6.2 SIL Determination, Verification & Layer of Protection Analysis (LOPA)

6.2 SIL Determination, Verification & Layer of Protection Analysis (LOPA)

Determining how much risk reduction an automated safety system must provide is among the most consequential responsibilities of an automation engineer. Under-specifying safety integrity exposes personnel, the environment, and the enterprise to catastrophic industrial accidents, while over-specifying safety integrity imposes crippling capital expenditures, complex proof-testing requirements, and frequent spurious plant shutdowns. A Certified Automation Professional (CAP) must master Safety Integrity Level (SIL) determination, apply Layer of Protection Analysis (LOPA), verify compliance against corporate tolerable risk guidelines, and mathematically calculate the average Probability of Failure on Demand ($PFD_{avg}$).

---

Target SIL Allocation Methodologies

Safety Integrity Level (SIL) allocation matches the risk reduction provided by a Safety Instrumented Function (SIF) to the unmitigated risk inherent in the process. IEC 61511 and IEC 61508 recognize three broad categories of SIL determination:

+-------------------------------------------------------------------------+
|                        SIL DETERMINATION METHODS                        |
+-----------------------+-------------------------+-----------------------+
| Qualitative           | Semi-Quantitative       | Fully Quantitative    |
| - Risk Matrix         | - Layer of Protection   | - Fault Tree Analysis |
| - Calibrated Risk     |   Analysis (LOPA)       |   (FTA)               |
|   Graph               |                         | - Markov Models       |
| Fast, highly          | Objective, scenario-    | Computationally       |
| subjective, team-     | driven, reproducible,   | intensive, reserved   |
| dependent             | standard industry tool  | for complex interlocks|
+-----------------------+-------------------------+-----------------------+

Low Demand vs. High Demand / Continuous Operating Modes

IEC 61511 distinguishes operating modes based on the frequency of demands placed upon the safety system:

• Low-Demand Mode: Demands on the SIF occur no more frequently than once per year ($< 1\text{ demand/year}$). This is the dominant mode across process manufacturing (refineries, petrochemicals, specialty batch chemical plants). Performance is measured as average Probability of Failure on Demand ($PFD_{avg}$).
• High-Demand / Continuous Mode: Demands occur more frequently than once per year ($> 1\text{ demand/year}$), or the safety loop operates continuously to maintain safe conditions (e.g., turbine overspeed trip systems, burner flame scanners). Performance is measured as the Probability of Dangerous Failure per Hour ($PFH$).

---

Layer of Protection Analysis (LOPA)

Layer of Protection Analysis (LOPA) is an order-of-magnitude semi-quantitative methodology developed by the Center for Chemical Process Safety (CCPS) and incorporated into IEC 61511-3. LOPA takes a single cause-consequence pair identified during a Process Hazard Analysis (such as a HAZOP) and systematically determines whether existing protection layers reduce the risk to a tolerable level.

[ Initiating Event ] (Frequency: IEF)
         │
         ▼
[ Enabling Conditions & Modifiers ] (P_e, P_ign, P_pres)
         │
         ▼
[ Layer 1: BPCS Control / Alarm Loop ] (PFD_BPCS <= 0.1)
         │
         ▼
[ Layer 2: Independent Operator Action ] (PFD_Operator <= 0.1)
         │
         ▼
[ Layer 3: Safety Instrumented Function (SIF) ] (Target SIL PFD)
         │
         ▼
[ Layer 4: Mechanical Relief Device (PSV) ] (PFD_PSV <= 0.01)
         │
         ▼
[ Consequence / Tolerable Target Frequency ] (F_t)

Mathematical Formulation of LOPA

The unmitigated hazard frequency ($F_{unmitigated}$) is the product of the Initiating Event Frequency ($IEF$), the probability of any Enabling Conditions ($P_e$), and the probability of any Conditional Modifiers ($P_m$):

$$F_{unmitigated} = IEF \times P_e \times P_{ign} \times P_{pres}$$

Where:

