Functional Safety from Scratch: A Practical Guide to Process Industry Applications

Front Cover
Functional Safety from Scratch
Functional Safety from Scratch
Copyright
Contents
About the author
Acknowledgements
Abbreviations
Glossary
Introduction
	Which industries are covered?
	Who is the book suitable for?
	Who developed this book?
1 - Introduction to functional safety
	1.1 What could possibly go wrong?
	1.2 Hazard and risk
		1.2.1 What is a hazard?
		1.2.2 What is harm?
		1.2.3 What is risk?
		1.2.4 What is tolerable risk?
		1.2.5 Risk management through functional safety
	1.3 Functional safety standards: IEC 61508 and IEC 61511
		1.3.1 Purpose of the standards
		1.3.2 Scope of IEC 61511
		1.3.3 Why comply with IEC 61511?
	1.4 IEC 61511 key concepts
		1.4.1 The functional safety lifecycle
		1.4.2 Intrinsically safer design
		1.4.3 The safety requirements specification (SRS)
		1.4.4 Assuring that functional safety is achieved
		1.4.5 Random and systematic failures
		1.4.6 Competency
	1.5 The structure of IEC 61511
	1.6 The origins of IEC 61511
	Exercises
	Answers
		Question 1—Answer
		Question 2—Answer
		Question 4—Answer
	References
	Further reading
2 - Basic terminology: SIF, SIS and SIL
	2.1 The meaning of SIF, SIS and SIL
		2.1.1 What is a SIF?
		2.1.2 What is a SIS?
		2.1.3 SIL, reliability, and integrity
		2.1.4 What is an interlock (or trip)?
	2.2 Anatomy of a SIF
		2.2.1 The sensor subsystem
			Other components of the sensor subsystem
			The MooN concept for initiators
		2.2.2 The logic solver subsystem
		2.2.3 The final element subsystem
			Actuated valves
			Motor control circuits
			Other final elements
			Other elements of the final element subsystem
			The MooN concept for final elements
		2.2.4 Permissives and inhibit functions
		2.2.5 Other important aspects of a SIF
	2.3 Development of a SIF
		2.3.1 SIL assessment
		2.3.2 SIL verification
	2.4 Failure
		2.4.1 Failure modes
		2.4.2 Failure rates
		2.4.3 Hardware fault tolerance
	Exercises
	Answers
		Question 1—Answer
		Question 2—Answer
		Question 3—Answer
		Question 4—Answer
		Question 5—Answer
		Question 6—Answer
		Question 7—Answer
		Question 8—Answer
	References
3 - Risk evaluation
	3.1 Identifying hazardous scenarios
	3.2 Expressing risk in numbers
	3.3 Tolerable risk
		Defining a tolerable risk per event
		Defining a total tolerable risk per risk receptor
	3.4 How much precision is needed?
	3.5 The ALARP concept
	Exercises
	Answers
		Question 1—Answer
		Question 2—Answer
		Question 3—Answer
	References
4 - Introduction to SIL assessment
	4.1 Safety instrumented function (SIF) operating modes
		4.1.1 What are low demand, high demand and continuous modes?
		4.1.2 Selecting an operating mode
		4.1.3 Formal definition of operating modes
		4.1.4 The significance of operating modes
			Definition of SIL
			Failure rates
			SIL assessment methodology
		4.1.5 Tips on selecting the operating mode
	4.2 The objectives of SIL assessment
		4.2.1 Low demand mode SIFs
		4.2.2 High demand and continuous mode SIFs
		4.2.3 Why not use default SIL targets?
		4.2.4 Prevention or mitigation?
	4.3 Identifying and documenting SIFs
		4.3.1 Objective
		4.3.2 Using process control narratives, interlock descriptions
		4.3.3 Using cause & effect diagrams (C&EDs)
		4.3.4 Using HAZOP and old SIL assessment study reports
			Should BPCS trips be included?
