Safety Instrumented System Reliability
A chemical plant has a high-pressure reactor protected by a Safety Instrumented System (SIS) consisting of a pressure transmitter (PT), a logic solver (LS), and a shutdown valve (SDV). The SIS is designed to achieve SIL 2 according to IEC 61511. The proof test interval is 1 year. The following failure rate data (in failures per hour) are available from the manufacturer: PT: λ_du = 5e-7 (dangerous undetected), λ_dd = 1e-6 (dangerous detected), λ_su = 1e-7 (safe undetected), λ_sd = 1e-6 (safe detected). LS: λ_du = 1e-7, λ_dd = 5e-7, λ_su = 5e-8, λ_sd = 5e-7. SDV: λ_du = 1e-6, λ_dd = 2e-6, λ_su = 1e-7, λ_sd = 1e-6. The SIS is configured in a 1oo1 voting architecture for each component. The plant operates 8000 hours per year. The current proof test interval is 1 year (8760 hours). The plant is considering extending the proof test interval to 2 years to reduce maintenance costs. The risk tolerance criteria for the plant is that the average probability of failure on demand (PFD_avg) for the SIS must be ≤ 1e-2 (SIL 2).
1. Calculate the PFD_avg for each component and for the entire SIS for the current proof test interval of 1 year. Assume that dangerous detected failures are repaired with a mean time to repair (MTTR) of 8 hours, and proof tests are perfect (100% effective). Determine if the SIS meets the SIL 2 requirement.
Read the worked answer
For a 1oo1 architecture, the PFD_avg for dangerous undetected failures is approximately λ_du * TI / 2, where TI is the proof test interval. For dangerous detected failures, the PFD contribution is λ_dd * MTTR. Safe failures do not contribute to PFD. So for each component:
PT: PFD_du = 5e-7 * 8760 / 2 = 5e-7 * 4380 = 2.19e-3. PFD_dd = 1e-6 * 8 = 8e-6. Total PFD_PT = 2.19e-3 + 8e-6 = 2.198e-3.
LS: PFD_du = 1e-7 * 4380 = 4.38e-4. PFD_dd = 5e-7 * 8 = 4e-6. Total PFD_LS = 4.38e-4 + 4e-6 = 4.42e-4.
SDV: PFD_du = 1e-6 * 4380 = 4.38e-3. PFD_dd = 2e-6 * 8 = 1.6e-5. Total PFD_SDV = 4.38e-3 + 1.6e-5 = 4.396e-3.
For a series system (1oo1 for each), the total PFD_avg is approximately the sum of the PFDs of the components: PFD_SIS = PFD_PT + PFD_LS + PFD_SDV = 2.198e-3 + 4.42e-4 + 4.396e-3 = 7.036e-3. This is less than 1e-2, so the SIS meets SIL 2 (PFD between 1e-3 and 1e-2). However, note that the sum is close to the limit; with some margin, it is acceptable.
2. Calculate the PFD_avg for the SIS if the proof test interval is extended to 2 years (17520 hours). Determine if the SIS still meets SIL 2. What other factors should be considered before extending the proof test interval?
Read the worked answer
With TI = 17520 hours, the PFD_du for each component doubles (since PFD_du is proportional to TI). So:
PT: PFD_du = 5e-7 * 17520 / 2 = 5e-7 * 8760 = 4.38e-3. PFD_dd remains 8e-6. Total PFD_PT = 4.38e-3 + 8e-6 = 4.388e-3.
LS: PFD_du = 1e-7 * 8760 = 8.76e-4. PFD_dd = 4e-6. Total PFD_LS = 8.76e-4 + 4e-6 = 8.80e-4.
SDV: PFD_du = 1e-6 * 8760 = 8.76e-3. PFD_dd = 1.6e-5. Total PFD_SDV = 8.76e-3 + 1.6e-5 = 8.776e-3.
Total PFD_SIS = 4.388e-3 + 8.80e-4 + 8.776e-3 = 1.4044e-2. This exceeds 1e-2, so the SIS would not meet SIL 2. Therefore, extending the proof test interval to 2 years is not acceptable without additional risk reduction measures.
