Compensating measures are what replaces the risk reduction of a safety instrumented function while that function is unavailable. The standard requires them once a dangerous fault has been detected: either hold safe operation by other means, or take the process to a safe state. They split on whether a person is involved. Where the architecture is redundant the compensation is automatic, because the remaining channels keep voting and nobody has to do anything. Where it is not, a person becomes the protection, and that arrangement is what many practitioners call an alternate protection plan.
A manual plan has to be specific. It names the alternate indication being watched, who watches it, the value at which they act, and what they do. The test that decides whether it is worth anything is process safety time. If the operator cannot detect and act before the hazard arrives, the plan is not protection and the honest answer is to shut down. Compensating measures are temporary cover for a known gap rather than a permanent protection layer, and they do not restore the PFDavg the unavailable function was contributing.
Key Points
- Compensating measures replace the risk reduction of a safety instrumented function for as long as it is unavailable.
- Where the architecture is redundant the compensation is automatic. Where it is not, a person carries it under an alternate protection plan.
- A manual plan only protects anything if the operator can act within the process safety time. If they cannot, take the process to a safe state.
Example
A 1oo2 transmitter pair protects a vessel on high level. One transmitter fails and is taken out of service, so the function runs on the survivor with no fault tolerance left. That compensation is automatic and nobody is assigned to anything. Had the function been 1oo1 to begin with there would be nothing left to vote, so the alternate protection plan would put an operator on an independent level indication, with a defined action and the authority to shut the vessel down.
See Also: bypass, independent protection layer, process safety time
Cited Sources