		4.3.5 Using binary logic diagrams
		4.3.6 Using interlock logic diagrams
		4.3.7 Using piping & instrumentation diagrams (P&IDs)
	4.4 Separating complex interlocks into SIFs
	4.5 The double jeopardy rule
	4.6 Independent protection layers
		4.6.1 Pressure relief devices (PRDs)
		4.6.2 Alarms with operator response
		4.6.3 Control loops
		4.6.4 Autostart of standby equipment
		4.6.5 BPCS interlocks
		4.6.6 Interlocks in other PLCs
		4.6.7 Check valves
		4.6.8 Other mechanical protective devices
		4.6.9 Operating procedures
		4.6.10 Spill containment
		4.6.11 Trace heating
		4.6.12 Backup utility supplies
		4.6.13 Another SIF
		4.6.14 Typical IPL credit available
		4.6.15 Examples of insufficient independence
	4.7 Critical common element analysis
	Exercises
	Answers
		Question 1—Answer
		Question 2—Answer
		Question 3—Answer
		Question 4—Answer
		Question 5—Answer
		Question 6—Answer
		Question 7—Answer
		Question 8—Answer
		Question 9—Answer
		Question 10—Answer
		Question 11—Answer
		Question 12—Answer
		Question 13—Answer
	References
5 - SIL assessment methodology
	5.1 Introduction
	5.2 Overview of SIL assessment methods
		Features of SIL assessment common to all methods
	5.3 Selecting initiating events
		Typical initiating events
		Determine the initiating event in sufficient detail
		Control loop malfunctions
		Failure of safeguards as initiating events
	5.4 Assessing the likelihood of initiating events
	5.5 Assessing the consequence severity
	5.6 Documenting the SIL assessment study
	5.7 Risk matrix method
		5.7.1 Method overview
		5.7.2 Likelihood and severity categories
		5.7.3 The risk matrix
		5.7.4 Calibration of the risk matrix
		5.7.5 Handling multiple initiating events
		5.7.6 Handling enabling conditions and conditional modifiers
		5.7.7 Handling independent protection layers (IPLs)
		5.7.8 Estimating the SIF demand rate
		5.7.9 Risk matrix and ALARP
		5.7.10 High demand and continuous mode SIFs
	5.8 Risk Graph method
		5.8.1 Method overview
		5.8.2 Parameters used in Risk Graph
		5.8.3 Risk Graph examples
		5.8.4 Selecting parameter categories
			Demand frequency (W parameter)
			Exposure (F parameter)
			Avoidance (P parameter)
		5.8.5 Calibration of the Risk Graph
		5.8.6 Handling multiple initiating events
		5.8.7 Handling enabling conditions and conditional modifiers
		5.8.8 Handling independent protection layers (IPLs)
		5.8.9 Estimating the SIF demand rate
		5.8.10 High demand and continuous mode SIFs
	5.9 Layer of protection analysis (LOPA)
		5.9.1 Method overview
		5.9.2 Enabling conditions
		5.9.3 Conditional modifiers
		5.9.4 Handling multiple initiating events
		5.9.5 Estimating the SIF demand rate
		5.9.6 Example LOPA worksheet
		5.9.7 High demand and continuous mode SIFs
	5.10 Fault tree analysis
		5.10.1 Method overview
		5.10.2 Documenting Fault Tree analysis
	5.11 Cost/benefit analysis
		5.11.1 Introduction
		5.11.2 Calculating the cost of the outcome
			Example
		5.11.3 Calculating the cost of the SIF
		5.11.4 Selecting the optimal solution
	5.12 The SIL assessment workshop
		5.12.1 The SIL assessment team
		5.12.2 Overall objectives of the SIL assessment workshop
	Exercises
	Answers
		Question 1—Answer
		Question 2—Answer
		Question 3—Answer
		Question 4—Answer
		Question 5—Answer
		Question 6—Answer
		Question 7—Answer
		Question 8—Answer
		Question 9—Answer
		Question 10—Answer
		Question 11—Answer
		Question 12—Answer
		Question 13—Answer
		Question 14—Answer
		Question 15—Answer
		Question 16—Answer
		Question 17—Answer
		Question 18—Answer
	References
6 - SIL assessment: special topics
	6.1 Redundant initiators
		Handling redundant initiators
	6.2 Redundant safety functions
		What determines if two SIFs are redundant?
		One SIF as backup to another
		Redundant SIFs in low risk situations
	6.3 One SIF—two hazards
	6.4 The IPLs vary depending on demand case
	6.5 The demand case is activation of another SIF
	6.6 One SIF cascades to another
	6.7 Initiating event involves multiple simultaneous failures
		Example 1
		Example 2
	6.8 Permissives
		Demand frequency
		Defining physical initiators and final elements
	6.9 Multiple sensors distributed across a wide area
	6.10 Operator action as initiator
	6.11 Duty and standby pumps
		Variable number of pumps running
		Duty pump switchover
	6.12 Alarms from cascade control loops
	6.13 Final elements are shared between the basic process control system (BPCS) and the SIS
	6.14 Selecting primary final elements
		6.14.1 Introduction
		6.14.2 The safe state
		6.14.3 Selecting primary final elements
	Exercises
	Answers
		Question 1—Answer
		Question 2—Answer
		Question 3—Answer
		Question 4—Answer
		Question 5—Answer
		Question 6—Answer
		Question 7—Answer
		Question 8—Answer
		Question 9—Answer
	Reference
7 - Key functional safety documents
	7.1 The how and why of documentation
	7.2 The functional safety management plan
	7.2.1 Introduction
		7.2.1 Introduction
	7.2.2 The functional safety lifecycle
		7.2.2 The functional safety lifecycle
			What information is needed for each lifecycle phase?
