Low demand mode

Safety Integrity Level Probability of Failure on Demand (PFDavg.) Low Demand Mode Risk Reduction Factor (RRF)... 

Results of the evaluation typically include a number of safety integrity and availability measurements. Most important, the average probability of failure on demand (PFDavg) and the safe failure fraction (SFF) is calculated for low demand mode. Probability of failure per hour is calculated for high demand mode. From charts, the SIL level that the... 

When the process design is successfully oriented toward safety, risk analysis teams will usually estimate residual hazardous situations that occur only once in many years (clearly low demand mode). The average time period between hazardous events is often estimated to be over 10 years. Thus, we have a situation where the SIS is activated only once every ten years or more. During normal operation it is static. A safety isolation valve may sit motionless for years Contrast this with the operation of a BPCS. The control signals are normally d)mamic with some signals moving considerably at all times. 

The safety and availability of a set of equipment used for a safety instrumented function may benefit from testing. However, that depends on redundancy and how often the demand occurs. Three modes of operation have been defined in lEC 61508 for equipment providing a safety instrumented function continuous demand mode, high demand mode and low demand mode. This book will use the lEC 61508 definitions to designate those three different situations. 

In low demand mode safety instrumented functions, the person performing the SIF verification calculations must ... 

Remember that in continuous demand mode credit can be given for automatic diagnostics or for proof test procedures only for redundant systems. In addition, many of the calculation assumptions made for low demand mode do not apply. The "probability of dangerous failure per hour" must be calculated based on all dangerous failures. 

When a proof test is done at least twice during an expected average demand period, low demand mode is appropriate and the calculated result can be done with PFDavg as defined in Chapter 4. The important variables that must be considered in the calculation include ... 

Safety Integrity Level Average probability of failure on demand (Low demand mode of operation)... 

Problem A set of non-redundant (lool) safety equipment is used to perform a safety instrumented function in low demand mode. The equipment is to be inspected and fully restored every five years. Therefore the manual proof test interval is five years and the manual proof test effectiveness can be assumed to be 100%. 

Low Demand Mode Verification Calculation Using Fault Trees... 

An instrument is to be used in a safety instrumented function in low demand mode. The failure rates are given as ... 

It also needs to be emphasized that SIL is a lifecycle issue and although our present focus is in the hardware solutions required to satisfy the safety functions, all phases of the Safety Lifecycle have to be reviewed for final SIL verification. For all the examples and solutions, a low demand mode of operation is assumed since this is the mode that predominantly applies to the process industries. 

The PFDavg for entire safety instrumented function can be calculated a number of different ways. One approach is to calculate an arithmetic average of the PFD as a function of operating time interval. When this is done on a spreadsheet, the answer is approximately 0.0019. Per the low demand mode PFDavg chart, this qualifies for S1L2. 

The average probability of failure to perform the design function on demand PFDavg for the E/E/PE safety-related system operating in the low demand mode is calculated from the formula ... 

Table 1. Safety integrity levels target failure measures for a safety function operating in low demand mode.

In the present paper, only the low demand mode of operation is assumed (i.e. the safety function is only performed on demand, and not more than one per year). The target failure measure is then defined by the average probability of dangerous failure on demand of the safety function (PFDavg), and the associated SIL is determined by Table 1. Note that these definitions stem from lEC 61508, 2009 revision, which are more precise than in the first edition. 

Table 1. The different SIL levels for Low demand mode and High demand mode. 

SIL Low demand mode PFD requirements High demand mode PFH requirements... 

Low demand mode The frequency of demands for operation made on a safety-related system is no greater than one per year and no greater than twice the proof-test frequency. 

If a demand occurs, the probability of the SIS being unable to perform as required equals the probabihty of failure on demand (PFD). Results later in the paper are assigned the corresponding SIL. The examples given in this thesis all belong to the low demand mode category, i.e. shut down valves, heat detectors and the like. We do not expect these systems to be activated often. Moreover, only dangerous and not on-line detected failures will be included. 

This standard also states that high demand or continuous mode should be used for machinery, Low demand mode of operation is not considered to be relevant for SRECS applications at machinery (lEC 62061 2005-i-Al 2012,3.2.26). 

