Safety Integrity Level Analysis

Safety is crucial for complex installations. The SIL level is a measure of the operational reliability of functional safety. A SIL analysis is a good way to determine whether existing functional safety measures guarantee sufficient safety and risk reduction. A SIL assessment is increasingly used in the industrial sector. A SIL assessment consists of three main components:

Analyzing the possible risks / undesirable events;
SIL classification: determining the level of safety required to control the risks;
SIL verification: determining whether the design or implementation of functional safety provides the required safety.

1. Introduction

Safety is becoming increasingly important in industrial environments. A SIL (Safety Integrity Level) analysis is a good way to determine whether existing functional safety measures guarantee sufficient safety and risk reduction. SIL assessments are now increasingly used in the industrial sector. The EN-IEC 61508 standard specifies the requirements that functional safety measures must meet and the procedures that can be followed to perform a SIL analysis. EN-IEC 61508 is a general standard for functional safety. The EN-IEC 62061 (machine safety) and EN-IEC 61511 (process safety) standards are derived from it and provide a more concrete interpretation.

2. What is functional safety?

Safety is essentially about being free from unacceptable risks such as bodily injury and other health effects, whether direct or indirect.

Safety in industrial environments can consist of many components. These include effective process control, preventive measures to prevent accidents, emergency measures in the event of an incident, evacuation procedures, and so on. All these different types of measures together form a number of "layers of defense," also known as "layers of protection." The objective is to prevent risks in advance and/or control them if they occur. Therefore, these are all essentially risk-reduction measures.

A more formal definition of functional safety is as follows: functional safety is that part of total safety that depends on automated systems, in which the system reacts in a certain way based on input values.

Two examples:

A pressure safety device that trips when the temperature in a combustion boiler is too high, causing valves in the gas supply line to close, is a functional safety device
Thermal protection in the windings of an electric motor that shuts down the motor at high temperatures to prevent overheating is considered functional safety. Insulating material to prevent overheating, on the other hand, is not considered functional safety.

3. SIL analysis approach

A SIL analysis consists of three main components:

Risk analysis: analyzing potential risks/unwanted events. These must, of course, be prevented as much as possible with safety measures. The risk analysis determines (qualitatively) whether functional safety measures are necessary.
SIL classification: determining the required safety level to control risks, with the principle that the greater the risk, the higher the required SIL level. The SIL classification therefore determines the required reliability level of functional safety.
SIL verification: determining whether the functional safety design provides the required safety.

4. Risk analysis

The first step is to analyze the potential risks/adverse events. The risk analysis determines (qualitatively) whether functional safety is necessary.

This often begins with a physical and functional breakdown of a factory, machine, or process. Using common analysis techniques such as HAZOP or FMECA, deviations from normal process operation can then be identified. This results in a list of undesirable events/risks.

In addition to HAZOP and FMECA analyses, various standards also include a list of standard hazardous situations for processes or installations within the scope of the standard. Often, the measures to be taken are already prescribed. One of these may be the requirement for functional safety. It is therefore first important to assess the relevance of the standard hazardous situations to the specific situation being analyzed.

5. SIL classification

The risk analysis has resulted in an inventory of risks or hazardous situations. The essence of the SIL classification is to determine the required safety level to control the risks. The greater the risk, the higher the required SIL level. There are four levels: SIL 1 through SIL 4, with SIL 1 representing the lowest and SIL 4 the highest degree of risk reduction. As the SIL level increases, the requirement for the availability of functional safety increases. For example, the following availability requirements apply to safety functions that are used relatively infrequently:

SIL 1: 90% (1 nine)
SIL 2: 99% (2 nines)
SIL 3: 99.9% (3 nines)
SIL 4: 99.99% (4 nines)

For the SIL classification, estimates are made of aspects such as the probability of an adverse event occurring, the severity of the consequences of this adverse event, the degree of exposure to the risk and its avoidability.

A risk graph can then be used to determine the required SIL level. A risk graph is ideally a policy, for example, in the form of a decision tree, regarding the required SIL level for a safety measure, taking into account the assessments of probability, consequence, exposure, and avoidability. Standards 61508/61511 also contain several sample risk graphs. An example risk graph is shown in the figure below.

6. SIL verification

Finally, the SIL verification determines whether the functional safety design provides the required safety. And, in the case of existing installations and safety features, whether the actual design meets the required SIL classification.

To this end, it is important to map the operation of functional safety. Functional safety systems are usually constructed according to the sensor-logic-actuator principle. This involves identifying which components perform a function in the safety system. After inventorying the failure data of the components, the availability of functional safety can be determined. Finally, it can be determined whether it meets the required SIL classification.