1、Safety Instrumented Functions (SIF)- Safety Integrity Level (SIL)Evaluation Techniques Part 2:Determining the SIL of a SIFvia Simplified EquationsApproved17 June 2002ISA-TR84.00.02-2002 - Part 2TECHNICAL REPORTISA The Instrumentation,Systems, andAutomation Society TMNOTICEOFCOPYRIGHTThis is a copyri
2、ghted document and may not be copied or distributed in anyform or manner without the permission of ISA. This copy of the document wasmadeforthesoleuseofthepersontowhomISAprovideditandissubjecttothe restrictions stated in ISAs license to that person. It may not be provided toany other person in print
3、, electronic, or any other form. Violations of ISAscopyright will be prosecuted to the fullest extent of the law and may result insubstantial civil and criminal penalties.ISA-TR84.00.02-2002 Part 2Safety Instrumented Functions (SIF) Safety Integrity Level (SIL) Evaluation Techniques Part 2:Determini
4、ng the SIL of a SIF via Simplified EquationsISBN: 1-55617-803-4Copyright 2002 by ISAThe Instrumentation, Systems, and Automation Society. All rights reserved.Not for resale. Printed in the United States of America. No part of this publication may be reproduced,stored in a retrieval system, or transm
5、itted in any form or by any means (electronic mechanical,photocopying, recording, or otherwise), without the prior written permission of the Publisher.ISA67 Alexander DriveP.O. Box 12277Research Triangle Park, North Carolina 27709- 3 - ISA-TR84.00.02-2002 - Part 2PrefaceThis preface, as well as all
6、footnotes and annexes, is included for information purposes and is not part ofISA-TR84.00.02-2002 Part 2.This document has been prepared as part of the service of ISA the Instrumentation, Systems, andAutomation Society toward a goal of uniformity in the field of instrumentation. To be of real value,
7、 thisdocument should not be static but should be subject to periodic review. Toward this end, the Societywelcomes all comments and criticisms and asks that they be addressed to the Secretary, Standards andPractices Board; ISA; 67 Alexander Drive; P. O. Box 12277; Research Triangle Park, NC 27709;Tel
8、ephone (919) 549-8411; Fax (919) 549-8288; E-mail: standardsisa.org.The ISA Standards and Practices Department is aware of the growing need for attention to the metricsystem of units in general, and the International System of Units (SI) in particular, in the preparation ofinstrumentation standards.
9、 The Department is further aware of the benefits to USA users of ISAstandards of incorporating suitable references to the SI (and the metric system) in their business andprofessional dealings with other countries. Toward this end, this Department will endeavor to introduceSI-acceptable metric units
10、in all new and revised standards, recommended practices, and technicalreports to the greatest extent possible. Standard for Use of the International System of Units (SI): TheModern Metric System, published by the American Society for Testing and redundant element with one or more safety instrumented
11、 function.Each element should be evaluated with respect to all the safety instrumented functions with whichit is associated to ensure that it meets the integrity level required for each safety instrumented function; to understand the interactions of all the safety instrumented functions; and to unde
12、rstand the impact of failure of each component.ISA-TR84.00.02-2002 - Part 2 - 12 -This document does not provide guidance in the determination of the specific SIL required (e.g.,SIL I, 2, and 3) for the SIS. The user is again referred to ANSI/ISA-84.01-1996 or to otherreferences.The primary focus of
13、 this document is on evaluation methodologies for assessing the capability ofthe SIS. The SIS lifecycle model is defined in ANSI/ISA-84.01-1996. Figure I.2 shows theboundaries of the SIS and how it relates to other systems.StartConceptualProcessDesignPerformProcess HazardAnalysis systematic failures
14、 may be introduced during the specification, design, implementation,operational and modification phase and may affect hardware as well as software. ANSI/ISA-SIS BoundaryISA-TR84.00.02-2002 - Part 2 - 14 -84.01-1996 addresses systematic safety integrity by specifying procedures, techniques,measures,
15、etc. that reduce systematic failures.An acceptable safe failure rate is also normally specified for a SIF. The safe failure rate iscommonly referred to as the false trip, nuisance trip, or spurious trip rate. The spurious trip rate isincluded in the evaluation of a SIF, since process start up and sh
16、utdown are frequently periodswhere chances of a hazardous event are high. Hence in many cases, the reduction of spurioustrips will increase the safety of the process. The acceptable safe failure rate is typicallyexpressed as the mean time to a spurious trip (MTTFspurious).NOTE In addition to the saf
17、ety issue(s) associated with spurious trips the user of the SIS may also want the acceptableMTTFspuriousto be increased to reduce the effect of spurious trips on the productivity of the process under control. Thisincrease in the acceptable MTTFspuriouscan usually be justified because of the high cos
