Target Safety Integrity Level Research Articles

A mathematical optimization model for determining safety integrity levels in process facilities

In process industries, Safety Instrumented Functions (SIFs) are implemented to meet government-mandated risk tolerance criteria, which aim to ensure the safety of both individuals and society. The level of risk reduction achieved by a SIF is quantified by its Safety Integrity Level (SIL). Determining the target SILs is a challenging task for facility owners as they must balance the costs and benefits of risk reduction while complying with regulatory requirements. Furthermore, governments define risk tolerance criteria for an overall facility rather than for single scenarios. Therefore, determining a set of SILs for all SIFs becomes imperative to collectively reduce both individual and societal risks to tolerable levels intended for the overall facility. In this paper, we propose a mathematical optimization model to determine the most beneficial collection of SILs that guarantees meeting the risk tolerance criteria. Our model considers both individual and societal risk perspectives and effectively models an overall facility. The proposed model is applied to a process facility and the results are compared with the results from the existing methods for SIL determination. The results demonstrate the model's superior effectiveness in helping owners to select the most beneficial target SILs while ensuring compliance with government requirements.

SIL‐3, SIL‐2, and unicorns (there is a high probability your SIL 2 and SIL 3 SIFs have no better performance than SIL 1)

AbstractSafety instrumented system (SIS) standards improved the definition of interlocks and introduced requirements for improved management systems to enforce independence from other independent protection layers (IPLs). SIS standards require verification that the performance of each safety instrumented function (SIF) will be met during its lifetime, where the performance criterion is documented as the target safety integrity level (SIL) or risk reduction factor for the SIF. The SIL is in turn tied to specific values of probability of failure on demand (PFD). The current SIS standards and the TR (Technical Reports, from ISA) that explain how to do SIL verification calculations do not include accounting for specific human error probabilities—this is a major deficiency as even the probability of a single human error can be much larger than the target PFD of 0.001 for a SIL 3 and oftentimes a little larger than the PFD of 0.01 for a SIL 2. The SIL verification methods outlined in the standards and technical reports like ANSI/ISA TR84.00.02 facilitate consistency for the component‐only failure rates. As user companies seek to obtain greater risk reduction from their SIS to satisfy their corporate risk criteria, failure to adequately address potential specific human failures can lead to overly optimistic results and a misallocation of resources intended to reduce risk.

Criticality analysis for safety-critical software in nuclear power plant distributed control system

Abstract Software criticality analysis examines the degree of contribution that each individual failure mode of a software component has on the reliability of software. Higher safety integrity levels are assigned to software modules whose failures cause an unacceptable impact on the operation of the system, and these levels require the implementation of more rigorous software quality assurance measures as defined in IEEE Std 1012 and in the customer’s system requirements specification. In this paper, a novel software criticality analysis method is proposed, the results of which can be used to guide the development of newly developed software and the procurement of Commercial-Off-The-Shelf (COTS) software. The software structure is first analyzed and the software is divided into modules according to their functions. Then the criticality levels of software components are preliminarily classified by means of a safety criticality preliminary analysis tree, followed by their verification through the software hazard and operability analysis (HAZOP). Finally, the target Safety Integrity Level (SIL) of each software module is determined based on its criticality level and the overall safety objective (i. e., SIL) of the system it resides in. As an example, this proposed method is applied to a nuclear power plant safety-critical system to demonstrate the detail application process and to verify the feasibility of the method. Compared with the existing software criticality analysis methods, this method has better operability and verifiability, and can be utilized as a technical guidance for the software criticality analysis of nuclear power plant digital control systems.

“Is your SIF trying to do too much?”

AbstractThe number of inputs and outputs to a SIF (safety instrumented function)—including voting—affects the probability of failure on demand (PFD) and the SIL (safety integrity level), assuming the test interval remains the same. The larger the number of inputs and outputs that perform separate functions, the higher the PFD and potentially the lower the SIL. What if the SIF includes all the sensors and final elements that are involved in any trip of a large processing unit like a heater, a reformer, or a distillation column? What if the SIF includes actions to shut down upstream and downstream units? When SIL verification is done for such a SIF, the target PFD and SIL may not be possible to achieve. The temptation may be to add redundancy in sensors and final elements or to reduce the proof test interval in an attempt to reduce the calculated PFD. Frustration may abound as capital and operating costs rise steeply. This paper shows how to use the principles of layer of protection analysis and the information in the process hazard analysis to split up the massive SIF into smaller SIFs that are more manageable. An example is included.

