Does The Mode Of Operation Affect How The Safety Integrity Level Is Determined?

First, it is helpful to use a common term hazard rate to examine the differences between low demand mode of operation and high demand or continuous mode of operation. This is the estimated rate at which specified hazards will take place unless other protective measures are in place (such as other safety-related systems). The fundamental aim is to design a safety-related system so that the resulting hazard rate is sufficiently low to meet the tolerable risk in the context of the specific application.

See example system architectures.

Low demand mode of operation

For a safety function operating in low demand mode, the achieved hazard rate depends on the rate of demands on the E/E/PE safety-related system and the probability of failure on demand of the E/E/PE safety-related system in the context of a specified safety function. That is:

Hazard rate (h) = Demand rate (d) x Average probability of failure on demand (PFDavg)
h = d x PFDavg

In the context of a system architecture such as that shown in Figure 1(a) and (b), where the E/E/PE safety-related system is acting as a protection system for specified conditions arising on the equipment under control (EUC) and EUC control system (i.e. where a failure of the EUC control system would give rise to a demand on the E/E/PE safety-related system), this relationship only holds if there is adequate independence between the EUC and EUC control system combined and the E/E/PE safety-related system. If there is inadequate independence then it is necessary to take into account the effect of common cause failures between the EUC and EUC control system combined and the E/E/PE safety-related system. Such failures will lead to an increased hazard rate or place increased demands on other safety-related systems.

The target failure measure for a safety function operating in low demand mode is the average probability of failure to perform the safety function on demand and from above it can be seen that:

PFDavg = h / d

h / d is sometimes referred to as the risk reduction factor.

Therefore, for a safety function operating in low demand mode, in the case of a quantified approach to determining the safety integrity level, the required safety integrity level is determined from the required average probability of failure on demand (PFDavg) (see table 2 of IEC 61508-1). The PFDavg required to achieve the tolerable risk, and hence the required safety integrity level, can be obtained from knowledge of the demand rate (d) and the hazard rate (h) necessary to achieve the tolerable risk.

High demand or continuous mode of operation

For a safety function operating in high demand or continuous mode and in the case of a quantified approach to determining the safety integrity level, table 3 of IEC 61508-1 is used to determine the required safety integrity level. The table relates the safety integrity level to the probability of a dangerous failure per hour, which is equivalent to the hazard rate and has to be low enough to achieve the tolerable risk.

Hazard rate (h) = Probability of a dangerous failure per hour

 

This text contains extracts from the IEC Functional Safety Zone. All such extracts are copyright of International Electrotechnical Commission © 2005, IEC, Geneva, Switzerland. All rights reserved. IEC has no responsibility for the placement and context in which the extracts are reproduced. This notice takes precedence over any general copyright statement.