SOME PRACTICAL CONSIDERATIONS WHEN
APPLYING IEC-61508SIPI workshop
February, 2003
Erik DomNero Engineering
1
INTRODUCTIONThe IEC-61508 standard has now been around for a while, and after the euphoric reactions of the first years many companies are now applying it in practice, or at least they are trying. Being a general standard, it doesn’t offer too many worked out details, especially for the first 5 steps of the lifecycle model, where reference is made to other standards or current evaluation methods. For an “IEC” standard, it was even surprising to see these steps covered.Being involved with the standard since 1997, I’ve tried out different ways to apply it myself and as a consultant I’ve seen many different approaches. Even amongst “specialists” opinions differ and in recent years the standard has opened new commercial possibilities for companies that are now offering safety management tools, in some cases covering the whole lifecycle of the standard.For this short presentation I’ve picked out some items of the lifecycle, but similar remarks or discussion points could be made for the other steps.
Erik Dom
2
IEC-61508 LIFECYCLE MODEL1 Concept
2 Overall scope definition
3 Hazard and risk analysis
4 Overall safety requirements
5 Safety requirements allocation
Overall Installation and commissioning
Overall safety validation
Decommissioning or disposal
Overall operation and maintenance and repair
12
13
16
14 Overall modification and retrofit
Back to appropriateoverall safetylife cycle phase
15
Safety related systems: E/E/PES9 Realization (see E/E/PES
safety lifecycle)
External risk reduction facilities11
Realization
Safety related systems: other technologies
Realization
10Overall operation & maintenance planning
Overall planning
6Overall
installation and commissioning
planning
Overall validation planning
7 8
3
The DIN 19250 risk graph
Shown as an example in IEC 61508Applied in several companies, often in a different way
Definition of probability of unwanted occurrenceInterpretation of unwanted OCCURRENCECalibration of the risk graphInterpretation of “a” (“SIL 0”)
4
RISK GRAPH
a --bcdefg
h
a, b, c, d, e, f, g, h represent the necessary minimum risk reduction. The link between the necessary minimum risk reduction and the safety integrity level is shown in the table.
W1W2
abcdefg
-abcdef
Necessary minimum risk
reduction Safety integrity level
- No safety requirements
a No special safety requirements
b, c 1d 2
e, f 3g 4h An E/E/PE SRS is not
sufficient
W3
C = Consequence risk parameter
F = Frequency and exposure time riskparameter
P = Possibility of avoiding hazard riskparameter
W = Probability of the unwantedoccurrence
a, b, c ... h = Estimates of the required riskreduction for the SRSs
C1
P1F1Starting pointfor risk reduction
estimation
F2
F1
F2
P2C2
P1
P2
C3
C4
5
Probability of unwanted occurrence
The standard says:
W1 (LOW): A very slight probability…….only a few are likely.W2: A slight probability……. few are likely.W3 (HIGH): A relatively high probability……. frequent are likely
How is this currently interpreted by users?
6
Interpretation 1
W1 < 10-4/jr10-2/jr > W2 > 10-4/jrW3 > 10-2/jr
Interpretation 2
W1: 3 different independent failures are required for the occurrence to happenW2: 2 different independent failures are required for the occurrence to happenW3: 1 failure is sufficient for the occurrence to happen
7
Interpretation 3
W2: this is the “normal” probability for an event, arguments required to pass from W2 to W3 or W1
Interpretation 4
W1: less than 0.03 times per yearW2: between 0.3 and 0.03 times per yearW3: between 3 and 0.3 times per year
Used in IEC-61511 for calibrated matrixVery different from interpretation 1Leads to much lower SIL levelsProbability is replaced by “demand rate”
8
Interpretation of “Definition of unwanted occurrence”Case: overpressure in vessel containing flammable liquids leading to mechanical
rupture of vessel, release of product and finally a fire or an explosion with serious injury
Problems when defining the unwanted occurrence:
Very difficult to predict the final effect of a cloud (impossible to define during a “SIL” meeting) -> this has a major impact on the C factorThe case contains different events (rupture -> release -> explosion -> injury), where only the last event can be treated with the risk matrix (without injury C1 is always applicable). Releases are also considered as major risks by the authorities but can’t be covered by the risk graphProbabilities are often applied to other cases (i.e. An explosion is defined as unwanted occurrence while the probability of the overpressure is considered for the probability).This has a conservative effect on the result.
9
Risk reduction obtained by all protection layers
Necessary risk reduction
Actual risk reduction
Partial Risk by other protection layers
Partial Risk covered by SIS
Partial Risk by other non SIS prevention/mitigation protection
layers
RESIDUAL RISK
TOLERABLE RISK
EUC RISK
Increasing risk
Risk reduction is known (10, 100, 1000) but since the calibration is not known, what is
the absolute value of EUC risk and residual risk???
Increasing risk
RESIDUAL RISK
RESIDUAL RISK
EUCRISK
EUCRISK
?
?
Principle of risk reduction and residual risk
10
Interpretation of SIL “a”
Definition = “NO SPECIAL SAFETY REQUIREMENTS”
Means that the required risk reduction lies between 1 and 10Mostly interpreted as: can be installed in DCSMost companies don’t define the EUC, so is not clear if additional risk reduction is required (see example)
EUC
11
ConclusionUse of risk graph can be emotional/subjectiveNot suited for complex issues, one risk graph evaluation is often used for hazards with many different initiating events/scenario’sEUC is rarely defined, leading to a mix-up of control and safetyMany interpretations possible (W & P factors)What’s the residual risk?Depends heavily on the experience of the hazard teamResults can easily be “manipulated” in view of the required resultSIL “a” is often not consideredThe environmental graph (not shown in this presentation) is verysevere and leads to high SIL’s compared with human injuryDefinition of demand rate (IEC-61511) is confusing
12
The role of pressure relief valves in SIS
Should these be taken into account?If so, what SIL level to be assigned?
