Required Safety Integrity Level Research Articles

Hazard evaluation and safety assessment for subsea HIPPS

AbstractThe safety practice of depressurization of pipelines by flare system in the hydrocarbon industry is not sufficient for pipelines in the subsea production process. There are many challenges in the subsea production process due to multiphase fluid flow. Failure of a process to arrive at its safe state could result in fatality, significant property damage, and can lead to a disastrous environment. The safe state of a process is identified through the consequence of hazard and risk assessments at critical modes of operations. A well‐designed safety instrumented function (SIF) can prevent escalation of minor malfunction into an accident. The prime objective of this work is to obtain the required safety integrity level (SIL) for subsea High Integrity Pressure Protection System (HIPPS). Based on hazard assessment (HAZOP) and risk assessment (LOPA), SIL for SIF is recommended, and finally through reliability calculations, the SIL for subsea HIPPS is determined.

Safety of Control Systems with Dual Architecture Based on PLCs

The implementation of safety functions, in contrast to ordinary control functions, requires a different approach to the design of the hardware and software of the control system. The reason for the different approaches is that each safety function must meet the required Safety Integrity Level (SIL). This has two aspects: safety integrity against random failures and safety integrity against systematic failures. Hardware is primarily related to random failure safety integrity, and software primarily to systematic failure safety integrity. The focus of this contribution lies in the design of a method that will allow the software of a safety function for industrial applications to be designed using a model of the functional behavior of this function. Since commercially available programmable logic controllers (PLCs) with a defined SIL level (so-called safety PLC) do not support such solutions, a dual architecture based on standard PLCs, including their software control, is proposed in the paper. Such an approach will make it possible to significantly limit the occurrence of systematic errors in the creation of application software, as well as to test the created application software and reveal deficiencies that arose in previous phases of the life cycle (e.g., when specifying safety functions). To implement the method proposed in this paper, a dual architecture created from the safety PLC Simatic series S7-1500 is used. With the help of this architecture, the safety function “Muting” is implemented.

Calculation of the Dangerous Failure Rate of the Safety Function

Each safety-related function must be implemented with a defined safety integrity level (SIL) if the control system implements safety-related functions (SFs) in addition to the standard control functions. The required SIL of the SF depends on the quantity of the risk associated with the failure of this one SF. The SIL against random failure can be expressed through the dangerous failure rate of the SF for an electronic safety-related control system (ESRCS) operating in a continuous mode of operation. The proof must be provided (among other things) that the SIL requirements for the individual SFs are met so the ESRCS can be accepted and implemented. The assessment of the impact of random failures on the SIL of the SF must be performed using the quantitative analysis method. This paper describes the procedure and derives equations for evaluating the impact of random failure on SIL of the SF using Markov chains with two absorption states. The achieved results are presented for SF implemented by ESRCS with dual architecture based on composite fail-safety technique.

Detection Error Contaminated by Outliers to Classify Density Profiles Dependent on the Relative Speed Between a MIMO Sensor and a Human Hand

The detection of human hand intrusion is crucial for improving the productivity of human–robot collaboration. Recent trends to safety-related sensors have adopted the concept of radar-based human presence detection. Some of them have already been commercialized. However, it has not yet been elucidated whether radars can sufficiently detect human hand intrusion and satisfy the required safety integrity level. In this study, we present outlier and error profiles obtained by detecting human hand intrusion based on the motion and speeds of the human hand and radar sensor. Our experiments indicate that slow hand movements require further studies from the viewpoint of safety. In addition, we suggest a new noise model demonstrating random noise and temporary outliers based on the recorded noise profiles of actual human participants. The obtained outlier and error profiles can be utilized as an outlier judgement criterion of the sensing in the specific case of the radar.