18、t associated with a spurious trip.The objective of this technical report is to provide users with techniques for the evaluation of thehardware safety integrity of SIF (PFDavg) and the determination of MTTFspurious. Methods ofmodeling systematic failures are also presented so a quantitative analysis
19、can be performed if thesystematic failure rates are known.ISA-TR84.00.02-2002 shows how to model complete SIF, which includes the sensors, the logicsolver and final elements. To the extent possible the system analysis techniques allow theseelements to be independently analyzed. This allows the safet
20、y system designer to select theproper system configuration to achieve the required safety integrity level.ISA-TR84.00.02-2002 - Part 1 provides a detailed listing of the definition of all terms used in this document. These are consistent withthe ANSI/ISA-84.01-1996, IEC 61508 and IEC 61511 standards
21、. the background information on how to model all the elements or components of a SIF. Itfocuses on the hardware components, provides some component failure rate data that areused in the examples calculations and discusses other important parameters such ascommon cause failures and functional failure
22、s. a brief introduction to the methodologies that will be used in the examples shown in thisdocument. They are Simplified equations (3), Fault Tree Analysis (4), and Markov Analysis (5).ISA-TR84.00.02-2002 - Part 2 provides simplified equations for calculating the SIL values forDemand Mode Safety In
23、strumented Functions (SIF) installed in accordance with ANSI/ISA-84.01-1996, “Applications of Safety Instrumented Systems for the Process Industries”. Part 2 shouldnot be interpreted as the only evaluation technique that might be used. It does, however, providethe engineer(s) performing design for a
24、 SIS with an overall technique for assessing the capabilityof the designed SIF.ISA-TR84.00.02-2002 - Part 3 provides fault tree analysis techniques for calculating the SIL forDemand Mode Safety Instrumented Functions (SIF) installed in accordance with ANSI/ISA-84.01-1996, “Applications of Safety Ins
25、trumented Systems for the Process Industries”. Part 3 shouldnot be interpreted as the only evaluation technique that might be used. It does, however, providethe engineer(s) performing design for a SIS with an overall technique for assessing the capabilityof the designed SIF.ISA-TR84.00.02-2002 - Par
26、t 4 provides Markov analysis techniques for calculating the SIL valuesfor Demand Mode Safety Instrumented Functions (SIF) installed in accordance with ANSI/ISA-84.01-1996, “Applications of Safety Instrumented Systems for the Process Industries”. Part 4should not be interpreted as the only evaluation
27、 technique that might be used. It does, however,- 15 - ISA-TR84.00.02-2002 - Part 2provide the engineer(s) performing design for a SIS with an overall technique for assessing thecapability of the designed SIF.ISA-TR84.00.02-2002 - Part 5 addresses the logic solver only, using Markov Models forcalcul
28、ating the PFD of E/E/PE logic solvers because it allows the modeling of maintenance andrepairs as a function of time, treats time as a model parameter, explicitly allows the treatment ofdiagnostic coverage, and models the systematic failures (i.e., operator failures, software failures,etc.) and comm
29、on cause failures.Figure I.3 illustrates the relationship of each part to all other parts.ISA-TR84.00.02-2002 - Part 2 - 16 -Figure I.3 ISA-TR84.00.02-2002 Overall FrameworkPart 1Part 2Part 3Part 4Part 5Development of the overall terms, symbols, explanation ofSIS element failures, comparison of syst
30、em analysistechniques, and uncertainty analysis examples.Development of SIL for SIF usingSimplified Equation Methodology.Development of SIL for SIF usingFault Tree Analysis Methodology.Development of SIL for SIF usingMarkov Analysis Methodology.Guidance indeterminingthe PFD ofE/E/PE logicsolver(s) v
31、iaMarkovAnalysis- 17 - ISA-TR84.00.02-2002 - Part 21 Scope1.1 ISA-TR84.00.02-2002 - Part 2 is informative and does not contain any mandatoryrequirements. This part of the technical report is intended to be used only after a thoroughunderstanding of ISA-TR84.00.02-2002 Part 1, which defines the overa
32、ll scope. ISA-TR84.00.02-2002 - Part 2 provides:a) technical guidance in Safety Integrity Level (SIL) Analysis;b) ways to implement Safety Instrumented Functions (SIF) to achieve a specified SIL;c) failure rates and failure modes of SIF components;d) diagnostics, diagnostic coverage, covert faults,
33、test intervals, redundancy of SIF components;e) tool(s) for SIL verification of SIF.1.2 ISA-TR84.00.02-2002 - Part 2 provides one possible technique for calculating PFDavgvalues for Safety Instrumented Functions (SIF) installed in accordance with ANSI/ISA-84.01-1996, “Application of Safety Instrumen
