Functional risk-reduction measures

Safety instrumented systems (SIS) play a major part in industrial risk management as risk reduction measures. The main European standard for functional safety of SIS, denoted electrical / electronic / programmable electronic (E/E/PE) safety-related systems, is the EC 61508 (lEC, 2005a). The second edition will soon be adopted in 2009 (EC, 2009). Objectives are to enable the design of SIS, and the development of apphca-tion sector standards. Such examples are EC 61511 (lEC, 2004) for process industry, and EC 62061 (EC 2005b) for machinery. One of the main contributions of EC 61508 is to consider the overall system and software safety life cycle. The standard fi amework, with the corresponding normative parts and subclauses, is ... 

Functional Safety Assessment is according to lEC 61508 an investigation, based on evidence, to judge the functional safety achieved by one or more E/E/PE safety-related systems and/or other risk reduction measures. ... 

For those hazardous events where you end up in the black area, the risk reduction can be determined in different ways both by E/E/PE safety related systems and by other risk reduction measures. Other risk reduction measures can, for instance, be a safety function completely determined by mechanics. 

Estimate the risk of each hazard, as a function of the likelihood or frequency of the hazard and its potential consequences Identify candidate risk reduction measures for each hazard Choose which risk reduction measures to implement, with priority given to the hazards with the highest risks... 

Whilst lEC 61508 provides design requirements for the achievement of functional safety for E/E/PE safety-related systems, it does not provide design requirements for other risk reduction measures but does take into account the risk reduction achieved by such measures. 

Function to be implemented by an E/E/PE safety-related system or other risk reduction measures, that is intended to achieve or maintain a safe state for the equipment under control in respect of a specific hazardous event. ... 

The failure frequency necessary to meet the tolerable risk, with respect to a specific safety function being carried out by the safety-related system, is determined taking into account any other risk reduction measures that are properly designed on functional safety criteria and properly managed throughout the life of the equipment. 

SILs are order of magnitude bands of PFDavg, which also reflects the amount of risk reduction of a preventive safety instrumented function. Non-SlS Mainly two parameters, namely, consequence and likelihood, which affect risk, are considered. The consequence is the potential severity of the hazard. The likelihood is the frequency of occurrence. Risk graphs/risk matrices are used for these purposes. The inherent risk can be reduced by non-SlS risk reduction. To assess the risk, one is required to know and evaluate the effectiveness of all non-SIS risk reduction measures to ensure that the risk is reduced to as low as possible before application of any SIS. In other words, it is required to assess whether an SIS is necessary to further reduce the risk. Non-SIS risk reduction methods could be consequence reductions such as a dike, whereas blast walls or blast-resistant control buildings could reduce likelihood. 

Functional safety As per lEC 61508 4 2010, it is part of overall safety relating to EUC and EUC control system that depends on functioning of E/E/PE safety related system and other risk reduction measures." From lEC 61511, one gets that, it is that part of the overall safety related to the process and the BPCS which depends on the correct functioning of the SIS and other protection layers (not only SIS). The difference is due to the fact that lEC 61511 is related to process. 

Overall safety requirements To develop the specification for the overall safety requirements, in terms of the safety functions requirements and safety integrity requirements. EUC, the EUC control system and human factors. Description of, and information relating to, the hazard and risk analysis Specification for the overall safety requirements in terms of the functions and safety integrity. Includes SIS, non-SIS and external risk reduction measures. 

Review meetings will then include the results of SLC study work, which will provide feedback on the risk assessment and proposed risk reduction measures associated with functional safety problems. 

Allocation of risk reduction measures to SIS and non-SIS functions as per phase 5... 

Here, WSN is seen as a system exhibiting a binary functioning behavior i.e one monitored point is covered and connected or not with binary sensors i.e. one sensor is in an active state (Tx, Rx, Idle) or not. For this kind of system, both importance measures RRW and RAW are commonly used (Youngblood, 2001). RRW of component i stands for Risk Reduction Worth and is defined by... 

Identification of critical structures and/or critical functions probability analysis or range of potential consequences quantitative or quahtative analysis Risk reduction (e.g. risk reduction steps for particular measures, risk reduction effectiveness in terms of threat, vulnerability, and consequence of loss of a particular asset, risk reduction effectiveness in terms of threat, vulnerability, and consequence of loss in context of a larger system and the entire Sector). 

Hazard analysis The functions, steps, and criteria for design and plan of work, which identify hazards, provide measures to reduce the probability and severity potentials, identify residual risks, and provide alternative methods of further control (SSDC) a process of examining a system, design, or operation to discover inherent hazards, characterizing them as to level of risk and identifying risk-reduction alternatives (APR 800-16) the determination of potential sources of danger and recommended resolutions in a timely manner for those conditions found in either the hardware/software systems, the person-machine relationship, or both, which cause loss of personnel capability, loss of system, or loss of life or injury to the public (NSTS 22254). 

Thus SIL is both a measure of the risk reduction needed to bring an unwanted event to a tolerable frequency and a specification for the system or systems that are designed to perform the safety-related function. 

It is inherent in the model that all hazards are translated into rehable, quantified bands of risk and rated accordingly. This function is critical to the safety system as the rating forms the basis for both determining action priorities and measuring the impact of ary risk reduction. This process provides the benchmark for continuous improvement. 

According to lEC 61508-4 [lEC, 1998c], low demand mode safety functions are those where the frequency of demands on safety-related system is no greater than one per year and no greater than twice the proof test frequency . The measure of safety performance of a demand mode safety function is the risk reduction factor, AR ... 

Systematic failure normally occurs on account of design failure, including incorrect specifications, using a component not fit for the operation, and or due to error in software. Safety life cycle is adapted for systematic faults. So safety standards meant for E/E/PEs take care of both. SISs (Ref. Chapter VII) are developed to prevent or mitigate hazardous events to protect people or the environment, or prevent damage to process equipment. In this connection another important issue is SIL (Chapter VIII), which is a discrete level for specifying the safety integrity requirements of safety functions, but is not a measure of risk. SIL provides means for risk reduction to a tolerable level. The fundamental question, in case of functionally safe instrumentation, is how frequently failures of function will lead to accidents. The answers can be ... 

We applied the generic safety standard EN ISO/IEC 61508 [2] to the signal path and interpreted the COOPERS services as safety functions. The safety standard prescribes measures and methods to reduce the risk from an unacceptably high level to one below the so-called "tolerable risk", which is typically in the magnitude of the natural risk to which a human is exposed without the system. For our specific case a modified risk reduction approach had to be chosen In COOPERS, we start from a risk level which society already considers tolerable, and the services are expected to reduce the risk even further. 

---