Requirements of the allocation process

1 The requirement here is to agree on the safety layers to be used and to allocate performance targets for the safety instrumented functions. In practice, safety functions are in many cases only allocated to safety instrumented systems where there are problems in using inherently safe designs or other technology systems. 

Examples of such problems include limitations on flare capacity or protection against exothermic reactions. Any decision to use instrument based systems rather than more traditional approaches such as relief valves will need to be supported by sound reasons that will stand up to regulatory authority challenge. 

As stated above, the hazard and risk assessment and allocation may be concurrent activities or allocation may in some circumstances take place prior to hazard and risk assessment. Decisions on the allocation of safety functions to safety layers are often taken on the basis of what has been found to be practicable by the user organization. Established industry good practice should also be taken Into account. Decisions will then be taken on the safety instrumented systems, assuming credit for the other safety layers. For example, where relief valves have been installed and these have been designed and installed according to industry codes, it may then be decided that these are adequate on their own to achieve adequate risk reduction. Safety instrumented systems would then only limit pressure where size or performance of the relief valve(s) was insufficient for the application or release to the atmosphere is to be prevented. 

No reproduction or networking permitted without license from IHS 

3 When a safety function is aiiocated to a safety instrumented function, it wiii be necessary to consider whether the appiication is in demand or in continuous mode. The majority of appiications in the process sector operate in demand mode where demands are infrequent, in such cases, Tabie 3 in iEC 61511-1 ANSi/iSA-84.00.01-2004 Part 1 (iEC 61511-1 Mod) is the appropriate measure to use. There are some appiications where demands are frequent (for exampie, greater than one per year) and it is more appropriate to consider the application as continuous mode because the probability of dangerous failure will be primarily determined by the failure rate of the SIS. In such cases. Table 4 in IEC 61511-1 ANSI/ISA-84.00.01-2004 Part 1 (IEC 61511-1 Mod) is the appropriate measure to apply. Continuous mode applications where failure would result in an immediate hazard are rare. Burner or turbine speed control may be continuous mode applications if protection systems are insufficient for all failure modes of the control system. 

2 Requirements of the allocation process 9.2.1 The allocation process shall result in 

NOTE Legislative requirements or other industry codes may determine priorities in the allocation process. 

2 The required safety integrity level of a safety instrumented function shall be derived by taking into account the required risk reduction that is to be provided by that function. 

NOTE See lEC 61511-3 ANSI/ISA-84.00.01-2004 Part 3 flEC 61511-3 Modf for guidance. 

3 For each safety instrumented function operating in demand mode, the required SIL shall be specified in accordance with either Table 3 or Table 4. If Table 4 is used then neither the proof-test interval nor the demand rate shall be used in the determination of safety integrity level. 

---