Safety Integrity Levels

1. © 2003 by CRC
Press LLC
•There are three standards pertinent to the concept of safety integrity levels. They are:
•ANSI/ISA S84.01 - 1996 (herein referred to as 'S84.01 '): Application of Safety
Instrumented Systems for the Process Industries
•IEC 61508 - 2000 (herein referred to as '61508'): Functional safety of electrical I
electronic I programmable electronic safety-related systems
•IEC 61511 - 2003 (herein referred to as '61511'): Functional safety - Safety
Instrumented Systems For The Process Industry Sector
•Addressing each of these in tum:
•IEC 61508 was developed by the International Electrotechnical Commission (IEC) and
is performance based rather than prescriptive. It has seven parts, as follows:
•61508-1: General requirements
•61508-2: Requirements for electrical/electronic/programmable electronic
safety-related systems
•61508-3: Software requirements
•61508-4: Definitions and abbreviations
Standards
• 61508-5: Examples of methods for the determination of SIL

2. © 2003 by CRC
Press LLC
61508 was developed m parallel with the ANSl/ISA-84.01-1996 by the
Instrumentation, Systems, and Automation Society (ISA), and later adopted by the
American National Standards Institute (ANSI).
• IEC 6151 1 contains the following three Parts:
• 61511-1: Framework, definitions, system, hardware and software
requirements
• 6151 1-2:
• 6151 1-3:
Guidelines for the application of IEC 61511-1
Guidance for the determination of the required safety
integrity levels
The IEC standards 61508 and 61511 require that SIL be assigned to the safety
instrumented functions (SIF) of the safety instrumented systems (SIS) for processes,
that have insufficient mitigation from the potential hazards. According to the IEC
standards, a SIF is a "safety function with a specified SIL which is necessary to achieve
functional safety and which can be either a safety instrumented protection function or a
safety instrumented control function." A SIS is an "instrumented system that is used to
implement one or more SIFs. It is composed of any combination of sensors, logic
solvers, and final elements." SIS is devoted to responding to an emergency situation.
SIS consists of instrumentation for emergency shutdown and thus brings the process to
a safe state in the event of an upset. Instrumented emergency shutdown systems

3. © 2003 by CRC
Press LLC
protect against a loss of containment situation on downstream piping/
equipment, which could also lead to loss of containment/fire hazards.
Levels of SIL
There are four levels of SIL. SIL 1 is the lowest and SIL 4 is the highest level of safety
integrity. The assignment of SIL addresses the need to provide safeguards or mitigation
matching the potential hazards of the processes including the failure of the
instrumented systems. SIL is a measure of reliability of the respective SIS.
Table 20-1. SIL Correlations with Availability and (PFD)
The terms 'SIL' and 'availability' represent the integrity of the SIS when a process
demand occurs. Consider that a particular SIF is assigned a value of SIL 1, as an
example. Assigning SIL 1 to a particular SIF means that the level of risk is considered
to be sufficiently low and that the SIF with a 10% chance of failure (90% availability)
is acceptable. The availability of 90% would mean that there would be one statistical
Safety
Integrity
Level
IEC
61508 /
61511
ISA/ANSI
S84.01
Availability
Required
Probability to
Fail on Demand
(PFD)
1/PFD
4 Yes No > 99.99 % 10-5 to 10-4 100,000 to 10,000
3 Yes Yes 99.90 - 99.99 % 10-4 to 10-3 10,000 to 1,000
2 Yes Yes 99.00 - 99.90 % 10-j to 10-2 1,000 to 100
1 Yes Yes 90.00 - 99.00 % 10-2 to 10-• 100 to 10

4. © 2003 by CRC
Press LLC
testing and modification phases.
The general sequence of steps in a typical SIL study as per the SLC are:
• Determine whether 6151l or S84.01 is to be used.
• Identify the SIFs using previous PHA studies (PrHA, HAZOP, Hazard Analyses,
etc.) for 615I I, or the need for SIS if S84.0 I is to be used.
• Assign target SILs to the SIFs using one of the many methods (Risk Graph,
Consequence based, Risk Matrix, Layered Risk Matrix or Layer of Protection
Analysis, LOPA - Note that LOPA is only recommended in 6151 1, but not by
S84.0 l . See Chapter 21 "Layer of Protection Analysis" for details of the
methodology), as per 6151 1(S84.0l does not include LOPA as does 6151 l).
Verify the performance of the SIS with reference to the established target SlLs. (SIS is
only one of the protective layers. It is important to make a comprehensive assessment
of the other layers of protection, as per 6151 1, that are relevant to the SIFs for SIL
estimation).