• $IEF$ (Initiating Event Frequency): The historical failure rate of the event trigger, expressed in events per year (e.g., cooling water pump mechanical seal failure = $0.1/\text{yr}$; control loop transmitter drift = $0.1/\text{yr}$; operator manual valve error = $0.5/\text{yr}$).
• $P_e$ (Enabling Condition): An operating condition or state required for the initiating event to lead to the consequence (e.g., reactor operating in active reaction phase only 40% of the year, $P_e = 0.40$).
• $P_{ign}$ (Probability of Ignition): For flammable releases, the probability that the vapor cloud encounters an ignition source (e.g., $0.1$ for open outdoor areas; $1.0$ if adjacent to fired heaters).
• $P_{pres}$ (Probability of Personnel Presence / Occupancy): The fraction of time workers are exposed in the impact zone (e.g., 2 hours per 24-hour day = $0.083$).

The mitigated event frequency ($F_{mitigated}$) accounts for all qualified Independent Protection Layers ($IPL$):

$$F_{mitigated} = F_{unmitigated} \times \prod_{j=1}^{n} PFD_{IPL,j}$$

To satisfy corporate risk tolerance, $F_{mitigated}$ must be less than or equal to the Tolerable Event Frequency ($F_{tolerable}$) established for that consequence category (e.g., $10^{-4}/\text{yr}$ for severe lost-time injury; $10^{-5}/\text{yr}$ for single fatality; $10^{-6}/\text{yr}$ for multiple fatalities).

If existing non-SIS protection layers fail to bridge the gap between $F_{unmitigated}$ and $F_{tolerable}$, the remaining risk reduction must be provided by a newly engineered Safety Instrumented Function (SIF):

$$PFD_{SIF\_target} = \frac{F_{tolerable}}{F_{unmitigated} \times \prod PFD_{non\text{-}SIS\_IPL}}$$ $$RRF_{required} = \frac{1}{PFD_{SIF\_target}}$$

The Four Mandatory Criteria for an Independent Protection Layer (IPL)

Not every safety device or operational procedure qualifies as an IPL in a LOPA study. To earn credit as an IPL (typically providing a risk reduction factor between 10 and 100, i.e., $PFD \le 0.1$), an engineering safeguard must satisfy four strict, non-negotiable rules:

1. Independence: The protection layer must be completely independent of the initiating event and independent of all other credited protection layers. If a BPCS level control loop failure is the initiating event, a high-level alarm running on the same BPCS controller or using the same level sensor cannot be credited as an IPL.
2. Functionality: The safeguard must possess the physical capacity, speed of response, and mechanical sizing required to completely prevent or mitigate the consequence under worst-case process conditions.
3. Integrity: The safeguard must have a documented, quantifiable failure probability ($PFD$). Components must be designed, maintained, and operated in accordance with established engineering standards.
4. Auditability: The safeguard must be periodically inspected, functionally tested, and documented in plant maintenance ledgers. If proof tests are not performed and recorded, the IPL credit is legally invalidated.

---

SIL Verification: Calculating Average Probability of Failure on Demand ($PFD_{avg}$)

Once a target SIL is established via LOPA, the automation engineer must mathematically verify that the physical SIS design meets or exceeds that target. In low-demand operating modes, the reliability metric evaluated is $PFD_{avg}$.

