Then one afternoon a level controller sticks, and the separator starts to fill.
Layer one, the process design, was never going to stop this. Layer two is the control system, and the control system is the thing that failed.
Layer three is a high alarm and an operator with about sixty seconds. Today that is not enough.
Layer four is the safety instrumented function. Sensor, logic solver, final element. It has done nothing for nine months.
It closes the inlet in under two seconds. Layers five and six are never called on.
Nothing happened.
No release. No fire. No investigation, no regulator, no name in the news. The most expensive thing on that plant spent nine months doing absolutely nothing, and then earned every bit of it in under two seconds.
Whether the people who specified, verified and maintained that function were capable of it is not a matter of opinion. It is examined.