Safety integrity level tightens, engineers relax
UNTIL recently the essential yet onerous duty of classifying safety instrumented systems (SISs) according to their Safety Integrity Level (SIL) - that is, their potential risk for people, environment and/or process in case of any malfunction - was the post-installation responsibility of the plant engineer alone.
Now that the new IEC 61508 standard for functional safety has provided clear guidelines for the decision-making process and empowered instrument manufacturers themselves to design SIL-compliant products, the SIL classification of new devices has become an issue for which engineers need no longer take sole responsibility.
IEC 61508 provides a coherent framework that integrates all previous safety regulations into the first systematic approach to process safety. It has been developed by the International Electrotechnical Commission (IEC), the authoritative worldwide body responsible for developing consensus about global standards in the electrotechnical field.
IEC 61508 applies wherever electrical, electronic or programmable electronic systems are used to perform safety functions - including complete loop/safety systems, measuring points (sensors), control units (PLCs) and actuators (valves). SISs are used across a range of industries, and in the chemical industry account for 3-5 percent of all measuring points.
The new standard defines “safety” not only according to the potential degree of damage for people, environment and process but also according to the inherent probability of a risk-critical situation occurring in the given application.
All relevant parameters are organised in a single risk graph whose axes are labelled “degree of damage” and “probability of occurrence”. The central “degree of damage” parameters are further analysed according to the length of time (“seldom to often” or “frequent to continuous”) and “avoidance of damage” (“possible under certain circumstances” or “almost impossible”).
The risk graph provides clear, step-by-step pathways for systematically carrying out a risk evaluation of any given SIS and arriving at a SIL classification.
While IEC 61508 determines the SIL level applicable for the SIS, the SIL level itself also defines limit values that must be applied when designing the safety loop – such as “probability of failure on demand” (PFD).
Previously it was the duty of the operator to keep a record of the instrument’s suitability for the SIL-classified application. It became the engineer’s task to carry out exhaustive, laborious and time-consuming field tests and make statistical evaluations - on the basis of which a device could be declared as “proven in use” and thus qualify for a SIL acceptance.
Now that IEC 61508 allows the manufacturer to declare instruments suitable for a particular SIL level and offer them as “ready for use”, this duty is eliminated and the engineer is relieved of the burden of proof.
There are two ways in which the instrument manufacturer can examine and declare the devices suitable for a SIL level.
Firstly, for already existing and introduced devices, the supplier takes over the “proven in use” procedure, in which the instruments are tested and described according to IEC 61508/61511.
Secondly, for newly developed devices, the supplier makes a direct declaration to IEC 61508 which can also address any relevant internal design procedures. This declaration comprises an evaluation of the hardware and software of the device based partly on a Failure, Modes, Effects and Diagnostics Analysis (FMEDA) and partly on an assessment of the proven-in-use documentation.
*Commentary by Endress+Hauser Australia
2-Nov-2004