Safety instrumented systems and SIL

Why it matters

When control fails and a reactor overheats or a vessel over-pressures, the last automatic line of defence is the safety instrumented system (SIS). Accidents such as Bhopal, Texas City and Buncefield showed the cost of weak protective layers. Indian refineries, petrochemical and fertiliser plants design SIS to IEC 61511, and engineers who can calculate a SIL target and verify a design are in demand.

Key ideas

What an SIS is. An independent system of sensors, a logic solver and final elements (valves, motor trips) that takes the process to a safe state when a dangerous condition is detected. Each protective action is a safety instrumented function (SIF) — for example "close the feed valve and open the vent if reactor pressure exceeds 18 bar". The SIS is separate from the basic process control system (BPCS) so that a single fault cannot both cause the upset and disable the protection.

Layers of protection. Process design, BPCS control, alarms with operator response, the SIS, mechanical relief (relief valves, rupture discs), physical containment (dikes), and emergency response. Each independent protection layer (IPL) reduces the frequency of the hazardous outcome by its probability of failure on demand (PFD).

Standards. IEC 61508 is the generic functional-safety standard (and covers product certification); IEC 61511 is its process-industry application. Both use a safety lifecycle: hazard and risk analysis (HAZOP), allocation of safety functions to layers, a safety requirements specification (SRS), design, installation, validation, operation with proof testing, and management of change.

Safety integrity level (SIL). For a SIF in low-demand mode (demanded less than once a year — most process trips) the SIL is set by the average PFD:

• SIL 1: PFDavg 10⁻² to 10⁻¹ (risk reduction factor RRF 10 to 100)
• SIL 2: 10⁻³ to 10⁻² (RRF 100 to 1000)
• SIL 3: 10⁻⁴ to 10⁻³ (RRF 1000 to 10 000)
• SIL 4: 10⁻⁵ to 10⁻⁴ (RRF 10 000 to 100 000) — rarely used in process plants. High-demand or continuous-mode functions use the probability of dangerous failure per hour (PFH) instead. A SIL applies to a whole SIF, not to a single instrument.

Determining the SIL. Layer of protection analysis (LOPA) compares the mitigated event frequency with the tolerable frequency set by company risk criteria. The SIF must supply the remaining risk reduction. Risk graphs and risk matrices are simpler qualitative alternatives.

Verifying the design. PFDavg is calculated from the dangerous undetected failure rate λ_DU of each element, the proof-test interval T_I and the architecture (voting):

• 1oo1 — one device; any dangerous failure defeats it.
• 1oo2 — either of two devices can trip; safer, but more spurious trips.
• 2oo2 — both must agree; fewer spurious trips, less safe than 1oo1.
• 2oo3 — two of three; a good balance of safety and availability. Common-cause failures (same design, same process connection, same maintenance error) are represented by a β-factor and often dominate redundant designs. The design must also meet hardware fault tolerance (architectural) constraints and systematic-capability requirements.

Design practices. De-energise to trip (loss of power or signal gives the safe state); separate sensors and valves from the BPCS; diagnostics to convert undetected failures into detected ones; partial-stroke testing of valves; regular proof testing; strict bypass management.

Formulas

RRF = 1 / PFDavg

• RRF: risk reduction factor (dimensionless); PFDavg: average probability of failure on demand (dimensionless).

f_mitigated = f_initiating × PFD₁ × PFD₂ × …

• f: event frequencies (per year); PFDᵢ: PFDs of the independent protection layers other than the SIF.

PFD_SIF,required = f_tolerable / f_mitigated

PFDavg(1oo1) ≈ λ_DU·T_I / 2 PFDavg(1oo2) ≈ (λ_DU·T_I)² / 3 + β·λ_DU·T_I / 2 PFDavg(2oo3) ≈ (λ_DU·T_I)² + β·λ_DU·T_I / 2 PFDavg(2oo2) ≈ λ_DU·T_I

• λ_DU: dangerous undetected failure rate (per hour); T_I: proof-test interval (h); β: common-cause fraction. Valid when λ_DU·T_I ≪ 1; repair time neglected.