5. © 2003 by CRC
Press LLC
auditing
Clause 5 Clause
6.2
Safety requirements
specification for the SIS
Clauses 10 and 12
3
Stage 1
[
·--·----·- - --·-- ·-···---··-·-·-··-··-···-····---
Design and development
of other means of risk
reduction Clause 9
- - - · ..
Design and engineering
of SIS
Clauses 11 and 12
4
Stage
Installation, commissioning
and validation
5
Clauses 14 and 15
8
Decommissioning
Clause 18
Key:
- - - - . Typical direction of Information flow
D No detailed requirements given In this standard
D Requirements given In this standard
NOTE 1 Stages 1through 5 lncluslve are defined In 5.2.6.1.3
NOTE 2 All references are to Part 1 unless otherwise noted
Clauses
7, 12.4,
and 12.7
rn

6. © 2003 by CRC
Press LLC
lIIdentify other Pls •
[ AssilSll s L_J==
.:
J - Assign SILs _]
(1 to 4) J j risk matrix, layered - ----1 (1 to 3)
- _l --- risk matrix, etc. _
Verify [ Verify
performance of
the SIS taking all
relevant IPLs into
account
performance
(other P ls not
considered)
-- - - - - -
Figure 20-2 General Sequence of Steps for Assigning SIL
As per 6151 l, SIL estimation also takes into account the other layers of protection (PL) in
the process. SILs are calculated for the SIF, which may include one or more protection
layers and may be dependent or independent of one another (clearly, greater protection is
afforded by totally independent as opposed to dependent protection layers identified for a
particular SIF). Setting and meeting SlL targets can be viewed in two basic ways. If the
user decides to use only ANSI/ISA 84.0 l and ignore other layers of protection, then SIL
targets can only be met by upgrading SIS components, e.g. upgrading emergency shutdown
systems (ESD). However this can be a very costly business and thus the wisdom of sticking
with ANSI/ISA 84.0 l and ignoring the other possible protection layers (offered by IEC

7. © 2003 by CRC
Press LLC
MITIGATION
Mechanical mitigation systems
Safety instrumented control systems
Safety instrumented mitigation systems
Operator supervision
PREVENTION
Mechanical protection system
Process alarms with operator corrective action
Safety instrumented control systems
Safety instrumented prevention systems
CONTROL and MONITORING
Basic process control systems
Monitoring systems (process alarms)
Operator supervision
( PROCESS )
Figure 20-3 Typical Risk Reduction Methods Found in Process Plants

8. © 2003 by CRC
Press LLC
Consequence-based (as recommended by S84.0 l only), Modified HAZOP (as
recommended by S84.0l only), the Risk Matrix, and the Layered Risk Matrix discussed
below are the most common methods used to determine the target SIL. The Layer of
Protection Analysis (LOPA) methodology could also be used to assign SJ Ls (see Chapter
21., Layer of Protection Analysis). SILs assigned to SIFs in this manner represent the
target (for existing or new systems) for the level of performance required to provide a
certain level of reliability.
Consequence Based Method (S84.0l)
This is the simplest of all SIL assignment methods in that it requires only relating the
consequences directly to the SIL values, as shown in a typical SIL and consequence
correlations table below.
Table 20-2 SILs Related to Consequences
This method is not truly risk based as it only considers consequences. The disadvantage of
this technique is that it does not take into account likelihood, is ultra-conservative, and
limits the user, possibly prohibitively.
Consequence Prescribed SIL Values
Catastrophic community impact SlL 4
Employee and community impact SIL 3
Major property and production SIL 2
Minor property and production SIL 1

