(55aw) Applicability of LOPA Summation on Scenarios with Multiple Bpcs Failure

There are different ways to estimate the LOPA (Layer of Protection Analysis) gap, one of the common approaches is to sum up the causes if the IPL (Independent Protection Layer) involves SIF (Safety Instrumented Function), to help identify the required reliability of the SIF safeguard. However, for some of the more complex scenarios where multiple initiating causes would lead to the same consequence, the summation of all initiating causes may sometimes lead to unrealistic total ICF (initiating cause frequency), subsequently leading to potentially high demand mode on the relevant SIFs. For example, for complex scenarios with many BPCS (Basic Process Control System) failure causes, industry experience confirms that sensor and the final element has much higher failure rate than the logic solver. The failure of the logic solver is at least two order of magnitude lesser than the sensor and final element - which means that the logic solver remains operational in 99 out of 100 cases of BPCS loop failure. Hence where BPCS loops are using the same logic solver, it may be justified to relax the conservative rule of summing up all the BPCS loop failure for a scenario.

This study aims to compare the LOPA gaps between the different methodologies: (1) the more typical summing of all causes and (2) using FTA (Fault Tree Analysis) to take into account of common mode failure (i.e. logic solver), using multiple BPCS failures as potential initiating causes. By conducting sensitivity studies using different numbers of initiating BPCS causes, the study draws conclusions on the optimum number of BPCS failures to be summed up before the estimated total ICF becomes unreasonable.