Safety instrumentation systems risk reduction

Safety instrumented function (SIF) A safety function allocated to the safety instrumented system with a safety integrity level necessary to achieve the desired risk reduction for an identified process hazard. 

Once the severity and the probability corresponding to a scenario are estimated, that is, the risk is assessed, a decision can be made on the nature of the protection system to be implemented. If a safety instrumented system (SIS) is to be used, consisting of one or more independent protection levels (IPL), the required reliability of the protection system, constituting a so-called Safety Integrated Level (SIL) can be determined by using this risk assessment, respective of the required risk reduction. 

As stated above, the hazard and risk assessment and allocation may be concurrent activities or allocation may in some circumstances take place prior to hazard and risk assessment. Decisions on the allocation of safety functions to safety layers are often taken on the basis of what has been found to be practicable by the user organization. Established industry good practice should also be taken Into account. Decisions will then be taken on the safety instrumented systems, assuming credit for the other safety layers. For example, where relief valves have been installed and these have been designed and installed according to industry codes, it may then be decided that these are adequate on their own to achieve adequate risk reduction. Safety instrumented systems would then only limit pressure where size or performance of the relief valve(s) was insufficient for the application or release to the atmosphere is to be prevented. 

A working definition of the Safely Lifea/cle is that it is an engineering process utilizing specific steps to ensure that Safety Instrumented Systems (SIS) are effective in their key mission of risk reduction as well as being cost effective over the life of the system. Activities associated with the Safety Lifecycle start when the conceptual design of facilities is complete and stop when the facilities are entirely decommissioned. Key activities associated with a Safety Lifecycle are outlined below. 

Another difference between Basic Process Control System design and Safety Instrumented System design is that per ANSl/lSA-84.00.01-2004 (lEC 61511 Mod) these systems are designed and implemented to meet different risk reduction requirements presented by the various hazards. (Chapter 1)... 

Although some consider fire and gas systems to be outside the scope of a safety instrumented system, many others classify these functions as safety instrumented functions. The criteria is based on needed risk reduction. When consequence or likelihood reduction is achieved by these functions and the risk reduction needed is greater than 10, ANSl/lSA-84.00.01 (lEC 61511 Mod) (Ref. 9) requires the hmction be classified as a SIR... 

All equipment used in the SIS must be classified as a safety instrumented system. The design, installation, operation and maintenance process must follow all the rules of ANSl/lSA-84.00.01-2004 (lEC 61511 Mod), put there to prevent systematic faults. If this is not done, the standard clearly states that any safety instrumented function cannot have a risk reduction greater than 10. This is the bottom of SlLl range so, in effect, that design cannot meet SIL 1 requirements. The practical effect of this requirement is that a designer cannot combine control functions and safety functions in the same equipment imless the equipment is classified as a safety instrumented system and follows aU the design rules of the standard. 

Safety instrumented systems (SIS) play a major part in industrial risk management as risk reduction measures. The main European standard for functional safety of SIS, denoted electrical / electronic / programmable electronic (E/E/PE) safety-related systems, is the EC 61508 (lEC, 2005a). The second edition will soon be adopted in 2009 (EC, 2009). Objectives are to enable the design of SIS, and the development of apphca-tion sector standards. Such examples are EC 61511 (lEC, 2004) for process industry, and EC 62061 (EC 2005b) for machinery. One of the main contributions of EC 61508 is to consider the overall system and software safety life cycle. The standard fi amework, with the corresponding normative parts and subclauses, is ... 

NOTE 2 Where reasonably practicable, processes should be designed to be inherently safe. When this is not practical, risk reduction methods such as mechanical protection systems and safety instrumented systems may need to be added to the design. These systems may act alone or in combination with each other. 

Part 3, Annex D - semi-quaUtative, calibrated risk graph) The purpose of the W factor is to estimate the frequency of the unwanted occurrence taking place without the addition of any safety instrumented systems (E/E/PE or other technology) but including any external risk reduction facilities. ... 

Coverage Safety related systems including external risk reduction systems Mainly on safety instrumentation systems... 

It is interesting to note the heading of the chapter It is named like this to indicate that safety instrumented functions (SIFs—in plural) constitute a safety instrumented system (SIS). From the discussions in previous chapters, readers have come across varieties of definitions of accidents, hazards, and risks from different perspectives. Also there were a few things common such as the accidents are not always negative, and there are always aim to avoid accidents so that there is not loss to the system, personnel, and environment. At the back of the mind, we always try to develop and incorporate some things to reduce risks and to maintain work safety. Therefore, safety work involves some activities, measures, and techniques, which can contribute or help to reductions in losses in different forms, and human injury or fatality. There are quite a good number of elements involved in work safety these include, but are not limited to the following ... 

Safety function Function implemented by a safety instrumented system or other safety related technological system for reduction risk of the facilities, i.e. to achieve or maintain a safe state for the process, with respect to a specific hazardous event. 

