Safety Instrumented Functions Research Articles

A mathematical optimization model for determining safety integrity levels in process facilities

In process industries, Safety Instrumented Functions (SIFs) are implemented to meet government-mandated risk tolerance criteria, which aim to ensure the safety of both individuals and society. The level of risk reduction achieved by a SIF is quantified by its Safety Integrity Level (SIL). Determining the target SILs is a challenging task for facility owners as they must balance the costs and benefits of risk reduction while complying with regulatory requirements. Furthermore, governments define risk tolerance criteria for an overall facility rather than for single scenarios. Therefore, determining a set of SILs for all SIFs becomes imperative to collectively reduce both individual and societal risks to tolerable levels intended for the overall facility. In this paper, we propose a mathematical optimization model to determine the most beneficial collection of SILs that guarantees meeting the risk tolerance criteria. Our model considers both individual and societal risk perspectives and effectively models an overall facility. The proposed model is applied to a process facility and the results are compared with the results from the existing methods for SIL determination. The results demonstrate the model's superior effectiveness in helping owners to select the most beneficial target SILs while ensuring compliance with government requirements.

Optimization of safety instrumented system performance and maintenance costs in Algerian oil and gas facilities

Gas processing industry is associated with high risks which have the potential to cause catastrophic accidents. Safety Instrumented Systems (SISs) are considered the most effective safety barriers in this sector aiming to prevent undesired events and mitigate their consequences. However, several factors can affect their performance including maintenance strategy in place. In this paper, a Stochastic Petri Net (SPN) model is proposed for evaluating maintenance strategies related to SIS. The model is applied to analyze the performance of an Emergency Shutdown System (ESD) in a Flared Gases Recovery Unit located at south Algerian field. Furthermore, the paper investigates the financial impact of proof tests, including direct costs (such as manpower, equipment, and transportation) and indirect costs (such as production losses and gas flaring tax). These costs can be effectively managed and reduced by optimizing proof test intervals and scheduling tests during planned plant shutdowns. The results demonstrate that the proposed Stochastic Petri Net (SPN) model successfully analyzes the impact of imperfect full and partial proof tests on PFD average values of Safety Instrumented Functions (SIFs). In addition, it has been shown through reliability analysis that the proposed model is able to minimize spare parts expenses leading to significant cost savings while maintaining the required safety integrity levels (SILs), about 60% benefit achieved within two years compared to the actual procurement process over same period.

Risk assessment of solid desiccant dehydration package system using safety integrity level‐based safety instrumented system design approach

AbstractThe dehydration package system plays an important role in the stable process operation and production of high‐quality liquefied natural gas by removing water, which is essential for natural gas production. However, as this system operates under various conditions with chemicals, there are threats to safety from potential hazards within the system. Therefore, ensuring system safety can significantly impact the reliable operation of process plants. This study aims to assess the risk of the dehydration package system through the safety integrity level (SIL)‐based safety instrumented system (SIS) design approach as suggested in the International Electrotechnical Commission (IEC) 61,508/61511 standards. Fourteen major hazards requiring recommendations were identified for improving safety through the hazard and operability study (HAZOP). The three major hazards were valve malfunction and gas heater/cooler control failure. Twenty‐one safety instrumented functions (SIFs) in all study nodes were suggested as recommendations to improve safety. Using layers of protection analysis (LOPA), the SIL allocation of the 21 SIFs was performed reasonably with process risks and safeguards. The PDS method was adopted for SIS design and verification, with SIL analysis performed for all the SISs. The results showed that SISs of the dehydration package system satisfied the required SILs.

Hazard evaluation and safety assessment for subsea HIPPS

AbstractThe safety practice of depressurization of pipelines by flare system in the hydrocarbon industry is not sufficient for pipelines in the subsea production process. There are many challenges in the subsea production process due to multiphase fluid flow. Failure of a process to arrive at its safe state could result in fatality, significant property damage, and can lead to a disastrous environment. The safe state of a process is identified through the consequence of hazard and risk assessments at critical modes of operations. A well‐designed safety instrumented function (SIF) can prevent escalation of minor malfunction into an accident. The prime objective of this work is to obtain the required safety integrity level (SIL) for subsea High Integrity Pressure Protection System (HIPPS). Based on hazard assessment (HAZOP) and risk assessment (LOPA), SIL for SIF is recommended, and finally through reliability calculations, the SIL for subsea HIPPS is determined.

