Safety excellence cuts costs, boosts profits at Petronas

“Allowing a one-hour delay on 100 loops, at $10,000 per loop, can significantly improve profitability.” Petronas’ Sharul Rashid discussed how safety instrumented functions at one of the company’s refineries in Malaysia.

Safety is typically viewed as a necessary expense. It isn’t free, but doing it right can improve profits when it reduces the costs of unreliability, as demonstrated by a Petronas refinery in Malaysia and explained at the EcoStruxure Triconex User Group meeting this week in Galveston, Texas.

“Similar to airplane cockpit instrumentation, the plant instrumentation must be working perfectly or the plant is not fit and safe to operate,” said Sharul Rashid, principal engineer, instrument control systems, Petronas. The safety system is a critical layer of protection. “When alarms come in, they have to be attended to, or you get Bhopal.”

Petroliam Nasional Berhad (Petronas) is Malaysia’s fully integrated oil and gas multinational, ranked among the largest Fortune 500 corporations. It has assets in more than 65 countries, is among the world’s top five oil and gas companies (in terms of production), and is the most profitable company in Asia. Rashid’s refinery is on Malaysia’s east coast. Its total of about 15,000 tags include 1,086 fire & gas, 3,202 safeguarding and 11,918 DCS tags.

At Petronas, “We have been successfully using structured approach to properly manage the instrumented protective function/safety instrumented function (IPF/SIF) lifecycle.” IPF Classification is divided into three categories based on the nature of business process. The plant instrument team is responsible to:

1. Ensure that all IPF in the existing plant are classified via an IPF study, to be conducted by GTS (Group Technical Services).
2. Ensure that data used for the IPF study are the latest and updated.
3. Be the custodian of the master copy of the finalized report

The management of change (MOC) project team is responsible to:

1. Ensure that new IPF tags are classified via IPF Study to be conducted by GTS.
2. Properly hand over to the instrument and maintenance teams all the related IPF documents.

When the plant was new, an instrumented protective function (IPF) study showed using one out of two voting (1oo2) transmitters resulted in poor availability. Two out of three (2oo3) was more reliable, but 1oo2 was used where it met the safety requirements.

At hand-off and every five years, IPFs are studied and reclassified as needed. “Once you have made the study, don’t put it on the shelf. Study it, and implement the changes it suggests as a project,” Rashid said. “If the current configuration doesn’t meet the requirements, close the gaps. But, if the CAPEX is very expensive, we must apply ALARP (as low as reasonably practical).”

Projects also can be driven by profitability. Lost production due to lack of availability has a cost, and that is considered in the safety review. “At Petronas, we have to design to meet both safety and availability criteria,” Rashid said. The product loss equation (PLE) changes with the price of oil, which can change the cost of availability and drive a change from less reliable 1oo2 to more reliable 2oo3 if the cost of the change is not prohibitive.

“Safety standards are many and confusing, and you need to keep up on them,” Rashid said. “A lot of things change when the standards change. It’s a constant challenge.” Being innovative and applying the latest standards has allowed Petronas to perform safety system projects that improve profitability.

For example, NAMUR safety standards allow up to one hour for response to a transmitter alarm. Petronas may place a time-limited, automatic over-ride on 1oo2 systems to allow the plant to respond to a transmitter malfunction without tripping the safety system, Rashid said. “Allowing a one-hour delay on 100 loops, at $10,000 per loop, can significantly improve profitability.”

In other cases, 1oo2 can be converted to 2oo3 by adding a transmitter. Where wiring costs are prohibitive, it might be a wireless transmitter. Where another penetration is not practical, it may be possible to use a nearby process transmitter. “When it is not practical to add a transmitter due to penetration or wiring costs, we can use a control transmitter with a barrier,” Rashid said. “One channel goes to the DCS, and the other channel from the barrier goes to the safety system.”

In this case, it’s necessary to provide a procedure for maintenance to override the safety system when needed for control system maintenance.

The refinery also takes full advantage of valve and transmitter self-diagnostics, automatic safety system testing, and other condition-monitoring techniques to improve reliability. It’s just one way they help keep Petronas safely near the top of the Fortune 500.