An independent protection layer is a device, system or action that can prevent the scenario from reaching its consequence, and that works independently of the initiating cause and of every other layer credited in the same scenario.
The four tests
- Independent: its failure is not caused by the initiating event and shares nothing critical with other credited layers (sensor, logic solver, final element, utility, operator).
- Specific / effective: designed to prevent this consequence for this scenario, with enough capacity and fast enough.
- Dependable: its PFD can be stated and is supported by design, testing and records.
- Auditable: it is inspected and tested, and the records exist.
Common layers and the usual questions
| Layer | Typical questions before credit |
|---|---|
| BPCS control loop or alarm | Is the cause a BPCS failure? Then the same BPCS cannot also be a layer. Only one BPCS credit per scenario under most company rules. |
| Operator response to an alarm | Is the alarm independent of the cause? Is there enough time (detection, decision, action) within the process safety time? Is the action trained and written? |
| Relief valve or rupture disc | Is it sized for this scenario's relief case (two-phase, runaway, blocked outlet)? Does the release go to a safe place? Is it tested? |
| Check valve | Usually low credit; prone to leakage; credit only if tested. |
| Dike or bund | Mitigates the spill size, not the release; credit only if the consequence is defined after containment. |
| Another SIF | Independent sensors, logic and final elements? |
Documenting the claim
For each IPL record: what it is, which scenario, the PFD used, why it is independent, the test interval and the reference to test records. First Out AI has an "Independence, evidence" field for each IPL row, and a value of 1 can be used to list a layer as considered but not credited, which reviewers appreciate.
Typical failures of independence
- Alarm and trip from the same transmitter.
- A relief valve credited for a case it was not sized for.
- Operator response credited when the operator is also the initiating cause (wrong line-up).
- Two IPLs depending on the same instrument air header.
Written for First Out AI as engineering guidance. It supports engineering work and does not replace it; check every value against your standards, certificates and company rules with a competent functional safety engineer.