Safety Instrumented Systems - Part B

Safety Instrumented Systems - Part B Notes

Rationale

Safety instrumented systems (SIS) are crucial for reducing the risk of accidents and their consequences in industrial settings.
Understanding the special requirements of SIS is essential for proper maintenance, troubleshooting, and configuration.

Outcome

Upon completion of this module, you will be able to describe the principles and applications of safety instrumented systems.

Prerequisites

Prior completion of the module "310401hA Safety Instrumented Systems - Part A" is required.

Objectives

Select, configure, and verify an SIS system for a specific Safety Integrity Level (SIL) rating.

Introduction

This module focuses on how to verify a safety system to ensure it performs as designed.

Objective One: Verification

Goal: Select, configure, and verify an SIS system for a specific SIL rating.

Verification

Control functions performed by an SIS are called Safety Instrumented Functions (SIF).
SIFs are designed to prevent or mitigate specific hazards and are assigned a Safety Integrity Level (SIL).
SIL rating verification requires calculating the SIF's average Probability of Failure on Demand (PFDavg).
Hardware Fault Tolerance (HFT) of the SIF architecture must comply with its SIL rating.
Spurious Trip Rate (STR) must meet company policy.

Methods for Calculating PFDavg (Table 1)

Method	System Modeled	Quantification Technique	Handles Different Repair Times	Handles Diverse Technology	Handles Sequence Dependent Failures
Simplified Equations	Simple SIF equation	Simple math	No	No	No
Fault Tree Analysis	SIF with complex relationships	Simple math or Boolean algebra	Yes	Yes	Yes
Markov Analysis	SIF with complex relationships, time dependant requirements or PE logic solvers	Matrix algebra	Yes	Yes	Yes

Simplified Equations: Only method presented in this module.
Fault Tree Analysis: Uses top-down diagrams representing the logical relationship between subsystem and component failures.
Markov Analysis: Uses circles representing system states, connected by transitions (arrows) indicating paths between states.

Simplified Equations for PFD (Table 2)

Equations for Probability of Failure On Demand

Configuration	Equation
1oo1	$(2 λ_{DU} × TI)$
1oo1D	$2 λ<em>{DU} × TI + (2 λ</em>{SD} + 2 λ_{DD} × MTTR)$
1oo2	$[(1-β)× (λ<em>{DU} ×TI)^2] / 3 + (β×λ</em>{DU} × TI) / 2$
1oo2D	$[(1-β)x(λ<em>{DU} ×TI)^2] / 4 + (β×λ</em>{DU} × TI) / 2$
2oo2	$[(1-β)× (λ<em>{DU} ×TI)^2] / 4 + (β×λ</em>{DU} × TI) / 2$
2oo3	$[(1-β)× (λ<em>{DU} ×TI)^2] + (β×λ</em>{DU} × TI) / 2$

Assumptions for Correct Application:

Failure rates are constant over the functional test period.
Failure rates for redundant components within a sensor voting group are identical.
Full functional tests are 100% effective.
Final control elements fail in the safe state (e.g., ESD valve fails closed).
Automatically diagnosed failures cause the SIF to take automatic action or degrade to a mode where the SIF can take safety action automatically.
Mean Time To Repair (MTTR) is the time to repair any detected failure.

SIL Rating Based on PFDavg (Table 3)

Safety Integrity Level (SIL)	PFDavg	Risk Reduction Factor (RRF)
SIL 4	0.00001 to 0.0001	10,000 to 100,000
SIL 3	0.0001 to 0.001	1,000 to 10,000
SIL 2	0.001 to 0.01	100 to 1,000
SIL 1	0.01 to 0.1	10 to 100

Simplified Equations for Spurious Trip Rate (STR) (Table 4)

Configuration	Equation
1oo1	$(λ<em>S + λ</em>{DD})$
1oo2	$2(λ<em>S + λ</em>{DD}) + (β (λ<em>S + λ</em>{DD}))$
2oo2	$(2 × λ<em>S (λ</em>S + λ<em>{DD}) × MTTR) + (β (λ</em>S + λ_{DD}))$
2oo3	$(6 × λ<em>S (λ</em>S + λ<em>{DD}) × MTTR) + (β (λ</em>S + λ_{DD}))$

Assumptions for Correct Application:

Failure rates are constant over the functional test period.
Failure rates for redundant components within a sensor voting group are identical.
Final control elements fail in the safe state.
Diagnosed dangerous failure puts the SIF in a safe state via automatic or human intervention.

Limitations of Simplified Equations

They do not account for partial proof test calculations, varying degrees of diagnostic coverage, or other factors.
More complex formulas are required for these calculations.

