“Is your SIF trying to do too much?”

Abstract

AbstractThe number of inputs and outputs to a SIF (safety instrumented function)—including voting—affects the probability of failure on demand (PFD) and the SIL (safety integrity level), assuming the test interval remains the same. The larger the number of inputs and outputs that perform separate functions, the higher the PFD and potentially the lower the SIL. What if the SIF includes all the sensors and final elements that are involved in any trip of a large processing unit like a heater, a reformer, or a distillation column? What if the SIF includes actions to shut down upstream and downstream units? When SIL verification is done for such a SIF, the target PFD and SIL may not be possible to achieve. The temptation may be to add redundancy in sensors and final elements or to reduce the proof test interval in an attempt to reduce the calculated PFD. Frustration may abound as capital and operating costs rise steeply. This paper shows how to use the principles of layer of protection analysis and the information in the process hazard analysis to split up the massive SIF into smaller SIFs that are more manageable. An example is included.