It gives application specific guidance on the use of standard products for the use in “safety instrumented” systems using the proven-in-use justification. The guidance allows the use of field devices to be selected based on proven in use for application up to SIL 3 and for standard off-the-shelf PLCs for applications up to SIL 2.

The first edition was issued at the beginning of 2003. Edition 2 will be published during 2016 and this chapter has been updated to include the main changes from edition 1. Unfortunately part 1 which was published in February 2016 contained many editorial mistakes. Some of these editorial mistakes may lead the reader to misinterpret the technical requirements. Example of these are:

At the time of writing, it is the authors' understanding that IEC will use a “Corrigendum” covering all the editorial mistakes that may give rise to a technical misunderstanding. The numerous other editorial mistakes will be corrected along with those given in this “Corrigendum” and the Part 1 will be reissued as either edition 2.1 or 3. In the context of this chapter the authors have used their understanding of the wording that the committee intended to be published.

The standard is in three parts:

Part 1 of the standard covers the life cycle including:

It is intended for the activities of SIS System Level Designers, Integrators, and Users in the process industry.

Component level product suppliers, such as field devices and logic solvers, are referred back to IEC 61508 as is everyone in the case of SIL 4.

Part 2 gives general guidance to the use of Part 1 on a paragraph-by-paragraph basis.

Part 3 gives more detailed guidance on targeting the Safety Integrity Levels and has a number of Appendixes covering both quantitative and qualitative methods.

Since the standard is only aiming at the integration level of the SIS, rather than the individual elements, the requirements for design and development of the SIS (covered by Parts 2 and 3 of IEC 61508) have been significantly simplified. Hardware design has been replaced by a top-level set of straightforward requirements, such as, “unless otherwise justified the system shall include a manual shutdown mechanism which bypasses the logic solver.” The software requirements are restricted to the applications software using either limited variability languages or fixed programs. Thus, the software requirement tables that are given in Part 3 of IEC 61508 have been expressed in textual terms using the requirements for SIL 3 but, in general, confined to the “HR” (i.e., highly recommended) items and using engineering judgment on the suitability at the applications level. For applications software using full variability languages the user is referred to IEC 61508.

The techniques and measures detailed within IEC 61511, and hence this chapter, are suitable for the development and modification of the E/E/PE system architecture and software using Limited Variability Languages up to SIL 3 rated safety functions. Unless specifically identified the same techniques and measures will be used for SILs 1, 2, and 3.

Where a project involves the development and modification of a system architecture and application software for SIL 4 or the use of full variability languages for applications software (or the development of a subsystem product), then IEC 61508 should be used.

An existing system designed and installed to some previous standard, prior to IEC 61511, shall be acceptable if it can be demonstrated that it is adequately safe.

Figure 8.1 shows the relationship between 61511 and 61508.

SR/15 describes both quantitative and risk matrix approaches to establishing target SILs but a very strong preference for the quantitative approach is stressed. It addresses the setting of maximum tolerable risk targets (fatality rates). The tolerable risk targets were shown in Chapter 2 of this book.

Cost per life saved and ALARP are also addressed.

In order to avoid some of the repetition present in 61508, the life-cycle activities are summarized into three chapters such as provide:

Detailed lists of headings are offered for such essential documents as the Safety Plan, the Safety Specification, the Safety Manual and the Functional Safety assessment.

Some specific design guidance is given for pressure and flow control, gas holder control, burner control, fire and gas detection and process shutdown systems.

There is a worked example of an assessment of a gas detection system.

SR/15 also includes a checklist schedule to aid conformity in the rigor of carrying out assessments based on Appendix 2 of this book. The term “Required” is used to replace the more cumbersome “Highly Recommended” of IEC 61508. The document has 107 pages.

This guide is applicable to process industries such as onshore and offshore oil and gas, non-nuclear power generation, chemicals and petrochemicals. Other process industries may choose to use the guidelines at their own discretion. It outlines general information for all users plus guidance on organizational responsibilities for end users, designers, suppliers (of systems and products), integrators, installers and maintainers. It does not provide checklists or detail on how to design, operate and maintain such systems.

Clause 3 provides an overview of IEC 61511-1, Clause 4 provides an overview of the legal aspects, Clause 5 focuses on issues that affect all users, and Clause 6 addresses activities of specific users covering the whole life cycle of the SIS. Technical detail and examples are given in the annexes.

An exception is the “grandfather” clause stating that ISA 84 does not need to be applied to plant which predated 2004.

The authors assume that ISA will adopt the 2nd Edition of IEC61511 in a similar way.

This is the result of a Norwegian law which states that any new standard, associated with safety, must IMPROVE on what is currently being achieved. Therefore the authors of OLF-070 assessed the current practices in the Norwegian sector and calculated the expected PFDs for each safety loop and determined which SIL band they fitted.

Whereas IEC 61508 and 61511 present a risk based approach to setting integrity targets OLF-070 differs in that it sets out a number of common instrumented safety functions with typical SIL levels assigned. One is then guided towards the design to the examples in the guidance and allocating the given SIL targets.

The aim of this approach is to minimize the amount of time and resource spent on SIL targeting, whilst maintaining a minimum standard for common instrumented functions. This would provide greater standardization across the industry.

This approach needs to be treated with care, however, as there are a number of assumptions incorporated in the “common” functions. All functions are assumed to be LOW DEMAND, and the requirements for a second layer of protection are assumed (e.g. Pressure Relief). All the assumptions in these “common” functions need to be verified against the actual design to ensure that nothing is missed.

Only where the safety function cannot be matched to one of the “common” functions in the guidance then a risk based approach following 61508 is then recommended.

It should also be noted that the guidelines give failure rate figures for systematic, as well as random hardware failures.

In general the guidance in respect of safety management, installation, commissioning, operation and maintenance is much the same as in IEC 61508.

In conclusion, although the OLF-070 guidelines much the same principles as IEC 61508/61511 the main difference is the initial determination of integrity levels. Whereas the IEC standard defines a risk based approach, the OLF-070 guideline attempts match the safety instrumented functions to “common” typical loops and assign a minimum integrity level. The disadvantage of this approach is that the demand rate, severity, and personnel exposure to the hazard are not taken into consideration in the assessment. The second main difference is the method of dealing with systematic failures. IEC-61508/61511 provides a number of procedural methods for dealing with systematic failures, with the level of rigor increasing with the SIL level applied. OLF-070 assigns a failure rate to the systematic failures which is added to the PFD to assess the overall Safety Integrity (PFD).

A typical example of a recommended loop design is shown in Figure 8.2.

The publication recognizes that there should be a balanced approach to risk management starting with adoption of inherently safer design principles, with elimination of hazards as the first priority. SIL targeting is usually determined by adopting a risk-based approach either quantitatively, qualitatively or a mixture of both. Guidance on safety integrity level (SIL) determination considers the required performance of the safety instrumented function (SIFs) to be implemented by protection systems to prevent specific hazardous events or to mitigate the consequence of those hazardous events. Whilst the main focus of the publication is safety and environmental risk, the guidance can also be applied to other risk drivers (e.g. as a basis for asset protection).

The scope of the publication is relevant to SIFs operating in any of the following modes of operation: low demand, high demand or continuous. It illustrates a number of methods available for ensuring that an appropriate SIL is selected for each SIF.