraged as a matter of operational discipline and to foster good process safety culture, but the approach in this paper serves to reduce the uncertainty in the risk judgements of what is the maximum time allowable for a bypass or deferral before a statistically significant change in the risk of the scenario occurs. This can in turn reduce the number or time spent on the related risk assessments (miniature PHAs) for an associated Management of Change.