fredag den 16. oktober 2009

Safety Integrity Levels (SIL)


The SIL concept is a way of categorizing safety functions into five discrete levels: SIL0 - SIL4. The SIL determination follows a complex, although systematic, process as shown below (Figure A.5 from EN 50129).

However, for many purposes the quantitative SIL value can be substituted with a more straightforward qualitative approach when categorizing safety functions. For example:
Safety critical functions kind of compare to SIL3/4 (as e.g. the emergency brake in a train or the logic in an interlocking system.)
Safety related functions kind of compare to SIL 1/2 (as e.g. emergency announcement speakers in a train or warning lamps for track crossing)


Interpretation

At high SIL, the heaviest measures to avoid random, systematic errors and common cause failures have to be used at all phases in the V-model.

The SIL determination often ends up in complicated mathematical discussions among risk analytics (e.g. is the human failure rate 1e-3 or 2e-4 [pr. action]).

These types of discussions narrow the number of persons, who participates in the safety discussions; which again might decreases the safety awareness among the other staff groups: Implementation engineers, maintenance staff, train drivers and sub suppliers as an unfortunate side effect.

In an operating organization, with many small projects and a few major projects, it can therefore be advantageously to simplify the categorization of the safety functions into the above described categories e.g. "Safety related" and "Safety critical".

Such a concept is easier to communicate to the staff groups and integrate into the used procedures and documents.

Note 1; the used categorization method should be described in the Safety plan and agreed upon by the Safety Authority.

Note 2; for product developers and suppliers it will most likely be necessary to make quantitative risk calculations and common cause analysis, see examples in e.g. TR 50451:2007.

Next chapter >> 5.1 What is the task of the Assessor?

Focus on the Source

The SIL levels are explained in EN 50129 in the normative Annex A, "Safety Integrity Level".
Related concepts like Systematic and random failures, Tolerable Hazard rates (THR), Common cause Failures (CCF), process independence and safety targets are also explained.

Annex B of EN 50129 explains about Detailed technical requirements to e.g. redundancy and CCF.

Annex C of EN 50129 explains about Identification of hardware component failure modes.

TR 50451:2007, "Railway applications. Systematic allocation of safety integrity requirements" explains how to calculate the needed SIL of a new product.

3 kommentarer:

Daryl Mather sagde ...

Excellent blog on SIL and instrumentation safety. I have added the RSS feed to our group on LinkedIn Safety Instrumented Systems.

http://www.linkedin.com/groupRegistration?gid=2060050

You would be welcome to join, keep up the good posts.

Fulvio sagde ...

Hi,
I think that the SIL concept has not been properly adopted by the CENELEC standard. The IEC 61508 has a different approach for the SIL definition that allows an easier comprehension. The IEC 61508 set 2 parameters for the SIL assignment:
1)The fault tolerance (related to system architecture)
2)The safe failure fraction (related to the statistics approach).
The EN 50129 generates the wrong idea (by the A.1 Table) that there is a direct equivalence between the THR and SIL. The CLC/TR 50451 is useful to understand that SIL level depends also by the system architecture. Another important problem related with this big misunderstanding is the definition of who is in charge of SIL definition and when you have to define it. The SIL definition is possible only during the system requirement apportionment, so subsystem developers are in charge of SIL definition. I think that is important to underline that a safety system requirement is not possible to describe by SIL level (with some exception).

Troels Winther sagde ...

SIL is applied to functions. If you need a function that e.g. measures the current through a point motor at a main line, then the technical solution that measures the current, most likely have to be designed according to a high SIL