September

2007

[Link]
WHAT IS AN SIS?
Various acronyms are used in discussions about
safety instrumented systems (SISs). While these
Environmental Manager acronyms are defined in the text of this article,
a little more explanation is warranted.
The acronym “SIL” stands for safety integ-
rity level. Each SIL represents the difference

Tolerable Risk between the process risk without an SIF, and

the risk deemed tolerable. An “SIF” is a safety
instrumented function and consists of the sen-
sors, logic solvers, and final elements neces-
sary to detect a particular hazardous condition
and cause the process to go to a safe state. It’s
While determined risk is generally well understood, tolerable important to note that SILs apply to each SIF,
not to the SIS as a whole.
risk can be the missing link to complete risk assessments An “SIS” is a collection of all the sensors,
logic solvers, and final elements necessary to
Mike Schmidt veloped their lists of safety instrumented address all the SIFs in a process, hence the
Emerson Process Management functions (SIFs) and are asked to assign word “system”. SILs establish the required reli-
an SIL to each one (Table 1). ability of an SIF. Once a safety instrumented
function is designed, reliability calculations

S
afety instrumented systems Detailed design of an SIS cannot begin can show if the SIF is reliable enough to reduce
(SIS) are in the spotlight these until each SIF has been assigned an SIL. the risk to a tolerable level.
days. More companies have come This is the point in the process where Safety integrity levels range from 1 to 4, but
to recognize the importance of many are tempted to throw up their it should be noted that SIL 4 is not recognized
recently published consensus standards, hands in despair and want to arbitrarily in all SIS standards. Instead, there is an expec-
tation that the process will be re-designed to
and recent fatal accidents tied to the assign everything as SIL 3. This is not the reduce the risk. An SIS can also include SIFs
failure of instrumented safeguards have answer. At the very least, it fails to comply that are not SIL rated. Various users refer to
brought further attention. The result is with the letter and the spirit of the stan- them as “N/R” (not rated) or “SIL 0” — handy
that facilities all over the world are look- dards, but worse, it misallocates resources terms, albeit not defined in any standards. ❏
ing at their safety interlocks and conclud- to overdesign when these resources could
ing that what they really need is a full- be better used to reduce risk elsewhere. rate risk-tolerance criteria that speak to
blown SIS. The disconnect occurs because SIL as- the total corporate risk, but many have
As some work to upgrade their SISs, signment depends on a comparison of no risk-tolerance criteria at all. It is still
they find plenty of guidance available for two values: determined risk, about which a rare organization that has established
the early steps — process hazard analysis much has been written; and tolerable risk, risk-tolerance criteria that are actually
(PHA), consequence analysis, and layers which is frequently invoked but rarely useful at the level of a process unit, where
of protection analysis (LOPA) — and also presented in terms that are useful for SIL the SIS resides.
guidance for the later steps — compo- assignment. Instead, the literature usu-
nent selection, failure probability and SIL ally contains some variation of this state- Recommended approach
(safety integrity level) verification calcu- ment: “Each organization is responsible A typical approach to SIL assignment, but
lations, and system-design guidelines. A for establishing its own risk-tolerance certainly not the only one, is to use a risk
disconnect comes when end users have de- criteria.” Some organizations have corpo- matrix. Risk is a product of consequence

TABLE 1. SAFETY INTEGRITY LEVELS TABLE 2. RISK MATRIX

Safety Probability of Risk Reduction Consequences (per event)
Integrity Failure on Demand Factor (RRF) < 0.01 x > 0.01 x > 0.1 x > 1 x > 10 x
Level (PFDAVG) Serious Serious Serious Serious Serious
SIL 4 10-4 > PFD > 10-5 10,000 < RRF 100,000 f > High N/R SIL 1 SIL 2 SIL 3 SIL 4
Likelihood

SIL 3 10-3 > PFD > 10-4 1,000 < RRF < 10,000
High > f > 0.1 High N/R N/R SIL 1 SIL 2 SIL 3
SIL 2 10-2 > PFD > 10-3 100 < RRF < 1,000
SIL 1 10-1 > PFD > 10-2 10 < RRF < 100 f < 0.1 High N/R N/R N/R SIL 1 SIL 2
f =Benchmark frequency

