High demand mode

Results of the evaluation typically include a number of safety integrity and availability measurements. Most important, the average probability of failure on demand (PFDavg) and the safe failure fraction (SFF) is calculated for low demand mode. Probability of failure per hour is calculated for high demand mode. From charts, the SIL level that the... 

The safety and availability of a set of equipment used for a safety instrumented function may benefit from testing. However, that depends on redundancy and how often the demand occurs. Three modes of operation have been defined in lEC 61508 for equipment providing a safety instrumented function continuous demand mode, high demand mode and low demand mode. This book will use the lEC 61508 definitions to designate those three different situations. 

In high demand mode, the probability evaluation is done by comparing the calculated probability of failure per hour (PFH) against the PFH table shown in Figure 7-4. 

Continuous / High Demand Mode Verification Calculation... 

Table 1. The different SIL levels for Low demand mode and High demand mode. 

SIL Low demand mode PFD requirements High demand mode PFH requirements... 

High demand mode The frequency of demands for operation made on a safety-related system is greater than one per year or greater than twice the proof-test frequency. 

The team assesses the number of demands placed on each SIF to ensure they are consistent with what was originally defined. For example, if the original premise was that the SIF would have about one demand for every ten years, but, in reality, the SIF is exposed to one demand a year, the team modifies the PHA assumptions based on this new operating experience. This may result in a higher SIL requirement or in the determination that the SIF is operating in high-demand mode rather than low-demand mode. 

This demand rate indicates that the SIF needs to be tested at least every 50 days to meet the demandmode criteria. Howrever, from a practical viewrpoint, the SIF is being tested very frequently to address the estimated demand rate rather than addressing the real need to ensure that the SIF provides the required performance. As stated previously, if the SIF meets either the demand rate or test frequency rule, the SIF should be considered high-demand mode. Since the SIF operates every 100 days, the SIF meets the highdemand rate rule of more than one demand per year. Testing more frequently does not affect the SIF s mode of operation. 

The estimated hazard rate (1/27 years) is higher than the SIF failure rate (1/50 years), which is not possible. Instead, the analysis should have considered that the SIF is actually operating in a high-demand mode (i.e., the SIF is the initiating cause), and the hazard rate is limited by the SIF failure rate or 1/50 years. The mechanical integrity of the SIF should be sufficient to ensure that its failure rate is equal to or less than 1/50 year. 

The batch process is tripped once every 3-4 batches, and 100 batches are produced annually. This means that the SIF operates approximately 25 to 35 times per year, which is high-demand mode operation per the rule of 1 demand per year. Looking at this on the basis of the hazard rate equation ... 

Hazardous by-product forming A hazardous by-product is formed in a chemical reaction at a very small rate (ppm). The only control is on the main reaction. The by-product accumulates over a month in the reactor and becomes a hazard when it reaches a certain concentration. An online analyzer for the by-product stopping the recycle stream when high concentration is detected provides the only protection against this hazard and was initially defined as an SIF. Linder normal operation, the demand on the SIF occurs four times a year. This indicates that it may be more appropriate to consider this as a high-demand mode SIF. The final determination depends on the dangerous failure rate of the analyzer function. 

Gas Pump Control Shutoff Gas stations employ fuel pumps that are designed to stop flow of gas when the car s gas tank is full. When the gas pump control fails to function, the car s gas tank is overfilled. The fuel pump shutdown represents an example of a protective system operating in high-demand mode, as there are several demands on the fuel pump shutoff a day. 

As shown in the previous examples, the situations that are considered to be high demand or continuous demand are actually BPCS functions that are required to be extremely reliable because there is no back-up protection system. An SIS operating as a protection system (i.e. low demand) is used to move a process to a safe state upon detection of an abnormal condition. If a process condition always occurs at the end of every batch, then it is not unexpected. Many practitioners believe that high-demand mode safety functions should not exist in the process industry, and where they are identified, they should be re-engineered to convert them to low-demand mode. 

