1、Safety Instrumented Functions (SIF)- Safety Integrity Level (SIL)Evaluation Techniques Part 3:Determining the SIL of a SIFvia Fault Tree AnalysisApproved17 June 2002ISA-TR84.00.02-2002 - Part 3TECHNICAL REPORTISA The Instrumentation,Systems, andAutomation Society TMNOTICEOFCOPYRIGHTThis is a copyrig
2、hted document and may not be copied or distributed in anyform or manner without the permission of ISA. This copy of the document wasmadeforthesoleuseofthepersontowhomISAprovideditandissubjecttothe restrictions stated in ISAs license to that person. It may not be provided toany other person in print,
3、 electronic, or any other form. Violations of ISAscopyright will be prosecuted to the fullest extent of the law and may result insubstantial civil and criminal penalties.ISA-TR84.00.02-2002 Part 3Safety Instrumented Functions (SIF) Safety Integrity Level (SIL) Evaluation Techniques Part 3:Determinin
4、g the SIL of a SIF via Fault Tree AnalysisISBN: 1-55617-804-2Copyright 2002 by ISAThe Instrumentation, Systems, and Automation Society. All rights reserved.Not for resale. Printed in the United States of America. No part of this publication may be reproduced,stored in a retrieval system, or transmit
5、ted in any form or by any means (electronic mechanical,photocopying, recording, or otherwise), without the prior written permission of the Publisher.ISA67 Alexander DriveP.O. Box 12277Research Triangle Park, North Carolina 27709- 3 - ISA-TR84.00.02-2002 - Part 3PrefaceThis preface, as well as all fo
6、otnotes and annexes, is included for information purposes and is not part ofISA-TR84.00.02-2002 Part 3.This document has been prepared as part of the service of ISA the Instrumentation, Systems, andAutomation Society toward a goal of uniformity in the field of instrumentation. To be of real value, t
7、hisdocument should not be static but should be subject to periodic review. Toward this end, the Societywelcomes all comments and criticisms and asks that they be addressed to the Secretary, Standards andPractices Board; ISA; 67 Alexander Drive; P. O. Box 12277; Research Triangle Park, NC 27709;Telep
8、hone (919) 549-8411; Fax (919) 549-8288; E-mail: standardsisa.org.The ISA Standards and Practices Department is aware of the growing need for attention to the metricsystem of units in general, and the International System of Units (SI) in particular, in the preparation ofinstrumentation standards. T
9、he Department is further aware of the benefits to USA users of ISAstandards of incorporating suitable references to the SI (and the metric system) in their business andprofessional dealings with other countries. Toward this end, this Department will endeavor to introduceSI-acceptable metric units in
10、 all new and revised standards, recommended practices, and technicalreports to the greatest extent possible. Standard for Use of the International System of Units (SI): TheModern Metric System, published by the American Society for Testing and redundant element with one or more safety instrumented f
11、unction.Each element should be evaluated with respect to all the safety instrumented functions with which it isassociated to ensure that it meets the integrity level required for each safety instrumented function; to understand the interactions of all the safety instrumented functions; and to unders
12、tand the impact of failure of each component.This document does not provide guidance in the determination of the specific SIL required (e.g., SIL I, 2,and 3) for the SIS. The user is again referred to ANSI/ISA-84.01-1996 or to other references.ISA-TR84.00.02-2002 - Part 3 - 12 -The primary focus of
13、this document is on evaluation methodologies for assessing the capability of theSIS. The SIS lifecycle model is defined in ANSI/ISA-84.01-1996. Figure I.2 shows the boundaries of theSIS and how it relates to other systems.StartConceptualProcessDesignPerformProcess HazardAnalysis systematic failures
14、may be introduced during the specification,design, implementation, operational and modification phase and may affect hardware as well as software.ANSI/ISA-84.01-1996 addresses systematic safety integrity by specifying procedures, techniques,measures, etc. that reduce systematic failures.SIS Boundary
15、ISA-TR84.00.02-2002 - Part 3 - 14 -An acceptable safe failure rate is also normally specified for a SIF. The safe failure rate is commonlyreferred to as the false trip, nuisance trip, or spurious trip rate. The spurious trip rate is included in theevaluation of a SIF, since process start up and shut
16、down are frequently periods where chances of ahazardous event are high. Hence in many cases, the reduction of spurious trips will increase the safety ofthe process. The acceptable safe failure rate is typically expressed as the mean time to a spurious trip(MTTFspurious).NOTE In addition to the safet
17、y issue(s) associated with spurious trips the user of the SIS may also want the acceptableMTTFspuriousto be increased to reduce the effect of spurious trips on the productivity of the process under control. This increase inthe acceptable MTTFspuriouscan usually be justified because of the high cost
18、associated with a spurious trip.The objective of this technical report is to provide users with techniques for the evaluation of the hardwaresafety integrity of SIF (PFDavg) and the determination of MTTFspurious. Methods of modeling systematicfailures are also presented so a quantitative analysis ca
19、n be performed if the systematic failure rates areknown.ISA-TR84.00.02-2002 shows how to model complete SIF, which includes the sensors, the logic solverand final elements. To the extent possible the system analysis techniques allow these elements to beindependently analyzed. This allows the safety
20、system designer to select the proper system configurationto achieve the required safety integrity level.ISA-TR84.00.02-2002 - Part 1 provides a detailed listing of the definition of all terms used in this document. These are consistent with theANSI/ISA-84.01-1996, IEC 61508 and IEC 61511 standards.
