Safety integrity level risk analysis

General References Guidelines for Hazard Evaluation Procedures, Second Edition with Worked Examples, American Institute of Chemical Engineers, New York, 1992 Layer of Protection Analysis A Simplified Risk Assessment Approach, American Institute of Chemical Engineers, New York, 2001 ISA TR84.00.02, Safety Instrumented Functions (SIF)—Safety Integrity Level (SIL) Evaluation Techniques, Instrumentation, Systems, and Automation Society, N.C., 2002. 

The required safety integrity level of the instrumented function shall be derived by taking into account the required risk reduction that is to be provided by that function. For those SILs, the target PFDj,yg on demand and the target frequencies of dangerous failure are hsted in Table 3.8 [ANSI/ISA-84.00.01(2004) Part 3] for each SIF. Several risk analysis methods ranging from qualitative to fully quantitative can be deployed based on the severity and complexity of the scope, as listed in Table 3.9. 

Note that the example SIL levels provided in this chapter are only examples. They are not to be assumed recommended levels of protection. The selection of an appropriate Safety Integrity Level (SIL) is site-specific and the analysis requires selecting criteria for tolerable risk, and evaluating process conditions, specific chemicals, equipment design-limits, control schemes, process conditions, and unique hazards. Experts in process engineering, instrumentation, operations, and process safety should imdertake SIL selection. 

Thns, the requirements for safety functions result from hazard analysis, while requirements for the safety integrity level are determined from the risk analysis. 

Control System (BPCS), including functions of Supervisory Control and Data Acquisition (SCADA) system, the alarm system (AS) and Safety Instrumented Systems (SIS) performing defined Safety Instrumented Frmetions (SIF). Proper design of layers of protection is based on hazards analysis and risk assessment with consideration of human and organizational factors. It is essential to ensure required safety integrity level (SIL) for each of these layers. 

In order to determine the required SIL level, a detailed hazard analysis is performed for the equipment under control (EUC). From the hazard analysis, all safety functions are identified (example—Detect failure of braking). A target safety integrity level is assigned to each of the safety functions (example—detect failure of braking—SIL 3) in order to ensure the residual risk is lower than the acceptable risk (in other words, the risk is sufficiently reduced). The outcome will be an EUC safety function specification detailing the function and target SIL level (between 1 to %) required for each safety function identified in the hazard analysis. 

In [lEC 62061] the result of the risk analysis is that the risk reduction requirements on the E/E/PE-based safety functions end up in a certain SIL (Safety Integrity Level). Three levels exist from SIL 1 (lowest risk reduction) up to SIL 3 (highest risk reduction). 

Phases 1 to 5 deal with concept and analysis—risk assessments to discover the Safety Instrumented Functions (SIF) and assign an appropriate Safety Integrity Level (SIL) rating. 

SIL stands for safety integrity level. It is a measure of performance of an SIS. It is determined by PFD for SIF (SIS). There are four SIL levels represented by number, viz. SIL 1, 2, 3, 4. Higher the SIL number, the better will be the performance and lower will be PFD value. However, with an increase in SIL number, the cost and complexity of the system increases, but risk level reduces. It is worth noting that there could be individual component PFD but not SIL. SIL is only given to a system (SIS). SIL certification can be issued by the company (self-certification allowed), or other competent authority to indicate that appropriate procedure, analysis, and calculation... 

Layer of protection analysis (LOPA) LOPA is a systematic and structured way of quantification of risk reduction and safety integrity level (SIL) determination. Usually, it starts its work on the data developed in HAZOP analysis. For each documented undesired event with an initiating cause, it provides an independent protection layer (IPL), which will mitigate or prevent the hazard. Then, the total amount of risk can be determined. If safety instrumented function is necessary, LOPA methodology can be used to determine SIL also. From ISA 84 transaction it is found that LOPA is a simplified risk assignment tool used to evaluate the effectiveness of IPLs that are designed to reduce the likelihood or severity of an undesirable event. Quantitative PHA LOPA deals with single cause consequence pairs. Detailed documentation is possible and can be applied for continuous process. 

There are a number of requirements specified for nonlisted PLCs. According to A8.3 (P37) of NFPA 87 (2015) Controls that meet the perfomumce-based requirements of standards such as ANSI/ISA 84-00.01 Application of Safety Instrumented Systems for the Process Industries, can be considered equivalent. The determination of equivalency involves complete conformance to the safety lifecycle including risk analysis, safety integrity level selection, and safety integrity level verification, which should be submitted to the authority having jurisdiction. 

The probability is a constant, determined by risk analysis. The standard ISO/IEC 61508 [11] provides a range of failure rates for each defined safety integrity level (SIL). The probability P, could be, e.g., for SIL 3 systems operating on demand 1 — 10 to 1 - 10-4. 

Galixto, E., The safety integrity level as Hazop risk consistence The Brazilian risk analysis study case. Proceedings of the European Safety and Reliability Conference, 2007, pp. 629-634. 

Since the 1970s, TOTAL has developed and implemented a very poweifiil range of methods and tools based on traditional approaches. They ate nsed on a daily basis to perform onr lehability analysis. However, in recent years international standards such as the lEC 61508 [lEC 00] and lEC 61511 [lEC 03] have proposed a new concept of safety integrity level (SIL) required to achieve a level of acceptable risk. They are progressively imposed on the design of SlSs and as their scope naturally concern HIPS, their implementation carmot be ignored. Much work was necessary to establish hnks between these two approaches and identify their similarities and differences. 

An example of a risk situation is used in this exercise. We are asked to use layers of protection analysis to arrive at a risk reduction model for the situation. The quantitative analysis method is then used to define the safety integrity level (SIL) required for the safety instrumented system. This model can also be used to check the practical application of qualitative methods for determining SILs. 

Using the proposed list of SIFs, a PHA team meeting is held to determine the required safety integrity levels for the SIFs. In this section, the Layer of Protection Analysis (LOPA) method will be used. For a description of the LOPA method, refer to Annex F in Part 3 of ISA-84.01-2004. Additional guidance is provided in AlChE, COPS, Layer of Protection Analysis, Simplified Process Risk Assessment, 2001. 

The upset in Event 4 is similar to the upset in Event 1. Operator intervention can stop this runaway by starting the steam turbine driven water pumps, or adding Shortstop. While this operator action was judged to be very effective, no risk reduction credit was taken because of operator availability. The analysis shown in Table 7 led to safety integrity level 3 for SIF S-1. 

Integral part of the risk analysis of a critical system is identification and assessment of hazards that significantly contribute to risk (Rausand Hoyland 2004). The hazard analysis generates data required in the next stage of analysis, which lead to description of risk scenarios, definition of safety functions, evaluation of actual risk levels and required risk reduction. Then the technical specification of safety-related functions to be realized by the system architectures considered to select most justified one. 

The reliability performance of the SIS is referred to as safety integrity in the lEC-standards. This is the probability that the SIS satisfactorily performs the required SIFs, under stated conditions and for a stated period of time (lEC 61511 2003). In an early design phase, a hazards and risk analysis is performed to establish the required level of safety integrity of each SIF that is performed by the SIS, and in design and operation, it is necessary to demonstrate that this level of safety integrity is met. 

---