How can it be determined in advance during SIL classification whether the SIF can be achieved? Share practical and simplified SIL preliminary calculation methods

Thread Content

This post was last edited by biubiu0304 on 2022-2-28 at 13:52. Introduction: We know that after conducting Hazard and Operability (HAZOP) analyses and Safety Integrity Level (SIL) assessments, if it is determined that a Safety Instrumented System (SIS) is needed to reduce risks, then it is necessary to perform SIL evaluations for the instrument safety functions (SIF). The conventional SIL verification process is relatively cumbersome and time-consuming, and it often happens that the verification results do not meet the requirements of the target SIL level (in other words, the SIL verification is not passed). In such cases, it is necessary to analyze various possible causes, which could be issues with the SIF design or problems with certain instrumentation devices... This is a common phenomenon in current SIL verification tasks. Imagine if, when determining the SIL level, we simplified the SIL assessment process – eliminating the need for failure data of the equipment and complex calculations – so that an approximate SIL level could be determined through simple judgments. Wouldn’t this **improve work efficiency and reduce the need for rework? We call this a practically simplified SIL pre-calculation: 1. Under normal circumstances, for a SIF with a single execution action (1oo1), it is possible to achieve an SIL1 level using standard data calculations, but it is difficult to reach a value of 1.00E-02 for PFDavg (with RRF=100). If equipment with a SIL rating of SIL2 or higher is used, the resulting SIF can achieve a SIL2 level; however, it is difficult for PFDavg to reach values of 1.00E-03 or even 2.50E-03. In other words, when determining the SIL rating, if it is required that the PFD of the SIF be less than 2.50E-03 or that the RRF exceed 400, then the results of the SIL calculation are unlikely to meet those requirements. (For example, if a SIL2 rating for an SIF requires a PFD of less than 1.00E-03, then the SIL calculation will inevitably fail!) ) ； 2. During the SIL verification process, the presence of redundancy in sensors has a minor impact on the PFDavg of the entire SIF, whereas an increase in the actions that need to be carried out simultaneously (critical actions) has a greater impact on the PFDavg of the entire SIF ； 3. If all devices use certified failure data for calculations and the target requirement for SIF is SIL2, the number of critical actions should not exceed 3 ； As the number of critical actions increases, the SIL level that can be achieved by SIF tends to decrease. This paper will discuss in detail the aforementioned method for SIL preliminary calculation, based on failure data from actual projects as well as the extensive experience of the project team members. Overview of SIL verification methods: When determining the SIL level, all failure factors that can lead to a non-safe state must be taken into account, such as random hardware failures, design defects in hardware and software, and environmental disturbances. Certain failures in these types, especially hardware random failures, can be quantified in low-demand operation modes using the average failure probability on demand (PFDavg). However, the safety integrity of SIF also depends on many factors that cannot be quantified precisely and can only be considered qualitatively. Therefore, in conventional SIL verification, the SIL level of the SIF is determined by calculating and analyzing PFDavg for each component of the SIF, while also taking into account factors such as structural constraints and system capabilities, in order to confirm whether it meets the required target SIL level. Since the SIL level requirements for SIFs in the chemical industry are mainly at SIL1 and SIL2 levels, it is relatively easy to meet the target SIL level requirements when conducting SIL calculations by taking into account structural constraints and system capabilities; therefore, it will be assumed in the following that only PFDavg is used to represent the SIL level of the entire SIF. The value of PFDavg is obtained by summing up the PFDavg values of the subsystems related to safety functions in the SIF; it represents the average