Reliability assessment and verification of safety instrumented systems with the application of LOPA and FTA in the isomerisation unit of the Isfahan Oil Refinery

The reliability and effectiveness of safety systems in the isomerisation unit of Isfahan refinery complex were evaluated. The methodology consisted of two parts: 1) identification of hazardous scenarios, protection layers, and safety integrity level (SIL); 2) verification of SIL of the system using fault tree analysis (FTA). Out of the 22 identified hazardous scenarios, four scenarios had SIL 1, 17 scenarios had SIL 2, and 1 scenario had SIL 3. The scenario related to stop the outflow of fluid from the pumps with the consequent increase in reaction intensity, rise in temperature, and ultimately the reactor explosion had the most critical points of the production process and SIL 3. In all the scenarios, SIL of the system was in accordance with the required SIL (Target SIL). The results indicated that the intrinsic safe design and use of up-to-date equipment with high reliability led to an acceptable level of risk.

New fuzzy uncertainty assessment approach of target SIL evaluation by risk graph optimization

The requirements on the design of safety instrumented systems based on safety integrity level (SIL) have been developed continuously in the oil and gas industries. IEC 61508 and IEC 61511 explain various methods to determine the target SIL for specified safety functions, such as risk graph, risk matrix and layer of protection analysis. These methods could achieve different target SIL for the same safety function, principally due to uncertainty in the models. Additionally, uncertainties in the input parameters donate uncertainty in the output (target SIL). Based on conventional practice in oil and gas industry, engineer usually use different methods such as risk graph, hazardous event severity matrix and LOPA to evaluate target SILs for the same function and accept the most conservative value as the target SIL. In this paper, the uncertainty assessment in target SIL determination evaluated by the risk graph method using new fuzzy set approach has been done and finally a new framework based on this method is proposed.

An adverse outcome pathway framework to support the assessment of DART liabilities of compounds

Recent developments in technology and the move towards efficient utilisation of resources have inspired researchers and practitioners to come up with cost-effective approaches to Safety Integrity Level (SIL) determination and calculation as the current methods are too cumbersome and time-consuming. The bottom line is meeting the organisation's safety requirements in an economical manner regardless of methodology employed without sacrificing accuracy. This paper proposes the Funnel Risk Graph Method (FRGM) as a funnel technique to assess lower SIL ratings, whilst more complex methods can be applied on higher SILs with caution. A review of various target SIL determination and calculation methods in the life cycle of a Safety Instrumented System (SIS) is also presented and compared as per the criteria of relevant qualifying factors. The key outcome of this review is that the qualitative FRGM can be used as a funnel technique to assess lower SIL ratings whilst more complex methods are applied on higher SILs with caution.

Identify SIF and specify necessary SIL, and other IPLs, as part of PHA/HAZOP - or - why it is not necessary to “boldly go beyond HAZOP and LOPA”

This article shows how to apply the qualitative definition of IPLs within the setting of a process hazard analysis (PHA) to get most of the gain from Layer of Protection Analysis (LOPA) without doing a LOPA (without using numerical values). The article includes an implementation path to develop PHA leader competencies to guide the qualitative approach. We also show the way we use a PHA team to identify when a SIF is needed and to select the proper target safety integrity level (SIL). This portion of the SIL evaluation and the identification and labeling of the IPLs during the PHA/hazard and operability analysis (HAZOP) does not take any longer than a normal PHA/HAZOP, once the right habits are established. Note that this approach eliminates the need for a separate SIL Evaluation Study to identify the SIFs and select the target SIL. Finally, the article ties together these two specific topics, along with the topic of making risk judgments, to show there is less than 5% need to go beyond HAZOP, and less than 0.01% need to go beyond LOPA. © 2016 American Institute of Chemical Engineers Process Saf Prog 35: 349–359, 2016

SIL determination as a utility-based decision process

Using the concept of ALARP (As Low As Reasonably Practicable) and the Expected Utility Theory (EUT), this paper introduces a risk-based optimisation approach to the SIL (Safety Integrity Level) determination process. In the commonly used SIL determination methods the target SIL is determined by comparing the existing level of risk to a pre-set corporate risk target; the gap defines the level of risk that should be reduced by additional layers of protection, such as safety systems. Such methods do not directly factor in the cost impact of the allocated target SILs, nor do they examine the practicability of all SIL alternatives in reducing the risk to as low as possible. The method presented in this paper is based on assigning utility values to different SIL alternatives, in accordance with the cost and benefits of each alternative, and comparing the expected utility values in order to determine the optimum SIL rating as target. A numerical analysis has been developed and applied to the SIL evaluation for a gas turbine over-speed protection to demonstrate the advantages and challenges of the new method.