9. © 2003 by CRC
Press LLC
Risk Graph Method
61511 recognizes the value of considering multiple protection layers. Typically, this can
be reflected by the application of say the Risk Graph technique combined with the
different protection layers to modify the actual SIL requirements. These other layers may
offer sufficient overall protection. A SIL in the risk graph is determined based on four
factors as shown in the following tables and figure:
Deviation Causes "
Cposequences
SafE!{luards
;·-.
HAZOP Risk
Matrix Recommendations
'
Require d
SIL
s L RR
High
Temperature
in Reactor
R-123
Runaway
reaction Over-temperature
and possible
reactor rupture
leading to
explosion &
multiple fatalities
(1) Automated
depressurizing
system (2) Pressure
relief valves
3 2 6 Safeguards are
adequate SIL 3
High Level in
Storage Tank
T-546
Overfilling
by operator
Non-hazardous
material spill
inside dike
(1) Tank overflow (2)
Level gauge on tank
(3) High level alarm
on tank
1 2 2 Safeguards are
adequate SIL 1
High Pressure
in
Intermediate
Vessel V- 793
Gas blow
through on
control
valve FV-
203 failure
Overpressure of
vessel, loss of
containment,
employee injury
Pressure relief valve
on Intermediate
Vessel
2 2 4 Install low low trip
on control valve
FV-203 to prevent
gas blow through
from upstream
vessel if level is lost
SIL2

10. © 2003 by CRC
Press LLC
abnormal situations, which may exist during the build-up to the
occupied taking into account the vulnerability to the hazardous
event.
Occupancy F Probability that the exposed area is occupied at the time of the
hazardous event. Determined by calculating the fraction of time
the area is occupied at the time of the hazardous event. This
should take into account the possibility of an increased
likelihood of persons being in the exposed area in order to
investigate
hazardous event (consider also if this changes the C parameter).
Probability of avoiding
the hazard p The probability that exposed persons are able to avoid the
hazardous situation, which exists if the safety instrumented
function fails on demand. This depends on there being
independent methods of alerting the exposed persons to the
hazard prior to the hazard occurring and there being methods of
escape.
Demand rate w The number of times per year that the hazardous event would
occur in the absence of the safety instrumented function under
consideration. This can be determined by considering all
failures, which can lead to the hazardous event and estimating
the overall rate of occurrence. Other protection layers should
be included in the consideration.

11. © 2003 by CRC
Press LLC
This can be calculated by determining the
numbers of people present when the area
exposed to the hazard is occupied and
multiplying by the vulnerability to the identified
hazard.
The vulnerability is determined by the nature of
the hazard being protected against. The
following factors can be used:
V = 0.01 Small release of flammable or toxic
material
V = 0.1 Large release of flammable or toxic
material
V = 0.5 As above but also a high probability of
catching fire or highly toxic material
V = 1 Rupture or explosion
Co
Range > 0.1 to 1.0
Range > 1.0
2. For the interpretation of CA,
Cs, Cc and Co, the
consequences of the
accident and normal healing
should be taken into account.
Occupancy (F)
This is calculated by determining the
proportional length of time the area exposed to
the hazard is occupied during a normal working
period.
NOTE 1 If the time in the hazardous area is
different depending on the shift being
operated then the maximum should be
selected.
NOTE 2 It is only appropriate to use FA where it
can be shown that the demand rate is random
and not related to when occupancy could be
higher than normal. The latter is
usually the case with demands which occur at
equipment start-up or during the investigation of
abnormalities.
FA
Fs
Rare to more
frequent exposure in
the hazardous zone.
Occupancy less than
0.1
Frequent to
permanent
exposure in the
hazardous zone.
3. See comment 1 above.
Probability of avoiding the hazardous event
(P) if the protection system fails to operate.
PA
Ps
Adopted if all
conditions in
column 4 are
satisfied.
Adopted if all the
conditions are not
satisfied.
4. PA should only be selected if
all the following are true:
• Facilities are provided to alert
the operator that the SIS has
failed;
• Independent facilities are
provided to shut down such
that the hazard can be
avoided or which enable all
persons to escape to a safe

12. © 2003 by CRC
Press LLC
one hazardous event. In determining the
demand rate, limited credit can be allowed for
control system performance and intervention.
The performance which can be claimed if the
control system is not to be designed and
maintained according to IEC 61511, is limited to
below the performance ranges associated with
SIL 1.
For demand rates
higher than 1OD per
year, higher integrity
shall be needed.
high, the SIL has to be
determined by another
method or the risk graph
recalibrated. It should be
noted that risk graph methods
may not be the best approach
in the case of applications
operating in continuous mode,
see
3.2.43.2 of IEC 61511-1.
6. D is a calibration factor, the
value of which should be
determined so that the risk
graph results in a
level of residual risk which is
tolerable taking into
consideration other risks to
exposed persons and
corporate criteria.
NOTE This is an example to illustrate the application of the principles for the design of risk graphs. Risk graphs
for particular applications and particular hazards will need to be agreed with those involved, taking into account
tolerable risk, see D.1 to D.6.

