[Link]-tech.

com

Module 10
Design Decisions

Introduction
• The voting architecture, diagnostic coverage,
proof test interval, and common cause failure
potential affect the achievable PFD and the
spurious trip rate
• The impact of each design decision is discussed
and typical examples are presented

Module 10 – Design Decisions © SIS-TECH

[Link]

Effect of Device Integrity

Simplex Device
0.025

Higher MTTFD = Higher SIL

0.020
Probability of Failure on Demand

0.015

SIL 1
0.010

SIL 2
0.005

0.000
25 50 75 100 175 250

Mean Time to Failure Dangerous (MTTFD)

Proof Test Interval = 1 year, no on-line diagnostics
CCPS IPS Book 3

Effect of Proof Testing

(1oo1 example)
TI
PFDavg  CCPS IPS Book
1.000E+00
2
Probability of Failure on Demand

1.000E-01

IL 1
1.000E-02

IL 2
1.000E-03
1 2 3 4 5 6 7
25 years 0.020 0.040 0.060 0.080 0.100 0.120 0.140
50 years 0.010 0.020 0.030 0.040 0.050 0.060 0.070
75 years 0.007 0.013 0.020 0.027 0.033 0.040 0.047
100 years 0.005 0.010 0.015 0.020 0.025 0.030 0.035
250 years 0.002 0.004 0.006 0.008 0.010 0.012 0.014
Testing Interval (Years)

Module 10 – Design Decisions © SIS-TECH

[Link]

Voting Architectures
• MooN = M-out-of-N
– SIS, or part thereof, made up of “N” independent
channels, which are so connected, that “M” channels
are sufficient to perform the SIF
– All “N” can detect the process deviation
• Architecture choice based on:
– Integrity
– Reliability
– Hardware Fault Tolerance
– Diagnostics
– Mechanical Integrity Plan

Effect of Voting
1.0E+00
Architecture
PROBABILITY OF FAILURE ON DEMAND (PF

Different architectures
1.0E-01 achieve different
IL 1 PFDavg at same test
2oo2 interval (TI)
1.0E-02

IL 2 1oo1
1.0E-03

IL 3 2oo3
1.0E-04
1oo2

1.0E-05
1 2 3 4 5 6 7

VOTING 1oo1 5.00E-03 1.00E-02 1.50E-02 2.00E-02 2.50E-02 3.00E-02 3.50E-02

M-out-of-N 1oo2 2.50E-05 1.00E-04 2.25E-04 4.00E-04 6.25E-04 9.00E-04 1.23E-03
2oo2 1.00E-02 2.00E-02 3.00E-02 4.00E-02 5.00E-02 6.00E-02 7.00E-02
2oo3 7.50E-05 3.00E-04 6.75E-04 1.20E-03 1.88E-03 2.70E-03 3.68E-03

TEST INTERVAL (YEARS)

Assuming: Mean Time to Failure Dangerous = 100 years; Failure rate, , = 0.01/year

6
CCPS IPS Book
6

Module 10 – Design Decisions © SIS-TECH

[Link]

Fault Tolerance
• For safety
– Redundancy provided to protect against dangerous
failure
• For reliability
• Redundancy provided to protect against safe failure
– MooN voting
• N-M+1 = number of failures required for functional failure
• N-M = hardware fault tolerance

Common Fault Tolerant

Architectures

Module 10 – Design Decisions © SIS-TECH

[Link]

Effect of Fault Tolerance

Change Over an order of magnitude
1oo1 to 1oo2 reduction in PFDavg
1.0E+00

1oo2 = 1oo1^2

PROBABILITY OF FAILURE ON DEMAND (PFD)

1.0E-01

IL 1 1oo1
1.0E-02

IL 2
1oo2
1.0E-03

IL 3 Twice as likely to have

1.0E-04
spurious trip

1.0E-05
1 2 3 4 5 6 7
1oo1 5.00E-03 1.00E-02 1.50E-02 2.00E-02 2.50E-02 3.00E-02 3.50E-02
VOTING
M-out-of-N 1oo2 2.50E-05 1.00E-04 2.25E-04 4.00E-04 6.25E-04 9.00E-04 1.23E-03
2oo2 1.00E-02 2.00E-02 3.00E-02 4.00E-02 5.00E-02 6.00E-02 7.00E-02
2oo3 7.50E-05 3.00E-04 6.75E-04 1.20E-03 1.88E-03 2.70E-03 3.68E-03