Using credible failure rates for SIS ensures process safety: A summary of the panel discussion

AbstractOn March 13, 2023, in conjunction with the 19th Global Congress on Process Safety, four of the authors gathered to participate in a panel session. The discussion centered on the premise that many individual device failure rates published by some manufacturers and some certifying agencies are deemed—by members of the panel, many safety instrumented system (SIS) designers, and practicing engineers in the field—to be too low. This is especially true for mechanical final elements. A SIS designed using these unrealistic failure rates often results in estimated safety integrity levels (SILs) for the individual safety instrumented functions (SIFs) comprising the SIS, which would be achievable only under the most optimistic assumptions regarding installation, operation, and maintenance. These estimated SILs are unlikely to be achieved in the field. The panel discussed the underlying causes of this serious safety issue and proposed some possible solutions. This paper summarizes the panel discussion among four of the authors. Relevant graphics shown during the discussion and some panelists' quotations are included.

SAFETY INTEGRITY LEVEL ASSESSMENT AT URANIUM EVAPORATOR AND DEPOSITION VESSEL IN NON NUCLEAR REACTOR INSTALLATIONS

The operation of non-reactor nuclear installations that use nuclear material in the process must be ensured safely during the process. One of the assessments of the safety level of the protection system that has been owned by the installation is using the Safety Integrity Level (SIL) which assesses the safety level of the protection system based on the value of the risk reduction factor that the protection system can achieve. The uranium evaporator and deposition vessel at the Experimental Fuel Element Installation (EFEI) is one of the installations that uses nuclear material in the process so it is necessary to assess the SIL of these 2 vessels. The piping and instrumentation diagram (P&ID) is used to determine the SIL value and Safety Instrumented System (SIS) component are installed in evaporator and deposition vessel. Maintenance data and OREDA (Offshore Reliability Data) are used to determine the failure rate. After knowing and determining the installed SIS components, then determining the architecture vote of the Safety Instrumented Function (SIF) based on the P&ID diagram, so that it can be known that the installed SIS uses vote 1oo1, 1oo2, 1oo3, or the appropriate vote. The installed SIF architecture vote will determine the equation used to calculate the Probability Failure on Demand (PFD). The total PFD obtained is adjusted to the SIL table to find out what SIL level the installed protection system is at. The value of the safety level of the protection system with SIL assessment in the evaporator vessel obtained 2 protection systems with SIL values of level 2 all and in the deposition vessel obtained 2 protection systems with SIL values of level 1 and level 2. The SIL value in the evaporator and deposition vessel analyzed has not reached level 3 or 4, so it is necessary to add SIF to the SIS protection system to increase the SIL value until the SIL value is obtained between level 3 or 4 because safety in the operation of non-reactor nuclear installations is absolute.Keywords: Non-Reactor Nuclear Installations, PFD, SIF, SIL, SIS

SIL calculation in gas processing plants based on systematic faults and level of maturity

Since Safety Instrumented Systems (SIS) are of great importance in terms of safety and protection in industrial plants, many efforts have been made for appropriate use of these systems. As it is vital not to sacrifice hazards, potential dangers, and people’s safety and health, for economic and financial reasons, device selection and configuration in SISs should be pursued with sufficient care to achieve a certain Safety Integrity Level (SIL). Today, many SIL calculation methods use pure random failures, while systematic failure mechanisms are still active in every plant and may cause serious damages and injuries. Meanwhile, the available standards have not explicitly suggested “specific requirements relating to 100% avoidance of systematic faults and errors, which generally lead to systematic failures”. In this paper, the failures which led to shutdown in four units of a gas refinery, including a total number of 352 safety instrumented functions (SIFs), during 10 years of operation are investigated. Based on the obtained practical results, systematic error contribution to the studied SIFs failures is determined. Moreover, amateur decision making profound impacts on dangerous failures have been analyzed. The developed closed-form formula for calculation of systematic error’s weight in various levels (e.g., management level, engineering phase, etc.) has been verified, using different case-studies of an in-service gas plant. Furthermore, a practical guideline is proposed to improve the decreased actual SIL value, while taking into account the impacts of systematic failures.