21、the background information on how to model all the elements or components of a SIF. It focuses onthe hardware components, provides some component failure rate data that are used in the examplescalculations and discusses other important parameters such as common cause failures and functionalfailures.
22、 a brief introduction to the methodologies that will be used in the examples shown in this document.They are Simplified equations (3), Fault Tree Analysis (4), and Markov Analysis (5).ISA-TR84.00.02-2002 - Part 2 provides simplified equations for calculating the SIL values for DemandMode Safety Inst
23、rumented Functions (SIF) installed in accordance with ANSI/ISA-84.01-1996,“Applications of Safety Instrumented Systems for the Process Industries.“ Part 2 should not beinterpreted as the only evaluation technique that might be used. It does, however, provide theengineer(s) performing design for a SI
24、S with an overall technique for assessing the capability of thedesigned SIF.ISA-TR84.00.02-2002 - Part 3 provides fault tree analysis techniques for calculating the SIL for DemandMode Safety Instrumented Functions (SIF) installed in accordance with ANSI/ISA-84.01-1996,“Applications of Safety Instrum
25、ented Systems for the Process Industries.“ Part 3 should not beinterpreted as the only evaluation technique that might be used. It does, however, provide theengineer(s) performing design for a SIS with an overall technique for assessing the capability of thedesigned SIF.ISA-TR84.00.02-2002 - Part 4
26、provides Markov analysis techniques for calculating the SIL values forDemand Mode Safety Instrumented Functions (SIF) installed in accordance with ANSI/ISA-84.01-1996,“Applications of Safety Instrumented Systems for the Process Industries.“ Part 4 should not beinterpreted as the only evaluation tech
27、nique that might be used. It does, however, provide theengineer(s) performing design for a SIS with an overall technique for assessing the capability of thedesigned SIF.- 15 - ISA-TR84.00.02-2002 - Part 3ISA-TR84.00.02-2002 - Part 5 addresses the logic solver only, using Markov Models for calculatin
28、g thePFD of E/E/PE logic solvers because it allows the modeling of maintenance and repairs as a function oftime, treats time as a model parameter, explicitly allows the treatment of diagnostic coverage, and modelsthe systematic failures (i.e., operator failures, software failures, etc.) and common c
29、ause failures.Figure I.3 illustrates the relationship of each part to all other parts.ISA-TR84.00.02-2002 - Part 3 - 16 -Figure I.3 ISA-TR84.00.02-2002 overall frameworkPart 1Part 2Part 3Part 4Part 5Development of the overall terms, symbols, explanation ofSIS element failures, comparison of system a
30、nalysistechniques, and uncertainty analysis examples.Development of SIL for SIF usingSimplified Equation Methodology.Development of SIL for SIF usingFault Tree Analysis Methodology.Development of SIL for SIF usingMarkov Analysis Methodology.Guidance indeterminingthe PFD ofE/E/PE logicsolver(s) viaMa
31、rkovAnalysis.- 17 - ISA-TR84.00.02-2002 - Part 31 Scope1.1 ISA-TR84.00.02-2002 - Part 3 is intended to be used only after achieving a thorough understandingof ISA-TR84.00.02-2002 Part 1, which defines the overall scope. This technical report addresses:a) technical guidance in Safety Integrity Level
32、(SIL) Analysis;b) ways to implement Safety Instrumented Functions (SIF) to achieve a specified SIL;c) failure rates and failure modes of SIF components;d) diagnostics, diagnostic coverage, covert faults, test intervals, redundancy of SIF components; ande) tool(s) for SIL verification of SIF.1.2 ISA-
33、TR84.00.02-2002 - Part 3 is considered informative and does not contain any mandatoryrequirements. The User should refer to ISA-TR84.00.02-2002 Part 1, which defines the generalrequirements for the verification of SIL for SIF.1.3 ISA-TR84.00.02-2002 - Part 3 is intended to provide guidance on the ap
34、plication of Fault TreeAnalysis (FTA) to SIF. FTA is one possible technique for calculating SIL for a SIF installed per ANSI/ISA-84.01-1996(1).1.4 ISA-TR84.00.02-2002 - Part 3 covers the analysis of a SIF application from the field sensorsthrough the logic solver to the final elements.1.5 Common cau
35、se failure and systematic failure are an example of important factors readily modeledin FTA.1.6 Part 3 assumes that the complex analysis of the failure rate for a programmable logic solver is doneby another method (see Part 5) or is provided by a vendor as an input PFDLor MTTFspuriousinto thisanalys
