Overcoming challenges in using layers of protection analysis (LOPA) to determine safety integrity levels (SILs)

Abstract

The international standard on safety instrumented systems (SISs), IEC 61511/ISA 84, requires the determination of safety integrity levels (SILs) for safety instrumented functions (SIFs) in SISs. Arguably, this is the most important requirement in the standard. Various methods are used for SIL determination including risk matrices and risk graphs, although layers of protection analysis (LOPA) is used increasingly. In employing these methods, a determination must be made as to whether existing risk levels for a process are tolerable by comparing risk estimates with risk tolerance criteria. If a risk gap is found, the SIL required to close the gap is specified. This determination requires setting risk tolerance criteria and making risk estimates.LOPA is used to calculate the risk of individual hazard scenarios. Consequently, in order to simplify the determination of SILs using LOPA, overall risk tolerance criteria often are allocated to individual hazard scenarios so that risk estimates for scenarios can be compared with the allocated criteria. Sometimes hazardous events are used and the risks of scenarios that involve the same hazardous event are aggregated. Unfortunately, allocation of facility risk tolerance criteria to scenarios or events is fraught with difficulties and use of LOPA with allocated risk tolerance criteria can produce inaccurate results within a facility and inconsistent results across facilities.A procedure is provided in this paper for SIL determination using LOPA in which facility risk tolerance criteria are used meaningfully and justifiably. The procedure entails the calculation of overall facility risk and an examination of contributions to the risks to individuals and groups of people from sources of risk such as different types of hazards, different modes of process operation, and different units and processes. The procedure is illustrated with an example.