Funtional safety management
August 1st 2009

Pilz gives an overview of IEC 61511 for for the provision of safety instrumented systems

Maximising product throughput, product quality and financial performance while reducing operating expenses are key priorities for industry today. At the same time more stringent regulatory and compliance demands, drive greater focus and scrutiny on the implementation of critical systems relating to environmental, health and safety.

Many Irish companies operating process plants have links to International companies and in particular to parent companies operating in the USA. IEC 61511 has been recognised by European safety authorities and by USA based process companies as representing the best practices available for the provision of safety instrumented systems.

On first reading, it appears to add a high documentation and validation overhead on process projects. However, Pilz has shown that practical, pragmatic and appropriate application of the standard yields benefits including: higher plant availability, optimum engineering resource utilisation, validated compliance and safety traceable to an internationally accepted standard.

IEC 61511 defines a hazard as a potential source of harm. Risk is usually defined as the combination of probability and the severity of an unplanned event. The best way to reduce risk in a manufacturing plant is to design inherently safe processes. However, inherent safety is rarely achievable and risks prevail wherever there are hazardous or toxic materials stored, processed, or handled.Most process companies conduct HAZOPS to identify the hazards and evaluate each risk situation by considering likelihood and severity. Risk prevention and risk reduction measures are then considered based on site and best practice experience.

A HAZOP study will identify cause-consequence pairs. To study the prevention and mitigation layers for each cause-consequence, IEC 61511 introduces a structured Layer of Protection Analysis (LOPA) process. The severity level can be categorised considering damage to persons and damage to the environment from release of toxic gas and additionally loss of plant from mechanical damage to the production plant.

The independent protection layers (IPL) can now be evaluated for each individual cause. An IPL is a device, system, or action that is capable of preventing a scenario from proceeding to its undesired consequences independent of the initiating event or the action of any other layer of protection associated with the scenario. The effectiveness and independence of an IPL must be auditable.

The LOPA process should be applied in particular to events with a high severity consequence, a high frequency of initiating events and where a control or instrumented system is considered as an independent layer.

The probability of failure on demand of each independent layer can be calculated to determine if the risk reduction from the combined layers is sufficient based on statutory and corporate definitions of tolerable risk. This process is used to specify a target level of risk reduction for each safety instrumented function by defining the required Safety Integrity Level (SIL). Four SIL levels are defined, with SIL4 being the most dependable and SIL1 the least.

Other factors must be considered in rating a safety instrumented system including safe failure fraction, diagnostic coverage, common cause ß factor, proof testing interval, mean time to repair.

Typically, Safety Instrumented Systems consist of three elements: A Sensor (input), a Logic Solver and an output (Final Control Element).

Sensors: Field sensors are used to collect information necessary to determine if an emergency situation exists.With improvements in technology and quantitative system reliability, a single sensor can now be used for both safety and standard control, reducing hardware costs and maintenance resource requirements.

Logic Solver: The purpose of this component of Safety Instrumented Systems (SIS) is to determine what action is to be taken based on the information gathered.

High reliability logic solvers are used which provide both fail-safe and fault-tolerant operation.

Final Control Element: This implements the actions determined by the logic system.

This final control element can be a pneumatically actuated On-Off valve operated by solenoid valves, or other such device. Again, with improvements in technology and quantitative system reliability, a single final control element can now be used for both safety and standard control.

Careful separation and integration of the Basic Process Control Systems (BPCS) and SIS for alarm and process monitoring together with the partitioning of the SIS across distinct plant units ensures high availability without compromising safety.

However a study by the UK HSE (Health Safety & Environmental Agency) found that 85 percent of all SIS failures are engineeringrelated, with about 60% built-into the SIS before installation.

Post installation the main cause of an SIS failure is not the failure of logic solvers, but the failure of field devices. The SIS design must incorporate the monitoring of I/O components in its overall design. Certified smart sensors and final control elements that can report their health to the logic solver are now available. It is a requirement of the IEC 61511 standard that all components of an SIS are taken off-line and fully tested – the interval between tests depends on the components in question and the required SIL.

Validation is an essential element of the IEC 61511 process. The standard recommends a clear separation of the design and validation processes with the level of independence required being linked to the SIL level of the overall system. Safety matrix functionally testing, SIL validation of the 'as built' systems and implementation of maintenance schedules, are all crucial to not only achieve, but to maintain the required Safety Integrity Level of the system.

Pilz Ireland has provided IEC 61511 compliant services and solution instrumented systems in a ramge of applications. It is accredited by TÜV for the application of a safety management system compliant with IEC 61508 to the integration of functional safety systems.

More articles from Pilz Ireland: