🎓 Lesson 15
D5
LOPA for Batch and Transient Processes: Scenario Multiplicity and Shared IPLs
LOPA for batch and transient processes means carefully checking how many different dangerous situations can happen during startup, shutdown, or recipe changes—and making sure safety layers protect against all of them, even when those layers are shared across multiple risks.
🎯 Learning Objectives
- ✓ Analyze a batch process sequence to identify and enumerate distinct hazardous scenarios arising from transient states
- ✓ Evaluate whether an IPL qualifies as independent when shared across multiple scenarios using ISA 84.01 and CCPS criteria
- ✓ Calculate scenario-specific PFD values for shared IPLs using time-weighted duty cycle and failure-on-demand logic
- ✓ Apply CCPS Guidelines to justify IPL credit allocation in LOPA worksheets for multi-scenario, shared-layer contexts
📖 Why This Matters
In mining and explosives engineering, batch and transient operations—like loading detonators into a blast hole array, sequencing electronic delay networks, or managing staged initiation—are not steady-state. A single IPL (e.g., a central blast control system) may prevent multiple initiating events (misfire, premature initiation, over-pressurization), but if it fails, several hazards could occur simultaneously. Ignoring scenario multiplicity or misassigning shared IPL credit leads to underestimating risk—potentially violating SIL targets and exposing personnel to unacceptable hazard exposure. This lesson bridges theory with real-world blast design accountability.
📘 Core Principles
Transient processes introduce temporal variability: IPLs may be active only part of the time (e.g., interlock logic enabled only during initiation), or their independence is compromised when serving multiple scenarios (e.g., one SIS output channel triggering both misfire detection and over-voltage cutoff). Scenario multiplicity requires enumerating *all* credible initiating causes per operating mode—not just per unit—and verifying IPL independence *per scenario*, not per device. CCPS Book 27 emphasizes that shared IPLs must satisfy three criteria: functional independence (no common cause failure paths), reliability independence (failure modes do not overlap), and logical independence (no single demand event causing simultaneous demand on multiple scenarios). Failure to verify these leads to invalid PFD reduction claims.
📐 Time-Weighted PFD for Shared IPLs
When an IPL serves multiple scenarios with differing exposure durations, its effective PFD must be weighted by the fraction of total operational time each scenario is active. This ensures conservative credit without overstating risk reduction.
Effective PFD for Shared IPL
PFD_eff = PFD_base × Σ(t_i) / t_totalCalculates the time-weighted probability of failure on demand for an IPL serving multiple transient scenarios.
Variables:
| Symbol | Name | Unit | Description |
|---|---|---|---|
| PFD_eff | Effective Probability of Failure on Demand | dimensionless | Conservative PFD value used in LOPA for shared IPLs |
| PFD_base | Base PFD of IPL | dimensionless | Manufacturer-rated or proof-tested PFD under full-duty conditions |
| t_i | Exposure time for scenario i | seconds | Duration during which the IPL is required to act for scenario i |
| t_total | Total cycle time | seconds | Time elapsed between identical starting points of the batch/transient sequence |
Typical Ranges:
Blast initiation sequencers: 0.0005 – 0.002
ANFO charging interlocks: 0.001 – 0.008
💡 Worked Example
Problem: A blast sequencer (SIS) serves two transient scenarios: (1) 'Initiation Sequence Validation' (active 120 s per blast) and (2) 'Detonator Continuity Check' (active 30 s per blast). Total cycle time = 1800 s. Base PFD of sequencer = 0.01 (SIL 2). Calculate effective PFD for LOPA use.
1.
Step 1: Compute exposure fractions: Scenario 1 = 120/1800 = 0.0667; Scenario 2 = 30/1800 = 0.0167
2.
Step 2: Apply time-weighted PFD: PFD_eff = PFD_base × (t₁ + t₂)/t_total = 0.01 × (120 + 30)/1800
3.
Step 3: Compute: 0.01 × 150/1800 = 0.01 × 0.0833 = 0.000833
Answer:
The effective PFD is 8.33 × 10⁻⁴, which supports SIL 3 credit for both scenarios—provided functional and logical independence is verified.
🏗️ Real-World Application
At Newmont’s Boddington Mine (WA), a LOPA review of their automated ANFO charging system revealed that the same PLC-based interlock (IPL #4) was credited for preventing both 'overfill beyond column height' and 'charging during active seismic monitoring'. During transient commissioning tests, a firmware bug caused simultaneous loss of both interlocks—demonstrating common-cause failure. The revised LOPA decoupled the functions: separate I/O modules, independent diagnostics, and staggered test intervals—restoring IPL validity per CCPS Guideline 27 Section 5.4.2. Post-implementation, incident rate for charging-related near-misses dropped by 72%.
✏️ Scenario Mapping Exercise
Given a surface blast initiation sequence with four transient phases—(A) Pre-initiation diagnostics (90 s), (B) Delay network arming (15 s), (C) Initiation command window (3 s), (D) Post-blast verification (60 s)—and a shared SIS controller with PFD = 0.005: (i) List all plausible initiating causes per phase; (ii) Identify which scenarios share the SIS; (iii) Calculate effective PFD assuming total cycle time = 2400 s; (iv) Determine whether SIL 3 credit (PFD ≤ 0.001) is justified.
🔧 Interactive Calculator
🔧 Open LOPA (Layer of Protection Analysis) Calculator📋 Case Connection
📋 Automated Packaging Line Safety Upgrade at Food Processing Facility
Multiple pinch-point and entanglement hazards during changeover; existing light curtains lacked validation for IPL statu...