Safety Integrity Level Verification Research Articles

HAZOP Study and SIL Verification of Fuel Gas System in ORF Using IEC 61511 Standard and FTA Method

Safety is an important aspect of the industrial process. Failure of system and mechanism endanger both human and environmental safety. Safety is obligated to be implemented precisely and thoroughly to prevent failure consequences. One of the preventive implementations is to map out safety devices in the form of SIS (Safety Instrumented System) and other layers of protection. However, to acknowledge this safety device performance used SIL (Safety Integrity Level). This final research is intended to analyze Fuel Gas systems on Onshore Receiving Facilities (ORF). HAZOP (Hazard Operability Study) as process hazard analysis with deviation during the operation so that the risk level is known. SIL verification towards SIL target is SIL-2 refer to IEC 61511 standards by FTA (Fault Tree Analysis) method. From the HAZOP study can be concluded that over-pressure becomes a top hazard to all nodes due to the most severe consequences, the highest likelihood (medium risk). The calculation result of PFDavg is Node 1 (Fuel Gas Scrubber V-6060) is 6,22E-03, Node 2 (Fuel Gas Filter Separator S-6060A) is 1,24E-03, Node 3 (Fuel Gas Filter Separator S-6060B) is 1,24E-03, Node 4 (Fuel Gas Superheater E-6060) is 1,21E-03, and Node 5 (Instrument Gas Receiver V-6070) is 2,23E-03. The conclusion of this research shows that five components of the Fuel Gas System fulfill the SIL-2 target, therefore, doing a re-design to add a safety device is unnecessary

SIL‐3, SIL‐2, and unicorns (there is a high probability your SIL 2 and SIL 3 SIFs have no better performance than SIL 1)

AbstractSafety instrumented system (SIS) standards improved the definition of interlocks and introduced requirements for improved management systems to enforce independence from other independent protection layers (IPLs). SIS standards require verification that the performance of each safety instrumented function (SIF) will be met during its lifetime, where the performance criterion is documented as the target safety integrity level (SIL) or risk reduction factor for the SIF. The SIL is in turn tied to specific values of probability of failure on demand (PFD). The current SIS standards and the TR (Technical Reports, from ISA) that explain how to do SIL verification calculations do not include accounting for specific human error probabilities—this is a major deficiency as even the probability of a single human error can be much larger than the target PFD of 0.001 for a SIL 3 and oftentimes a little larger than the PFD of 0.01 for a SIL 2. The SIL verification methods outlined in the standards and technical reports like ANSI/ISA TR84.00.02 facilitate consistency for the component‐only failure rates. As user companies seek to obtain greater risk reduction from their SIS to satisfy their corporate risk criteria, failure to adequately address potential specific human failures can lead to overly optimistic results and a misallocation of resources intended to reduce risk.

“Is your SIF trying to do too much?”

AbstractThe number of inputs and outputs to a SIF (safety instrumented function)—including voting—affects the probability of failure on demand (PFD) and the SIL (safety integrity level), assuming the test interval remains the same. The larger the number of inputs and outputs that perform separate functions, the higher the PFD and potentially the lower the SIL. What if the SIF includes all the sensors and final elements that are involved in any trip of a large processing unit like a heater, a reformer, or a distillation column? What if the SIF includes actions to shut down upstream and downstream units? When SIL verification is done for such a SIF, the target PFD and SIL may not be possible to achieve. The temptation may be to add redundancy in sensors and final elements or to reduce the proof test interval in an attempt to reduce the calculated PFD. Frustration may abound as capital and operating costs rise steeply. This paper shows how to use the principles of layer of protection analysis and the information in the process hazard analysis to split up the massive SIF into smaller SIFs that are more manageable. An example is included.

Reliability assessment and verification of safety instrumented systems with the application of LOPA and FTA in the isomerisation unit of the Isfahan Oil Refinery

The reliability and effectiveness of safety systems in the isomerisation unit of Isfahan refinery complex were evaluated. The methodology consisted of two parts: 1) identification of hazardous scenarios, protection layers, and safety integrity level (SIL); 2) verification of SIL of the system using fault tree analysis (FTA). Out of the 22 identified hazardous scenarios, four scenarios had SIL 1, 17 scenarios had SIL 2, and 1 scenario had SIL 3. The scenario related to stop the outflow of fluid from the pumps with the consequent increase in reaction intensity, rise in temperature, and ultimately the reactor explosion had the most critical points of the production process and SIL 3. In all the scenarios, SIL of the system was in accordance with the required SIL (Target SIL). The results indicated that the intrinsic safe design and use of up-to-date equipment with high reliability led to an acceptable level of risk.

