Safety Integrity Level (SIL) Verification – Comparison of PFD Calculation Methods 《Translation》

Thread Content

Abstract: IEC61511 specifies that for each SIF, the failure probability PFD must be equal to or lower than the failure target value specified in the safety requirement specification, and this must be confirmed through calculations. The author conducted safety integrity level (SIL) verification for an actual project using the reliability block diagram method, fault tree analysis, and Markov model method (with software for calculations), and compared these three mainstream PFD calculation methods for SIL verification. The SIL verification process mainly includes: forming a verification team (of professionals) ； Prepare documentation (SIF list; the table should include information on the safety instrumented loops and their target SIL levels, details of the instrument equipment used, data on equipment failures, and inspection and testing intervals) ； Reliability modeling ； Software calculation (calculates the Safety Failure Factor (SFF); combined with the Hardware Fault Tolerance (HFT), it determines the safety integrity level of the architecture) ； Based on failure data and reliability models, the failure probability PFD at the required time is calculated, as well as the inspection and testing cycle to meet SIL requirements; furthermore, the shutdown rate of critical processes can be calculated according to the needs of the enterprise ； Generate a report (including calculation results, compliance assessment, inspection and testing cycles that meet SIL requirements, and recommended actions). This paper only discusses the advantages and disadvantages of three different methods for the failure probability PFD under computational constraints. Project example: When the liquid level in the equipment is too high, the steam valve assemblies (FCV-01-681 and EV-010656) as well as the PCV-01-616 valve are shut down via interlock, in order to prevent high pressure inside the equipment from causing accidents that could result in injuries or damage to the equipment. The process is shown in Figure 1. The input and output structure of the level SIF circuit is presented in Table 1, the circuit failure rate data are shown in Table 2, and the SIL verification results for the circuit are given in Table 3. Table 1 Input and Output of the Level Interlock Circuit
Circuit Name: Level Interlock Circuit
Voting Scheme: 2oo3
Input Unit: LT_01-658A/B/C
Logic Processing Unit: PES1oo2D
Output Units: FCV-01-681/EV-01-656, PCV-01-616 (2oo2)
Note: For the entire group, the valve assembly FCV-01-681/EV-01-656 operates in a 1oo2 configuration.

Table 2 Failure Rate Data for the Level Interlock Circuit
Name: λDD, λDU, λSD, λSU
Structure Type: TIM, TTR
Level Gauge: 6.22E-08, 7.18E-08, 7.97E-08, 1.02E-07
B3: 8 hours per 36 months
Safety Barrier: 3.00E-08, 1.10E-07
A3: 8 hours per 36 months
Processor: 1.10E-06, 1.50E-08, 1.30E-06, 6.0E-09
B3: 4 hours per 36 months
Power Supply: 2.25E-06, 2.50E-07
B3: 4 hours per 36 months
DI Card: 1.30E-08, 2.70E-08, 1.30E-08
B3: 4 hours per 36 months
DO Card: 2.00E-08, 1.20E-08
B3: 4 hours per 36 months
Actuator: 5.60E-07, 3.00E-07
A3: 8 hours per 36 months
Ball Valve 1: 15.30E-07
A3: 8 hours per 36 months
Ball Valve 2: 7.10E-07
A3: 8 hours per 36 months
Butterfly Valve: 2.75E-06
A3: 8 hours per 36 months
Solenoid Valve: 4.57E-09, 1.10E-07
A3: 8 hours per 36 months