	7.2.3 Management of change and configuration management
		7.2.3 Management of change and configuration management
			Management of change
			Configuration management
	7.2.4 Management requirements in the FSMP
		7.2.4 Management requirements in the FSMP
			Overall planning
			Document management
			Competency management
			Action item management
			Contractor management
			SIL capability management
			Assurance planning
	7.2.5 Why the FSMP is important
		7.2.5 Why the FSMP is important
	7.3 The Safety Requirements Specification (SRS)
	7.3.1 Introduction
		7.3.1 Introduction
	7.3.2 What is the purpose of the SRS?
		7.3.2 What is the purpose of the SRS?
	7.3.3 When is the SRS developed?
		7.3.3 When is the SRS developed?
	7.3.4 What should the SRS contain?
		7.3.4 What should the SRS contain?
			Example wording for SIF logic description
			Information you should consider adding to the SRS
	7.3.5 Common cause failures
		7.3.5 Common cause failures
	7.3.6 SIF demand rates
		7.3.6 SIF demand rates
	7.3.7 Selecting a spurious trip rate target
		7.3.7 Selecting a spurious trip rate target
	7.4 The safety manual
	7.5 Maximising the effectiveness of documentation
	Minimise repetition
		Minimise repetition
	Automate, but be careful
		Automate, but be careful
	Consider the future
		Consider the future
	7.6 Complete overview of functional safety documentation
	Exercises
	Essay or discussion question
		Essay or discussion question
	Answers
	Question 1—answer
		Question 1—answer
	Question 2—answer
		Question 2—answer
	Question 3—answer
		Question 3—answer
	Question 4—answer
		Question 4—answer
	Question 5—answer
		Question 5—answer
	Question 6—answer
		Question 6—answer
	Question 7—answer
		Question 7—answer
	Question 8—answer
		Question 8—answer
	Question 9—answer
		Question 9—answer
	Question 10—answer
		Question 10—answer
	Question 11—answer
		Question 11—answer
	Question 12—answer
		Question 12—answer
	Question 13—answer
		Question 13—answer
	Question 14—answer
		Question 14—answer
	Question 15—answer
		Question 15—answer
	Question 16—answer
		Question 16—answer
	Question 17—answer
		Question 17—answer
	Question 18—answer
		Question 18—answer
	Question 19—answer
		Question 19—answer
	Reference
8 - Safety instrumented system design
	8.1 The goal of SIS basic design
	8.2 PLC-based logic solvers
		8.2.1 What is a SIS PLC?
		8.2.2 PLC redundancy and diagnostics
		8.2.3 Diagnostics for field devices
		8.2.4 Setting trip parameters
			Setpoints
			Trip delay
			Reset
		8.2.5 Cybersecurity
	8.3 Selection of field devices
		8.3.1 Preferred types of SIF initiator
			Selection of initiator type
			Valve limit switches as initiators
		8.3.2 Defining final element architecture
		8.3.3 SIF architecture
		8.3.4 Testing and maintainability
			Are Bypass Lines Allowed on SIS Shutdown Valves?
		8.3.5 Partial valve stroke testing
			Is PVST a diagnostic?