Functional safety assessment process for MITICA safety system in the ITER neutral beam test facility

The Safety System of the ITER Neutral Beam Test Facility (NBTF) aims to deal with all risks for people and environmental safety related to SPIDER and MITICA operation. A coordinating system, called Central Safety System (CSS), was designed to supervise safety-relevant systems, implement safety actions on the different plant units to guarantee the NBTF personnel safety and provide an effective human interface of the NBTF safety. The SPIDER CSS, the part of CSS dealing with SPIDER and NBTF shared items, is in operation, while the MITICA CSS is in the detailed design phase. The MITICA CSS will have the same architecture and principles as SPIDER CSS. A safety risk analysis was carried out based on a Hazard Identification (HAZID) methodology: MITICA plant was partitioned into 46 nodes, for each node possible hazards were identified based on a list drawn up from EN ISO 12100 standard and, after that, the risk assessment process was performed. As a result, the Safety Instrumented Functions (SIF) to be implemented in the MITICA CSS were defined. Through a Layer Of Protection Analysis (LOPA) approach, in accordance with the IEC 61511 standard, the Safety Integrity Level (SIL) was allocated to each SIF. This paper will describe the MITICA risk analysis process and present the relevant functional safety results for MITICA CSS implementation.

Safety assessment through HAZOP‐LOPA‐SIL analysis implementation in the DPA demulsifier production process

AbstractIn this paper, the HAZOP‐LOPA‐SIL method is implemented on a safety assessment for an O‐benzenedicarboxylic acid diallyl ester (DPA) demulsifier production process. The risk matrix and tolerable risk criterion are determined with hazard and operability (HAZOP) analysis, and the whole processing technique is divided into nine nodes and seven safety instrumented functions (SIFS). By using guide words and subsequence parameters, the deviation of each node is analyzed, and recommendations are then proposed. After determining the safety integrity level (SIL) of each SIF according to the layer of protection analysis (LOPA) method, the result shows that the SIL of the whole system is SIL1. Considering the influence of mechanical element degradation (valves) on SIL determination, gamma distribution has been adopted to analyze the gradation process. In the serviceable cycle, the minimum PFD average is larger than 0.21 in order to exceed the range of SIL 1. This means that the SIL of the SIF can effectively prevent the failure caused by valve degradation. According to software analysis, the SIL validation result of the whole safety instrument system(SIS) is SIL1.

SIL‐3, SIL‐2, and unicorns (there is a high probability your SIL 2 and SIL 3 SIFs have no better performance than SIL 1)

AbstractSafety instrumented system (SIS) standards improved the definition of interlocks and introduced requirements for improved management systems to enforce independence from other independent protection layers (IPLs). SIS standards require verification that the performance of each safety instrumented function (SIF) will be met during its lifetime, where the performance criterion is documented as the target safety integrity level (SIL) or risk reduction factor for the SIF. The SIL is in turn tied to specific values of probability of failure on demand (PFD). The current SIS standards and the TR (Technical Reports, from ISA) that explain how to do SIL verification calculations do not include accounting for specific human error probabilities—this is a major deficiency as even the probability of a single human error can be much larger than the target PFD of 0.001 for a SIL 3 and oftentimes a little larger than the PFD of 0.01 for a SIL 2. The SIL verification methods outlined in the standards and technical reports like ANSI/ISA TR84.00.02 facilitate consistency for the component‐only failure rates. As user companies seek to obtain greater risk reduction from their SIS to satisfy their corporate risk criteria, failure to adequately address potential specific human failures can lead to overly optimistic results and a misallocation of resources intended to reduce risk.

Safety in modular process plants: demonstration of safety concepts

The modularization of process plants addresses the need for flexible production options in the process industry. In order to maintain the advantages of the adaptability of modular plants, an adaptation of established engineering methods and procedures to their dynamic context of use is required. This paper describes the development and the features of a demonstrator, which makes it possible to investigate aspects of modular plant topology, the design of modular process units, and the functional safety of modules and plants. During the engineering of the modules, modular planning principles are applied and evaluated with respect to the requirements for functional safety and with a strong focus on the modification of safety systems through the exchange of PEAs and FEAs. For the design and modification of the safety systems, a safety life cycle, which meets the requirements of modular automation and takes the provisions of IEC 61508 and IEC 61511 into account, is applied. Practical insights into the construction and the implementation of the distributed Safety Instrumented System as well as the Basic Process Control System are described. In addition to the validation of safety concepts related to the interconnection of Safety Instrumented Functions, the demonstrator is used to study human working environments in modular plants.

“Is your SIF trying to do too much?”