SIL Attachment Paradigm from the Perspective of Quantitative Hazard Rates

Safety requirements aim avoidance and control of systematic faults as well as control of random faults. For demonstrating that random faults are kept under the tolerable rates, quantitative hazard analyses are performed. Paramount importance shall be attached to the definition of tolerable hazard rates (THR) since the definition of what the hazard rate is allocated to influences the expected outcomes and the correct operation of the safety-critical system. In this paper, two approaches used in railway industry are discussed by mentioning technical specifications and referencing railway standards. It is found that there are misinterpretations for the quantitative hazard rates and use cases are provided to show the results of different approaches. Moreover, safety integrity level (SIL) of the human-machine interface (HMI) related functions for on-board and trackside applications are investigated, and their drawbacks are explained for the mission-critical systems. Finally, some findings of tool usage for fulfilling SIL requirements are detailed. Beside theoretical information, this paper includes field experiences gained during the development of safety-critical on-board and trackside interlocking (IXL) projects.

The application of Bayesian – Layer of Protection Analysis method for risk assessment of critical subsea gas compression systems

Subsea gas compression system (SGCS) is a new critical subsea-to-shore field development solution that could reduce costs and environmental footprint. However, this system is not without inherent and operational risks. It is therefore, vital to evaluate the possible risks associated with SGCS to ensure the safe operation of the system. To this end, Layer of Protection Analysis (LOPA) is a suitable method for the estimation of possible risks. However, the failure rate data from SGCS required for LOPA is sparse and mostly developed from experimental testing. Bayesian (BL) logic is an effective tool that could be used to resolve this shortfall. In this paper, generic data from a secondary database was updated with SGCS specific data using BL logic to give a better risk frequency value. The key findings show that the posterior values derived from the BL-LOPA methodology are safer and more reliable to implement for an event scenario when compared to literature, expert judgement and generic data; therefore recommending an improved judgement in the application of safety instrumented systems for a required safety integrity level. The case studies used demonstrated that the BL-LOPA risk assessment method is sufficiently robust for quantifying uncertainties in new process facilities with sparse data.

Risk Graph에 의해 할당된 SIL에 따른 철도 승강장 도어 시스템의 정량적 Risk 저감 모델

There exists required safety integrity level (SIL) to assure safety in accordance with international standards for every electrical / electronics / control equipment or systems with safety related functions. The SIL is allocated from lowest level (level 0) to highest level (level 4). In order to guarantee certain safety level that is internationally acceptable, application of methodology for SIL allocation and demonstration based on related international standards is required. Especially, in case of the SIL allocation method without determining of quantitative tolerable risk, the additional review is needed to check whether it is suitable or not is required. In this study, the quantitative risk reduction model based on the safety integrity allocation results of railway platform screen door system using Risk Graph method has been examined in order to review the suitability of quantitative risk reduction according to allocated safety integrity level.

반 정량적 리스크 저감 요소를 고려한 철도 승강장 스크린 도어시스템의 안전 무결성 수준 할당

There exists required safety integrity level (SIL) to assure safety in accordance with international standards for every electrical / electronics / control equipment or systems with safety related functions. The SIL is allocated from lowest level (level 0) to highest level (level 4). In order to guarantee certain safety level that is internationally acceptable, application of methodology for SIL allocation and demonstration based on related international standards is required. However, the theoretical and practical study for safety integrity level is barely under way in the domestic railway industry. This research studied not only the global process of SIL allocation to guarantee safety in accordance with international standards for safety related equipment and system, but the quantitative methodology based on international standard and the semi-quantitative methodology as alternative way for SIL allocation. Specifically, the systematic SIL allocation for platform screen door system of railway is studied applying the semi-quantitative methodology in order to save much time and effort compared to quantitative method.

