If you used LOPA to determine if you need a SIF and to identify what SIL is required (if any), then you cannot share or partially share a final element. So, if the BPCS control loop is the cause (initiating event) and that loop uses the final element in question, then that same final element cannot be used in an IPL (regardless of if the IPL is configured in the BPCS or via an SIS). There are good reasons for this rule. First, what failure modes lead to common cause failure? Let’s say the valve in question needs to “close” to be safe. Then what if the valve is stuck open due to cold welding into the open position because it happens to be full open nearly all of the time? What if the valve is left in manual control at the local valve control station? What if the valve if manually locked or gagged open (such as with a nut on a stem) for testing of the control loop up to the final element? What is something is jammed in the valve that prevents valve closure (such as scale, a fragment of a upstream component such as filter, etc.)? Then any of these common errors will also take out the SIF using the same valve. This is the types of mistakes in design that LOPA and SIS standards are trying to avoid.
So, per the rules of LOPA, the boundary of a BPCS extends to include anything touched by the BPCS “loop” including impulse lines and taps for the sensor portion (including level bridles, for instance), transmitters, conduit, input module, logic solver, output module, conduit, final element (without or without a solenoid to completely open the air to the valve, if an air-to-open valve is the final element). LOPA would not allow the sharing of the final element. In FTA, you could account for the common cause failures and common human errors described earlier, but nearly all folks who think they understand FTA, will do this common cause analysis wrong, especially the human error portion. For instance, some think that “if we write a procedure to control such common cause human errors then the errors are eliminated”… this is far from the truth.
Now, with all of that stated, we know of some reputable chemical companies that allow sharing of the final element if the install a separate solenoid to vent the air and close the valve . They justify this using a FTA (not LOPA) and presumably accounting for and controlling the CC errors and failures. Many of us doubt they can keep control of the CC human errors for the life of the process.
One step further: Our understanding on the definition of degrees of freedom means that IEC 61511 (and therefore ANSI/ISA 84) would prohibit sharing of the final element in a SIL 3 SIF, with the BPCS (using the same valve) being the initiating event (cause) of the scenario. (But, as a side note, we
