Frequency

Consideration Rel. High Slight Very Slight

Business SH&E W3 W2 W1

Potential for off-

site impact or
Corporate/Site
Major on site
C4 HIGH SIGNIFICANT MODERATE
(including fatality)

Major on plant

Consequence
Factory impact (incl. C3
Serious injury)

Serious on-plant
Unit impact (including C2
MTI)

Other
Minor on-plant
impact
C1 LOW

CIPS - Critical
NEGLIGIBLE

Instrument Protection
System
and what it means to me

David Hind Orica Carseland Works 1

 Introduction

What is CIPS?


What Effect Will it Have?

David Hind Orica Carseland Works 2

 What is CIPS

Critical

Last Resort

Must Work

Instrument

Involves valves, switches, transmitters, etc.

Protection

Security

Safety

System

Not just one thing, but many things.

David Hind Orica Carseland Works 3

 What's Critical

Hazop Process

Identifies hazards & risks

Sets risk targets


CIPS Review

Defines how bad it could be

Consequence/frequency

Defines level of protection required

David Hind Orica Carseland Works 4

 Example : AN Pumping System

90% AN
Tank
PUMP

David Hind Orica Carseland Works 5

 Example : AN Pumping System

90% AN
Tank
PUMP

Are there any hazards????

David Hind Orica Carseland Works 6

 CIPS Decision Matrix
Frequency
Consideration Rel. High Slight Very Slight
Business SH&E W3 W2 W1

Potential for off-

site impact or
Corporate/Site C4 HIGH SIGNIFICANT MODERATE
Major on site
(including fatality)

Major on plant
Consequence

Factory impact (incl. C3

Serious injury)

Serious on-plant
Unit impact (including C2
MTI)

Minor on-plant
Other
impact
C1 LOW NEGLIGIBLE

David Hind Orica Carseland Works 7

 High Risk

Eliminate the risk mechanically

Fault Tree Analysis

Hard Wired

Safety PLC (Quadlog/Triconics)
Frequency
Consideration Rel. High Slight Very Slight
Business SH&E W3 W2 W1

Potential for off-

site impact or
Corporate/Site
Major on site
C4 HIGH SIGNIFICANT MODERATE
(including fatality)

Major on plant
Consequence

Factory impact (incl. C3

Serious injury)

Serious on-plant
Unit impact (including C2
MTI)

Minor on-plant
Other
impact
C1 LOW NEGLIGIBLE

David Hind Orica Carseland Works 8

 Significant Risk

Loop Analysis

FDT Calculations

Hard Wired

Safety PLC (Quadlog/Triconics)
Frequency
Consideration Rel. High Slight Very Slight
Business SH&E W3 W2 W1

Potential for off-

site impact or
Corporate/Site
Major on site
C4 HIGH SIGNIFICANT MODERATE
(including fatality)

Major on plant
Consequence

Factory impact (incl. C3

Serious injury)

Serious on-plant
Unit impact (including C2
MTI)

Minor on-plant
Other
impact
C1 LOW NEGLIGIBLE

David Hind Orica Carseland Works 9

 Moderate Risk

Good design practice

Hard Wired

Safety PLC (Quadlog/Triconics)

DCS
Frequency
Consideration Rel. High Slight Very Slight
Business SH&E W3 W2 W1

Potential for off-

site impact or
Corporate/Site
Major on site
C4 HIGH SIGNIFICANT MODERATE
(including fatality)

Major on plant
Consequence

Factory impact (incl. C3

Serious injury)

Serious on-plant
Unit impact (including C2
MTI)

Minor on-plant
Other
impact
C1 LOW NEGLIGIBLE

David Hind Orica Carseland Works 10

 Low Risk

Good design practice

DCS

Negligible Risk Frequency

Consideration Rel. High Slight Very Slight
Business SH&E W3 W2 W1


Do you really need it? Corporate/Site
Potential for off-
site impact or
Major on site
(including fatality)
C4 HIGH SIGNIFICANT MODERATE

Major on plant
Consequence

Factory impact (incl. C3

Serious injury)

Serious on-plant
Unit impact (including C2
MTI)

Minor on-plant
Other
impact
C1 LOW NEGLIGIBLE

David Hind Orica Carseland Works 11

 Example : AN Pumping System

Hazard :
Frozen AN line resulting
in dead heading pump,
heat build-up and pump
90% AN explosion