Beyond HAZOP and LOPA: Four different company approaches

For operations where application of standards, regulations, and/or Recognized and Generally Accepted Good Engineering Practices may not be sufficient to address a particular company's risk, several options exist. For qualitative assessment of process hazards, Hazard and Operability Studies (HAZOP) and What-If reviews are two of the most common petrochemical industry methods used. Up to 80% of a company's process hazard analysis (PHA) may consist of HAZOP and What-If reviews (Nolan, Application of HAZOP and What-If Safety Reviews to the Petroleum, Petrochemical and Chemical Industries, William Andrew Publishing/Noyes, 1994, p. 1). After the PHA, Layer of Protection Analysis (LOPA) is commonly used throughout industry to evaluate the required safety integrity level for instrumented protection layers in a semiquantitative manner (Dowell, International Conference and Workshop on Risk Analysis in Process Safety, CCPS/AIChE, 1997). HAZOP, What-If, and LOPA are all straightforward methods and are relatively easy to perform. However, much like a hammer, they are not always the best or most appropriate tool for a given job. At times, more advanced methodologies such as Fault Tree Analysis, Quantitative Risk Assessment, Event Tree, Failure Mode, and Effects Analysis and Human Reliability Analysis are necessary to properly assess risk. However, these more advanced tools come with a price. They are often more expensive, time consuming, and require a higher level of expertise. The decision to use these higher level methodologies is not taken lightly and different companies use different criteria for determining when to take this next step. This article will present approaches by four companies, BASF, Celanese, The Dow Chemical Company, and Eastman Chemical Company. Each company will outline criteria used to determine when to go beyond HAZOP, What-If, and LOPA and will present examples where more advanced techniques were used. The intent of this article is to provide readers with real world examples that demonstrate the appropriate application of the “right” tool and to illustrate what criteria can be used to make informed decisions regarding selection of a PHA methodology. © 2016 American Institute of Chemical Engineers Process Saf Prog 36: 38–53, 2017

Determining and verifying the safety integrity level of the safety instrumented systems with the uncertainty and security aspects

Safety and security aspects consist of two different group of functional requirements for the control and protection systems. In the paper it is proposed that the security analysis results can be used as a factor increasing or decreasing the risk level. It concerns a process of determining required safety integrity level of given safety functions. The authors propose a new approach for functional safety risk analysis. In this case the security factor influences the value of required safety integrity level SIL by changing the frequency of accident scenario. It can be done by using the methodology of modified risk graph. On the other hand there is a verification of required SIL fulfillment for designed safety-related system which implements safety function. In this case the result of security analysis is affecting uncertainty of probabilistic model parameters. The proposed method takes into consideration the sensitivity analysis of probabilistic models of E/E/PE or safety instrumented systems SIS as well as the uncertainty of probabilistic results. It uses differential factors, which are helpful for effective verification of required SIL of the E/E/PE or SIS systems taking into account results of sensitivity analysis and/or assessment of uncertainty ranges obtained from probabilistic models developed.

Cost effective alternative in meeting the required Safety Integrity Level (SIL)

Demonstrating process safety has always been one of the paramount concerns of Engineering, Procurement, and Construction (EPC) companies in the industrial sector, especially with the development of stringent standards such as IEC-61508 and IEC-61511. One of the means of process safety demonstration is through Safety Integrity Level (SIL) Verification. In some cases, SIL verification results show that several Safety Instrumented Functions (SIFs) do not meet their required SIL; and one of the actions is to add new SIF components. However, with the addition of new components comes a change order, which eventually leads to added cost and time overruns for design and construction projects; and in some instances, introduces additional risks to the system. This paper presents a case study based on the SIL verification report of a design and construction project. The scenario of interest involves the over-pressurization in the High Pressure (HP) Flare Knock-Out (KO) Drum which activates a SIF that will close two Shutdown Valves (SDVs), preventing added pressure to be delivered to the KO Drum. Seeing as two SDVs in a 2oo2 configuration need to be closed, the SIF was not able to meet its target failure measure of SIL 2. Three cases were set, in order to meet the required SIL. The first one involves adding new SDVs; the second case made use of upstream existing SDVs, while the third one is similar with the second but differs in configuration of the SDVs. SIL verification was performed for all three cases through the Fault Tree Analysis modeling technique. Results of this study suggest that using existing instruments can be a cost effective way of meeting the required SIL, which eliminates all the hassle and potential risk introduced when bringing in new instruments to the design.

Functional Safety and Mean Time to Fail for Underground Mining Proximity Detection Device in No-Go-Zones

Abstract: Due to the inevitable proximity of heavy machinery and human workers in mining and tunnelling the risk of severe accidents is high. The paper describes recent worldwide efforts to increase occupational safety in this industry. The major problems and approaches are discussed using the example of the development of proximity detection systems. Due to the hard environmental conditions, guards and protective devices cannot be used in many cases. Consequently functional safety is gaining importance in mining and tunnelling. The standards for functional safety are well-developed for manufacturing industry, but some issues cannot be applied directly in mining and tunnelling. One of these problems is the mean time to fail, which is a condition to reach a required safety integrity level. Small samples of data make statistical conclusion difficult. A method based on Markov chains is presented for this purpose and is compared with a standard method.