Explanation of the calculation process: Since the reference literature does not provide values for the common failure probability of multiple channels, a reference value of 0.1 is used in all calculations. Furthermore, the reliability block diagram method and the fault tree analysis cannot calculate the functional test coverage parameter, nor can they handle multi-structure or heterogeneous structures; as a result, the functional test coverage is assumed to be 100% during calculations. When using these two methods to analyze output modules, the PFD for individual valves is calculated using a 1oo1 voting scheme, without taking into account the effects of common cause failures. Both the HAZOPkit software and exSILentia software are based on the Markov model method; therefore, these two software tools were directly used as the verification results for the Markov model method. The calculation results from the exSILentia software serve as a reference to those in the literature; since it is unclear which parameters were used in the calculations, they are provided only for reference. Table 3 Results of SIL calculations for the level interlock circuit. Name, PFDavg values; Reliability analysis methods: Fault tree analysis, HAZOP; Software used: KIT, exSILentia. Inputs (including level gauges and safety barriers): 1.40E-04, 1.52E-4, 2.10E-04, 2.52E-04. Logic controllers (including power supply, processor, and cards): 3.04E-03, 4.00E-3, 3.99E-03, 1.97E-04. Outputs (FCV-01-681/EV-01-656, PCV-01-616): 1.74E-02, 1.74E-2, 1.90E-02, 1.89E-02. For SIF circuits, PFDavg values are: 2.10E-02, 2.16E-2, 2.32E-02, 1.93E-02. Some studies have compared the accuracy of fault tree analysis and Markov model approaches using prior data from the OREDA database; it was found that in systems with relatively simple structures, the results obtained from these two methods differ little and are consistent with the prior data. The Markov model method yields better results for complex systems. Therefore, this paper will no longer compare the accuracy of these three verification methods, but will only discuss them in terms of functionality and practicality. Table 4 Comparison of Verification Methods: Reliability block diagram method, Fault tree analysis method, Markov model method. The level of computational complexity is low; it can be calculated manually. The computational load is high, and a computer is necessary. It provides a relatively good representation of the relationship between the failure of individual devices and system failures. Data requirements: The amount of data required is relatively small, with only dangerous failure states taken into account. Data requirements: The amount of data required is relatively small, with only dangerous failure states considered. Data requirements: A larger amount of data is needed, including both dangerous and safe failure states, although this is not mandatory. Multiple failure models: Not supported / Supported / Supported. It is difficult to achieve dynamic modeling; only one reliability indicator can be obtained per modeling session. Dynamic modeling is possible, allowing multiple reliability indicators to be determined in a single modeling session. Multiple voting modes: Supported / Supported / Supported. Heterogeneous structures: Not supported / Supported / Supported. Function test coverage: Not supported / Not supported / Supported. Computational complexity: After the design of reliability block diagrams and fault tree models is completed, calculations can be carried out directly using the derived PFD formulas, resulting in low computational load. The Markov model describes system states through matrices, and the computational load is very high; therefore, a computer is necessary to carry out the calculations. It reflects the relationship between individual devices and the system: The reliability block diagram method clearly illustrates the series and parallel connections within a system, while the fault tree method enables an intuitive understanding of the logical relationship between failures of individual devices and system failures. The Markov model method performs poorly in this regard. Data requirements: It is generally believed that the Markov model method requires a large amount of data. However, through calculations, the author found that if only the failure probability PFD related to the computational system requirements is taken into account, similar results can be obtained using only the reliability block diagram method or the fault tree method. Multiple failure models: The fault tree analysis method is based on the assumption that events have only two states and that the logical relationships between failures are definite; therefore, it is difficult to describe events with multiple states. For example, certain electronic components may have states such as normal, open circuit, and short circuit. The Markov model method is based on probability theory and provides a good description of polyphasic systems. Modeling scope: The reliability block diagram method and the fault tree analysis method can determine only one reliability indicator per modeling attempt; moreover, when the model structure changes, the calculation formulas must be derived anew, resulting in limited flexibility. Multiple voting modes and irregular structures: The most **frustrating aspect** I encountered during this verification process was the calculation of the output module (valve assembly). In the instance, the three valve types are all different and are divided into two groups; since no appropriate formula could be found, it was necessary to calculate the PFD for each individual device separately and then use a simple probability method for the calculations. The fault tree method can support multiple voting groups and heterogeneous structures, but the derivation of the formulas is extremely difficult. Functional test coverage: In this verification, it was assumed that the functional test coverage is 100%, meaning that the device returns to its initial state after each functional test; this is clearly not realistic. During actual testing, the functional test coverage has a significant impact on the calculation results, and among these three verification methods, only the Markov model approach can achieve this functionality. Summary: Whether using the reliability block diagram method, fault tree analysis, or Markov model method for SIL verification, it is necessary to rely on statistics of the failure rates of equipment and components; accurate data is a prerequisite for accurate verification results. For SIF loops with a simpler structure, the verification results from all three methods lead to the same conclusion regarding the SIL level. Furthermore, the reliability block diagram method and fault analysis provide a good description of the relationship between individual devices and systems, and the formulas for simple models are mostly available publicly; thus, companies can use these formulas during the design and selection phase of SIS systems to estimate the lower bounds for the reliability data of the required devices. Due to its flexibility and accuracy, the Markov model approach has become the preferred method for SIL verification software; its issues of high computational cost and poor intuitiveness have also been addressed in such software. Additionally: For the specific algorithms of the three verification methods discussed in this article, please refer to the post at https://bbs.hcbbs.com/thread-3123029-1-1.html. Note: This article is reproduced from the WeChat official account: Haopeng Technology – “Safety Integrity Level (SIL) Verification – Comparison of PFD Calculation Methods”