SIL Rating for Components (Table 5)

Determined by component type (A or B), architecture, and Safety Failure Fraction (SFF) rating.
The lowest rating of any component dictates the overall allowed SIL.

Type A Components

Simple devices with well-known failure modes and a solid history of operation.

SFF	HFT of 0	HFT of 1	HFT of 2
< 60%	SIL 1	SIL 2	SIL 3
60% to <90%	SIL 2	SIL 3	SIL 4
90% to <99%	SIL 3	SIL 4	SIL 4
>99%	SIL 3	SIL 4	SIL 4

Type B Components

Complex components with potentially unknown failure modes.

SFF	HFT of 0	HFT of 1	HFT of 2
< 60%	Not allowed	SIL 1	SIL 2
60% to <90%	SIL 1	SIL 2	SIL 3
90% to <99%	SIL 2	SIL 3	SIL 4
>99%	SIL 3	SIL 4	SIL 4

Distillation Fired Heater Reboiler Example

A refinery is installing a new processing unit with a distillation column heated by a gas-fired heater reboiler (Figure 1).

Scenario

The amount of vapor generated is sensitive to the vapor/liquid temperature in the column.
Malfunctions leading to excessive heat input can generate excessive vapor amounts.
Cooling systems may lack the capacity to control pressure during excess heat input.
Vapor release from a column rupture can cause an explosion when contacting the fired heater.

Task

Select, configure, and verify a column pressure SIS.

Steps

Risk assessment
Conceptual design verification
Redesign verification
SRS specifications

Risk Assessment

Identified Risks

Column rupture likelihood: Occasional.
Explosion severity to personnel: Severe (two fatalities).
Explosion severity to the environment: Minor (minor on-site release).
Explosion severity to commercial aspects: Severe (equipment damage > 20 million).

Risk Matrix Assignment

Medium risk, requiring a SIL 2 SIS installation.

Layer of Protection Analysis (LOPA)

Acceptable risk level for an explosion: 10^{-4} occurrences per year.
Initiating event: Overheating due to fuel control valve failure.
Process risk level for fuel valve failure: Once every two years.
Mechanical pressure relief valve risk reduction: 10 (credit of 0.1).
Alarms and operator response risk reduction: 10 (credit of 0.1).
BPCS risk reduction: None (failure of its control valve is the initiating event).

Required Risk Reduction

The risk reduction that the SIS system requires is 200 times or a PFD of 0.005, which you calculate as follows.
PFD = (10^{-4} / yr) / ((2 / yr)(0.1)(0.1)) = 0.005
A PFD of 0.005 requires an SIL 2 SIS installation.

Nuisance Trips and Shutdowns

Nuisance trips should occur less than once every three years (STR < 0.33 failures/yr).
Planned shutdowns occur once every three years.

Conceptual Design Verification

Initial SIF Design (Figure 2)

Pressure SIS transmitter (PZT-8) to measure column pressure.
Fail-closed (FC) pressure SIS valve (PZV-8) to shut off fuel supply.
Safety PLC logic solver:
- Alarm (PZAH-8) to BPCS for high column pressure.
- Automatic closure of ESD fuel valve (PZV-8) at trip point.

Equipment Failure Rates (Table 6)

Failure rates are given in failures per billion hours (FIT).

Instrument	λSU (FIT)	λSD (FIT)	λDD (FIT)	λDU (FIT)
Pressure transmitter	0	250	750	120
Solenoid de-energize to trip	0	6690	0	2900
Ball valve, tight shut-off	0	2153	0	2378
Safety PLC	990	0	509	7

Reliability Block Diagram (RBD) (Figure 3)

Calculates PFDavg, STRSIS, and overall allowed SIL rating.

Design Information

Simplex architecture (1oo1) for pressure transmitter, safety PLC, solenoid, and ESD valve.
Common Cause Factor (CCF) beta (β) factor of 0% due to no redundancy.
Proof test interval (TI) of one year (8760 hours) for sensors and final elements.
Proof TI of three years (26,280 hours) for the logic solver.

Initial Design Limitations

Insufficient risk reduction.
- PFDavg of 2.37 E-02 (0.0237) exceeds the required 0.005.
Inadequate nuisance trip reduction.
- STRSIS of 1.05 failures/yr, exceeds the required 0.33 failures/yr.
Overall allowed SIL 1 rating, lower than the required SIL 2.

PFD Calculation

PFDavg is the sum of PFD calculations for each component (Table 2 formulas).

Example: ESD Ball Valve (1oo1 Architecture)

PFD = 2 * λDU * TI
λDU = 2378 E-09 failures/hr, TI = 8760 hr
PFD = (2 * 2378 E-09) * 8760 = 1.04 E-02

STR Calculation

STRSIS is the sum of STR calculations for each component (Table 4 formulas).

