Technical Report | Process Safety
The PST Gap: When Your Instruments Can’t Respond in Time
A trip that activates too late — or can’t return the process to safe operation before design limits are exceeded — isn’t protection. It’s a false sense of security.
What’s Covered Here
Introduction
Your safeguards are only as good as their ability to act in time
Facilities routinely credit instruments — high-pressure alarms, level trips, high-temperature control, operator responses to low-O₂ alarms — as Independent Protection Layers (IPLs) in PHAs and LOPAs. The assumption is simple: if the alarm annunciates or the trip triggers, the event is prevented. But what if the instrument, or the associated alarm response, simply can’t prevent the design-limit exceedance? Cognascents Consulting has validated IPL response capability across multiple refinery units — and the results are a wake-up call.
As an industry, we routinely ensure pressure-relief valves are sized for every credited overpressure case in a LOPA. Why don’t we hold our instrumented protections to that same standard?
“A trip that can’t return the process to safe operation before design limits are exceeded isn’t protection. It’s a false sense of security.”
The Problem
Credited protection isn’t always real protection
There are multiple ways to define Process Safety Time (PST). For simplicity, here we define it as the window between a process parameter passing an action set point and the undesired event occurring — the span of IRT + PLT in the figure below. A safeguard must complete its protective action — automated trip or operator response — within that window.
Of critical note, a Maximum Setpoint (MSP) must be identified and tracked as a Safe Operating Limit (SOL) — yet most facilities have never calculated it. What ends up occurring is that IPL credit is assigned based on assumed effectiveness, not validated effectiveness. PHAs identify what instrumented safeguards exist; they don’t confirm whether those safeguards can actually respond in time. The result is a hidden gap: instruments that look protective on paper but cannot prevent the hazard they’re credited to address. And without structured validation, that gap is invisible.
Figure 1: Timeline for Progression of a Scenario
Figure 1 — After the initiating event (IE), the process parameter climbs through the setpoint range and safety margin toward the design limit. Process safety time (PST) is the window from the action set point to the undesired event — the span of IRT + PLT. The Maximum Setpoint (MSP) is the highest point at which a credited alarm or trip can be set while still leaving enough margin below the design limit. Adapted from CCPS, Guidelines for Initiating Events and Independent Protection Layers in Layer of Protection Analysis, Figure 3.1.[1]
Failure Modes
Where PST failures show up
Not every IPL requires a PST calculation — a pump deadhead scenario, for example, is better validated by a rotating-equipment specialist than by any formula. But for instrumented trips and alarm-based operator responses tied to time-sensitive excursions, structured validation is essential. Two scenarios illustrate the problem well.
Scenario 1
Compressor KO drum overfill
A PHA team may credit the high-level trip (LSHH) on the knock-out drum and accept the protection at face value. The deeper issue: the KO drum is significantly smaller than the upstream equipment. When a large liquid surge occurs, the drum may initiate the trip in time — but the volume passes through before the compressor winds down to a safe speed.
Liquid carryover into a high-speed compressor causes catastrophic mechanical failure in seconds. The correct SOL is on the upstream vessel, where there is sufficient time and volume to take protective action. The KO drum LSHH is still useful for the gradual level-rise events it was designed for.
Scenario 2
Distillation column overpressure
Teams often assume a large column and overhead system has enough vapor space to absorb a pressure excursion. PST calculations tell a different story. For the most severe cases — particularly lighter columns like depropanizers with total-condensing overheads when cooling is lost — overpressure can develop in 30 seconds to a few minutes.
The point PHA teams miss: the time available is measured from the PVHH — the alarm with predetermined, trained actions — not from normal operations or the first troubleshooting alarm. That window is almost always shorter than it appears in qualitative conversation.
Operator-based IPLs deserve the same scrutiny. Even companies that have implemented safety instrumented systems and follow ISA-84 / IEC 61511 often fail to apply those same principles to operator responses — never calculating whether a person can detect an abnormal condition, recognize it as an emergency, decide on the correct response, and act within the available PST. For fast-developing events, that window is frequently tighter than assumed — making operator-based IPLs among the most overlooked gaps in PST discussions.
The Data
What the data shows
After implementing SOL programs for various refineries, Cognascents developed the following case study across seven unique units at three facilities. PST validation was performed on instrumented IPLs spanning pressure, temperature, level, flow, and concentration parameters. The results were consistent — and concerning.
failure rate at one unit — every evaluated instrument was incapable of responding within the required PST.
range of failure rates observed across all seven units evaluated.
units in which all credited instruments passed PST validation.
Figure 2: Passing vs. Failing PST Calculations by Unit
Figure 2 shows the share of credited instrumented IPLs that could (dark) and could not (light) complete their protective action within the available process safety time, by unit. In no unit evaluated did every credited instrument pass — and one unit (Coker) failed every evaluated case. These are instruments formally credited in LOPA studies as providing a defined order of magnitude of risk reduction. They couldn’t do the job when it mattered.
The Framework
How the gap gets closed
Closing the PST gap requires a structured framework — not calculations in isolation. The approach Cognascents applied combines PHA outputs, engineering validation, and corporate equipment guidance.
“When an incident occurs, the first question should no longer be ‘Why didn’t the operator respond in time?’ — it should be ‘Why didn’t we set our operators up for success?’”
The Broader Implication
A systemic gap — and what it means for your facility
The PST gap is systemic. It emerges directly from how PHAs and LOPAs are designed: PHAs are risk-assessment tools, not instrument-response validators. That work has to happen outside the PHA room. PST validation is documented as a standard expectation in LOPA guidance — yet it remains inconsistently applied across the industry. Until it becomes a standard step in SOL development, facilities will continue to operate with protection layers that exist on paper but not in practice. In high-consequence environments, that distinction could be the difference between a near-miss and a fatality.
If your facility hasn’t conducted structured PST validation, ask yourself:
Have your alarm-based IPLs been validated for operator response time — detection, recognition, decision, and action — against the available PST?
Have your instrumented trips been evaluated to confirm that sensor lag, logic-solver execution time, and final-element stroke time fit within the PST window?
Where PST failures exist, have your LOPA studies been updated to reflect the loss of credited risk reduction?
Talk to a Senior Engineer
If any of these don’t have a clear answer, the gap may already exist at your facility — you just haven’t found it yet. Cognascents specializes in SOL program development, PST validation, and PHA / LOPA support across refining and chemical operations.
References & Citations
The Process Safety Time framework and the scenario timeline (Figure 1) used in this report follow the guidance of the AIChE Center for Chemical Process Safety (CCPS).
- CCPS, Guidelines for Initiating Events and Independent Protection Layers in Layer of Protection Analysis, 1st Ed., John Wiley & Sons / AIChE Center for Chemical Process Safety, New York, NY, 2015. DOI: 10.1002/9781118948743. Figure 1 in this report is adapted from Figure 3.1.
- ISA-84 / IEC 61511 — Functional safety: safety instrumented systems for the process industry sector.
- OSHA 29 CFR 1910.119 — Process Safety Management of Highly Hazardous Chemicals.
Prepared by Cognascents Consulting Group. Figures 1 and 2 were recreated for this report; Figure 1 is adapted from the CCPS reference cited above and reproduced for instructional purposes with attribution.