Other factors to consider: The proof test coverage (imperfect proof tests would increase PFD), common cause failures (not considered in this simple model), systematic failures, diagnostics coverage, and the actual failure rate data uncertainty. Also, the maintenance procedure and personnel competence affect proof test effectiveness. Before extending, one could improve diagnostics, add redundancy (e.g., 1oo2 for the transmitter), or reduce the proof test interval for critical components. A risk assessment should be conducted.
3. Propose a modification to the SIS design that would allow the proof test interval to be extended to 2 years while still meeting SIL 2. Calculate the new PFD_avg to verify.
Read the worked answer
One option is to change the pressure transmitter from 1oo1 to 1oo2 architecture. For a 1oo2 voting, the PFD_avg for dangerous undetected failures is approximately (λ_du * TI)² / 3 (for perfect proof test) plus the contribution from dangerous detected failures. Actually, for 1oo2, PFD_avg ≈ (λ_du * TI)² / 3 + λ_dd * MTTR (if detected failures are repaired). But we must also consider that in 1oo2, a dangerous detected failure in one channel may not cause a spurious trip if the other channel is healthy, but for simplicity, we use the standard formula. However, the 1oo2 architecture also has a common cause factor, but we'll ignore that for now. Let's compute for PT in 1oo2: λ_du = 5e-7, TI = 17520 h. PFD_du = (5e-7 * 17520)² / 3 = (8.76e-3)² / 3 = 7.674e-5 / 3 = 2.558e-5. The dangerous detected contribution: for 1oo2, if one channel fails detected, the system may still function, but the PFD contribution is often approximated as λ_dd * MTTR (same as 1oo1) but sometimes reduced. To be conservative, we can use the same λ_dd * MTTR = 1e-6 * 8 = 8e-6. So total PFD_PT ≈ 2.558e-5 + 8e-6 = 3.358e-5. This is much lower. Now, recalculate total PFD_SIS with PT in 1oo2, LS and SDV unchanged (1oo1): PFD_LS = 8.80e-4, PFD_SDV = 8.776e-3. Total = 3.358e-5 + 8.80e-4 + 8.776e-3 = 9.689e-3. This is below 1e-2, so SIL 2 is met. However, we must also consider common cause failures, which could increase PFD. A beta factor of 10% might be applied. With beta=0.1, the common cause PFD for 1oo2 is approximately β * λ_du * TI / 2 = 0.1 * 5e-7 * 17520 / 2 = 0.1 * 4.38e-3 = 4.38e-4. Adding this to the total: 9.689e-3 + 4.38e-4 = 1.0127e-2, which slightly exceeds 1e-2. So with common cause, it might not meet. Therefore, additional measures may be needed, such as also upgrading the SDV to 1oo2 or reducing the proof test interval for the SDV. Alternatively, improve diagnostics to reduce λ_du. A more robust solution: change the shutdown valve to 1oo2 as well. Let's compute SDV in 1oo2: λ_du = 1e-6, TI=17520. PFD_du = (1e-6 * 17520)² / 3 = (1.752e-2)² / 3 = 3.0695e-4 / 3 = 1.023e-4. PFD_dd = 2e-6 * 8 = 1.6e-5. Total PFD_SDV = 1.023e-4 + 1.6e-5 = 1.183e-4. With common cause beta=0.1: common cause PFD = 0.1 * 1e-6 * 17520 / 2 = 0.1 * 8.76e-3 = 8.76e-4. So total SDV PFD including common cause = 1.183e-4 + 8.76e-4 = 9.943e-4. Now total SIS: PT (1oo2 with CCF) = 3.358e-5 + 4.38e-4 = 4.716e-4; LS (1oo1) = 8.80e-4; SDV (1oo2 with CCF) = 9.943e-4. Sum = 4.716e-4 + 8.80e-4 + 9.943e-4 = 2.3459e-3, well below 1e-2. So changing both PT and SDV to 1oo2 would allow a 2-year proof test interval while meeting SIL 2 even with common cause. This is a feasible modification, though it increases cost and complexity. Another option is to add a diagnostic that reduces λ_du, but that requires vendor data. The calculation shows that redundancy is effective.