Safety Integrity Level Verification Model for IED Protection Schemes

The ever-increasing complexity of intelligent electronic devices (IED) for the protection of electrical equipment leads to significant research challenges in evaluating their safety integrity level (SIL). The development of new technologies, components, operation, and maintenance requirements are factors that increase uncertainties and risks associated with the safety, integrity, and reliability of the IEDs. Based on both “the U.K. guidance on assessing the safety integrity of electrical supply protection” and Markov processes, this research proposes a methodology to assess and verify the integrity of protection schemes in industrial and commercial power systems. The average probability of failure on demand (PFDavg) and SIL level, are used to quantify the reliability of protection arrangements for radial distribution systems in accordance with the safety integrity foundations of IEC 61508 and IEC 61511 standards. The methodology is implemented with the IEEE 242-2001 case study, with illustrative results.

IEC 61508 안전 무결성 수준의 정량적 검증

IEC 61508 안전 무결성 수준의 정량적 검증

Safety integrity level verification for safety-related functions with security aspects

Abstract The article is devoted some important issues of the functional safety analysis, in particular the safety integrity level (SIL) verification of safety functions to be implemented within the distributed control and protection systems with regard to cyber security aspects. The procedure for functional safety management includes hazard identification, risk analysis and assessment, specification of overall safety requirements and definition of safety functions. Based on risk assessment results the safety integrity level (SIL) is determined for consecutive safety function. These functions are implemented within industrial control system (ICS) that consist of the basic process control system (BPCS) and/or safety instrumented system (SIS). Determination of required SIL related to required risk mitigation is based on semi-quantitative evaluation method. Verification of SIL for considered architectures of BPCS and/or SIS is supported by probabilistic models with appropriate data and model parameters including cyber security-related and uncertainty aspects. A method based on quantitative and qualitative information is proposed for SIL verification with regard of the evaluation assurance levels (EAL), the security assurance levels (SAL) and the number of protection rings described in the SeSa methodology. A method for SIL verification, based on so called differential factor is presented.

Verification of safety integrity level of high demand system based on Stochastic Petri Nets and Monte Carlo Simulation

The paper proposed an approach of verifying the Safety Integrity Level (SIL) for the high demand safety system. This approach is based on the Stochastic Petri Nets models and Monte Carlo simulation (SPN-MC) and follows the requirements of IEC61508, which is a commonly accepted standard in the domain of functional safety of programmable electronic and control engineering systems. The paper provides a comparative analysis of the SIL with the application of SPN-MC and the Reliability Block Diagram (RBD) method given by EN61508 to prove the correctness and feasibility of the SPN-MC approach. Additionally, a typical large scaled complex system was adopted to apply the novel approach, which is hard for classical analytical methods.

Integrated functional safety and cyber security analysis

The chapter is devoted some important issues of the functional safety analysis, in particular the safety integrity level (SIL) verification of safety functions to be implemented within the distributed control and protection systems with regard to security aspects. A method based on quantitative and qualitative information is proposed for the SIL (IEC 61508, 61511) verification with regard of the evaluation assurance levels (EAL) (ISO/IEC 15408), the security assurance levels (SAL) (IEC 62443), and the number of protection rings described in the Secure Safety (SeSa-SINTEF) methodology. The proposed approach will be composed of the following items: process and procedure based safety and security management, integrated safety and security assessment of industrial control system (ICS) of the critical infrastructure.

SIL verification for SRS with diverse redundancy based on system degradation using reliability block diagram

Safety integrity level (SIL) verification is a critical step in safety lifecycle of safety-related systems (SRS). Introducing redundancy into SRS raises two issues: voting group configuration and common cause failures (CCF). In order to minimize CCF, diverse redundancy is widely adopted by SRS. However, in the past, almost all attention of SIL verification has been paid to identical redundancy, this is reflected in IEC 61508, ISA-TR84.00.02 and scientific literatures. Therefore, a novel method for SIL verification of SRS with diverse redundancy based on system degradation is proposed. Key idea of the method is to calculate average probability of dangerous failure on demand (PFDG) at each stage of system degradation, which is caused by failures of redundant channels. To validate proposed method, it has been applied on safety shutdown system of Nuclear Power Control Test Facility, and numerical result is compared with FTA and FRANTIC model. Sensitivity studies and comparison of numerical results indicate that the method has very good consistency with FTA and FRANTIC model. Moreover, two sets of general formulae for PFDG of any MooN(D) group with diverse redundancy are provided. From engineering practice point of view, it makes SIL verification process simpler.