- Vendor data is not available- Valves are used in many different applications so that general reliability data
can’t be given be Vendors- Feedback from customers is not available since maintenance/repair is done
by specialized shops or customer itself- Depends strongly on application:
- Clean or dirty/agressive products- Outlet to safe area (confined) or to atmoshere- Rupture disc installed (P between disc and valve monitored?)Testing frequency and method?- How to define test interval?- Test method verifies only limited number of possible errors (setting).
Calculation errors, installation problems are not verified....
13
A POSSIBLE APPROACH FOR SAFETY VALVES
SIL 3 high pressure risk allocated to SIS & PSV
Clean service to confined
area
SIL 2 allocated to PSV
SIL 1allocated
to SIS
NO SIL allocated to PSV
SIL 3allocated
to SIS
YES NO
SIL OVERALL = SIL PSV + SIL SIF
14
Emergency handswitches in the process industry
Example: emergency stops to isolate plant areas in case of fire, leakage or explosion
To be treated according to IEC test intervals, calculations,...?Activated by human action + mitigatingDo they belong in SIS?Are these the same as the HS’s in the Machine Directive?
15
ALTERNATIVES FOR THE RISK MATRIX
LOPA (Layers of Protection Analysis)EVENT/FAULT TREE ANALYSIS
RISK GRAPH or
other qualitative
method
QUANTIFIED FMEA
LOPA Rough estimate with
event tree
Event tree Fault tree
HRA
SIMPLE ISSUES GOOD GOOD GOOD EXCESSIVE EXCESSIVE COMPLEX ISSUES POOR POOR FAIR FAIR GOOD
16
What is LOPA?
A simplified form of risk assessmentVerifies if sufficient layers of protection are presentLimited to evaluating a single cause-consequence pair as scenarioRepresents typically one path (worst case) through an event tree
17
Process Design
Basic Process Control SystemsMonitoring Systems (process alarms)
Operator Supervision
PREVENTIONMechanical Protection System
Process AlarmsOperator Supervision
Safety Instrument System
MITIGATIONMechanical Mitigation Systems
Safety Instrumented Control SystemsSafety Instrumented Mitigation Systems
PLANT EMERGENCY RESPONSE
COMMUNITY RESPONSE
Concept of layers of protection acc. to IEC-61511-1
18
An example of LOPA
Description Probability
Frequency (per year)
Consequence
Risk tolerance criteria
Maximum tolerance for serious fire Maximum tolerance for fatal injury
< 1 x 10-4
< 1 x 10-5 Initiating event Failure of DCS 1 x 10-1 Enabling event N/A
Probability of ignition 0.1 Probability of personnel in affected area 0.1 Probability of fatal injury 0.5
Conditional Modifiers
Others N/A Frequency of unmitigated consequence 5 x 10-4
SIF (not yet existing, to be added) 1 x 10-2 Independent Protection layers
Human action upon DCS alarm cannot be taken into account since DCS failure is the initiating event!
Total PFD for all IPL’s
1 x 10-2
Frequency of Mitigated Consequence 5 x 10-6 Actions required to meet required risk reduction
Install SIF with a PFD of 1 x 10-2
19
Another way of representing LOPA
1. No release of material, 8x10 -2/yr
Overpressure
10-1/yr
PAHalarm
Operator response
Protection layer 1:
PSV
Success
Failure
0,1
0,9
0,9
0,1
0,1
0,9
0,9
0,1
2. Release from PSV to flare, 8x10 -3/yr
3. Release to atmosphere, 9x10 -4 /yr
4. Release from PSV to flare, 9x10 -3/yr
5. Release to atmosphere, 1x10 -3/yr
20
When can LOPA be used?
Typically after a qualitative hazard evaluationThe consequences are too severe to rely on qualitative methods onlyWhen a scenario is too complex to use a qualitative method or when the hazard evaluation team does not fully understand:
• The initiating events• The sequence of events• The role of different IPLs (Independent Protection Layer)
As a screening tool before quantitative methodsTo verify the sufficiency of IPLsAlways applied to one scenario at a time
Never to replace quantitative risk analysis!
21
RELIABILITY DATA for SIL CALCULATIONS
OREDAVENDOR DATA (uncertified)CERTIFIED VENDOR DATAMIL (for electric/electronic components)Commercial databasesOwner’s database
OFTEN CONTRADICTORY!!!!!!!!!!!!!!!!!!!!!!
22
OREDA
Conservative (? )Availability of details of types of failure (but not of type of application)Some populations are (too) small (i.e. temperature)Instruments are not specified in detail
23
24
UNCERTIFIED VENDOR DATA
Based on theoretical calculationsBased on lab testsBased on feedback from customersInitial values are often adapted after a few years use with caution!
25
CERTIFIED VENDOR DATA
Few availableSometimes required information missingShould be interpreted with care, reliability data and details are only valid under certain conditionsExample of certificate for temperature transmitter
26
COMMERCIAL DATABASES
Some very expensive (purchase + support)What’s the basis of the reliability data?Sometimes with integrated safety management systemNot very flexibleSome “over-optimistic”, some values are very different from OredaSome allow to pick data depending on application (agressive or dirty fluids,...)
27
OWNER’s DATABASE
Requires some internal organizationTakes years before data are representativeImpossible for smaller companies with small installed baseWhy not in Belgian or European context?
28
WORKING WITH STANDARD SIS LOOPS
Conservative approach required not the most economical wayDifficult to cover all different applicationsDesign + components must be fixed since small deviations may lead to important deterioration of PFD’s (barriers, sensors,...)
Top Related