Tank
PUMP

David Hind Orica Carseland Works 12

 Example : AN Pumping System

Frequency
Consideration Rel. High Slight Very Slight
Hazard : Business SH&E W3 W2 W1

Frozen AN line resulting Potential for off-

site impact or
Corporate/Site C4 HIGH SIGNIFICANT MODERATE
Major on site
in dead heading pump, (including fatality)

heat build-up and pump

Major on plant
90% AN explosion Factory impact (incl. C3

Consequence
Serious injury)
Tank
Serious on-plant
Unit impact (including C2
PUMP MTI)

Minor on-plant
Other C1 LOW NEGLIGIBLE
impact

How Bad would a Pump Explosion Be?

How Frequent might it happen?

David Hind Orica Carseland Works 13

 Instrumentation Design

Valves, Transmitters, Switches, Measuring Device


Reliability

Fail Safe/Failure Modes

Diagnostics

Redundancy

Hard Wired System vs Software System

Bypasses

David Hind Orica Carseland Works 14

 Fault Tree Analysis
Frequency FDT

Low Level in D203 1

0.0125
LTLL 2202 Fails 0.0125 &
Suction
OR Problem

Pump Suction Blocked 0.02 0.02 0.0325

Flow
OR Problem
Line to AN Concentrator
Blocked 0.05 0.1925

XV2612 fails to open on

concentrator trip 0.01
OR Pump Dead Headed
Blocked Recycle Line 0.05 0.16

Line to AN Storage Blocked 0.05

David Hind Orica Carseland Works 15

 Fraction Dead Time (FDT)

Calculating the amount of time an
instrumented trip system would not work
properly by examining the individual items

Data from tables, experience, etc.

David Hind Orica Carseland Works 16

Example : AN Pumping System

Hazard :
Frozen AN line resulting FSL E1
in dead heading pump,
heat build-up and pump
FIT
90% AN explosion

Tank
PUMP

Completed Fault Tree Analysis

Completed FDT Calculations
Complete Instrumentation Design

David Hind Orica Carseland Works 17

 Protection System

Instrumentation System

Documentation System

Training & Procedures

Modification System (AWO)

Trip Testing

David Hind Orica Carseland Works 18

Documentation

How does it work and why.


P&IDs

Trip Matrix

CIPS Review Documents

Software Code

Instrument Index

Operating Procedures

David Hind Orica Carseland Works 19

 Modification System (AWO)

System to allow it to change

Provides checks that change does not cause
disaster

David Hind Orica Carseland Works 20

 Training & Procedures

Knowledge of how it works

Knowledge of why it works

Knowledge to keep it working

David Hind Orica Carseland Works 21

 Trip Testing

Ensure the system will work when you want it to.


Method of testing

on line vs off line

Record Keeping

Frequency

based on acceptable dead time

David Hind Orica Carseland Works 22

 No Testing
Device Fails

Operating

Failed

Time (months)

David Hind Orica Carseland Works 23

Testing Every Month
Device Fails

Working

Tested & Repaired

Failed

Time (months)

David Hind Orica Carseland Works 24

Testing Every 3 Months
Device Fails

Working

Failed

Tested and Repaired

Time (months)

David Hind Orica Carseland Works 25

 CIPS and ME

More Documentation

Rules on Process Bypasses

Redundant Systems

More Complex

Safer System

David Hind Orica Carseland Works 26

 More Documentation

P&IDs

Hazops

Trip Matrix

CIPS Review

FDT Calculations

Fault Tree Analysis

Trip Testing Records

More Information

Must keep it updated

David Hind Orica Carseland Works 27

 Effect of CIPS
 SaferSystem
 Quantification of Risk Reduction
 More/Better Documentation

Trip Testing & Record Keeping

More Complex Systems

Higher On line Time?

David Hind Orica Carseland Works 28

 Frequency
Consideration Rel. High Slight Very Slight
Business SH&E W3 W2 W1

Potential for off-

site impact or
Corporate/Site
Major on site
C4 HIGH SIGNIFICANT MODERATE
(including fatality)

Major on plant

Consequence
Factory impact (incl. C3
Serious injury)

Serious on-plant
Unit impact (including C2
MTI)

Minor on-plant
Other
impact
C1 LOW NEGLIGIBLE