결과 심각도 및 리스크 그래프에 기반한 철도 승강장 도어시스템의 안전 무결성 수준 할당

Abstract : There exists required safety integrity level (SIL) to assure safety in accordance with international standards for every electrical / electronics / control equipment or systems with safety related functions. The SIL is allocated from lowest level (level 0) to highest level (level 4). In order to guarantee certain safety level that is internationally acceptable, application of methodology for SIL allocation and demonstration based on related international standards is required. However, application standard differs from every industry in domestic or international for application on mythology for allocation and demonstration of SIL. Application or asse ssment is not easy since absence on clear criteria or common definition . This research studied not only fundamental concept of SIL required to guarantee safety in accordance with international standards for safety related equipment and system, but different types of met hodologies for SIL allocation. Specifically, SIL allocation for Platform Screen Door system of railway is studied applying methodology of severity of accidents and risk graph among different methodologies for SIL allocation.

Braking system redundancy requirements for moving walks

The reliability of the braking system of moving walks plays a major role in the safe exploitation of these people movers. According to the requirements of the new standard ISO 22201-2, the reliability of a braking system of a moving walk has to correspond to safety integrity levels SIL1 till SIL3. In order to determine the required safety integrity level, a reliability analysis of a braking system has been performed using a probabilistic method and the Weibull distribution model. This paper presents the results of this reliability analysis and shows the necessity of redundancy of the braking system of public service moving walks. The results for the proposed redundant design show a higher reliability level and less reliability degradation in time than compared to braking system designs without redundancy. Based on these results and using a probabilistic and diagnostics approach, a suggestion for an intelligent system for preventing failure in a braking system is presented in this paper. This system maintains a required safety level of the braking system of a moving walk and predicts possible failures of the braking system.

Safety-Function Design for the Control System of a Human-Cooperative Robot Based on Functional Safety of Hardware and Software

Human-cooperative robots (HCRs) are expected to benefit various fields. Safety functions are essential to the control system of HCRs because their hazardous movements after a system failure may cause serious injuries to operators. Therefore, their reliability must be sufficiently high relative to the estimated risk, and it is important to design a suitable safety function for the control system to match the safety level required for an HCR. We propose a methodology of safety-function design for the control system of an HCR and attempt to effectively combine design approaches for hardware and software of safety-related systems (SRSs) on the basis of the concept of functional safety. This study describes the details of the methodology for an HCR that we adopted as a platform system. First, SRS hardware with a dual-channel voting architecture was designed, and then, functional safety analysis was performed to verify whether the hardware satisfied the required safety integrity level (SIL). Next, SRS software with diverse programming, which is recommended for the required SIL, was designed by utilizing a disturbance observer. Finally, experiments were conducted on the SRS for representative failures and the safety function was verified for the control system, as set by the proposed methodology.

Design of Functional Safety Temperature Transmitter and Reliability Analysis

This paper presents the design of the functional safety temperature transmitter and reliability analysis to develop the certified safety related product with independent intellectual property rights. According to the functional safety standard IEC61508 and the 1-out-of-1 and Diagnosis (1oo1D) architecture of the temperature transmitter, self-diagnostic methods are proposed. At the same time a Markov model is established to assess the reliability of the transmitter quantitatively. Analysis results show that safety integrity level (SIL) is SIL2 and safety temperature transmitter complies with functional safety requirements and safety integrity level requirements.

ProSIL Software for Functional Safety Management in Life Cycle / Aplikacja ProSIL Do Zarządzania Bezpieczeństwem Funkcjonalnym W Cyklu Życia

Abstract In the paper the ProSIL software to aid the functional safety management is presented. The software consists of three modules to aid: determination of the required SIL level (ProSILen), veryfication of the SIL level (ProSILver). In the aplication the method of the calibrated risk graph to determine the required safety integrity level SIL for defined safety instrumented functions is applied. The methods concerning functional safety analysis utilized in the process of the design and performing Safety Instrumented Systems (SIS) according to PN-EN 61508 and PN-EN 61511 prepared by the team during researches are implemented.