		8.3.6 Energise and de-energise-to-trip
		8.3.7 Derating
		8.3.8 Hard-wiring of field devices
	8.4 Independence
		8.4.1 Multiple SIFs in the same SIS
		8.4.2 Multiple systems tripping a motor via the same MCC
		8.4.3 Communications between SIS logic solver and BPCS
		8.4.4 Implementing BPCS and SIS in a single logic solver
		8.4.5 Implementing non-safety functions in the safety PLC
	8.5 Non-PLC based logic solvers
		Susceptibility to spurious trips
	8.6 What comes next?
	References
	Further reading
9 - Meeting SIL requirements: SIL verification
	9.1 What it takes to achieve a given SIL
	9.2 Calculating the random hardware failure measure
		9.2.1 Introduction
		9.2.2 How the failure measure is calculated: SIL verification
			Calculation of probability curves
				Single devices
				Multiple devices
				The complete SIF
			State-based calculations
		9.2.3 High demand and continuous modes
	9.3 More on proof testing
		9.3.1 Optimising the proof test interval
		9.3.2 The effect of human error during proof testing
	9.4 Architectural constraints
		9.4.1 Introduction
		9.4.2 Hardware type A and type B
		9.4.3 Safe failure fraction
		9.4.4 HFT requirements in IEC 61508:2000
		9.4.5 HFT requirements in IEC 61508:2010
		9.4.6 HFT requirements in IEC 61511:2016
		9.4.7 How to apply SFF requirements
	9.5 SIL capability and SIL certification
		9.5.1 Introduction
		9.5.2 Assessing the element's performance in the field
		9.5.3 What is the difference between ‘proven in use’ and ‘prior use’?
		9.5.4 What is meant by a “SIL 2 shutdown valve”?
		9.5.5 Software SIL capability
	9.6 Calculating predicted spurious trip rate
	9.7 What to do if SIS design targets are not met
	Exercises
		Descriptive questions
		Numerical questions
	Answers
		Question 1—Answer
		Question 2—Answer
		Question 3—Answer
		Question 4—Answer
		Question 5—Answer
		Question 6—Answer
		Question 7—Answer
		Question 8—Answer
		Question 9—Answer
		Question 10—Answer
		Question 11—Answer
		Question 12—Answer
		Question 13—Answer
		Question 14—Answer
		Question 15—Answer
		Question 16—Answer
		Question 17—Answer
		Question 18—Answer
		Question 19—Answer
	References
	Further reading
10 - Assurance of functional safety
	10.1 Introduction
	10.2 Verification
		10.2.1 Introduction
		10.2.2 How verification works in practice
		10.2.3 Verification checklists
		10.2.4 Discrepancy handling
		10.2.5 Competency and independence requirements
	10.3 Validation
		10.3.1 Introduction
		10.3.2 Hardware inspection
			Field equipment inspection
			SIS logic solver inspection
		10.3.3 End-to-end test
		10.3.4 Specific tests for sensors
		10.3.5 Specific tests for final elements
		10.3.6 Test equipment
		10.3.7 Document inspection
		10.3.8 Discrepancy handling
		10.3.9 Restoring the SIS after validation
		10.3.10 Validation report
		10.3.11 Revalidation
	10.4 Functional safety assessment
		10.4.1 Introduction
		10.4.2 Which stakeholders need to perform FSA?
		10.4.3 What sample size needs to be considered in FSA?
		10.4.4 Independence requirements for FSA
		10.4.5 How FSA is conducted in practice
		10.4.6 Assessment tasks
		10.4.7 Common pitfalls to avoid
		10.4.8 Example: assessment of SIL verification
	10.5 Functional safety audit
		10.5.1 Introduction
		10.5.2 Typical audit procedure
	Exercises
	Answers
		Question 1—answer
		Question 2—answer
		Question 3—answer
		Question 4—answer
		Question 5—answer
		Question 6—answer
		Question 7—answer
		Question 8—answer
		Question 9—answer
		Question 10—answer
		Question 11—answer
		Question 12—answer
		Question 13—answer
		Question 14—answer
		Question 15—answer
		Question 16—answer
11 - The SIS operational phase
	11.1 Introduction
	11.2 Training requirements
		11.2.1 Operator training
		11.2.2 Training for maintenance personnel
	11.3 Proof testing
		11.3.1 Introduction
		11.3.2 Applying more than one test procedure per device
		11.3.3 Test before performing maintenance
		11.3.4 Document the duration of testing and repair
	11.4 Monitoring of SIS performance
	11.5 SIS modifications and partial decommissioning
		11.5.1 The Management of Change procedure
	11.6 Future challenges
	11.7 Closing thoughts
	Exercises
	Answers
		Question 1—Answer
		Question 2—Answer
		Question 3—Answer
		Question 4—Answer
		Question 5—Answer
	Reference
A - Sample verification checklist
	Outline placeholder
		Verification checklist: SIL assessment
		Section 1. Scope of work executed
		Section 2. Inputs
		Section 3. Outputs
		Section 4. Quality
		Section 5. Personnel
		Section 6. Verification results
B - What is affected by SIL
	Start of appendix
Index
	A
	B
	C
	D
	E
	F
	G
	H
	I
	K
	L
	M
	N
	O
	P
	Q
	R
	S
	T
	U
	V
	W
Back Cover