%) Magnetrol UNDERSTANDING SAFETY INTEGRITY LEVEL

2 THE NEW STANDARDS IN SAFETY On the morning of 12/11/05, the largest detonation since the end ofWWII rocked the Buncefield Petrol Depot north of London. 72 million gallons of fuel ignited causing a shock that registered 2.4 on the Richter scale. Catastrophic events like Buncefield, Texas City and Bhopal are what the information in this brochure is meant to prevent. The New Standards in Safety Protecting People Profitabilitͩ Productivity and the Environment Buncefield Petrol Depot Explosion MILESTONE TUV (Bavaria) Microcomputers in Safety-Related Systems (1984) Health & Safety Executive (UK):...

3 Understanding Risk. All safety standards exist to reduce risk, which is inherent wherever manufacturing or processing occurs. The goal of eliminating risk and bringing about a state of absolute safety is not attainable. More realistically, risk can be categorized as being either negligible, tolerable or unacceptable. The foundation for any modem safety System, then, is to reduce risk to an acceptable or tolerable level. In this context, safety can be defined as "freedom from unacceptable risk." The formula for risk is: RISK = HAZARD FREQUENCY x HAZARD CONSEQUENCE Risk can be minimized initially...

4 Safety Instrumente! Systems (SIS) The Safety Instrumente System (SIS) plays a vital role in providing a protective layer around industrial process Systems. Whether called an SIS, emergency or safety shutdown system, or a safety interlock, its purpose is to take process to a "safe state" when pre-deter- _fpj _ mined set points have been exceeded or when safe ^ 驗' operating conditions have been transgressed. A SIS is comprised of safety functions (see SIF below) with sensors, logic solvers and actuators. Figure B shows its basic components: ITT3J-1 * Sensors for signal input and power ו Input...

5 Safety Life Cycle. Earlier we mentioned how a Hazard and Risk Assessment study will determine the need for an SIS. This assessment is one part of a safety life cycle which all major safety standards have speci-fied. The safety life cycle shows a systematic approach for the development of a SIS. A simplified version is shown in Figure D. Figure D The Safety Life Cycle is a sequential approach to developing a Safety Instrumented System (SIS). References to a Safety Life Cycle can be found in ANSI/ISA 84.00.01 Parts 1-3; IEC 61508 Part 1; and IEC 61511 Parts 1-3. Safety Integrity Level (SIL) To...

6 ure E SIL and Related Measures* SIL PFDavg 4 >99.99% 10-5 to <10-4 100,000 to 10,000 Potential for fatalities in the community 3 99.9% 10-4 to <10-3 10,000 to 1,000 Potential for multiple on-site fatalities 2 99 to 99.9% 10-3 to <10-2 1,000 to 100 Potential for major on-site injuries or a fatality 1 90 to 99% 10-2 to <10-1 100 to 10 Potential for minor on-site injuries SIL: Safety Integrity Level. AVAILABILITY: The probability that equipment will perform its task. PFDavg: The average PFD used in calculating safety system reliability. (PFD: Probability of Failure on Demand is the probability...

7 If you are using Manufactures prior use data because a selected product does not reach the required level under FMEDA analysis, be aware that there are significant requirements on the end user. A mature product must generally be used to have the required field experience, and the design and assembly must be "frozen in time" in such a way that no upgrades, modifications or even configuration changes may be allowed that may render the "Proven In Use" data useless. A key result of the analyses is establishing a Safe Failure Fraction (SFF) for a product. Figure F below shows the relationship of...

8 IEC61508/61511 Tying It All Together Understanding how safety is quantified in IEC 61508/61511 can be difficult for anyone new to the concept. It is a daunting task to immediately grasp how all the various aspects of analysis fit together. Following is one perspective which yields a sound, basic understand-ing of the key terms that have been discussed throughout this brochure. It is meant to be a quick-reference for the safety "novice." PHA (Process Hazards Analysis): This is where it starts. It is an analysis of the process that may range from a simplified screening to a rigorous Hazard and...

9 FMEDA Device Data Assessing SIL-Suitable Controls A Failure Modes, Effects and Diagnostic Analysis (FMEDA) is a detailed performance valuation that estimtes the failure rates, failure modes, and diagnostic capability of a device. The following pages show data for specific devices. The following explanations of key FMEDA data for SIL-suitable Magnetrol controls can be used as reference: 颕 FAIL DANGEROUS DETECTED (Xdd) Dangerous failures detected by internal diagnostics or a connected logic solver. FAIL DANGEROUS UNDETECTED (Xdu) Dangerous failures that are not detected by the device. Օ FAIL...

10 SIL-Suitable Magnetrol Controls The SIL indicated below is per IEC 61508/61511. Failure rates expressed in FITS and Annual. PFDavg is calculated according to a proof test interval of one year, though other proof test intervals can be applied. Transmitter failure rates assume the logic solver can detect both over-scale and under-scale currents. Contact Magnetrol for complete FMEDA reports. Sries and Description Model Eclipse® Guided Wave Radar Level Transmitter The Model 705 is a 24 VDC loop-powered transmitter that utilizes a variety of Coaxial, Twin, and Single rod probes. The performance...