The team assesses the number of demands placed on each SIF to ensure they are consistent with what was originally defined. For example, if the original premise was that the SIF would have about one demand for every ten years, but, in reality, the SIF is exposed to one demand a year, the team modifies the PHA assumptions based on this new operating experience. This may result in a higher SIL requirement or in the determination that the SIF is operating in high-demand mode rather than low-demand mode. 

A demand mode SIF operates in response to a process demand that occurs when the process deviates from normal operation to the extent that action must be taken to prevent the process variable from exceeding the safe operating limits. The majority of SIF experience infrequent demands (i.e., less than once per year), so they operate in what is known as low-demand mode. As the demand rate increases, there is a transition from low-demand mode to continuous-mode operation. Continuous mode SIFs act continuously to prevent the hazard such that the dangerous failure of the SIF results in an immediate hazard. In other words, the dangerous failure of the SIF is an initiator of the hazardous event. 

Consider two hazardous events release of hazardous material to the atmosphere and reactor rupture. The temperature control is the only layer of protection preventing the release of hazardous material, it operates in a continuous mode, and its dangerous failure results in the release. An adequately sized mpture disk does provide a layer of protection for reactor rupture, and in this case the temperature control still operates in continuous mode, and its dangerous failure results in a demand on the rupture disk. The rupture disk operates in low-demand mode. 

As shown in the previous examples, the situations that are considered to be high demand or continuous demand are actually BPCS functions that are required to be extremely reliable because there is no back-up protection system. An SIS operating as a protection system (i.e. low demand) is used to move a process to a safe state upon detection of an abnormal condition. If a process condition always occurs at the end of every batch, then it is not unexpected. Many practitioners believe that high-demand mode safety functions should not exist in the process industry, and where they are identified, they should be re-engineered to convert them to low-demand mode. 

ANSI/ISA-84.00.01-2004-1, Clause 9.2.3, provides two tables for defining the SIL requirements. Table 3 provides the SIL requirements in terms of PFDavg- Table 4 provides the SIL requirements in terms of Frequency of Failure (e.g., failures per hour) and defines the acceptable hazard rate for the high-demand/continuous SIF. ANSI/ISA-84.00.01-2004-1, Clause 9.2.3, states that when Table 4 is used, neither the proof-test interval nor the demand rate is used in the determination of the safety integrity level. This means that the Table 4 requirements should not be converted into PFDavg requirements, using the proof-test interval or the demand rate. Erroneous results can easily occur if a high-demand mode SIF is treated as a low-demand mode SIF, followed by incorrect use of Tables 3 and 4 (ANSI/ISA-84.00.01-2004-1 Clause 9.2.3). 

Table I-1 provides the hazard rate (HR) calculated from the simplified equation, which is typically the basis of Layers of Protection Analysis (LOPA), and a more rigorous equation based on the exponential distribution. The shaded area shows that for high-demand mode SIFs, the simplified equation yields a hazard rate that exceeds the failure rate k of the SIF, which is 0.1/year. In the case of either high-demand or continuous mode, the simplified mathematics developed for low-demand mode are not adequate, and more advanced assistance should be obtained from someone knowledgeable in the applicable mathematics of modeling such cases.

Table 1 - Definitions of SILs for Low Demand Mode from BS EN 61508...

In low demand mode, SEL is a proxy for PFD in hig demand / continuous mode, SIL is a proxy for failure rate. (The botmdary between low demand mode and high demand mode is in essence set in the standards at one demand per year. This is consistent with proof-test intervals of 3 to 6 months, which in many cases will be the shortest feasible interval.)... 

Refer to lEC 61508-1, table 2 (for low demand mode operation) or table 3 (for continuous or high demand mode operation) to determine the safety integrity level (SIL). The SIL then guides the selection of the techniques used for the avoidance of systematic faults in both hardware and software, so that as the risk reduction increases, or the hazard rate decreases, there is a reduction in the likelihood that systematic failures (including those resulting from incorrect specification) will result in a hazard. 

According to lEC 61508-4 [lEC, 1998c], low demand mode safety functions are those where the frequency of demands on safety-related system is no greater than one per year and no greater than twice the proof test frequency . The measure of safety performance of a demand mode safety function is the risk reduction factor, AR ... 

---