Method for assigning safety integrity level (SIL) during design of safety instrumented systems (SIS) from database

A SIL assignment method for the design and rectification of SIS used for preventing failure action and spurious activation is presented in this paper. The method has two stages, including SIL assignment based on experience and SIL assignment based on risk quantitative calculation results. SIS experience information, stored in a SIS experience knowledge database, comprises of equipment, SIS names and SIL information, which is summarized from many different SIS design packages of petrochemical units and SIS evaluation reports. In the stage of the SIL assignment based on experience, the SIL of SIS for a unit could be assigned by common SIS information retrieved from the experience knowledge database. In the stage of the SIL assignment based on risk quantitative calculation results, according to IEC 61511, a risk matrix is established to determine tolerable risks. A SIS initial event failure data table and a protective layer failure data table are established and the data could be obtained from certain common databases, such as OREDA, CCPS. The data will be used to calculate and identify residual risks after applying safeguards according to the Layer of Protection Analysis (LOPA) method. The SIL of SIS can be acquired from the calculation results of residual risks and tolerance risks. The combination use of the two stages can generate a method which could be applied in the SIS design of new-built or old-improved units. A SIL assignment program for the design and rectification of SIS is developed to help SIL-assigning. The software include three modules, a module of SIL assignment based on experience, a module of SIL assignment based on risk quantitative calculation results, and a module of SIL verification. Experience data and risk quantitative calculation results will contribute to the design of SISs for equipment systems. A residual oil hydrogenation unit is taken as an example to illustrate the design and rectification method for SIS.

New considerations for SIL verification of functional safety fieldbus communication

Safety integrity level (SIL) verification of functional safety fieldbus communication is an essential part of SIL verification of safety instrumented system (SIS), and it requires quantifying residual error probability (RP) and residual error rate of function safety communication. The present quantification method of residual error rate uses RP of cyclic redundancy check (CRC) to approximately replace the total RP of functional safety communication. Since CRC only detects data integrity-related errors and CRC has intrinsically undetected error, some other residual errors are not being considered. This research found some residual errors of the present quantification method. Then, this research presents an extended new approach, which takes the found residual errors into account to determine more comprehensive and reasonable RP and residual error rate. From perspective of the composition of safety message, this research studies RPs of those controlling segments (sequence number, time expectation, etc.) to cover the found residual errors beyond CRC detection coverage, and the influences of insertion/masquerade errors and time window on RP are investigated. The results turn out these residual errors, especially insertion/masquerade errors, may have a great influence on quantification of residual error rate and SIL verification of functional safety communication, and they should be treated seriously.

Use of hazardous event frequency to evaluate safety integrity level of subsea blowout preventer

Generally, the Safety Integrity Level (SIL) of a subsea Blowout Preventer (BOP) is evaluated by determining the Probability of Failure on Demand (PFD), a low demand mode evaluation indicator. However, some SIL results are above the PFD's effective area despite the subsea BOP's demand rate being within the PFD's effective range. Determining a Hazardous Event Frequency (HEF) that can cover all demand rates could be useful when establishing the effective BOP SIL. This study focused on subsea BOP functions that follow guideline 070 of the Norwegian Oil and Gas. Events that control subsea well kicks are defined. The HEF of each BOP function is analyzed and compared with the PFD by investigating the frequency for each event and the demand rate for the components. In addition, risk control options related to PFD and HEF improvements are compared, and the effectiveness of HEF as a SIL verification for subsea BOP is assessed.

Verification of safety integrity level with the application of Monte Carlo simulation and reliability block diagrams

The paper presents functional safety problems of technical systems. It aims to verify the safety integrity level for a selected integrated safety system. The paper provides a comparative analysis of the safety integrity level with the application of the Monte Carlo simulation and Reliability Block Diagram (RBD) methods. Additionally, a solution is proposed to section off, from the logical structure, so called voting zones to significantly reduce the risk of causing false alarms. The calculations were preceded with a review of existing studies of functional safety in extensive technical systems. The verification was done following the requirements of IEC 61508, which is a commonly accepted standard in the field of functional safety of programmable electronic and control engineering systems.