Part 1 of 61511 describes the typical layers of risk reduction (namely control and monitoring, prevention, mitigation, plant emergency response, and community emergency response). All of these should he considered as means of reducing risk and their contributing factors need to be considered in deriving the safety requirement for any safety instrumented system, which form part of the PREVENTION layer. 

The safety integrity level (SIL 3 in this case) is allocated based on a process hazard and risk assessment. It forms the basis for the risk reduction target for the safety instrumented system/SIL (HIPS in this case). For on-demand systems such as a HIPS, the SIL defines the probability of... 

With an understanding of the role of safety instrumented systems in risk reduction we are able to introduce the concept of safety integrity and safety integrity level , (SIL). 

Hence, it becomes possible to prevent electronic instrumentation from becoming a source of ignition in the plant areas if its temperature and stored energy levels can be limited by design, to values below the thresholds for the categories of gases on the plant. We know this from of protection as INTRINSIC SAFETY. This is a form of hazard prevention. It must not be confused with a safety instrumented system but it does feature in the list of risk reduction measures. 

At this point it may be helpful to illustrate some typical features of safety instrumented systems before we move on to risk reduction concepts. 

Note that this diagram defines safety integrity as applicable to all risk reduction facilities. It is a general term but when it is applied to the safety instrumented system it becomes a measure of the system s performance. 

Now we need to determine how much of the risk reduction job must be allocated to the safety instrumented system (RRFsis). Normally we would invert this value to give the PFDavg for the SIS. 

The task of the safety instrumented system is risk reduction... 

Once the need for risk reduction has been identified there is usually not much argument about the basic idea of installing a safety related system and often this is a safety instrumented system. Justification issues arise when the scale of investment has to be decided. .. is it to be a cheap system with high running costs or a more expensive model that repays its cost in reduced operating and maintenance costs Searching out the links between SIS costs and true running costs of the plant may be a tricky job. 

Task detail 1) Use the starting information given below and refer to Table 2.5 in Chapter 2 to classify the given risk and its frequency. 2) Using this table, decide the maximum tolerable risk frequency to reduce the risk to class 3 (considered to be acceptable) 3) Calculate the target risk reduction factor, PFDavg values and safety availability required from the proposed safety instrumented system to achieve the tolerable risk frequency ... 

This practical exercise is to eonstruct a fault tree diagram using the basic principles introduced in Chapter 3. It uses an example of a simple reactor with automatically controlled feeds that has the potential to cause a serious risk to plant personnel. Once the basic fault tree has been drawn, the model is to be adjusted to incorporate a safety-instrumented system and to demonstrate the resulting risk reduction. 

An example of a risk situation is used in this exercise. We are asked to use layers of protection analysis to arrive at a risk reduction model for the situation. The quantitative analysis method is then used to define the safety integrity level (SIL) required for the safety instrumented system. This model can also be used to check the practical application of qualitative methods for determining SILs. 

To define the layers of protection proposed for a polymer autoclave to reduce the risk of exposing site persoimel to toxic vapors. To draw a risk reduction model incorporating the layers of protection and use the model to decide the required SIL for the safety instrumented system. ... 

In ANSI/ISA-84.00.01-2004 (lEC 61511 Mod), 3.2.71, a safety instrumented function is defined as a "safety function with a specified safety integrity level which is necessary to achieve functional safety." This standard, 3.2.68, defines a safety function as a "function to be implemented by a SIS, other technology safety-related system or external risk reduction facilities, which is intended to achieve or maintain a safe state for the process, with respect to a specific hazardous event."... 

Safety function Safety instrumented function (SIF) lEC 61508 safety function implemented by E/E/PES, other technology safety related system, or external risk reduction facilities. lEC 61511 ANSI/ISA-84.00.01-2004 flEC 61511 Mod) SIF is imolemented solely by SIS... 

An operator-initiated SIF is often associated with a never exoeed never deviate alarm, where the operator is expected to mitigate risk in much the same manner as an automated SIF. Operator-Initiated SIFs are generally used when it is not possible to completely automate the function. The manually initiated action is typically comprised of the sensor detecting the hazardous condition, the logic solver that determines that the safety condition exists, alarm presentation, human response, and the equipment used by the operator to bring the process to a safe state. When risk reduction is taken for an operator-initiated SIF, the PFDavg should be determined for the instrumented system. This is discussed further in B.6. 

As per lEC 61511-3 2003 Clause 9.4.3, operator action as part of safety instrument functions (SIFs) can be credited with a level of risk reduction greater than 10 when the system from the sensor to the final element can be designed and evaluated as an SIS per the requirements of lEC 61511. A typical automated SIS, popularly known as an industrial automation and control system (LACS), from the sensor to the final element can be conceived, as shown in Fig. VIII/1.4-1 or Fig. VII/1.3-1 where the main constituents are sensor, logic solver, and final element. When an operator action such as through the display/alarm is necessary this needs to be as shown in Fig. XI/2.4.3-1. 

The total risk reduction for both the Basic Process Control System and Safety Instrumented... 

---