[Link] 1 3/6/09 11:16:40 AM

 TABLE 3. AN EXAMPLE OF A
'BUBMJUJFT
MATRIX FOR PHAS
Environmental Manager Severity (Consequence)
5 4 3 2 1 %JTBCJMJUJFT
1 5 4 3 2 1
2 8 7 6 4 2

Likelihood
*OKVSJFT
3 9 8 7 6 3
4 10 9 8 7 4 'JSTU
BJET
and likelihood. As shown in Table 2, conse- 5 10 10 9 8 5
quence and likelihood categories, like the
TABLE 4. RELATIVE COST OF /FBS
NJTTFT
SILs themselves, are separated by orders
CONSEQUENCES
of magnitude. The challenge for each com- FIGURE 1. The Accident Triangle or Safety
Fatalities 1.0x Pyramid depicts the simple observations of
pany then, is to define the consequences Serious injuries 0.1x H.W. Heinrich [1]
that are considered “serious” and the Injuries (reportables) 0.01x
benchmark frequency (f). First aids (non-reportables) 0.001x
*OUPMFSBCMF
SJTL
Many companies already use some type
NBOZFBS
ZFBS
of matrix, usually to prioritize recommen- The next step is to define the conse- XPSLFS QVCMJD
dations from HazOps (hazard and opera- quence categories. The universally used
bility reviews) or other PHAs. An example scale — and absolutely required by the "-"31
PS
UPMFSBCMF
SJTL

of this is shown in Table 3, where a rat- SIS standards — is of consequences to per- SFHJPO
ing of 1 would mean something should be sonnel. But other important consequence NBOZFBS
ZFBS
XPSLFS QVCMJD
done immediately, and a 10 would mean scales, like community, societal or envi-
that no action is required. ronmental consequences, may also show
Typical likelihood categories include up in one of these matrices. Just keep in /FHMJHJCMF
SJTL
terms such as frequent, occasional, sel- mind that as an SIF for reducing the risk
dom, remote and unlikely — but what do of a specific hazard is evaluated, the conse-
they mean? A company may leave it to the quences of that hazard must be evaluated
individual participants in the PHA to de- on each scale. The event will have the same FIGURE 2. The ALARP principle, developed
in the U.K., states that risks should be reduced
cide for themselves. frequency, regardless of the types of conse- to a level that is “as low as reasonably practi-
Some companies define these terms, but quences considered, and the consequence cable”
may use frequency intervals that are not that results in the highest SIL rules.
uniformly spaced. A typical set might be: While some organizations want to con- each fatality there were many incidents
• Event occurs once a year sider site and operability consequences of with less serious consequences, and that
• Event occurs once every 10 years (~1 a hazard in their analyses, there are seri- for each incident with less serious con-
order of magnitude) ous disadvantages to keep in mind. One, it sequences, there were even more near
• Event occurs once every 50 years (~ ½ puts a dollar scale on the same matrix as misses. From that simple observation
order of magnitude) environmental, health and safety (EHS) grew the notion that if we could be more
• Event occurs once every 150 years (~ ½ consequences, and it is not a big leap for alert to near misses and reduce them, we
order of magnitude) a plaintiff’s attorney to equate the EHS would necessarily reduce the incidence of
• Not likely to occur consequences to the dollar amounts. Also, more severe consequences. This led to the
The same holds true for the severity in the functions that strictly protect against eco- now familiar, safety pyramid (Figure 1).
consequence categories; a typical (nonlin- nomic loss don’t need to be burdened with While the premise of the safety pyra-
ear) arrangement might be: the documentation requirements of the mid has recently been called into ques-
• Loss of life; damage over $1 million SIS. Organizations are usually better off tion, Heinrich’s original observation is
• Lost-time injury; damage over to leave the economically driven functions still valid: near misses, first aids, and
$500,000 in the basic process control system and fatalities are each separated by about an
• Medical treatment; damage less than avoid giving them SIL ratings. order of magnitude (Table 4).
$500,000 Many have published cost estimates
• Minor injury; near miss; poor quality Consequence categories associated with increasing levels of in-
• No injury, impact on process If classifying likelihoods into categories jury, with costs ranging from a few hun-
that are separated by orders of magni- dred dollars for a first-aid injury to a
Converting an existing matrix tude is hard, it’s nothing compared to million dollars for a fatality. What the
To convert an existing matrix to an SIL- separating consequences into categories. various scales have in common is that se-
assignment matrix, the first step is to ad- Once a benchmark frequency is defined verity of consequences, when reduced to
just the likelihood categories so they are as a number, dividing or multiplying it dollars, seems to be separated by orders
one order of magnitude apart. After that, by ten is straightforward. Development of magnitude.
consequence categories should be adjusted of consequence categories, however, re- Once likelihood and consequence cat-
so they are also one order of magnitude quires agreement on what consequence egories that are separated by orders of
apart. The intervals could be 1.5, 15 and is ten times worse than another. magnitude have been established, an
150 years, or 5, 50 and 500 years, as long In the early twentieth century, H.W. SIL-assignment matrix can be developed.
as they are an order of magnitude apart. Heinrich [1] proposed the idea that for An example of a blank table is given in

