www.utm.my innova-ve entrepreneurial global
Safety Integrity Level (SIL) is defined as: Relative level of risk-reduction provided by a safety function to specify a target level of risk reduction. SIL is a measurement of performance required for a Safety Instrumented Function (SIF). Standard IEC6508 - generic standard for design, construction, and operation of electrical/electronic/programmable electronic systems. (similar to ANSI/ISA S84.0) IEC65 - was published in 200 to provide guidance to endusers on the application of Safety Instrumented Systems in the process industries. www.utm.my innova-ve entrepreneurial global 2
SIL is a measure of safety system performance, in terms of probability of failure on demand (PFD). Safety Integrity Level (SIL) Probability of Failure on Demand Average Range (PFD Average) Risk Reduction Availability (%) 0 - to 0-2 0 to 00 90 to 99 2 0-2 to 0-00 to 000 99 to 99.9 0 - to 0-4 000 to 0,000 99.9 to 99.99 4 Below 0-4 0,000 to 00,000 99.99 to 99.999 www.utm.my innova-ve entrepreneurial global
Event Likelihood Consequence Catastrophic Major Severe Minor Frequent SIL 4 SIL SIL SIL 2 Probable SIL SIL SIL SIL 2 Occasional SIL SIL SIL 2 SIL Remote SIL SIL 2 SIL 2 SIL Improbable SIL SIL 2 SIL SIL Negligible / Not Credible SIL 2 SIL SIL SIL www.utm.my innova-ve entrepreneurial global 4
The required SIL level is determined independently for every safety function or safeguarding loop. The realized SIL level of a loop, in contrast, is the actual SIL as it is realized in the field. It depends on: the transmitters used, the configuration of the transmitters barriers, isolators, fuses the logic solver or Safety Instrumented System the actuator(s): valves, valve positioners, circuit breakers, etc the configuration of the valves, for instance "single block" or "double block & bleed" www.utm.my innova-ve entrepreneurial global 5
Safety Integrated Levels (SILs) for emergency shutdown system: SIL (PFD = 0 - to 0-2 ): implemented with a single sensor, a single logic solver, a single final control element, and requires periodic proof testing SIL2 (PFD = 0-2 to 0 - ): typical fully redundant, including the sensor, a single logic solver, a single final control element, and requires periodic proof testing SIL (PFD = 0 - to 0-4 ): typical fully redundant, including the sensor, a single logic solver, a single final control element, and requires careful design and frequent validation test to achieve low PFD figures. www.utm.my innova-ve entrepreneurial global 6
7 www.utm.my innova-ve entrepreneurial global 7
W W2 W CONSEQUENCE RISK REDUCTION FACTOR REQUIRED MATRIX 4 0 0 000 000 TH NR 0 00 000 000 2 NR NR 0 00 00 NR NR NR 0 0 2 4 5 FREQUENCY C C 2 F F 2 P P 2 P P 2 2 4 5 a 2-2 - a 2 2 4 - - 2 - - a Risk Matrix C F 6 5 4 2 F 2 7 4 6 5 C 4 8 h 7 4 6 PFD avg = F t /F np = Tolerable Frequency Process Demand Frequency Risk Graph www.utm.my innova-ve entrepreneurial global 8
Calculate Initial Risk (or Inherent Risk) using risk analysis tools Inherent Risk = Threat X Vulnerability Calculate the residual risk (risk after barriers) using techniques such as ETA, LOPA Residual Risk = Inherent Risk X Controlled Risk Calculate the necessary risk reduction to reach an acceptable level Requires numerical expression of acceptable risk Risk Reduction = Inherent Risk Acceptable Risk www.utm.my innova-ve entrepreneurial global 9
Residual Risk = Inherent Risk Effectiveness of Controls Example Likelihood (times per period) Consequence $ Impact Total $ per period Inherent Risk 0 0,000 00,000 Effectiveness of control 80% 40% Residual Risks 2 6,000 2,000 Both the likelihood can be mitigated by some selected control measures www.utm.my innova-ve entrepreneurial global 0
Drive the consequence and/or frequency of potential incidents to an tolerable risk level Intolerable Risk Risk = frequency * consequence Tolerable Risk www.utm.my innova-ve entrepreneurial global
Incident Frequency = Initiating Cause Frequency Consequence = Scenario Consequence Initiating Cause Consequence Unmitigated Risk IS IT TOLERABLE? Compare unmitigated risk to risk tolerance. If unmitigated risk is greater than risk tolerance, independent protection layers are required www.utm.my innova-ve entrepreneurial global 2
IPL IPL 2 IPL Unmitigated Risk = frequency * consequence PFD PFD 2 PFD Mitigated Risk = reduced frequency * same consequence Success Safe Outcome Initiating Event Success Safe Outcome Failure Success Safe Outcome Failure Failure Consequences exceeding criteria The frequency can be reduced by using better devices to achieve tolerable risks www.utm.my innova-ve entrepreneurial global
Unmitigated Risk PFD=0. Preventiv e Feature PFD=0. PFD=0.0 Preventive Feature Mitigative Feature Mitigated Risk = reduced frequency * reduced consequence Different Scenario Consequence Occurs Initiating Event Frequency = /yr Success = 0.9 Failure = 0. Success = 0.9 Failure = 0. Success= 0.99 Failure = 0.0 Frequency = 0.9/yr Safe Outcome Frequency = 0.09/yr Safe Outcome Frequency = 0.0099/yr Mitigated Release, tolerable outcome Frequency 0.000/yr Consequences exceeding criteria www.utm.my innova-ve entrepreneurial global 4
Unmitigated Risk PFD=0. PFD=0. PFD=0.0 Preventive Feature Preventive Feature Mitigative Feature Mitigated Risk = reduced frequency * reduced consequence Different Scenario Consequence Occurs Initiating Event Frequency = /yr Success = 0.9 Success = 0.9 Success= 0.99 Failure = 0. Failure = 0. Failure = 0.0 Frequency = 0.9/yr Safe Outcome Frequency = 0.09/yr Safe Outcome Frequency = 0.0099/yr Mitigated Release, tolerable outcome Frequency 0.000/yr Consequences exceeding criteria www.utm.my innova-ve entrepreneurial global 5
COMMUNITY EMERGENCY RESPONSE Emergency Broadcasting PLANT EMERGENCY RESPONSE Evacuation Procedure MITIGATION Mechanical Mitigation System Safety Instrumented Control System Safety Instrumented Mitigation System Operator Supervision PREVENTION Mechanical Protection system Alarms with operator corrective actions Safety Instrumented Control System CONTROL & MONITORING Basic Process Control System Monitoring system (Alarms) Operator Supervision PROCESS DESIGN WHAT ARE IPL? Each layer is independent in terms of operation. The failure of one layer does not affect the next www.utm.my innova-ve entrepreneurial global 6
www.utm.my innova-ve entrepreneurial global 7