How Instrumented Protection Fails in Practice

A safety instrumented system (SIS) is installed to act on a day nobody can predict. When major accident reports are read side by side, one pattern appears again and again: the plant had an automatic protection on its drawings, and on the day it mattered, the protection did not act. The equipment was rarely the whole story. The failure usually started much earlier, in a specification, a test, a bypass or a change.

An advanced practitioner studies these patterns because they show where the effort should go. Buying better hardware addresses a small part of the problem. Most of the gap between the integrity that is claimed and the integrity that exists is created by people and by management systems.

Where the failures start

A well-known study of control system failures by the United Kingdom Health and Safety Executive (HSE) sorted the causes by the lifecycle phase in which they began. The largest single group started in the specification: the system did exactly what it was told to do, but it was told the wrong thing. Another large group came from changes after commissioning. Faults in the hardware design and in installation were a smaller share.

The lesson for a designer is direct. A careful calculation of probability of failure on demand (PFD) against a safety integrity level (SIL) target is worth little if the trip setting, the safe state or the response time in the specification is wrong. The lesson for an operator is equally direct: every modification, however small it looks, can quietly remove protection that the original design relied on.

Two worked cases

Case 1: storage tank overfill. Several serious tank farm accidents followed the same sequence. The automatic tank gauge stuck and showed a steady level while the tank kept filling. An independent high-level switch existed, but it was not in a working condition. Two protections existed on paper; neither existed on the day. The common thread was not the choice of instrument but the absence of a proof test that would have revealed the defect.

Case 2: a column during start-up. During a start-up, a distillation column was overfilled. The level instrument was ranged for normal operation and could not show the true level once liquid rose above the top of its range. Operators trusted a reading that was physically incapable of being correct. A measurement chosen for control was being used as if it could protect.