In the last five years a US refinery experienced the devastating effects caused by placing a demandon a safety function while simultaneously inhibiting the safety function at the same time. Thescenario occurred as follows:1.
The insulation bag around flow transmitter FT-101 becomes displaced and fails to provide properinsulation2.
Flow transmitter FT-101 taps freeze, also freezing the process variable3.
FIC-101 set point is lowered4.
FIC-101 closes FV-101 in an attempt to lower the process variable5.
FT-101 and FSLL-101 fail to sense the low flow condition because the process variable is frozen inplace (literally), and in turn fail to close fuel gas valve XV-1026.
Heater-101 pass tubes overheat and rupture causing a large fire and total destruction of theheaterThe elimination of single failures that can disable multiple protection layers has lead to manydiscussions about separation. This reasoning has been a leading factor in the separation of the SISfrom the BPCS. Responsible designers and governing bodies have made standards that enforce thisseparation.