probability of failure occurring when required during a certain operating period. This value is also influenced by various parameters such as the testing period, testing coverage, and common cause failures. For the convenience of calculation and analysis, the following assumptions are proposed: 1. The SIF is divided into three components – sensors (including sensors and input interface elements), logic operators (including CPUs, power supplies, and various module channels), and final actuation elements (including the final actuation elements and output interface elements). The average failure probability PFDavg for the entire SIF is calculated as follows: PFDavg = PFDSE + PFDLS + PFDFE, where PFDavg represents the average failure probability required for the entire SIF ； PFDSE is the average failure probability when sensors are required ； PFDLS is the average failure probability required by logical operators ； PFDFE is the average failure probability when the requirements for the final actuator are considered ； 2. It is assumed that the design life of the device is 15 years, the average time to repair (MTTR) is 24 hours, the inspection and testing cycle (TI) is 12 months, the functional test coverage (CTI) is 100%, the common cause failure factor (β) is 5%, and the operation mode is a low-demand operation mode ； 3. For devices of the same type, general failure data and certification failure data are used respectively, considering only undetected hazardous failures (DU) of the devices. As shown in Table 1 – Failure Data Table: Table 1 – Failure Data Table. Equipment/Brand Model, General Data (DU), Certification Data (DU): Temperature Transmitter/Rosemount 248RTD; 3.00E-07, 3.70E-08. Input Safety Isolator/Zhejiang Zhongkong HD554; 3.50E-07, 1.74E-08. Logic Operator/Zhejiang Zhongkong TCS-900 (2oo3D). CPU/SCU9010: 1.25E-07, 7.67E-09. AI/SAI9010: 1.00E-07, 2.11E-08. DO/SDO9010: 1.00E-08, 1.95E-08. Output Safety Relay/Shanghai Chenzhu CZSR840: 16.00E-07, 1.00E-09. Solenoid Valve/ASCO 551: 16.00E-07, 1.98E-07. Pneumatic Actuator/Wuxi Shenghans HPY: 6.00E-07, 2.23E-07. Ball Valve/Zhejiang Zhongkong SN5: 8.00E-07, 1.68E-07.

SIF1: High/High interlock for the temperature of Reactor R101 (TZS101, 1oo1); shuts down the feed valve XZV101 (1oo1). SIF2: High/High interlock for the temperatures of Reactors R102 (TZS102A, TZS102B, 1oo2); shuts down the feed valve XZV102 (1oo1). SIF3: High/High interlock for the temperature of Reactor R103 (TZS103, 1oo1); shuts down valves XZV103A and XZV103B (2oo2). The values for these SIFs are calculated using the data from Table 1 – Failure Data Table. The calculation results are shown in Table 2 – Calculation Tables for Each SIF: Table 2 – Calculation Tables for Each SIF. Component, SIFPFDavg (General), PFDavg (Certification): Sensor, SIF1: 2.87E-03, 2.42E-04; SIF2: 1.56E-04, 2.42E-05; SIF3: 2.87E-03, 2.42E-04. Logic Operator, SIF1: 8.11E-05, 1.64E-05; SIF2: 8.11E-05, 1.64E-05; SIF3: 8.11E-05, 1.64E-05. Final Actuators, SIF1: 1.17E-02, 2.61E-03; SIF2: 1.17E-02, 2.61E-03; SIF3: 2.22E-02, 5.05E-03. Total (SIF), SIF1: 1.47E-02, 2.87E-03; SIF2: 1.19E-02, 2.65E-03; SIF3: 2.52E-02, 5.31E-03. Note: The PDFavg values used in this example were calculated using the SIL calculation software developed by Haopeng Technology. A comparative analysis of the PFDavg values for each SIF component is shown in Figures 1, 2, and 3. Figure 1: Distribution of PFDavg proportions for SIF1; Figure 2: Distribution of PFDavg proportions for SIF2; Figure 3: Distribution of PFDavg proportions for SIF3. Based on the analysis of the PFDavg proportions of SIF in these three figures, we can preliminarily draw the following conclusions: 1) Whether general failure data or certified failure data are used, the PFDavg value for the logic operator component has almost no impact on the overall PFDavg of the SIF ； 2) For actuation actions that are valve-type SIFs, the proportion of PFDavg in the final actuator component is much larger than that in the sensor component. A. When PFDavg is calculated using data with invalid certifications, the proportion of the final actuator component in PFDavg is significantly larger ； B. When sensor redundancy is configured (such as SIF2, sensor 1oo2) or actions that need to be performed simultaneously are added (i.e., critical actions, such as