Cost effective alternative in meeting the required Safety Integrity Level (SIL)

Demonstrating process safety has always been one of the paramount concerns of Engineering, Procurement, and Construction (EPC) companies in the industrial sector, especially with the development of stringent standards such as IEC-61508 and IEC-61511. One of the means of process safety demonstration is through Safety Integrity Level (SIL) Verification. In some cases, SIL verification results show that several Safety Instrumented Functions (SIFs) do not meet their required SIL; and one of the actions is to add new SIF components. However, with the addition of new components comes a change order, which eventually leads to added cost and time overruns for design and construction projects; and in some instances, introduces additional risks to the system. This paper presents a case study based on the SIL verification report of a design and construction project. The scenario of interest involves the over-pressurization in the High Pressure (HP) Flare Knock-Out (KO) Drum which activates a SIF that will close two Shutdown Valves (SDVs), preventing added pressure to be delivered to the KO Drum. Seeing as two SDVs in a 2oo2 configuration need to be closed, the SIF was not able to meet its target failure measure of SIL 2. Three cases were set, in order to meet the required SIL. The first one involves adding new SDVs; the second case made use of upstream existing SDVs, while the third one is similar with the second but differs in configuration of the SDVs. SIL verification was performed for all three cases through the Fault Tree Analysis modeling technique. Results of this study suggest that using existing instruments can be a cost effective way of meeting the required SIL, which eliminates all the hassle and potential risk introduced when bringing in new instruments to the design.

A novel method for SIL verification based on system degradation using reliability block diagram

Safety integrity level (SIL) verification plays a critical role in reliability assessment of safety related systems. However, current methods available for SIL verification are too complicated to be applied in practice. Therefore, a novel method for SIL verification, which is based on system degradation using reliability block diagram (RBD), is proposed in this paper. The key idea of the method proposed is to perform RBD analysis and calculation of average probability of dangerous failure on demand (PFDG) at each stage of system degradation, which is caused by failures of redundant channels. The method has been applied to several classical redundant architectures of safety related systems, and could make the SIL verification process simpler. Further, the formulae obtained are identical with those given in IEC 61508.

A simplified Markov-based approach for safety integrity level verification

Safety integrity level (SIL) verification is a critical step in the life cycle of safety instrumented systems (SIS). For the chemical process industry (CPI), SIL verification often means calculation of average probability of failure on demand (PFDavg) of a SIS. Markov analysis covers most aspects of the quantitative safety evaluation and shows great flexibility. However, for a complex SIS, the model building is so cumbersome that industrial users always try to avoid using it. A simplified approach by conducting Markov analysis on each channel of a SIS with any type of architecture and combining the results together is proposed in this paper. A case study is performed and the results prove that the simplified approach can simplify Markov modeling without loss of accuracy if a proper common cause failure (CCF) model is adopted.

HASILT: An intelligent software platform for HAZOP, LOPA, SRS and SIL verification

Incomplete process hazard analysis (PHA) and poor knowledge management have been two major reasons that have caused numerous lamentable disasters in the chemical process industry (CPI). To improve PHA quality, a new integration framework that combines HAZOP, layer of protection analysis (LOPA), safety requirements specification (SRS) and safety integrity level (SIL) validation is proposed in this paper. To facilitate the integrated work flow and improve the relevant knowledge management, an intelligent software platform named HASILT has been developed by our research team. Its key components and functions are described in this paper. Furthermore, since the platform keeps all history data in a central case base and case-based reasoning is used to automatically retrieve similar old cases for helping resolve new problems, a recall opportunity is created to reduce information loss which has been cited many times as a common root cause in investigations of accidents.

The Operation Modes of E/E/PE System and Their Influence on Determining and Verifying the Safety Integrity Level

The Operation Modes of E/E/PE System and Their Influence on Determining and Verifying the Safety Integrity Level The standard PN-EN 61508 introduces some probabilistic criteria for the E/E/PE systems that can operate in different modes of operation, which are related to the safety integrity level (SIL). For the control and protection systems, operating in a low demand mode, the criterion is the average probability of dangerous failure on demand PFDavg. In case of systems working in a continuous mode of operation or high demand, the criterion is probability of dangerous failure per hour PFH. In practice, the E/E/PE systems implement many safety-related functions (SRFs), which have different requirements for high and low demands. Thus, there is the problem with choosing proper probabilistic criterion for determining required SIL for a safety-related function to be implemented by these systems as well as in the process of quantitative verification of SIL for considered architectures.

Security Aspects in Verification of the Safety Integrity Level of Distributed Control and Protection Systems

Security Aspects in Verification of the Safety Integrity Level of Distributed Control and Protection SystemsThe article addresses some important issues of the functional safety analysis, namely the safety integrity level (SIL) verification of distributed control and protection systems with regard to security aspects. A quantitative method for SIL (IEC 61508) verification, based on so called differential factors, is presented. Taking into account SIL and the evaluation assurance level (EAL), which concerns the level of information security within entire system, two parametrical criterion function is defined for the SIL verification.