An SIS is a set of
devices and software that perform one or
more Safety Instrumented Functions (SIF).
Each SIF has a stated SIL. The SIL is
related to the probability that the SIF
will Not work when challenged (when
needed). The higher the SIL, the more
redundant and sophisticated the shutdown
system becomes, and therefore the more
reliable it becomes. A SIL 1 will fail
less than 1 in 10 times and a SIL 2 will
fail less than 1 in 100 times it is
challenged. There are 6 major aspects
(broken into steps) of for SISs. In
brief these steps are:
-
SIF/SIL
determination:
This is deciding (1) if a SIF is
needed and if so (2) what should be
the SIL of the SIF. SIF/SIL
determination should and normally is
performed within a
PHA/HAZOP. You first find the
accident scenarios and then decide
what can go wrong and how, and then
you determine what independent
levels of protection you have and if
these are sufficient to keep the
risk at acceptable levels, and if
not, the PHA/HAZOP recommends a SIF
and SIL. Note that about 1% to 5%
of the time, a HAZOP team does not
fully understand an accident
scenario; in such cases, a further
analysis may be needed. The best
method for this further analysis is
LOPA (Layer of Protection Analysis).
-
Note that there are a couple of
other methods to determine SIF
and SIL, but these normally
grossly overestimate the number
of SIF and level of SIL. One
refinery had a SIL Vendor
perform this step (outside of a
PHA/HAZOP that had already been
done reasonably well) for them
using RiskGraph. The vendor
recommended and later convinced
the client refinery to install
about 110 different SIFs of SIL
1 to SIL 2; this was for only
ONE refinery unit. (This is way
too many SIFs, which is what PII
told the refinery represents who
asked us later about this
number. We said normally that
for a typical, complex refinery
unit, we end with about 10-12
SIFs, perhaps one is SIL 2 and
the rest are SIL 1.) When the
refinery tried to start up, the
unit tripped each time (due to
too many SIFs). The refinery
then disabled the SIFs they
thought were excessive and ended
up with about 12 SIFs in the
final configuration. These are
likely all they need and the
original PHA/HAZOP report pretty
much agrees. The lesson is
always use a PHA/HAZOP (and in
rare cases, a LOPA analyst) to
determine the SIF/SIL needed.
Do Not let the SIL vendors or
SIL Consultants determine what
is needed; if you do, they may
use other methods that will
require far more SIFs that are
needed; perhaps 10 times more
than is needed. The mistake
above cost the refinery tens of
millions of dollars of wasted
resources.
-
SIF
specification:
This involves (usually) process
engineers who take the request of
the HAZOP team (or perhaps LOPA
analyst) and design the SIS to
provide the SIF with the requested
SIL. This means also making sure
the proper sequence of functions is
considered in the design and the
interaction with the DCS (BPCS) is
accounted for.
-
SIF
design:
This is normally done by a SIL
vendor to meet the SIL specification
and requires instrumentation
specialist and perhaps
instrumentation engineers.
-
SIL
verification:
This should be done by the owner
company to make sure the SIL design
will provide the SIL needed, without
causing harm due to trips. This
requires a fault tree analysis (FTA)
or Markov analysis to complete a
quantitative risk analysis of the
design. Most folks use the
proprietary database and calculation
program for this task. You can also
let your SIL Vendor do this. Note
that the current version of the SIS
international standards have a
problem in the requirements for SIL
verification. The plans are to fix
this problem before the end of
2010. The problem is that the
current SIL verification methods do
not Require the inclusion of the
possibilities of humans leaving the
bypasses on, or bypass valves open,
or root valves closed (any of which
can happen if testing is required
without shutting down a system). It
also does not Require inclusion of
other systemic failures in the
calculation of SIL, such as plugging
of all instrument taps by the same
phenomena internal to the process
(such as dirt, debris,
polymerization). Omitting these
systemic failures can be a very Big
Deal. For instance, there are many
SIL 2 and SIL 3 systems that will
only have a SIL 1 reliability, if
the human and other systemic errors
are accounted for in the SIL
verification calculations. This
means that you could specify, order,
and install a SIL 3 system, only to
have the actual performance of a SIL
1 system. SIL 3 systems cost 5
times more than SIL1, and more
importantly, a SIL 3 would only be
installed if extreme risk was
present and if a SIL 3 was the Only
way to control the risk. In such
cases, you may believe you are
installing a SIL 3, but in fact the
performance of the SIF could have
100 times higher failure rate due to
these systemic errors and process
problems.
-
SIS
installation:
The vendor or the owner technicians
normally do this.
-
SIS
functional checks:
The owner process technicians
normally do this in the field as
part of operational readiness checks
or
pre-startup safety reviews (PSSRs).
Note that PII staff are
expert at all of the
above. For instance, our staff were
co-authors of the textbooks on how to
properly lead and document HAZOPs,
sponsored by AIChE/CCPS. Our staff
co-invented LOPA and were primary
authors of the first textbook on LOPA
and are authoring the second textbook on
LOPA now, again sponsored by AIChE/CCPS.
And we are helping the SIS standards
committee (ANSI/ISA committee) to fix
the requirements of Step 4, SIL
Verification, to include consideration
of systemic errors such as human
errors. We already do the calculations
right at PII.
If you want to know more
about how we can help your organization
with SIS, please
Contact Us.