Pfd Formulae Considering Imperfect Proof Tests

The current state of the art in process and plant safety for the process industries with means of process control technology (PCT) follows the concepts of functional safety as denoted in IEC 61511-1 (2003). Target of the standard is to provide suitable means for ensuring safety integrity of PCT safety functions throughout their entire lifecycle.Each PCT safety function gets rated with a SIL (safety integrity level) as a measure for the process risk that any particular measure covers. The higher the SIL the higher the requirements towards safety related availability.Among other requirements, IEC 61511-1 provides two criteria that depend on the target SIL and are tailored towards handling of systematic and random failures preventing a PCT safety function from executing its intended safety function upon demand:The minimum required hardware fault tolerance (HFT) criterion demands a minimum degree of redundancy in order to compensate for systematic failures, like design flaws, that could not be eliminated by the safety management system.For random hardware failures the average PFD (Probability of Failure on Demand) is to be calculated. It is a probabilistic criterion that is impacted by hardware failure rates, degree of redundancy, diagnostic means, as well as the maintenance strategy.IEC 61508-6 (2010) (part 6 of the related framework standard to IEC 61511) provides an overview of suitable mathematical methods that could be used to obtain the PFD. However, since most of the approaches tend to generate large and complex system descriptions (e.g. Markov technique) a set of simplified calculation formulae is also provided. From these, a large set of publications have been generated, providing even further simplified PFD calculation approaches, e.g. US ISA TR84.00.02 pt. 2 (2002) or German VDI/VDE 2180 pt. 4 (2010). Simplified equations allow for PFD calculation without the need for elaborate and time-consuming probabilistic models that require well-trained reliability engineers.A typical disadvantage of available simplified equations is their lack of consideration of imperfect proof tests: While a 100 % test of PCT safety equipment is not feasible in many cases, the related mathematical representation would often become too complex to be presented as a closed equation.In order to overcome these shortcomings, the current revision of German VDI/VDE and NAMUR PCT safety standards will address said topic by including a set of advanced PFD calculation formulae.These come for the most common (diverse redundancy) architectures (1oo1, 1oo2, 2oo3, …) and allow for the consideration of individual imperfect proof tests per channel. They can further be combined with partial tests (also with individual proof test coverage per channel).Together with the equations, recommendations on achievable proof test coverages for both, proof tests and partial tests, will be included.

Uncertainty analysis for target SIL determination in the offshore industry

The requirements on the design of SISs (Safety Instrumented Systems) based on SIL (Safety Integrity Level) have been developed continuously in the offshore industry. IEC 61508 and IEC 61511 illustrate various methodologies to determine the target SIL for specified safety functions, such as risk graph, layer of protection analysis, etc. These methods could arrive at different target SILs for the same safety function, mainly due to uncertainty in the models. In addition, uncertainties in the input parameters contribute to uncertainty in the target SIL. In the offshore industry, engineers usually utilize two or more methods to assess target SILs for the same function and take the most conservative value as the target SIL. In this paper, we investigate on the uncertainty in determining target SILs evaluated by the risk graph method, Minimum SIL Table from OLF 070 and LOPA. A procedure of SIL determination accounting for uncertainties is proposed for the risk graph method, Minimum SIL Table from OLF 070 and LOPA by using a Fuzzy Set approach only and the combination of Monte Carlo simulation and Fuzzy Set approach.

3-Parameters SPW technique: A new method for evaluation of target safety integrity level

Introduced by IEC-61508 standard, safety integrity levels (SIL) have been used for assessing the reliability of safety instrumented functions (SIF) for protection of the system under control in abnormal conditions. Different qualitative, semi-qualitative and quantitative methods have been proposed by the standard for establishing target safety integrity levels amongst which “Risk Graph” has gained wide attention due to its simplicity and easy-to-apply characteristics. However, this method is subject to many deficiencies that have forced industry men and experts to modify it to fit their demands. In this paper, a new modification to risk graph parameters has been proposed that adds more flexibility to them and reduces their subjective uncertainties but keeps the method as simple as before. Three parameters, namely severity (S), hazard avoidance probability (P), and demand rate (W) are used instead of former four parameters. Hence, the method is named SPW. The outcome results of this method can be directly converted to probability of failure on demand (PFD) or risk reduction factor (RRF). The proposed method has been tested on an example case that has been studied before with conventional risk graph and LOPA techniques. The results show that new method agrees well with LOPA and reduces costs imposed by conservative approximations assumed during application of conventional risk graph.

An evaluation approach using a HARA and FMEDA for the hardware SIL

Safety instrumented systems (SIS) are becoming increasingly complex, and form a growing proportion of programmable electronic parts. The IEC 61508 global standard was established to ensure the functional safety of SIS; however, it was expressed in highly macroscopic terms. The safety integrity level (SIL) is a criterion describing whether a component meets the safety requirements of a SIS. The safety requirements give a target SIL for the expected risks using hazard analysis and risk assessment (HARA). The SIL must correspond to the safety requirements. This study introduces an evaluation process for determining the hardware SIL through failure modes, effects, and diagnostic analysis (FMEDA). First, the components of the SIS subsystem are defined in terms of failure modes and effects, and then the failure rate and failure mechanism distribution are assigned to each component. The safety mode and detectability of each failure mode are determined for each component and, finally, the hardware SIL is evaluated. We perform a case study to evaluate the hardware SIL of the flame scanner system using HARA and FMEDA, where the safety requirement of the flame scanner was determined using the risk graph method. We verified that the hardware SIL of the flame scanner corresponded to the safety requirement.

Cookbook versus performance SIS practices

A safety instrumented system (SIS) is designed to achieve or maintain a safe state of the process when unacceptable process conditions are detected. An SIS is an independent protection layer that is covered by the performance-based standard ANSI/ISA 84.00.01-2004. The risk reduction allocated to the SIS determines its target safety integrity level (SIL). ANSI/ISA 84.00.01-2004 allows a combination of factors to be considered in the verification of the SIL of the SIS. Performance-based practices provide flexibility to users, yet add complexity to the design process, encouraging project teams to reinvent the wheel for even widely used process equipment. For many engineering applications, prescriptive approaches are favored due to simplicity. These so-called cookbook practices were very common in the process industry when ANSI/ISA 84.01-1996 was issued. They are also the backbone of many application standards and recommended practices. The cookbook typically specifies the SIS and maximum proof test interval based on analysis and accepted practice. The user must ensure that the cookbook assumptions are met by the existing equipment and mechanical integrity program. Otherwise, the installed risk reduction may not achieve the expected performance. This article provides an example of a “cookbook” approach for a simple SIS and illustrates the effect of extending the proof test interval from 1 year to 5 years on its probability of failure on demand. © 2008 American Institute of Chemical Engineers Process Saf Prog 2008

A case study of safety integrity level assessment and verification: Electronics division product line evaluation and analysis

With the adoption of IEC 61511 (Functional safety—Safety instrumented systems for the process industry sector) and ANSI/ISA-84.00.01-2004 (IEC 61511 Mod, Functional safety: safety instrumented systems for the process industry sector, Parts 1–3) standards, Air Products and Chemicals has made a concerted effort to provide a standardized approach to the design and implementation of safety instrumented systems following the safety lifecycle model. This presentation provides a case study describing the methodology used during the safety integrity level (SIL) assessment and verification of existing electronics division product lines. SIL assessment was accomplished through the use of hazard identification; likelihood, consequence, and risk analysis. Each of the electronics division product's safety instrumented function (SIF) was identified during SIL Assessment, making use of both layer of protection analysis (LOPA) and consequence analysis. A target SIL was determined for each SIF through quantitative and qualitative analysis. SIL Verification was accomplished using fault tree analysis in order to determine the average probability of failure on demand (PFDAVG) of each SIF. This analysis was a joint collaboration between the process safety and process controls engineering teams. © 2007 American Institute of Chemical Engineers Process Saf Prog, 2008

Techniques for assigning a target safety integrity level

The new ANSI/ISA S84.01-1996 (Instrument Society of America S84.01 Standard, Research Triangle Park, NC 27709, February 1996, [1]) Application of safety instrumented systems for the process industries, standard requires that companies assign a target safety integrity level (SIL) for all safety instrumented systems (SIS) applications. The assignment of the target SIL is a decision requiring the extension of the process hazards analysis (PHA). The assignment is based on the amount of risk reduction that is necessary to mitigate the risk associated with the process to an acceptable level. All of the SIS design, operation, and maintenance choices must then be verified against the target SIL. This paper examines the six most common techniques currently utilized throughout the process industries: Consequence Only, Modified HAZOP, Risk Matrix, Risk Graph, Quantitative Assessment, Corporate Mandated SIL.