TEST INTERVAL (YEARS)

1 of 4 CCPS IPS Book
Assuming: Mean Time to Failure
Dangerous = 100 years; Failure rate, , = 0.01/year
9

Effect of Fault Tolerance

Change
1.0E+00
1oo1 to 2oo2 Increase PFDavg by factor of 2
PROBABILITY OF FAILURE ON DEMAND (PF

1.0E-01 2oo2
IL 1 1oo1
1.0E-02

IL 2 Over order of magnitude

1.0E-03 reduction in spurious trip
IL 3
1.0E-04

1.0E-05
1 2 3 4 5 6 7

VOTING 1oo1 5.00E-03 1.00E-02 1.50E-02 2.00E-02 2.50E-02 3.00E-02 3.50E-02

M-out-of-N 1oo2 2.50E-05 1.00E-04 2.25E-04 4.00E-04 6.25E-04 9.00E-04 1.23E-03
2oo2 1.00E-02 2.00E-02 3.00E-02 4.00E-02 5.00E-02 6.00E-02 7.00E-02
2oo3 7.50E-05 3.00E-04 6.75E-04 1.20E-03 1.88E-03 2.70E-03 3.68E-03

TEST INTERVAL (YEARS)

2 of 4

Assuming: Mean Time to Failure Dangerous = 100 years; Failure rate, , = 0.01/year

CCPS IPS Book 10

10

Module 10 – Design Decisions © SIS-TECH

[Link]

Effect of Fault Tolerance

1.0E+00

Change
PROBABILITY OF FAILURE ON DEMAND (PF
2oo2 to 2oo3
1.0E-01

IL 1 2oo2 Over an order of magnitude

reduction in PFDavg
1.0E-02

IL 2
1.0E-03

IL 3 2oo3
1.0E-04 Spurious trip rate
increases by factor of 3
1.0E-05
1 2 3 4 5 6 7

VOTING 1oo1 5.00E-03 1.00E-02 1.50E-02 2.00E-02 2.50E-02 3.00E-02 3.50E-02

M-out-of-N 1oo2 2.50E-05 1.00E-04 2.25E-04 4.00E-04 6.25E-04 9.00E-04 1.23E-03
2oo2 1.00E-02 2.00E-02 3.00E-02 4.00E-02 5.00E-02 6.00E-02 7.00E-02
2oo3 7.50E-05 3.00E-04 6.75E-04 1.20E-03 1.88E-03 2.70E-03 3.68E-03

3 of 4 TEST INTERVAL (YEARS)

Assuming: Mean Time to Failure Dangerous = 100 years; Failure rate, , = 0.01/year
11
CCPS IPS Book
11

Effect of Fault Tolerance

1.0E+00
Change
1oo2 to 2oo3
PROBABILITY OF FAILURE ON DEMAND (PFD)

1.0E-01

IL 1
1.0E-02
Increase PFDavg by factor of 3
IL 2
1.0E-03
2oo3
IL 3 1oo2
1.0E-04
Over order of magnitude
reduction in spurious trip
1.0E-05
1 2 3 4 5 6 7
1oo1 5.00E-03 1.00E-02 1.50E-02 2.00E-02 2.50E-02 3.00E-02 3.50E-02
VOTING
M-out-of-N 1oo2 2.50E-05 1.00E-04 2.25E-04 4.00E-04 6.25E-04 9.00E-04 1.23E-03
2oo2 1.00E-02 2.00E-02 3.00E-02 4.00E-02 5.00E-02 6.00E-02 7.00E-02
2oo3 7.50E-05 3.00E-04 6.75E-04 1.20E-03 1.88E-03 2.70E-03 3.68E-03

TEST INTERVAL (YEARS)

4 of 4 Assuming: Mean Time to Failure Dangerous = 100 years; Failure rate, , = 0.01/year

CCPS IPS Book 12

12

Module 10 – Design Decisions © SIS-TECH

[Link]

Fault detection and response

• Detection
– By operator
– By diagnostics
– By proof test
• Response
– Repair should be completed within the mean
time to repair assumed in the design basis OR
– Management of Change action should be taken
• Compensating measures should be reviewed
as part of any MOC review

