The function of safety systems is to take control and prevent an undesirable event when the process and the facility
are no longer operating within normal operating conditions. Functional safety is the part of the overall safety of a system that depends on the correct response of the safety system response to its inputs, including safe handling of operator
errors, hardware failures and environmental changes (fires, lightning, etc.).
The definition of safety is "freedom from unacceptable risk" of physical injury or of damage to the health of people, either directly or indirectly. It requires a definition of what is acceptable risk, and who should define acceptable risk levels.
This involves several concepts, including:
-
Identifying what the required safety functions are, meaning that hazards and safety functions have to be known. A process of function reviews, formal hazard identification studies (HAZID), hazard and operability (HAZOP) studies and accident reviews are
applied to identify the risks and failure modes.
-
Assessment of the risk-reduction required by the safety function. This will involve a safety integrity level (SIL) assessment. A SIL applies to an end-to-end safety function of the safety-related system, not just to a component or part of the system.
-
Ensuring the safety function performs to the design intent, including under conditions of incorrect operator input and failure modes. Functional safety management defines all technical and management activities during the lifecycle of the safety system.
The safety lifecycle is a systematic way to ensure that all the necessary activities to achieve functional safety are carried out, and also to demonstrate that the activities have been carried out in the right order. Safety needs to be documented
in order to pass information to different engineering disciplines.
For the oil and gas industry, safety standards comprise a set of corporate, national and international laws, guidelines and standards. Some of the primary international
standards are:
- IEC 61508
- Functional safety of electrical/electronic/programmable electronic safety-related systems
- IEC 61511
- Functional safety - Safety instrumented systems for the process industry sector
A safety integrity level is not directly applicable to individual subsystems or components. It applies to a safety function carried out by the safety instrumented system (end-to-end: sensor, controller and final element).
IEC 61508 covers all components of the E/E/PE safety-related system, including field equipment and specific project application logic. All these subsystems and components, when combined to implement the safety function (or functions), are required to
meet the safety integrity level target of the relevant functions. Any design using supplied subsystems and components that are all quoted as suitable for the required safety integrity level target of the relevant functions
will not necessarily comply with the requirements for that safety integrity level target.
Suppliers of products intended for use in E/E/PE safety-related systems should provide sufficient information to facilitate a demonstration that the E/E/PE safety-related system complies with IEC 61508. This often requires that the
functional safety for the system be independently certified.
There is never one single action that leads to a large accident. It is often a chain of activities. There are many layers to protect against an accident, and these are grouped two different categories:
-
Protection layers — to prevent an incident from happening. Example: rupture disk, relief valve, dike.
-
Mitigation layers — to minimize the consequence of an incident. Example: Operator intervention or safety instrumented system (SIS)
An SIS is a collection of sensors, controllers and actuators that execute one or more SIFs/safety loops that are implemented for a common purpose. Each SIF has its own safety integrity level (SIL) and all sensors, controllers and final elements in one
SIF must comply with the same SIL, i.e., the end-to-end safety integrity level. The SIS is typically divided into the following subsystems:
-
Emergency shutdown system (ESD) to handle emergency conditions (high criticality shutdown levels)
-
Process shutdown system (PSD) to handle non-normal but less critical shutdown levels
-
Fire and gas systems to detect fire, gas leakage and initiate firefighting, shutdown and isolation of ignition sources
The purpose of an SIS is to reduce the risk that a process may become hazardous to a tolerable level. The SIS does this by decreasing the frequency of unwanted accidents:
-
SIS senses hazardous conditions and takes action to move the process to a safe state, preventing an accident from occurring.
-
The amount of risk reduction that an SIS can provide is represented by its SIL, which is a measure of the risk reduction factor provided by a safety function. IEC 61508 defines four levels, SIL 1–4, and the corresponding requirements for the risk
reduction factor (RFF) and probability of failure on demand (PFD):
SIL |
PFD |
RRF |
1 |
0.1–0.01 |
10–100 |
2 |
0.01–0.001 |
100–1000 |
3 |
0.001–0.0001 |
1000–10,000 |
4 |
0.0001–0.00001 |
10,000–100,000 |
The SIL for a component is given by its PFD, safe failure fraction and design to avoid influence of systematic errors.