36、is (per Clause 7.3.2 of ANSI/ISA-84.01-1996, the failure rate of the logic solver should be suppliedby the logic solver vendor). Calculation of the PFDavgand MTTFspuriousof electrical/electronic/programmable electronic systems can be performed using FTA by applying the techniques presented inthis pa
37、rt.1.7 This part does not cover modeling of external communications or operator interfaces. The SILanalysis includes the SIF envelope as defined by ANSI/ISA-84.01-1996 (see Figure I.2).1.8 The ultimate goal for the FTA is to determine the following: The PFDavg, Safety Integrity Level (SIL), and The
38、MTTFspuriousof the SIFThis analysis aids in the design of an effective SIF by allowing the User to determine where weaknessesexist within the SIF. This technique is applicable when the failure of the SIF can be caused by more thanone pathway, when strong interactions exist between multiple SIF, or w
39、hen several support systems(instrument air, cooling water, power, etc.) are involved.ISA-TR84.00.02-2002 - Part 3 - 18 -2 References1. ANSI/ISA-84.01-1996 “Application of Safety Instrumented Systems for the Process Industries,“Instrumentation, Systems, and Automation Society, Research Triangle Park,
40、 NC, 27709, February1996.2. ISA-TR84.00.02-2002, “Safety Instrumented Functions (SIF) Safety Integrity Level EvaluationTechniques, Part 1: Introduction; Part 2: Determining the SIL of a SIF via Simplified Equations; Part 3:Determining the SIL of a SIF via Fault Tree Analysis; Part 4: Determining the
41、 SIL of a SIF via MarkovAnalysis; Part 5: Determining the PFD of SIS Logic Solvers via Markov Analysis,“ Instrumentation,Systems and Automation Society, Technical Report, Research Triangle Park, NC, 27709, 2002.3. “Reliability, Maintainability and Risk” by David J. Smith, 4thEdition, 1993, Butterwor
42、th-Heinemann,ISBN 82-515-0188-1.4. “Guidelines for Safe Automation of Chemical Processes,“ Center for Chemical Process Safety,American Institute of Chemical Engineers, New York, NY 10017, 1993.5. “Evaluating Control Systems Reliability,“ W. M. Goble, Instrument Society of America, ResearchTriangle P
43、ark, NC, 27709, 1992.6. “Probabilistic Risk Assessment,” Henley, Ernest J. and Kumamoto, Hiromitsu, IEEE Press, New York,New York, 1992.7. “Guidelines for Chemical Process Quantitative Risk Analysis,” Center for Chemical Process Safety,American Institute of Chemical Engineers, New York, New York, 19
44、89.8. Systems Analysis Programs for Hands-on Integrated Reliability Evaluations (SAPHIRE),IRRAS/SARA Version 5.12, U. S. Nuclear Regulatory Commission, 1996.9. “Guidelines for Preventing Human Error in Process Safety,” Center of Chemical Process Safety,American Institute of Chemical Engineers, New Y
45、ork, New York, 1994.10. “An Engineers View of Human Error,” Trevor A. Kletz, Gulf Publishing Company, Houston, Texas,1991.11. NUREG/DR-1278-F, “Handbook of Human Reliability Analysis for Emphasis on Nuclear Power PlantApplications,” Swain 2. Top Event Identification;- 21 - ISA-TR84.00.02-2002 - Part
46、 33. Construction of the FTA;4. Qualitative Examination of the Fault Tree Structure; and5. Quantitative FTA Evaluation.The following procedure summarizes the important aspects of how a SIF is modeled using FTA.6.1 Step 1. SIF description and application informationCalculations to verify the SIF desi
47、gn meets the specified SIL are generally performed during theConceptual Design phase of the Safety Life Cycle Model. Consequently, the information required for theFTA should be well understood and readily available. Critical information to the successful developmentof the fault trees is as follows:
48、Instrumentation description Process description Support systems (instrument air, cooling water, hydraulic, electrical power, etc.) involved in SIFoperations Testing frequency and whether testing is done on-line or off-line Testing procedures and equipment used and likelihood for SIF equipment to be
49、compromised bytesting Failure modes Failure rates Diagnostic coverage Repair intervals and whether repair is done on-line or off-line Maintenance procedures and likelihood of SIF equipment compromised by repair Management of change procedures, frequency of change, and likelihood of error introduced duringchange Operating and maintenance discipline, including an estimate of the frequency of human error andcircumstances where incorrect bypassing could occur Administrative procedures Common cause failures Systematic failures Identify safety functions