13

13

Diagnostics detect failures

• Identify failures and degraded conditions
– Complete – equipment is not operational
• For example, the internal diagnostics within the transmitter
has determined that the programmable electronics are not
functioning properly. The device can no longer operate as
required for the safety function
– Degraded Condition (Partial failure) - equipment is
still operational, but not within specification
• For example, the analog signal has deviated more than 5%
from the median. The device may still operate as required
for the safety function

14

14

Module 10 – Design Decisions © SIS-TECH

[Link]

Diagnostic Examples
• Field Device
– Out-of-range
– Drifting or stuck measurements,
– Wrong position, and
– Not in commanded state
– Analog signal comparison with deviation alarm
• General
– Line monitoring – especially in energize-to-trip SIF
• Logic solver
– Stuck-on/stuck off detection for inputs and outputs on a safety
configured logic solver
– Watch-dog timer for program execution

15

15

Managing faults - Response

• Response to on-line detected failures
– Automatically go to safer logic?
– How reported to operator?
• Changing logic on detected failure
– Degrading toward safer logic:
• Operator continues normal observation of the process and its
alarms
– Degrading toward less safe logic:
• Compensating measures implemented within process safety
time to ensure risk reduction is sustained

16

16

Module 10 – Design Decisions © SIS-TECH

[Link]

Action on Detected Failure

• Decision at design stage!
• Vote failures to trip
– Safe
– Adjust Spurious Trip Rate
calculation
• Alarm only on failure
– Response procedures with
compensating measures
– Time and manpower
available to respond
– Increases PFD

17

17

Fault Configuration
– 1oo1D
Vote away Voting single detected failure away
1.0E+00
from trip from trip disables the function
PROBABILITY OF FAILURE ON DEMAND (PF

= Ignore
1.0E-01

IL 1
1.0E-02
Vote to trip = shutdown
IL 2
1.0E-03 Voting single detected failure toward the
IL 3 trip causes a spurious trip
1.0E-04

1.0E-05
1 2 3 4 5 6 7

VOTING 1oo1 5.00E-03 1.00E-02 1.50E-02 2.00E-02 2.50E-02 3.00E-02 3.50E-02

M-out-of-N 1oo2 2.50E-05 1.00E-04 2.25E-04 4.00E-04 6.25E-04 9.00E-04 1.23E-03
2oo2 1.00E-02 2.00E-02 3.00E-02 4.00E-02 5.00E-02 6.00E-02 7.00E-02
2oo3 7.50E-05 3.00E-04 6.75E-04 1.20E-03 1.88E-03 2.70E-03 3.68E-03

TEST INTERVAL (YEARS)

Depending on D configuration, single

fault can disable 18

18

Module 10 – Design Decisions © SIS-TECH

[Link]

Fault Configuration – 2oo2D

1.0E+00

Voting single detected failure away

PROBABILITY OF FAILURE ON DEMAND (PF

Vote away
1.0E-01 from trip disables the function
from trip
IL 1
1.0E-02 Vote to trip
IL 2 Voting single detected failure toward the
1.0E-03 trip improves safety by factor of 2
IL 3
1.0E-04

1.0E-05
1 2 3 4 5 6 7

VOTING 1oo1 5.00E-03 1.00E-02 1.50E-02 2.00E-02 2.50E-02 3.00E-02 3.50E-02

M-out-of-N 1oo2 2.50E-05 1.00E-04 2.25E-04 4.00E-04 6.25E-04 9.00E-04 1.23E-03
2oo2 1.00E-02 2.00E-02 3.00E-02 4.00E-02 5.00E-02 6.00E-02 7.00E-02
2oo3 7.50E-05 3.00E-04 6.75E-04 1.20E-03 1.88E-03 2.70E-03 3.68E-03

TEST INTERVAL (YEARS)

Depending on D configuration, single fault

can disable
19

19

Fault Configuration – 1oo2D

Voting single detected failure away from trip
degrades PFDavg more than one order of
1.0E+00
magnitude.
PROBABILITY OF FAILURE ON DEMAND (PF