ANSI/ISA-84.00.01-2004-1, Clause 9.2.3, provides two tables for defining the SIL requirements. Table 3 provides the SIL requirements in terms of PFDavg- Table 4 provides the SIL requirements in terms of Frequency of Failure (e.g., failures per hour) and defines the acceptable hazard rate for the high-demand/continuous SIF. ANSI/ISA-84.00.01-2004-1, Clause 9.2.3, states that when Table 4 is used, neither the proof-test interval nor the demand rate is used in the determination of the safety integrity level. This means that the Table 4 requirements should not be converted into PFDavg requirements, using the proof-test interval or the demand rate. Erroneous results can easily occur if a high-demand mode SIF is treated as a low-demand mode SIF, followed by incorrect use of Tables 3 and 4 (ANSI/ISA-84.00.01-2004-1 Clause 9.2.3). 

Table I-1 provides the hazard rate (HR) calculated from the simplified equation, which is typically the basis of Layers of Protection Analysis (LOPA), and a more rigorous equation based on the exponential distribution. The shaded area shows that for high-demand mode SIFs, the simplified equation yields a hazard rate that exceeds the failure rate k of the SIF, which is 0.1/year. In the case of either high-demand or continuous mode, the simplified mathematics developed for low-demand mode are not adequate, and more advanced assistance should be obtained from someone knowledgeable in the applicable mathematics of modeling such cases.

When the demand frequency is more than twice the periodic proof-test frequency, the application should be considered a high-demand mode application. Therefore the equations and techniques that use test interval as a key variable are not valid. In effect, one cannot take credit for periodic inspection unless it is done very frequently. Credit may be taken for diagnostics that cause the device to fail to the safe state (i.e. automatic process shutdown on any detected dangerous failure) in the high-demand case, as long as the diagnostic time period plus the time necessary to safely return the process to a safe state is less than the available process safety time (the time period between initiation of a demand and the hazard). 

In low demand mode, SEL is a proxy for PFD in hig demand / continuous mode, SIL is a proxy for failure rate. (The botmdary between low demand mode and high demand mode is in essence set in the standards at one demand per year. This is consistent with proof-test intervals of 3 to 6 months, which in many cases will be the shortest feasible interval.)... 

So what is the SIL achieved by the function Clearly it is not unique, but depends on the hazard and in paiticular whether the demaml rate for die hazard implies low or high demand mode. 

Refer to lEC 61508-1, table 2 (for low demand mode operation) or table 3 (for continuous or high demand mode operation) to determine the safety integrity level (SIL). The SIL then guides the selection of the techniques used for the avoidance of systematic faults in both hardware and software, so that as the risk reduction increases, or the hazard rate decreases, there is a reduction in the likelihood that systematic failures (including those resulting from incorrect specification) will result in a hazard. 

Note that table 3 expresses the safety performance measure as the probability of a dangerous failure per hour . This is because, at high demand rates (in relation to the proof test interval), the hazard rate for a demand mode safety function is approximately equal to (but always less than) the dangerous failure rate of the safety function. For a continuous mode safety function the hazard rate is equal to the dangerous failure rate of the safety function. Therefore, for both high demand mode and continuous mode safety functions, the hazard rate is a good measure of... 

High demand mode Where safety function is only performed on demand to transfer EUC into a specified safe state and the frequency of demand is greater than one per year. 

Then put the value in Eq. VIII/1.3.5-1 to obtain PFDavg- Also from the standard one gets that for continuous/high demand mode ... 

Safety integrity ievei (SiL) Low demand mode of operation (probability of faiiure on demand, pfd) High demand mode of operation (failures per year, fpy) Aviation industry-high demand mode of operation (failures per hour) European nuclear industry (pfd or fpy)... 

The different requirements of the altered Safety Integrity Levels (SIL) are in dependent on the probability of failure and are shown in Table 1. The probability values are defined as a PFD-value (probability of failure on demand), if the system is in a low demand mode and has to execute a safety function. However, if a system is operating in a high demand mode or continuous mode and a safety function has to be executed, then the probability of failure is specified with the PFH (probability of failure per hour). Its dimension or unit is (1/h). (Carsten 2006), (Kainka 1996)... 

In many cases, analogous systems are used as well in continuous (in the standard called high demand mode ) as well as in demand mode (in the standards called low demand mode ). Therefore, both concepts must be consistent. Note that, the terms in the standard (high demand mode and low demand mode) are misleading. 

Expected demand rate and the low or high demand mode... 

---