ARTICLES

Safety Integrity Not Only a Matter of Reliable Hardware

Bonne Hoekstra View Supplier Profile

Originally printed in: Exploration & Production: The Oil & Gas Review - 2005

Download PDF

1    2    3    4

Introduction

In today’s high-performing hydrocarbon industry, nothing is more important than safety. High pressures, high temperatures, explosive atmospheres, continuous processing at high speeds and volumes, and hostile locations, all contribute to unforgiving, high-risk environments where failure is costly and even minor errors can turn catastrophically critical in milliseconds.

This is no place for half measures, the unsafe, the unproven, the questionable; there is a massive body of work by certification bodies and others that has regularised this important field, particularly for the suppliers of safety-critical equipment where, for designers, integrators and installers, each item must display a safety integrity level (SIL). For such equipment, the international safety standard IEC 61508 describes three basic requirements that have to be fulfilled in order to claim a SIL:

• The average probability of failure on demand (PFD_AVG) or the failure rate of all elements within a safety instrumented function (SIF) shall be within the required SIL bandwidth (IEC 61508-1.
• The safe failure fraction (SFF) shall justify the required hardware fault tolerance for the claimed SIL (IEC 61508-2). These two subjects have to do with hardware safety integrity. But there is more to this than reliable hardware – the third pillar of safety integrity is systematic safety:
• The systematic safety integrity shall comply with the requirements for the required SIL (IEC 61508-1 Annex B and IEC 61508-3).

Suppliers of elements that will be part of an SIF have to provide failure rates of their equipment in order to facilitate end-users, contractors and/or system integrators to calculate the PFD_AVG. If they provide all the failure rate fractions

not only can PFDAVGbe calculated, but the SFF can be defined:

This SFF is needed to determine the required hardware fault tolerance corresponding with the required SIL and, as such, it defines whether a single safety element can be applied or that redundant elements are needed in the safety architecture.

1    2    3    4