1.0E-01

IL 1
1.0E-02
Vote away from trip
IL 2
Vote to trip
1.0E-03

IL 3
1.0E-04
Voting single detected failure
1.0E-05
toward the trip causes a spurious
1
5.00E-03
2
1.00E-02
3
1.50E-02
trip
4
2.00E-02
5
2.50E-02
6
3.00E-02
7
3.50E-02
VOTING 1oo1
M-out-of-N 1oo2 2.50E-05 1.00E-04 2.25E-04 4.00E-04 6.25E-04 9.00E-04 1.23E-03
2oo2 1.00E-02 2.00E-02 3.00E-02 4.00E-02 5.00E-02 6.00E-02 7.00E-02
2oo3 7.50E-05 3.00E-04 6.75E-04 1.20E-03 1.88E-03 2.70E-03 3.68E-03

TEST INTERVAL (YEARS)

Regardless of D configuration, single fault

cannot disable
20

20

Module 10 – Design Decisions © SIS-TECH

[Link]

Fault Configuration – 2oo3D

Voting single detected
1.0E+00 failure away from trip
degrades PFDavg more than one order of

PROBABILITY OF FAILURE ON DEMAND (PF

magnitude. 1.0E-01
IL 1
1.0E-02

IL 2 Vote away from trip

1.0E-03
Vote to trip
IL 3
1.0E-04
Voting single detected failure toward the
trip improves safety by factor of 3.
1.0E-05
1 2 3 4 5 6 7

VOTING 1oo1 5.00E-03 1.00E-02 1.50E-02 2.00E-02 2.50E-02 3.00E-02 3.50E-02

M-out-of-N 1oo2 2.50E-05 1.00E-04 2.25E-04 4.00E-04 6.25E-04 9.00E-04 1.23E-03
2oo2 1.00E-02 2.00E-02 3.00E-02 4.00E-02 5.00E-02 6.00E-02 7.00E-02
2oo3 7.50E-05 3.00E-04 6.75E-04 1.20E-03 1.88E-03 2.70E-03 3.68E-03

TEST INTERVAL (YEARS)

Regardless of D configuration, single fault

cannot disable
21

21

Proof Test
• A test, or series of tests, performed to detect
failures in a protective system and includes
inspection and preventive maintenance activities
necessary to maintain the system in its “as good
as new” condition
• This periodic activity validates the device
operation for those functions covered by the
specific proof test

1 of 3 22

22

Module 10 – Design Decisions © SIS-TECH

[Link]

Factors affecting Test Interval

• Hazardous Event
– Initiating event frequency
– Required risk reduction
• Operating Environment – Application History
– External environment
• Temperature
• Humidity
• Vibration
• Electromagnetic Interference
– Internal environment
• Deposition or pluggage
• Corrosion

2 of 3 23

23

Factors affecting Test Interval

• Device requirements
– Known failure modes and rates
– Manufacturer recommendations
– User equipment manual
– Service life
• Consensus
– Regulations
– Standards
– Insurance practices
– Example – NFPA 85 requires annual test of fuel block valves

3 of 3 24

24

Module 10 – Design Decisions © SIS-TECH

[Link]

PFDavg is an Average
Process Demand

Multiple tests before expected process demand decreases risk

CCPS IPS Book 25

25

Effect of Proof Testing

TI
PFDavg  CCPS IPS Book
1.000E+00
2
Probability of Failure on Demand

1.000E-01

IL 1
1.000E-02

IL 2
1.000E-03
1 2 3 4 5 6 7
25 years 0.020 0.040 0.060 0.080 0.100 0.120 0.140
50 years 0.010 0.020 0.030 0.040 0.050 0.060 0.070
75 years 0.007 0.013 0.020 0.027 0.033 0.040 0.047
100 years 0.005 0.010 0.015 0.020 0.025 0.030 0.035
250 years 0.002 0.004 0.006 0.008 0.010 0.012 0.014
Testing Interval (Years)

26

26

Module 10 – Design Decisions © SIS-TECH

[Link]

Proof test opportunity

• Maintenance, inspection, testing, and repair
– Essential for safe and reliable operation
• Review the production schedule
• Define when equipment can be accessed
– Equipment cycles
– Cleaning periods
– Maintenance outages
– Short outages
– Major turnarounds

27

27

Trade-offs
• Costs
– Capital
– Operation, maintenance and testing
• Short proof test intervals
– Less complexity in design
• Longer proof test intervals generally require:
– Redundancy and diagnostics in design
– On-line test and maintenance capability