2 CHEMICAL ENGINEERING [Link] SEPTEMBER 2007

[Link] 2 3/6/09 11:16:41 AM

 TABLE 5: SIL ASSIGNMENT MATRIX,WITHOUT SILS
Consequences (per event)
5 4 3 2 1
< 0.1 in- ≥ 0.1 injuries ≥ 0.1 disability ≥ 0.1 fatality ≥ 1 fatality
juries ≥ 1 first aid ≥ 1 Injury ≥ 1 disability ≥ 10 dis-
≥ 1 near miss ≥ 10 first aids ≥ 10 injuries abilities
1. Frequent
(>1 event/1.5 years)
Likelihood

2. Occasional has been no success in setting tolerable

(>1 event/15 years)
3/4. Seldom/Remote risk levels. The argument was made that
(>1 event/150 years) “a strict bright line approach to decision
5. Unlikely making is vulnerable to misapplication
(<1 event/150 years)
since it cannot explicitly reflect uncer-
'BUBMJUJFT tainty about risks, variation of suscep-
NBO
ZS                 tibility within a population, community
"VTUSBMJB $PNQBOZ preferences and values, or economic con-
/48 * siderations — all of which are legitimate
)POH
,POH $PNQBOZ
** components of any credible risk manage-
/FUIFSMBOET $PNQBOZ ment process.” In other words, in the U.S.,
*** tolerable risk remains very much subject
6OJUFE 4NBMM
,JOHEPN DPNQBOJFT to the political process.

FIGURE 3. Government mandates defining FIGURE 4. CPI benchmarks show that CPI benchmarks
tolerable risk are often referred to as bright large, multinational companies tend to set
lines. The color coding here refers back to levels consistent with government man- Almost all major companies in the chemi-
the 3 levels in the ALARP principle as shown dates. Smaller companies tend to operate in cal process industries (CPI) have guide-
in Figure 2. The U.S. does not set tolerable wider ranges and implicitly at higher levels lines for tolerable risk, but they are gen-
risk levels, nor offer guidelines of risk
erally considered highly confidential. No
TABLE 6: VOLUNTARY RISKS company is going to announce to the pub-
Smoking 9.7 x 10-3/yr or 9,700 fatalities per year per million smokers lic, for example, that they would tolerate
Automobile accident 1.4 x 10-4/yr or 140 fatalities per year per million people up to one fatality per year per ten thou-
Lightning strike 1.5 x 10-7/yr or 15 fatalities per 100 years per million people sand workers.
Some companies, especially smaller
Table 5. All that remains is to associate tolerable risk region must demonstrate ones, do not have explicit guidelines. How-
an SIL with each cell in the matrix. that they have achieved the lowest risk ever, the risk they tolerate can be inferred
possible, taking into consideration cost from the risk reduction measures they
What is a tolerable risk? versus risk reduction. have in place. Smaller companies with-
SILs represent the residual risk between out explicit guidelines generally tolerate
what is left after all other layers of protec- Government mandates greater levels of risk than their larger
tion have been applied to a hazard, and Some countries have mandated upper counterparts and this isn’t inappropriate.
the tolerable risk. But what is the toler- and lower levels for tolerable risk. Most A small company, struggling to establish
able risk? Consider this: Whether or not countries that have set these levels use itself or to make payroll, is going to look
your company has established a tolerable the average level of risk faced by the en- at the amount of risk that it can and must
risk criterion for your facility, what do you tire workplace population, regardless of tolerate to get through the next year very
believe it should be? How infrequently occupation, as the upper limit for toler- differently from a company that is look-
would a fatality occur for you to be able able risk. In many developed countries, ing out over the next 100 years. A small
to describe your facility as safe? Once a that is the equivalent of one fatality per company with a single plant will look at
year? Once every three years? Once every year per 1,000 workers. This upper bound- a single event that occurs once every 250
5,000 years? Once every million years? ary represents the level of fatality rate years and may very well decide that once
The ALARP principle (Figure 2) was de- already tolerated in industries such as every 250 years might as well be never.
veloped by the Health and Safety Execu- underground mining or deep-sea fishing. A large company, with 50 similar plants
tive of the U.K. It states that risks should The lower boundaries are generally two or around the world would look at that same
be reduced to a level that is “As low as three orders of magnitude lower. risk as once every 250 years for each plant,
reasonably practicable.” The ALARP prin- The Netherlands took a similar ap- but once every 5 years for the corporation,
ciple first divides risk into three areas: proach, but then declared that workplace and make a very different decision about
Intolerable Risk at the high end, Negli- risk should be 1% of general risk, because whether the risk is tolerable (Figure 4).
gible Risk at the low end, and the Toler- it is not voluntary risk. This results in
able Risk that falls between the two. Risk levels that are 100 times lower than those Voluntary and ‘natural’ risks
in the middle region can be tolerated as chosen by most countries that set levels. The levels mandated by governments,
long as all cost-effective measures to re- These levels, as shown in Figure 3, are or self-imposed by companies, can best
duce risk have been put into place. Any- sometimes called “bright lines,” especially be understood in terms of some of the
one operating a process with risks in the when discussed in the U.S., where there risks to which people voluntarily expose