A SIF is a series reliability system comprising three subsystems. The overall SIF $PFD_{avg}$ is the summation of the individual subsystem failure probabilities:

$$PFD_{avg}^{SIF} = PFD_{avg}^{Sensors} + PFD_{avg}^{Logic\_Solver} + PFD_{avg}^{Final\_Elements}$$

Simplified $PFD_{avg}$ Equations for Standard Architectures

Under low-demand conditions with constant failure rates (exponential distribution) where the product of dangerous undetected failure rate ($\lambda_{du}$) and Proof Test Interval ($T_i$) is small ($\lambda_{du} T_i \ll 1$), simplified equations derived from Markov modeling are used:

1oo1 Architecture (Simplex)

$$PFD_{avg}^{1oo1} = \lambda_{du} \left( \frac{T_i}{2} \right) + \lambda_{dd} \times MTTR$$

Where:

• $\lambda_{du}$ = Dangerous undetected failure rate ($1/\text{hour}$ or FIT)
• $\lambda_{dd}$ = Dangerous detected failure rate ($1/\text{hour}$ or FIT)
• $T_i$ = Proof Test Interval (hours, e.g., $1\text{ year} = 8,760\text{ hr}$; $2\text{ years} = 17,520\text{ hr}$; $5\text{ years} = 43,800\text{ hr}$)
• $MTTR$ = Mean Time to Restoration (repair time following detected failure, typically $8\text{ to }24\text{ hours}$)

Because $MTTR$ is typically orders of magnitude smaller than $T_i$ ($24\text{ hr} \ll 8,760\text{ hr}$), the undetected failure term dominates:

$$PFD_{avg}^{1oo1} \approx \frac{\lambda_{du} T_i}{2}$$

1oo2 Architecture (Dual Redundant for Safety)

In a 1oo2 system, both channels must fail in a dangerous undetected mode for the safety function to be lost upon demand. However, redundant identical channels share susceptibility to common-cause failures (e.g., extreme ambient heat, vibration, corrosive atmospheric contaminants, or maintenance calibration mistakes), represented by the Beta-factor ($\beta$):

$$PFD_{avg}^{1oo2} = \frac{(\lambda_{du} T_i)^2}{3} + \beta \left( \frac{\lambda_{du} T_i}{2} \right)$$

Where $\beta$ typically ranges from $0.01\text{ to }0.10$ ($1\%\text{ to }10\%$) depending on physical separation, diverse piping taps, and independent maintenance procedures per IEC 61508-6 Annex D.

2oo3 Architecture (Triple Modular Redundancy)

$$PFD_{avg}^{2oo3} = (\lambda_{du} T_i)^2 + \beta \left( \frac{\lambda_{du} T_i}{2} \right)$$

The Impact of Proof Test Interval ($T_i$) & Partial Stroke Testing (PST)

Notice that in a 1oo1 loop, $PFD_{avg}$ is directly proportional to $T_i$. If a facility extends its scheduled turnaround window from 1 year ($8,760\text{ hr}$) to 3 years ($26,280\text{ hr}$), the $PFD_{avg}$ triples, potentially degrading a verified SIL 2 function down into a non-compliant SIL 1 rating.

To maintain SIL compliance without shutting down the plant for full valve stroking, engineers install Partial Stroke Testing (PST) devices on emergency shutdown valves. A PST moves the valve stem by 10% to 15% during active production, confirming that the solenoid actuates, packing is unseized, and actuator pressure exhausts properly. This converts a portion of unrevealed failures into detected failures, increasing Diagnostic Coverage ($DC$):

$$DC = \frac{\lambda_{dd}}{\lambda_{dd} + \lambda_{du}} = \frac{\lambda_{dd}}{\lambda_d}$$

---

Realistic Industrial Calculation Scenario

A chemical refinery designs a high-pressure shutdown SIF on a crude hydrotreater separator drum. Corporate risk guidelines dictate a tolerable overpressure catastrophe frequency of $F_{tolerable} = 1.0 \times 10^{-5}/\text{year}$.