Remember: quality assurance depends on regular

feedback within the service life

28

28

Module 10 – Design Decisions © SIS-TECH

[Link]

Proof Tests
• Can be performed on-line or off-line
– Off-line
• Process is not operational
• Complete function test
– On-line
• Process is operational
• May be complete or partial test

29

29

Proof Test Plan

• Plan must cover SIS from sensor through final
element
– Device
– Segment
– Function

Sensing I/O Safety System I/O Final

Elements Hardware and Control
Logic Elements

Common
System
Aspects

30

30

Module 10 – Design Decisions © SIS-TECH

[Link]

Effect of Partial Testing

(Imperfect Testing)

CCPS IPS Book 31

31

Example:
Partial Stroke Testing of Block Valves
• Involves slight movement of the valve from the
full open position to detect problem with the
valve actuator
• Some equipment does not proof test the
solenoid used to actuate the valve, so it requires
a separate proof test procedure
• Some equipment cannot be repaired on-line, so
if there is a fault with the equipment, shutdown is
necessary
• See ISA TR96.05.01

32

32

Module 10 – Design Decisions © SIS-TECH

[Link]

On-line Testing
• Provided when proof tests must be performed at an
interval shorter than the scheduled process turnaround
interval
• Test facilities should be integral part of SIS design
– Should not cause any hazardous events
– Should not cause loss of process control
– Should not result in loss of indication of process variable
• Installation and facilities should permit on-line repair
and preventive maintenance
• Opportunity for spurious trip if performed improperly
• Often requires bypassing

33

33

Bypass
• Ability to bypass enables start-up, process
equipment maintenance, and on-line maintenance
reducing downtime and improving process reliability
• Ability to bypass also increases potential for
systematic errors (e.g., left in bypass) necessitating
more procedures, administrative control, and
security

Bypass switches or means shall be protected

to prevent unauthorized use (e.g., by key
locks or passwords in conjunction with
effective management controls)
-IEC 61511-1:2016 clause [Link]

1 of 5 34

34

Module 10 – Design Decisions © SIS-TECH

[Link]

Bypass (or Fault)

Configuration
1.0E+00
Vote away Vote away
Disabled
PROBABILITY OF FAILURE ON DEMAND (PF
from trip from trip
1.0E-01

IL 1
1.0E-02 Vote away
Vote away Degraded
IL 2 from trip*
from trip*
1.0E-03

IL 3
1.0E-04
*Assumes single channel fault

1.0E-05
If both channels are bypassed, Disabled
1 2 3 4 5 6 7

VOTING 1oo1 5.00E-03 1.00E-02 1.50E-02 2.00E-02 2.50E-02 3.00E-02 3.50E-02

M-out-of-N 1oo2 2.50E-05 1.00E-04 2.25E-04 4.00E-04 6.25E-04 9.00E-04 1.23E-03
2oo2 1.00E-02 2.00E-02 3.00E-02 4.00E-02 5.00E-02 6.00E-02 7.00E-02
2oo3 7.50E-05 3.00E-04 6.75E-04 1.20E-03 1.88E-03 2.70E-03 3.68E-03

TEST INTERVAL (YEARS)

2 of 5 35

35

Fault Configuration
2oo2D & 2oo3D
1.0E+00
PROBABILITY OF FAILURE ON DEMAND (PF

1.0E-01

Vote to trip Improves safety by factor of 2

IL 1
1.0E-02

IL 2
Improves safety by factor of 3
1.0E-03

IL 3 Vote to trip
1.0E-04

1.0E-05
1 2 3 4 5 6 7

VOTING 1oo1 5.00E-03 1.00E-02 1.50E-02 2.00E-02 2.50E-02 3.00E-02 3.50E-02

M-out-of-N 1oo2 2.50E-05 1.00E-04 2.25E-04 4.00E-04 6.25E-04 9.00E-04 1.23E-03
2oo2 1.00E-02 2.00E-02 3.00E-02 4.00E-02 5.00E-02 6.00E-02 7.00E-02
2oo3 7.50E-05 3.00E-04 6.75E-04 1.20E-03 1.88E-03 2.70E-03 3.68E-03

TEST INTERVAL (YEARS)