CHEMICAL ENGINEERING [Link] SEPTEMBER 2007 3

[Link] 3 3/6/09 11:16:41 AM

 TABLE 7. COMPLETED RISK MATRIX FOR EXAMPLE A
5 4 3 2 1
< 0.1 ≥ 0.1 injuries ≥ 0.1 disability ≥ 0.1 fatality ≥ fatality
injuries ≥ 1 first aid ≥ 1 Injury ≥ 1 disability ≥ 10 dis-
≥ 1 near miss ≥ 10 first aids ≥ 10 injuries abilities
1. Frequent N/R SIL 1 SIL 2 SIL 3 Redesign
(1 event/1.5 years)

Likelihood
2. Occasional N/R N/R SIL 1 SIL 2 SIL 3
themselves. That is not to say that risks (1 event/15 years)
like these should ever be compared to pro- 3/4. Seldom/Remote N/R N/R N/R SIL 1 SIL 2
cess risks in a public setting, which would (1 event/150 years)
likely inflame the audience. But, for one’s 5. Unlikely N/R N/R N/R N/R SIL 1
own understanding, it is helpful to know
that the upper level for ALARP is typically above is for all fatalities in the plant. How- Doing the math, the center of our tar-
set at 1 x 10–3 per year, or almost ten times ever, not all fatalities result from process get cell has a risk of 2.7 x 10–4 fatalities
lower than the risk to which smokers ex- safety risks, that is from process hazards. per man-year. Going back to our tolerable
pose themselves. If a chemical process had There are still the slips, trips and falls, the risk criteria, that is less than 4 x 10–4, so it
the same risk as smoking, it would be con- housekeeping issues, the electrical safety translates to SIL 2.
sidered an intolerable risk. and confined-space entry issues, and trans- Once we can assign SIL 2 to that cell,
On the other hand, dying from a light- portation-related fatalities. completing the rest of the matrix is easy
ning strike would generally be considered For Example A, assume that half of the (Table 7). The cell to the left is one order of
a negligible risk. If you consider your own risk comes from process safety risks or magnitude less risk, so it is SIL 1. Every-
personal risk management strategies, process hazards. If total tolerable risk is thing to the left of that is not rated. Simi-
chances are that you have not invested in 4 x 10–5 fatalities/man-year, then process larly, the cell below is one order of magni-
lightning protection at your home. Even in safety risk is half of that, or 2 x 10–5 fatali- tude less risk, so it is also SIL 1. Everything
your plant, the lightning protection is for ties/man-year. below that cell is not rated. Filling in the
electrical equipment, not personnel. Although we’ve assumed that no more rest of the matrix follows the same logic.
The risk of a fatality in a car accident is than half of the risk comes from the pro- When we’re finished, we have a risk ma-
within the ALARP region. Of course driv- cess hazards, we need to consider all of the trix that can be used for SIL assignment
ing has the potential for fatalities, but the process hazards that could lead to a fatal- for all SIFs, whether or not fatal conse-
risk is tolerable because the convenience ity. Unless there is only one potentially quences are anticipated.
or benefit is worth it. If it wasn’t, society fatal hazard, not all of the process safety Interestingly enough, when the risk ma-
would insist on lower speed limits and risk can be allocated to a single hazard. trix is finished, it spells out the criteria for
more safety features in cars. One approach is to assume workers are assigning an SIL to an SIF without ever
