Risk Abatement Provided by Safety Instrumented Systems MayCause Remote Hazards with Higher Risks

摘要

Section:Safety Instrumented Systems and Safety Critical DevicesA basic law of physics states that for every action there is an equal and oppositereaction. Translating that law into the world of risk analysis, we might state that for everyaction (even a risk mitigation action) there are consequences—and not all of thoseconsequences are 1) clearly identified, 2) fully understood, and/or 3) good. Even when theinitial actions are an effort to mitigate a perceived risk, the range of consequences (I.e.Reactions) can sometimes create another set of hazards and possibly larger risks than initiallyaddressed.The complexity of safety instrumented systems facilitates the creation of at least fourtypes of new hazards that should be addressed. First, someconsequences that may resultfrom the proper functioning of a single safety system may not be desirable. Second, theaccumulative and interactive effects when multiple safeguards function properly may causeunexpected and unwanted consequences. Third, unanticipated and sometimes unwantedconsequences at seemingly remote locations may occur. And fourth, because of interactionswith other control components, safety instrumented systems can easily create several layers ofrisk abatement actions cascading from the initiating event making it virtually impossible foroperations personnel to troubleshoot and correct the original anomaly in a timely manner-adding yet another hazard to the operations.This paper addresses the potential of creating "downstream" or remote hazards by theinstallation of safety instrumented systems and then discusses how and when consequenceanalyses should be expanded to identify these potential new hazards. This is done using thelife cycle approach for the design and maintenance of safety instrumented systems discussedin the newly published CCPS book, "Guidelines for Safe and Reliable Instrumented ProtectiveSystems."