Example: Pressure Transmitter (1oo1 Architecture)

STR = λS + λDD
λDD = 750 E-09 failures/hr, λS = 250 E-09 failures/hr
STR = (750 E-09 + 250 E-09) = 1.00 E-06

SIL Rating Determination

Using Table 5, based on component type, architecture, and SFF rating. The lowest SIL rating component counts.

Example: Safety PLC

Type B component, 1oo1 architecture (HFT of 0).
SFF = 1 - (λDU / λ)
λDU = 7 E-09 failures/hr
λ = λDD + λDU + λS = (509 E-09) + (7 E-09) + (990 E-09) = 1.51 E-06
SFF = 1 - (7E-09 / 1.51E-06) = 1 - 0.005 = 0.995 $or 99.5%</p></li>\n<li><p>HFT of 0 and SFF of 99.5% results in SIL 3.</p></li>\n</ul>\n<h5 id="prooftestingconstraints">Proof Testing Constraints</h5>\n<ul>\n<li>Yearly proof testing required for ESD valve and pressure transmitter, but design lacks bypass for online testing.</li>\n<li>Logic solver proof testing can be done during planned three-year shutdowns.</li>\n</ul>\n<h5 id="conclusion">Conclusion</h5>\n<p>The initial design does not meet PFDavg, STRSIS and SIL requirements.</p>\n<h4 id="redesignverification">Redesign Verification</h4>\n<h5 id="proposedmodificationsfigure4">Proposed Modifications (Figure 4)</h5>\n<ul>\n<li>Three pressure SIS transmitters (PZT-8A, PZT-8B, PZT-8C) in 2oo3 architecture with block valves for online proof testing.</li>\n<li>Two fail-closed (FC) pressure SIS valves (PZV-8A and PZV-8B) in 1oo2 architecture with a bypass for online proof testing.</li>\n<li>Dual redundant solenoids in 2oo2 architecture on each ESD valve.</li>\n<li>Dual redundant safety PLC logic solver (1oo2D architecture):<ul>\n<li>Alarm (PZAH-8) to BPCS for high column pressure.</li>\n<li>Alarm (PZI-8) when a redundant pressure component is in alarm.</li>\n<li>Alarm (XZI-8) when a bypass is in place.</li></ul></li>\n</ul>\n<h5 id="reliabilityblockdiagramrbdfigure5">Reliability Block Diagram (RBD) (Figure 5)</h5>\n<ul>\n<li>Calculates PFDavg, STRSIS, and overall allowed SIL rating.</li>\n</ul>\n<h6 id="designinformation-1">Design Information</h6>\n<ul>\n<li>Pressure transmitters: 2oo3 architecture, β factor of 5%.</li>\n<li>Safety PLC: 1oo2D architecture, β factor of 3%.</li>\n<li>Final element: 1oo2 architecture, β factor of 5%.</li>\n<li>Proof TI of one year (8760 hours) for sensors and final elements.</li>\n<li>Proof TI of three years (26,280 hours) for the logic solver.</li>\n</ul>\n<h5 id="redesignresults">Redesign Results</h5>\n<ul>\n<li>Required risk reduction is achieved.<ul>\n<li>PFDavg of 2.70 E-03 (0.0027) is less than the required 0.005 (SIL 2 rating).</li></ul></li>\n<li>Required spurious trip rate is achieved.<ul>\n<li>STRSIS of 0.034 failures/yr is less than the required 0.33 failures/year.</li></ul></li>\n<li>Required overall SIL 2 rating is achieved.</li>\n</ul>\n<h5 id="pfdcalculation-1">PFD Calculation</h5>\n<ul>\n<li>PFDavg is the sum of PFD calculations for each component (Table 2 formulas).</li>\n</ul>\n<h6 id="examplesolenoidvalves1oo2architecture">Example: Solenoid Valves (1oo2 Architecture)</h6>\n<ul>\n<li>Double the solenoid's undetected failure rate (λDU) from 2900 to 5800 due to 2oo2 architecture.<br />\n$ PFD = [(1-β) × (λDU ×TI)^2] / 3 + (β×λDU × TI) / 2
B = 0.05
λDU =5800 E-09 failures/hr
TI = 8760 hr
PFD = [(1-0.05)x((5800 E-09)x(8760))^2] / 3 + (0.05x(5800 E-09)x(8760)) / 2= 2.08 E-03

STR Calculation

STR for the solenoid valves is calculated as such:
λDD = 0 failures/hr
λs = 6690 E-09 failures/hr
MTTR is 72 hours.
B=0.05
STR = (2x(6690 E-09) ((6690 E-09)+(0))x (72))+(0.05) x ((6690 E-09)+(0)) = 3.4 E-07
The STR rate is now doubled because of the 2001 architecture; therefore, the STR equals 6.8 E-7 for the solenoid valves.