SIF3, critical action 2oo2), the proportion of the final actuator component in PFDavg becomes quite significant. Under normal conditions, the above situations are caused by the following reasons: ① Regarding dangerous failures (DU) that are not detected by the instrumentation equipment, the failure probability of valves is generally higher than that of transmitters ； ②In terms of device complexity, the number of devices involved in operating the on/off valves is greater than that in the sensor section ； ③From the perspective of SIF design, sensors may be provided with redundancy, while the addition of critical actions increases the PFDavg of the final actuator component. Based on the total values of various SIFs shown in Table 2 – the tables for calculating each SIF, that is, the PFDavg for the entire set of SIFs, the aggregate values of PFDavg for each SIF are presented in Figure 4. From this figure, the following conclusion can be drawn: 3) For SIFs involving a single execution action, it is possible to achieve a SIL1 level by using standard calculation methods for all devices, but it is difficult for PFDavg to reach the value of 1.00E-02. All devices can achieve SIL2 level (such as SIF1 and SIF2) using certified data calculations, but it is difficult to reach the values of 1.00E-03 (RRF=1000) or even 2.50E-03 (RRF=400) for PFDavg ； 4) Regardless of the data used for calculation, sensor redundancy has a minor impact on the PFDavg of the entire SIF (compared to SIF2 and SIF1), while adding critical actions has a greater impact on the PFDavg of the entire SIF (compared to SIF3 and SIF1). So far, based on the above conclusions, and prior to conducting specific calculations, we have been able to form a rough idea of what kind of design SIF is required, as well as what data should be used to calculate the SIF in order to achieve the desired SIL level. To further investigate the impact of adding more critical actions on the PFDavg value of the entire SIF, the following SIFs were defined: SIF4: High/High interlock for the temperature of reactor R104 (TZS104,1oo1), which shuts down the feed valves XZV104A~C (3oo3); SIF5: High/High interlock for the temperature of reactor R105 (TZS105,1oo1), which shuts down the feed valves XZV105A~D (4oo4); SIF6: High/High interlock for the temperature of reactor R106 (TZS106,1oo1), which shuts down the feed valves XZV106A~E (5oo5); SIF7: High/High interlock for the temperature of reactor R107 (TZS107,1oo1), which shuts down the feed valves XZV107A~F (6oo6). The values for these SIFs were calculated using the data from Table 1 – Failure Data Table, and together with the data from SIF1 and SIF3, the results are shown in Figure 5: Total PFDavg value for the SIFs. From Figure 5, it can be concluded that: 5) If all equipment is evaluated using certified data, and when the required SIL level for the SIF is SIL2, the number of critical actions should not exceed 3 ； 6) As the number of critical actions increases, the SIL level that can be achieved by SIF tends to decrease. Finally, we conclude this article with a simple practical example that provides only the SIF description and the target requirements. Readers are invited to conduct a preliminary assessment to determine whether the target requirements can be met without carrying out actual calculations; it is possible to make such a judgment based solely on the given SIF description. The example is shown in Table 3 – Case Analysis: Table 3 – Case Analysis SIF Description Target SIL Level Target PFDavg Ammoniocyanide Reactor R-0106A Temperature (TZT-01130A, 1oo1) High High Interlock to close the jacket hot water inlet valve XV-01140A, the outlet valve XV-01141A, and the phosphinaldehyde inlet valve XV-01136A; simultaneously open the jacket cold water inlet valve XV-01138A and the outlet valve XV-01139A. SIL11.00E-02: Can this SIF meet the target requirements? A. It can meet both the target SIL level requirements and the target PFDavg requirements. B. It can meet the target SIL level requirements, but not the target PFDavg requirements. C. It cannot meet neither the target SIL level requirements nor the target PFDavg requirements. The correct answer can be seen by replying to this post. Correct answer: B. Note: This article is reprinted from the WeChat official account: Haopeng Technology