13. © 2003 by CRC
Press LLC
PA
pc FA
F PA
p
Co FA
Generalized arrangement
(In practicalImplementations
the arrangement Is specmc to
the appllcatlons to be covered
by the risk graph)
F PA
p
c
F
p
w
Consequence parameter
Exposure time parameter
Probability of avoiding hazardous event
In the absence of the SIF under consideration
3
4
b
No safety requirements
No special safety requirements
A single SIF is not sufficient
a
b
1, 2, 3, 4 Safety integrity level
Figure 20-4 Risk Graph: General Scheme (IEC 61511-3,Annex D, p. 37)
If the consequence based route (alone) is chosen as opposed to the risk based methods, it
makes mitigation options very limited as it discounts both frequency and probability of
unwanted occurrences as contributing factors. It is therefore preferable to consider using
the Risk Graph method, which is shown in Figure 20-4, above. This illustrates how the
four parameters (C, F, P, and W) generate the target SIL values in the table, as follows. As
per 61511, assume that no SIS exist, even though non-SIS may be in place for the process.
Table 20-6 SIL Estimation Using Risk Graph Method
1
2
3
4
a
1
2
3

14. © 2003 by CRC
Press LLC
instead of
pebbles.
Safety Layer Matrix Method
An example of the Safety Layer Matrix (Layered Risk Matrix) is given below. The target
SIL is assigned on the basis of the risk ranking value and the number of PLs for that
scenano. A difference of the risk ranki ng and the PLs is correlated with SIL values. This
approach consists of matrices for each of the various consequence categories such as
Personnel, Operations, and Ecological factors, that are integrated with the HAZOP study
and incorporates PLs. The highest of the three SIL values is selected.
According to 61511, the required SIL values are matched with a combination of the
frequency and severity of impact of the hazardous events. See the tables and figure below.
Table 20-7 Frequency of Hazardous Event Likelihood - without considering PLs
(IEC 61511-3, 2003, Annex C, p. 30)
Type of Events Likelihood
Qualitative Ranking
Events such as multiple failures of diverse instruments or valves, multiple human
errors in a stress free environment, or spontaneous failures of process vessels.
Low
Events such as dual instrument, valve failures, or major releases in
loading/unloading areas.
Medium
Events such as process leaks, single instrument, valve failures or human errors
that result in small releases of hazardous materials.
High
* The system should be in accordance with this standard when a claim that a control function fails less
frequently than 10·1
per year is made.

15. © 2003 by CRC
Press LLC
SIL Required
, Minor , , Serious , ! Extensive
!
:--------------'---L------------- --·--- - - - _.,
: Hazardous Event Severity
Rating
,
II
------------------------------------------------
a)One level 3 SIF does not provide sufficient risk reduction at
this risk level. Additional modifications are required in order to
reduce risk (see d).
b)One level 3 SIF may not provide sufficient risk reduction at
this risk level. Additional modifications are required (see d).
c) SIS independent protection layer is probably not needed.
d) This approach is not considered suitable for SIL 4.
Number of
PLs
3
2 c) c) 1
1 c) 1 2
Hazardous
Event
Likelihood
L
0
w
M
e
d
H
i g
h
c 1 2
1 2 b
3
L
0
w
M
e
d
H
i g
h
c) 1 1
1 2 b)
3
b)
3
b
3
a)
3
L
0
w
M
e
d
H
i g
h

16. New and Existing Systems
The first step for assign ment of target SILs is to use tthe (updated) Pl-I As or conduct new
PHAs to screen for the potential haza rds. HAZOP is the most commonly used method. If
the risk is unacceptab le then it is preferable to reduce it to an acceptable level using non
SIS and SIS elements. I lowever, SISs are considered o n )' after a ll the non-SIS protect ion
layers have been considered. HAZOPs identify the potentia l hazards, using risk matrices in
te1111s of the likelihood and the severity of tbe hazards. Requ ired S!Ls are assigned to SIFs
identified in the PHA studies.
As introduced in the 615 1I, the intent of safety functions is to achieve or maintai n a safe
state for tbe specific haza rdous event in a process. Only those safety functions that are
assigned to the SlS are called SJF. Accordi ng to 615 11, the BPCS, relief systems, and
other layers of protection may be defined as safety functions for SJL analysis. A SIS may
contain one or many SJFs and each is assigned a SJ L. As well, a SJF may be achieved by
EX-103
tube or
tube sheet
rupture
Overpressuring of
stripper.
to
overpressure
of the vessel
relieving to
Oare.
siz ng to handle (a)
fire case,(b) tube
rupture on reboiler, (c)
total loss of renux to
stripper,(d)loss of
coolfng to condenser
EX- 102,(e)
Instrument or
controller failure,
(f) instrument air
failure,(g) power
fai ure etc.
2. PV-106
opens to
Oare.
Operations
s M 2 1
Ecological
s L 2 c)