AbstractThe number of inputs and outputs to a SIF (safety instrumented function)—including voting—affects the probability of failure on demand (PFD) and the SIL (safety integrity level), assuming the test interval remains the same. The larger the number of inputs and outputs that perform separate functions, the higher the PFD and potentially the lower the SIL. What if the SIF includes all the sensors and final elements that are involved in any trip of a large processing unit like a heater, a reformer, or a distillation column? What if the SIF includes actions to shut down upstream and downstream units? When SIL verification is done for such a SIF, the target PFD and SIL may not be possible to achieve. The temptation may be to add redundancy in sensors and final elements or to reduce the proof test interval in an attempt to reduce the calculated PFD. Frustration may abound as capital and operating costs rise steeply. This paper shows how to use the principles of layer of protection analysis and the information in the process hazard analysis to split up the massive SIF into smaller SIFs that are more manageable. An example is included.

Implementing layer of protection analysis in a global organization

AbstractThis paper will cover challenges and learnings from implementing layer of protection analysis (LOPA) in a Global organization. The challenges include a wide range of different processes, multiple functional organizations and different country guidance and regulations. The learning will include methods used for streamlining LOPA and communicating consistent LOPA guidance. LOPA is better used as a comparison tool than as an absolute measure of risk. For LOPA results to be comparable, common standards need to be used within the LOPA technique. The paper will cover some of the methods used to embed LOPA practices including: (1) Guidance using worked examples. (2) Templates for similar equipment. (3) Using an internal LOPA governance board to review complicated LOPAs. (4) Use of common software.(5) Strong interfaces between LOPA and safety instrumented function development.

Slaying the dragons that sabotage protection measures to feed on the ash of your plant

AbstractDragons are legendary winged monsters that breathe fire and feed on ash. Or so we think. This is a tale of three dragons that have evolved to hide in plain sight and quietly feed on the underpinnings of protection layers, eroding the effectiveness of process safety mitigation measures. These dragons are mischievous and feed off process upsets, near misses, and accidents. The Invisible Dragon roams around the plant breaking devices and causing people to make mistakes that set off alarms and causes safety instrumented systems (SIS) trips to initiate. Its special joy is creating initiating events that were not considered in the design. Tiny and Giant Dragons specialize in defeating the SIS protection layers, so that all three dragons can feed on the ash of an accident. The Tiny Dragon baits SIS designers with devices having extremely low failure rate data causing the humans to believe safety instrumented functions (SIF) are more reliable than they actually are. The Giant Dragon works alongside the Tiny Dragon to further undermine the SIS with its song of near perfect proof testing. This paper will illustrate the impacts of underestimating SIF demand rate, using overly optimistic failure rate data, and overestimating proof test coverage. We will discuss techniques to identify and correct these issues and suggest metrics to monitor SIS performance thus slaying the dragons.

Why a run-to-fail strategy is not good practice for SIS?

The Maintenance & Reliability engineers understand pain area that the portion before the “flat” part of the “Bathtub” is where a high number of premature failures can occur: commonly referred to as “infant mortality”. One of the fundamentals of the Probability of Failure on Demand (PFDavg) calculations in SIL verification analysis, is the concept of a constant failure-rate during useful life of the equipment. Probabilistic calculations assume that the failure rate of the devices used in a Safety Instrumented System (SIS) remains constant during the “flat” (constant failure rate) portion of the “bathtub” curve. Most manufacturers will perform stringent testing to weed-out, weaker units that could fail prematurely, leading to unwanted warranty claims. When equipment reaches to flat portion of it’s lifetime called as “wear-out” phase then the failures start to rise dramatically & then the integrity of the Safety Instrumented Functions (SIF) is compromised. During the Operation and Maintenance phase of the SIS, periodic performance assessments need to be made in order to ensure the as-designed, installed and commission SIS and its SIFs, still meet the performance requirements of the Safety Requirement Specification (SRS) [1]. Using a run-to-fail strategy will not enable the SIFs to meet the performance requirements once wear-out occurs. This paper will explain why a run-to-fail strategy is not good practice for a SIS, which will lead to the de-graded performance of the SIFs. This paper addresses both the design and operational impacts of a run-to-fail strategy.

Latest Technology to Manage the Complete Process Safety Lifecycle

Latest developments in software technology allow for the management of the complete Process Safety Lifecycle as defined in standard IEC-61511 for the Process Industry. Most companies in the Process Industry have accepted the necessity of conducting Process Hazard Evaluations e.g. HAZard and OPerability (HAZOP) studies and Layer Of Protection Analysis (LOPA), however it has been more challenging to follow-up on the recommendations and demonstrate that the Safety Instrumented Functions have been built and tested in accordance with the design specifications. Validating the assumptions of the Safety Study and a comparison with actual Process Safety performance in the Plant has proven to be cumbersome and was almost impossible in the past. Furthermore, there was little insight in the financial impact of Process Safety risks. Modern Technology facilitates the validation, hence allowing for the management of the entire Process Safety Lifecycle. Real measured Lead Process Safety KPI's can be produced, controlled and managed.