34、ted Systems for the Process Industries”.1.3 ISA-TR84.00.02-2002 - Part 2 provides the engineer(s) performing design for a SIF with arelatively simple technique generally following the simplified equation approach for assessing thecapability of the designed SIF.1.4 The procedures outlined in ISA-TR84
35、.00.02-2002 - Part 2 provide the engineer with stepsto follow in estimating a mathematical value for PFDavgfor typical configurations of SIF designedaccording to ANSI/ISA-84.01-1996. This procedure is appropriate for SIL 1 and SIL 2 SIFs. Thisprocedure should not be used for SIL 3 SIFs unless the Us
36、er has a thorough understanding of theSIL Verification mathematics and fully understands the limitations of the simplified equations.1.5 ISA-TR84.00.02-2002 - Part 2 does not cover modeling of external communications oroperator interfaces. The SIL analysis includes the SIF envelope as defined by ANS
37、I/ISA-84.01-1996 (see Figure I.2).2 References1. ANSI/ISA-84.01-1996 “Application of Safety Instrumented Systems for the ProcessIndustries”, Instrumentation, Systems, and Automation Society, ISA, Research Triangle Park,NC, 27709, February 1996.2. ISA-TR84.00.02-2002, “Safety Instrumented Functions (
38、SIF) Safety Integrity LevelEvaluation Techniques, Part 1: Introduction; Part 2: Determining the SIL of a SIF viaSimplified Equations; Part 3: Determining the SIL of a SIF via Fault Tree Analysis; Part 4:Determining the SIL of a SIF via Markov Analysis; Part 5: Determining the PFD of SIS LogicSolvers
39、 via Markov Analysis,“ Instrumentation, Systems and Automation Society, TechnicalReport, Research Triangle Park, NC, 27709, 2002.3. “Reliability, Maintainability and Risk” by David J. Smith, 4thEdition, 1993, Butterworth-Heinemann, ISBN 82-515-0188-1.4. “Guidelines for Safe Automation of Chemical Pr
40、ocesses”, Center for Chemical ProcessSafety, American Institute of Chemical Engineers, New York, NY 10017, 1993.ISA-TR84.00.02-2002 - Part 2 - 18 -5. “Evaluating Control Systems Reliability”, W. M. Goble, Instrument Society of America,Research Triangle Park, NC, 27709, 1992.6. “Probabilistic Risk As
41、sessment, Henley, Ernest J. and Kumamoto, Kiromitsu, IEEE Press,New York, New York, 1992.3 DefinitionsDefinitions and terminology used in this part are defined in ISA-TR84.00.02-2002 Part 1.4 Assumptions used in the calculationsThe following assumptions were used in this Part for Simplified Equation
42、 calculations:4.1 The SIF being evaluated will be designed, installed, and maintained in accordance withANSI/ISA-84.01-1996.4.2 Component failure and repair rates are assumed to be constant over the life of the SIF.4.3 Once a component has failed in one of the possible failure modes it cannot fail a
43、gain in oneof the remaining failure modes. It can only fail again after it has first been repaired. Thisassumption has been made to simplify the modeling effort.4.4 The equations assume similar failure rates for redundant components.4.5 The sensor failure rate includes everything from the sensor to
44、the input module of the logicsolver including the process effects (e.g., plugged impulse line to transmitter).4.6 The logic solver failure rate includes the input modules, logic solver, output modules andpower supplies. These failure rates typically are supplied by the logic solver vendor.NOTE ISA-T
45、R84.00.02-2002 - Part 5 illustrates a suggested method to use in developing failure rate data for the logicsolver.4.7 The final element failure rate includes everything from the output module of the logic solverto the final element including the process effects.4.8 The failure rates shown in the for
46、mulas for redundant architectures are for a single leg orslice of a system (e.g., if 2oo3 transmitters, the failure rate used is for a single transmitter, notthree (3) times the single transmitter value.)4.9 The Test Interval (TI) is assumed to be much shorter than the Mean Time To Failure(MTTF).4.1
47、0 Testing and repair of components in the system are assumed to be perfect.4.11 All SIF components have been properly specified based on the process application. Forexample, final elements (valves) have been selected to fail in the safe direction depending ontheir specific application.4.12 All equat
48、ions used in the calculations based on this part are based on Reference 3.4.13 All power supply failures are assumed to be to the de-energized state.- 19 - ISA-TR84.00.02-2002 - Part 24.14 It is assumed that when a dangerous detected failure occurs, the SIS will take the processto a safe state or pl
49、ant personnel will take necessary action to ensure the process is safe(operator response is assumed to be before a demand occurs, i.e., instantaneous, and PFD ofoperator response is assumed to be 0).NOTE If the action depends on plant personnel to provide safety, the user is cautioned to account for the probability offailure of personnel to perform the required function in a timely manner.4.15 The target PFDavgand MTTFspuriousis defined for each SIF implemented in the SIS.4.16 The Beta model is used to treat possible common cause failures.NOTE A detailed expla