17. © 2003 by CRC
Press LLC
complex. Although, the "desired SILs" may be identified, the actual in situ SIL values can
only checked using reliability modeling, such as fault tree analysis (FTA) or reliability
block diagrams supported by applicable failure rate data.
It may not be mandated for an existing facility to assess SIL values as per the standards,
however, in the event of plant modifications or for the introduction of new units or
grassroots facilities SIL values almost certainly need to be assessed as per the standards. In
addition, if there is an incident (accident or near miss), which could be attributed to lack of
reliability of SIS, then the standards for assessing SILs are recommended.
SIL Verification
Compliance with ANSI/ISA S84.01-1996 and IEC 61511, requires verification of the
performance of SIS. Typically, it is practicable to study only the critical safety functions
for a SIL study as there are usually too many safety functions and only those that are
deemed important can be considered depending on the allocated resources. The
established SILs (from previous steps) are now used as measures for verification
purposes when complying with 61511. SIL verifications may require full quantitative
assessments (using fault tree analysis - FTA, failure rates, reliability block diagrams, etc.)
to check if the performance of the SIS exemplified by the overall ESD system indeed
meets the established target SIL values based on unit wide overall scenarios (e.g., fire,
toxic release etc.)
A simple example of one shutdown sequence consisting of detectors, logic solver, and

18. © 2003 by CRC
Press LLC
[Failure rate of transmitters] + [Failure rate of
pressure switch] + [Failure rate of shutdown valve]
The PFD is calculated using the following equations:
PFD = 1 - Availability
Where:
Availability = 11(1 + Au1·erall x downtime)
RRF = Risk Reduction Factor = JIPFD (to be used in the SIL Correlations table)
For Transmitters:
Individual failure rate = 0.97 faults per year = 1.1 x 10·4
faults per hour
Assume downtime is 4 hours for repair, the equation for calculating the failure rate of a
component with 2 out of 3 voting system is given below (Smith and Simpson, 200 I):
[Failure rate of transmitters] = 6 x (Airansmittcr)
2
x downtime
Hence,
[Failure rate of transmi tters] =6 x ( 1.1 x I0-4
)
2
x 4
= 2.9 x 10·7
faults per hour

19. © 2003 by CRC
Press LLC
= 0.9997
PFD = 1- Availability
= 0.0003
1/PFD = 3333
This corresponds to a SIL 3 level (from the correlations table).
The above example is a simple illustration of the principle of SIL verification, which only
considers revealed failures, failures that can be immediately detected and repaired. In
practice, failure rate data used in SIL verification are affected by the type, size and
functionality of components being reviewed together with the corresponding failure modes.
The failure modes describe the loss of required system function(s) that result from failures.
The failure modes can be broken down into four types (Dowell and Green, 1998):
• Hidden dangerous;
• Hidden safe;
• Revealed dangerous; and
• Revealed safe.

20. Important Aspects of SIL Application
• There is danger of placing complete reliance on any one PL to cover hazards. For
example, the notion that pressure rel ief systems alone can protect against all I.ass of
containment situations. lf for example, toxic or flammable gas releases can occur
without overpressu re, e.g., through flange gaskets or seals leaking, then other forms
of protection are almost certainly required.
• Ful l compliance with 615 11 is an extremely onerous responsibi lity requinng
considerable deployment of resources. Lt wou ld be high ly undesirable to undertake
tbis exercise with too limi ted resources. Ful l planning as wou ld occur for a major
project would involve qualified personnel with adequate expertise.
• The earlier standa rd, S84.0 I, offers fewer options than the current (as of date)
61511 as (a) it does not recognize SIL 4 and (b) it does not permit/address the
contributions made by PLs.