PFDavg,SIF = PFD_sensors + PFD_logic + PFD_final elements

Worked examples

Example 1 (standard) — SIL target by LOPA. A cooling-water failure (initiating frequency 0.2 per year) can cause a reactor runaway. Existing IPLs: a high-temperature alarm with operator response (PFD 0.1) and a relief valve (PFD 0.01). The tolerable frequency is 10⁻⁶ per year. Find the required SIL.

1. f_mitigated = 0.2 × 0.1 × 0.01 = 2 × 10⁻⁴ per year.
2. PFD_required = 10⁻⁶/(2 × 10⁻⁴) = 5 × 10⁻³.
3. RRF = 1/(5 × 10⁻³) = 200.
4. 5 × 10⁻³ lies between 10⁻³ and 10⁻², so the SIF must be SIL 2 (RRF ≥ 200).

Example 2 (GATE level) — verifying PFDavg. The SIF uses pressure transmitters (λ_DU = 1 × 10⁻⁶ per h), a certified logic solver (PFD = 1 × 10⁻⁴) and shut-off valves (λ_DU = 4 × 10⁻⁶ per h). Proof test interval T_I = 1 year = 8760 h. Find PFDavg and the achieved SIL for (a) 1oo1 sensor and 1oo1 valve; (b) 1oo2 sensors and 1oo2 valves with no common cause; (c) case (b) with β = 10 %.

1. λT: sensor 1 × 10⁻⁶ × 8760 = 8.76 × 10⁻³; valve 4 × 10⁻⁶ × 8760 = 3.504 × 10⁻².
2. (a) Sensor 8.76 × 10⁻³/2 = 4.38 × 10⁻³; valve 3.504 × 10⁻²/2 = 1.752 × 10⁻². Total = 4.38 × 10⁻³ + 1 × 10⁻⁴ + 1.752 × 10⁻² = 2.20 × 10⁻² → SIL 1 (fails SIL 2).
3. (b) Sensors (8.76 × 10⁻³)²/3 = 2.56 × 10⁻⁵; valves (3.504 × 10⁻²)²/3 = 4.09 × 10⁻⁴. Total = 2.56 × 10⁻⁵ + 1 × 10⁻⁴ + 4.09 × 10⁻⁴ = 5.35 × 10⁻⁴ → SIL 3 range.
4. (c) Add common cause: sensors 0.1 × 4.38 × 10⁻³ = 4.38 × 10⁻⁴ → 4.64 × 10⁻⁴; valves 0.1 × 1.752 × 10⁻² = 1.752 × 10⁻³ → 2.16 × 10⁻³. Total = 4.64 × 10⁻⁴ + 1 × 10⁻⁴ + 2.16 × 10⁻³ = 2.72 × 10⁻³ → SIL 2. Common cause, not the independent failures, now dominates; it meets the SIL 2 target of Example 1 (PFD ≤ 5 × 10⁻³).

Common mistakes

• Writing PFD = 1 − RRF. The correct relation is RRF = 1/PFD.
• Using λ·T instead of λ·T/2 for the average PFD of a 1oo1 element.
• Ignoring common-cause failure and claiming a SIL that the redundant design does not reach.
• Assigning a SIL to an individual transmitter rather than to the complete function.
• Using a BPCS transmitter or valve as part of the SIF without proving independence.
• Forgetting that a longer proof-test interval directly increases PFDavg.

For GATE IN

GATE treats this area through reliability: probability of failure for series and parallel (redundant) systems, availability, MTBF and failure rates, and simple voting logic such as 1oo2 and 2oo3. Practise computing system reliability from component reliabilities, PFD from failure rate and test interval, and converting PFD to RRF and SIL bands.

Quick check

1. A SIF has PFDavg = 2 × 10⁻³. What are its RRF and SIL?
2. A 1oo1 valve has λ_DU = 2 × 10⁻⁶ per h and is proof-tested yearly. What is its PFDavg?
3. Which voting arrangement gives fewer spurious trips than 1oo2 while remaining tolerant of one dangerous failure?
4. Why are SIS outputs usually de-energise-to-trip?

Answers: 1. RRF = 500, SIL 2. 2. About 8.76 × 10⁻³. 3. 2oo3. 4. So that loss of power, signal or a broken wire drives the process to the safe state.