Step 1: LOPA Risk Accounting

• Initiating Cause: Distillation column reflux pump trips off, deadheading hydrotreater gas. Initiating Event Frequency: $IEF = 0.20/\text{year}$.
• Enabling Conditions: Operating at design throughput: $P_e = 1.0$.
• Existing Non-SIS Protection Layers:
  • Independent mechanical spring-loaded Pressure Safety Valve (PSV-301): Valid IPL, $PFD_{PSV} = 0.02$.
  • BPCS high-pressure operator alarm: Operator action cannot be credited because the pressure reaches catastrophic rupture limits in 4 minutes ($< 10\text{ minute}$ rule).
• Mitigated Frequency without SIF: $F_{mitigated\_non\text{-}SIS} = IEF \times PFD_{PSV} = 0.20 \times 0.02 = 4.0 \times 10^{-3}/\text{year}$
• Target SIF Performance Required: $PFD_{SIF\_target} = \frac{F_{tolerable}}{F_{mitigated\_non\text{-}SIS}} = \frac{1.0 \times 10^{-5}}{4.0 \times 10^{-3}} = 2.5 \times 10^{-3}$ $RRF_{required} = \frac{1}{2.5 \times 10^{-3}} = 400$ Since $PFD_{SIF\_target}$ falls between $10^{-3}$ and $10^{-2}$ ($RRF$ between 100 and 1,000), the function requires SIL 2.

Step 2: SIL Verification Calculations

The engineering team selects the following hardware with a Proof Test Interval of $T_i = 8,760\text{ hr}$ (1 year) and $MTTR = 24\text{ hr}$:

1. Sensor Subsystem (1oo2 Transmitters):
   • $\lambda_{du} = 1.5 \times 10^{-7}/\text{hr}$, $\beta = 0.05$
   • Independent term: $\frac{(\lambda_{du} T_i)^2}{3} = \frac{(1.5 \times 10^{-7} \times 8760)^2}{3} = 5.76 \times 10^{-7}$
   • Common cause term: $\beta \frac{\lambda_{du} T_i}{2} = 0.05 \times \frac{1.5 \times 10^{-7} \times 8760}{2} = 3.29 \times 10^{-5}$
   • $PFD_{avg}^{Sensors} \approx 3.35 \times 10^{-5}$
2. Logic Solver Subsystem (2oo3 Safety PLC):
   • Vendor certified TUV data: $PFD_{avg}^{Logic} = 4.5 \times 10^{-5}$
3. Final Element Subsystem (1oo1 Solenoid & ESDV):
   • $\lambda_{du} = 2.8 \times 10^{-7}/\text{hr}$
   • $PFD_{avg}^{Final} \approx \frac{\lambda_{du} T_i}{2} = \frac{2.8 \times 10^{-7} \times 8760}{2} = 1.23 \times 10^{-3}$

Step 3: Total Loop Evaluation

$$PFD_{avg}^{Total} = 3.35 \times 10^{-5} + 4.5 \times 10^{-5} + 1.23 \times 10^{-3} = 1.31 \times 10^{-3}$$ $$RRF_{achieved} = \frac{1}{1.31 \times 10^{-3}} = 763$$

Because $1.31 \times 10^{-3} \le 2.5 \times 10^{-3}$ ($RRF = 763 > 400$), the proposed physical design successfully verifies and satisfies the SIL 2 target.

---

Common Exam Traps

1. Crediting Alarms with Insufficient Action Time as IPLs: On the CAP exam, if an operator alarm has a response window of less than 10 minutes from alarm annunciation to the occurrence of the hazard, it cannot be credited as an Independent Protection Layer in a LOPA study.
2. Confusing RRF and PFD: Remember their reciprocal relationship: $RRF = 1 / PFD_{avg}$. A SIL 2 system requires an RRF between 100 and 1,000. An RRF of 500 corresponds to $PFD_{avg} = 0.002$.
3. Overlooking the Final Element Dominance: When an exam scenario describes a SIF failing to meet its SIL target, adding redundant sensors or upgrading the safety PLC rarely fixes the problem. The bottleneck is almost invariably the final control element (valves/actuators). Adding partial stroke testing or deploying dual valves (1oo2) is the standard engineering solution.