SIL Rating

The overall SIL rating is equal to the lowest SIL rating of any component (Table 5).
For example, calculate the SIL allowed for the ESD Valve. In this example, the ESD valve is a type A component and the ESD valve has 1oo2 architecture that provides an HFT of one (1).
λDU =2378 E-09 failures/hr
λ = λDD + λDU +λs = (0) + (2378 E-09)+(2153 E-09) = 4531 E-06

SFF = 1- (λDU / λ) = 1- (2378 E-09) / (4531 E-09) =1-0.525 = 0.475 $or 48%</p>\n<p>An SFF of less than 60% (<60%) and an HFT of one for a type B component allows for a SIL rating of two (2).</p>\n<h4 id="srsspecifications">SRS Specifications</h4>\n<h5 id="requiredinformationforeachsif">Required Information for Each SIF</h5>\n<ul>\n<li>Description of the SIF (what it does and its components).</li>\n<li>Common cause failures.</li>\n<li>Safe state definition.</li>\n<li>Proof test intervals.</li>\n<li>Response time to bring the process to a safe state.</li>\n<li>Safety Integrity Level (SIL) rating.</li>\n<li>Process measurements and their trip points.</li>\n<li>Process output actions and successful operation criteria.</li>\n<li>Manual shutdown requirements.</li>\n<li>Information regarding energizing or de-energizing to trip.</li>\n<li>Resetting after a shutdown.</li>\n<li>Maximum allowed spurious trip rate.</li>\n<li>Failure modes and SIS response to failures.</li>\n<li>Starting up and restarting the SIS.</li>\n<li>Interfaces between the SIS and any other system.</li>\n<li>Overrides / inhibits / bypasses and how they are cleared.</li>\n<li>Actions following a SIS fault detection.</li>\n</ul>\n<h4 id="selftest">Self-Test</h4>\n<ol>\n<li>What does the acronym STR stand for?</li>\n<li>List three (3) methods used to calculate the average probability of failure on demand.<br />\na)<br />\nb)<br />\nc)</li>\n<li>Calculate the PFD using simplified equations given the following information.<ul>\n<li>Two identical ESD valves in a 1oo2 architecture.</li>\n<li>A common cause beta factor of 3%.</li>\n<li>A proof test time interval of 8760 hours.</li>\n<li>A dangerous undetected failure rate of 2050 failures per billion hours.</li></ul></li>\n<li>Calculate the STR in failures per year using simplified equations given the following information.<ul>\n<li>A level switch.</li>\n<li>A safe failure rate of 118 failures per billion hours.</li>\n<li>A dangerous detected failure rate of 131 failures per billion hours.</li></ul></li>\n<li>Calculate the allowed SIL rating given the following information.<ul>\n<li>Three identical level switches (Type A) in a 2oo3 architecture.</li>\n<li>A safe failure rate of 118 failures per billion hours.</li>\n<li>A dangerous detected failure rate of 131 failures per billion hours.</li>\n<li>A dangerous undetected failure rate of 24 failures per billion hours</li></ul></li>\n<li>Using the RBD in Figure 6, answer the following questions.<br />\na) What is the PFDavg for this SIF and its SIL rating?<br />\nb) What is the STRSIS for this SIF in failures per year?<br />\nc) What is the overall allowed SIL for this SIF?</li>\n</ol>\n<h4 id="selftestanswers">Self-Test Answers</h4>\n<ol>\n<li>spurious trip rate</li>\n<li>a) simplified equations<br />\nb) fault tree analysis<br />\nc) Markov analysis</li>\n<li>PFD = 5.82 E-04<br />\nThe PFD for 1oo2 architecture is as follows:<br />\n$ PFD = [(1-β) × (λDU ×TI)^2] / 3 + (β×λDU × TI) / 2
β= 0.03
λDU = 20500 E-09 failures/hr
TI = 8760 hr

STR=0.00218 Failures/year
The STR for lool architecture is as follows:
STR = (λS + λDD)
λDD is 131 E-09 failures/hr
λ is 118 E-09 failures/hr

Allowed SIL rating is SIL 4.

The switch's 2oo3 architecture provides an HFT of one (1).
λDU =24 E-09 failures/hr
λ = λDD + λDU +λs = (131 E-09)+(24 E-09)+(118 E-09) = 273 E-09
SFF = 1- (λDU / λ) = 1- (24 E-09) / (273 E-09) =1-0.088 = 0.91$$ or 91%
An SFF of 90 to 99% and a HFT of one for a type A component allows for a SIL rating of four (4).

a) PFDavg = 2.18E-03, SIL 2
b) STRSIS 0.171 failures per year
c) SIL 2