Confirming the safety instrumented system layer of protection

AbstractThe safety instrumented system (SIS) is a complex protection layer with high reliability requirements. Assuring the effectiveness of the SIS requires monitoring the effectiveness of the safety instrumented functions (SIFs) as well as the independent protection layer(s) (IPL) that reduce demand on the SIF(s). An SIF tripping more frequently than anticipated may be due to flaws in IPLs intended to reduce demand on the SIF. A slower than expected or failed SIF trip may be due to flaws in the SIF components, the proof testing program, the maintenance program, or inadequate SIF design. This article will identify parameters that should be routinely monitored, illustrate how data can be captured and analyzed, detect weaknesses in the SIS IPL, and provide recommendations for routine monitoring and audit activities.

Research on safety requirements of critical safety instrumented function in coke oven gas to methanol process using aspen simulation

As an important part of the protection measures, safety instrumented systems are widely used in process industries, especially in coal chemical industry. The setpoint value and process safety time (PST), which are contents of safety requirements, of the safety instrumented function (SIF) directly affects whether the safety function can correctly protect a specific scenario. In this paper, the setpoint value and PST of the SIF of “low coke oxygen ratio” is studied. The HAZOP-LOPA method is used to analyze the deviations and the possible cause and consequences. Steady-state model of coke oven gas (COG) to methanol is established based on Aspen Plus to research the effect of the coke oxygen ratio on the high-temperature gas temperature and oxygen concentration in syngas under different working conditions. Based on the simulation results, combined with the sensor working principle and signal processing, the setpoint value is determined. The PST is determined by using Aspen Dynamics. It is found that the smaller the coke oxygen ratio, the higher the high-temperature gas temperature, and the higher the oxygen concentration in syngas; for controlling the coke oxygen ratio, controlling oxygen flow is more critical than controlling COG flow; the setpoint value should be set to 3.78; the PST should be or less than 3.4s.

Study on the risk analysis and system safety integrity of enclosed ground flare

The advantages of enclosed ground flare (EGF) contain that emissions of combustion in a timely manner, safe and reliable, complete combustion, low noise, to meet environmental protection. So EGF has become one choice of more chemical plants. However the EGF still belongs to the new technological means, the strength design of the flare system and the safety distance still do not have the standard requirement. Therefore, this paper research on the development process of the exhaust gas explosion caused by the EGF. Firstly, using PHAST software to simulate the damage caused by the flare gas leakage outside the abnormal condition. This is the determination of the safety distance of the EGF effect. And then using Hazard and Operability Analysis (HAZOP), Layer of Protection Analysis (LOPA), and Fault Tree Analysis (FTA) failure model for Safety Integrity Level (SIL) verification, demonstrate the installation of Safety Instrumentation System (SIS) to protect the Safety Instrumented Function (SIF) circuit to meet the safety requirements. This paper is conducive to the wind wall and the flare system of various types of material strength design and the surrounding personnel and facilities to determine the safety distance.

Safety systems in the ITER neutral beam test facility

SPIDER, the experimental device of the ITER Neutral Beam Test Facility (NBTF) devoted to the study of the ion source, has recently started operation. The construction of MITICA, the full-size prototype of the ITER heating neutral beam injector, is in progress. SPIDER and MITICA operation presents many possible hazards including radiation, electrical, explosive gas, laser and fire risks. An integrated approach, referred to as the NBTF Safety System, was chosen to deal globally with all risks for people and environment safety. As many different systems collaborate to guarantee the NBTF safety, a coordinating system, called Central Safety System (CSS), was implemented to supervise safety-relevant systems and provide an effective human interface of the NBTF safety. The CSS is also required to implement directly safety instrumented functions. The requirements of the safety systems derived from the safety risk analysis. The CSS uses the Siemens SIMATIC S7 400FH PLC along with safe input/output remote nodes connected through double ring-topology, redundant Profibus network. Complying with the IEC 61508/61511 standards, the system architecture uses the PROFISafe profile and the human machine interface is based on WinCC Open Architecture. Special provisions are used for communication of safety-related information with the PLC.