each exposed to a certain number of po- explicitly acknowledging a tolerable risk.
Example A: 1 fatality/100 years tentially fatal hazards, say five, and then The tolerable risk is only implied.
Let’s get back to SIL assignment. While distribute the “risk budget” over those five
each of us has a different level of personal hazards in establishing SIL selection crite- Example B: 1 x 10–6 fatalities/man-yr
tolerable risk, when asked how small the ria. Other hazards, although not expected Now consider Plant B. It is very similar to
average frequency for a fatality would need to be fatal, can then use the same criteria. Plant A, with the same number of exposed
to be for a plant to be considered safe, it is If total process safety risk is 2 x 10–5 fatali- workers and the same number of poten-
not at all uncommon for people to pick 100 ties/man-year, then: tially fatal hazards. In this case, however,
years. This is longer than any one person’s N/R: ≤ 4 x 10–6 fatalities/man-year senior management has declared that risk
career but short enough to be meaningful SIL 1: ≤ 4 x 10–5 fatalities/man-year needs to be reduced to the level considered
in terms of the life of a facility. So consider SIL 2: ≤ 4 x 10–4 fatalities/man-year “negligible” on the ALARP diagram (Fig-
a facility with a tolerable fatality rate of SIL 3: ≤ 4 x 10–3 fatalities/man-year ure 2). That is, less than one fatality per
one per 100 years. SIL 4 or re-design: > 4 x 10–2 fatalities/ million man-years.
Further assume that at this facility, the man-year The portion of total risk to an individual
workforce includes 250 workers who would attributable to process safety risk would
be exposed to process risks: Putting a stake in the ground again be half, or 5 x 10–7 fatalities per man-
(1 year/250 man-years) (1 fatality/100 With the tolerable risk criteria settled, year. Once again, with each individual
years) = 1 fatality/25,000 man-years then the next step is to assign an SIL to worker exposed to about five potentially
= 4 x 10–5 fatalities/man-year one of the cells in the matrix. For this ex- fatal hazards, the threshold for avoiding
= total tolerable risk ample, let’s look at cell 2–2 in Table 5. an SIL-rated SIF is 1 x 10–7 fatalities per
In this case the total tolerable risk is one We want to consider the risk at the mid- man-year.
fatality per 25,000 man-years, or 4 x 10–5 dle of the cell. Since the scale is logarith- Likewise, SIL 1 is less than 10–6, SIL 2 is
fatalities per man-year, which falls in the mic, the middle of the cell on the likelihood less than 10–5, and SIL 3 is less than 10–4.
middle of the tolerable risk region. scale is the log (geometric) mean of 1.5 and In the CPI, anything larger than 10–4 would
15 years, or 4.7 years. The log mean of 0.1 need to be redesigned to reduce the hazard
Process risk is only part of risk fatalities per event and 1 fatality per event before a safety instrumented function for
Note that the tolerable risk established is 0.32 fatalities per event. risk reduction was even considered.

4 CHEMICAL ENGINEERING [Link] SEPTEMBER 2007

[Link] 4 3/6/09 11:16:41 AM

 TABLE 8. COMLETED RISK MATRIX FOR EXAMPLE B
5 4 3 2 1
< 0.1 ≥ 0.1 injuries ≥ 0.1 disability ≥ 0.1 fatality ≥ fatality
injuries ≥ 1 first aid ≥ 1 Injury ≥ 1 disability ≥ 10 dis-
≥ 1 near miss ≥ 10 first aids ≥ 10 injuries abilities
1. Frequent SIL 2 SIL 3 Redesign Redesign Redesign
(1 event/1.5 years)