Risk reduction concept to provide design criteria for Emergency Systems for onshore LNG plants

The functional safety requirement is widely applied in the process plant industry in accordance with the international standards, such as IEC and ISA. The requirement is defined as safety integrity level (SIL) based on the risk reduction concept for protection layers, from original process risk to tolerable risk level. Although the standards specify both, the Prevention System and the Emergency System, as level of protection layers, the standards specify in detail only the use of the Prevention System (i.e., Safety Instrumented System (SIS)). The safety integrity level is not commonly allocated to the Emergency System (e.g., Fire and Gas System, Emergency Shutdown System and Emergency Depressuring System). This is because the required risk reduction can be normally achieved by only the Prevention System (i.e., SIS and Pressure Safety Valve (PSV)). Further, the risk reduction level for the Emergency System is very difficult to be quantified by the actual SIL application (i.e., evaluated based on the single accident scenario, such as an accident from process control deviation), since the escalation scenarios after Loss of Containment (LOC) greatly vary depending on the plant design and equipment. Consequently, there are no clear criteria for evaluating the Emergency System design. This paper aims to provide the functional safety requirement (i.e., required risk reduction level based on IEC 61508 and 61511) as design criteria for the Emergency System. In order to provide clear criteria for the Emergency System evaluation, a risk reduction concept integrated with public’s perception of acceptable risk criteria is proposed and is applied to identify the required safety integrity level for the Emergency System design. Further, to verify the safety integrity levels for the Emergency Systems, the probabilistic model of the Emergency Systems was established considering each Emergency System (e.g., Fire and Gas System, Emergency Shutdown System and Emergency Depressuring System) relation as the Overall Emergency System. This is because the Overall Emergency System can achieve its goal by the combined action of each individual system, including inherent safe design, such as separation distance. The proposed approach applicability was verified by conducting a case study using actual onshore Liquefied Natural Gas Plant data. Further, the design criteria for Emergency Systems for LNG plants are also evaluated by sensitivity analysis.

Cumulative Lopa Method

LOPA (Layer of Protection Analysis) is a simplified risk assessment method that is uniquely useful for determining how “strong” SIF (Safety Instrumented Function – “interlock”) should be designed. LOPA is a semi-quantitative tool which is readily applied after the Process Hazard Analysis (PHA) – for example, HAZOP – and before Fault Tree Analysis/Quantitative Risk Assessment if needed. In most cases, the SIF’s Safety Integrity Level requirements can be determined by LOPA without using the more time-consuming tool of Fault Tree Analysis or Quantitative Risk Assessment. The problem of classical LOPA approach is that it takes into consideration only one hazard scenario at a time. However a SIF may exist in several hazard scenarios, so in practice there is a need for a cumulative LOPA method where we can take into account all hazard scenarios in LOPA calculation which have identical SIF as a Safety Instrumented Independent Protection Layer. We lay down the mathematics of cumulative LOPA, and developed software called Tool4S which uses this mathematics. The article shows some example of the SW application.

A Fuzzy Probabilistic Approach for Determining Safety Integrity Level

The process industry has always been faced with the difficult task of determining the required integrity of safeguarding systems such as safety instrumented systems (SISs). The ANSI/ISA S84.01-1996 and IEC 61508 safety standards provide guidelines for the design, installation, operation, maintenance, and test of SIS. However, in the field, there is a considerable lack of understanding of how to apply these standards to both determine and achieve the required safety integrity level (SIL) for SIS. Moreover, in certain situations, the SIL evaluation is further complicated due to the uncertainty on reliability parameters of SIS components. This paper proposes a new approach to evaluate the ldquoconfidencerdquo of the SIL determination when there is an uncertainty about failure rates of SIS components. This approach is based on the use of failure rates and fuzzy probabilities to evaluate the SIS failure probability on demand and the SIL of the SIS. Furthermore, we provide guidance on reducing the SIL uncertainty based on fuzzy probabilistic importance measures.