3 of 5 36

36

Module 10 – Design Decisions © SIS-TECH

[Link]

Bypass Controls
• Administrative controls and access security
provisions
– Permit system
• Approval from operations to access equipment
• Ensure compensating measures are in place prior to bypass
being put in place
– Bypass log
• Audit trail for operations
• Bypasses in place should match permit system approvals
and log

An SIF in bypass is 100% unavailable

4 of 5 37

37

Bypass Controls
– Bypass alarms and annunciation
• Audible and visible alarm when bypass is implemented
• Consider repeating alarm after each shift begins until bypass
is cleared
– Allowable repair period – Mean Time To Restoration
(MTTRes)
• Exceeding this period should trigger additional notification
and approvals
– Compensating measures
• Sufficient to maintain required risk reduction

An SIF in bypass is 100% unavailable

5 of 5 38

38

Module 10 – Design Decisions © SIS-TECH

[Link]

STERIGENICS

CSB Safety Videos 2005-2011, Ethylene Oxide Explosion at Sterigenics

39

39

Things to think about…

• Bypass allowed skip of gas wash
– Purpose of gas wash understood?
– Bypass approval given by supervisor
– How are you communicating purpose of safety steps and how
bypasses affect the operation of these steps?
• No indication of hazard
– If flammability is a safety concern, why is this not monitored?
• Ignition source was permanently connected – the
oxidizer
– Why no flame arrestor?

40

40

Module 10 – Design Decisions © SIS-TECH

[Link]

Common …
• Cause
– Concurrent failures of different devices, resulting from a single
event, where these failures are not consequences of each other –
IEC 61511 definition

• Mode
– Concurrent failures of different devices characterized by the
same failure mode (i.e., identical faults) – IEC 61511 definition
• Dependent
– failure whose probability cannot be expressed as the simple
product of the unconditional probabilities of the individual events
which caused it – IEC 61511 definition
• Concurrent
– Generally accepted that the failures occur simultaneously or
within a short time of each other

41

41

Sources of Common Cause Failure

• Component
– Wear-out Susceptibility
– Software error
– Poor quality control, standards, or inspection
– Aging
– Maintenance or test degradation
• System Specification
– Unknown hazard
– Sizing errors
– Data sharing

42

42

Module 10 – Design Decisions © SIS-TECH

[Link]

Sources of Common Cause Failure

• Personnel Interactions
– Installation, operation, maintenance, testing
– Management of Change
• Common energy sources
– Instrument air
– Hydraulics
– Electricity
• Environmental Stress
– Temperature, humidity, vibration, corrosion
– Fire, weather, explosion, radiation
– Process upset, solids collection, animals

43

43

Minimize Common Cause Failures

• Use redundancy in supplied utilities
– Electric power
– Instrument air
– Hydraulic system
• Thoroughly test user application software
• Operate devices within manufacturer’s environmental
specifications
• Eliminate common process taps for redundant devices
• Use erosion/corrosion/plugging resistant technologies
where applicable
• Protect devices that are sensitive to ambient extremes
• Heat trace impulse lines and monitor operation

44

44

Module 10 – Design Decisions © SIS-TECH

[Link]

Reducing CCF with Diversity

• Consider the potential impact to the risk reduction
due to the loss of any diagnostic comparison
– Use different process variables, such as temperature
and pressure, to sense the process deviation
– Achieving safe state through different means
– Use of different technologies for the same process
variable (e.g. radar level vs. DP level vs. float level)
• Do not use lower reliability components simply to
provide diversity
• Separate process connections and isolation
valves for redundant sensors where possible

45

45

Summary
• Device integrity limits the performance that can
be claimed for equipment
• Diagnostics detect and alarm faults in equipment
– compensating measures needed to make it safe
• Diagnostic coverage assumption should be
limited by:
– coverage of the diagnostic algorithm and
– the speed and effectiveness of personnel response

46

46

Module 10 – Design Decisions © SIS-TECH

[Link]

Summary
• A proof test is performed to detect failures that
cannot be detected by other means
• A proof test plan should be developed to define
how the system is tested from input to output
– Proof testing should be performed after any approved
change
• A common cause factor between 0.1% and 5%
can be used if data is chosen that represents the
device in its operating environment

47

47

Module 10 – Design Decisions © SIS-TECH