Likelihood
2. Occasional SIL 1 SIL 2 SIL 3 Redesign Redesign
Looking at the middle of the same cell, (1 event/15 years)
we still end up with a risk of 2.7 x 10–4 3/4. Seldom/Remote N/R SIL 1 SIL 2 SIL 3 Redesign
fatalities per man-year. The plant is the (1 event/150 years)
same, so the risk is the same. What’s dif- 5. Unlikely N/R N/R SIL 1 SIL 2 SIL 3
ferent is the tolerable risk. In the case of
Plant B, the tolerable risk is set at a much a column of all non-rated SIFs, or else or to have very, very large consequences.
lower level, and so in this case, the risk all the SIFs, regardless of risk, will end And even in those cases, the quantitative
is not quite low enough to meet the SIL up being SIL rated. By the same token, analysis only needs be done if there is a
3 rating: there is no reason to extend the matrix question about the SIL assignment of a
farther to the left than a column that is particular SIF.
(1 event/4.7 years) (0.32 fatalities per
all “N/R”, or farther to the right than is Finally, risk matrix is easy to apply,
event) (1 yr/250 man-years) = 2.7 x 10–4
all “redesign”. and will result in hazards and their as-
fatalities/man-year
sociated risks being treated similarly
SIL rating = SIL 4 or redesign Business results achieved from project to project. This will result
As in the first example, the rest of the When a company establishes a risk ma- in much less under-specification with in-
matrix is easily populated. Because of the trix for SIL assignment, the matrix re- tolerably high risk, and much less over-
difference in tolerable risk, the SIL as- ceives a fairly broad distribution. To the specification with resulting misallocation
signments have shifted toward the lower extent that the company is uncomfortable of limited safety resources. ■
left-hand corner of Table 8. publicizing its tolerable risk criteria, the Edited by Dorothy Lozowski
risk matrix approach to SIL assignment Reference
Variations to consider does not require an explicit statement of 1. Heinrich, H.W., “Industrial Accident Prevention: A
Scientific Approach,” 4th ed., McGraw-Hill, N. Y.,
A variation to consider, depending on risk tolerable risk. 1959.
philosophy, is what part of a cell to bench- Because likelihood and consequence
mark to. In our examples, we took the cen- only need to be estimated to the nearest
ter of a cell. If the upper right corner is order of magnitude, most SIL assign- Author
used instead, the result will be an SIL as- ments can be made without using de- Mike Schmidt is a principal con-
sultant with Emerson Process
signment that is higher by one level. This tailed and expensive quantitative risk- Management at the Refining and
is clearly a more conservative approach. analysis techniques. It is usually easy to Chemical Industry Center in St.
Louis (641 Lambert Pointe Drive,
Another variation to consider is the get agreement, based solely on the expe- Hazelwood, MO 63042; Phone:
314-872-6069; Fax: 314-872-8686;
number of categories for both likelihood rience of the risk-assessment team, that Email: [Link]@emerson
and for consequence. Typically, a 5 x 5 ma- an event is likely to occur between 10 and [Link]). His responsibilities
include facilitating HazOps and
trix is the largest workable matrix, with 100 years, rather than spend the time de- other PHAs, consequence analy-
sis, facilitating LOPAs, reviewing
a larger matrix, the team doing risk as- termining whether it will be once every and preparing SRSs (SIS safety requirements specifica-
tions), and performing SIL calculations. Schmidt con-
sessment will probably spend more time 37 years or once every 54 years. sults on process design and optimization and teaches
debating categories than is warranted. By Since it is usually easy to get agree- in all these areas. In addition to being a registered PE
in several states, Schmidt is a CFSE. He has been with
the same token, if the matrix is smaller ment in the middle regions of conse- Emerson for over ten years, and has been working in the
CPI since 1977. The majority of his career has been in
than 3 x 3, it is unlikely to have enough quence and likelihood, quantitative risk operating companies, including Union Carbide, Rohm
detail to be worthwhile. analysis can be reserved for the more and Haas, and Air Products. He is the author of several
articles on process design and process safety, and is cur-
In general, it is a good idea to extend extreme situations, such as hazards that rently serving on the CCPS committee that is preparing
a guideline book on tolerable risk and on the API com-
the matrix far enough to the left to get are either expected to be very, very rare, mittee on overfill protection.

Reprinted with permission from Chemical Engineering. Copyright © 2009. All rights reserved.
#1-25811213 Reprinted by The YGS Group, 717.399.1900. For more information visit [Link]/reprints.

ER-00054 Sept07

[Link] 5 3/6/09 11:16:41 AM