Functional Safety Engineer

FUNCTIONAL SAFETY ENGINEER

CERTIFICATION COURSE
Exercise Solutions

The following slides are arranged by practical number

and consist of question items followed by answer items.

Copyright ProSalus Ltd 2011 1

Functional Safety Engineer

Practical exercise no: 1

Fault trees
This practical exercise requires attendees to construct a
fault tree diagram using the basic principles introduced in
module 3.

It uses an example of a simple reactor with automatically

controlled feeds that has the potential to cause a serious
risk to plant personnel. Once the basic fault tree has
been drawn, the model is to be adjusted to incorporate a
safety-instrumented system and to demonstrate the
resulting risk reduction.

The process is a reactor with a continuous feed of fuel and

oxidant. Two flow control loops are operated under a ratio
controller set by the operator to provide matching flows of fuel
and oxidant to the reactor.
An explosive mixture can occur within the reactor if the fuel
flow becomes too high relative to the oxidant flow.
Possible causes are: Failures of the BPCS or an Operator
error in manipulating the controls leading to sudden loss of
oxidant feed.
A SIS is proposed with a separate set of flow meters
connected to a flow ratio measuring function that is designed
to trip the process to safe condition if the fuel flow exceeds
the oxidant flow by a significant amount
The tag number for this SIF is FFSH- 03

Copyright ProSalus Ltd 2011 2

Functional Safety Engineer

Vertical or horizontal.

AND gate: P1 x P2
P1x F1, F1 x P2 etc
Note: F1 x F2 is not valid
unless periods are known.

OR gate: P1 + P2
F1 +F2

Copyright ProSalus Ltd 2011 3

Functional Safety Engineer

Fault tree for basic

hazard Explosion

Ignition Ex. mix

Fuel feed too high Oxidant feed too low

FT-1 fails low FC-1 fails high FT-2 fails high FC-2 fails low Oxidant fan fails

Copyright ProSalus Ltd 2011 4

Functional Safety Engineer

Explosion
Fault tree for risk
reduction using SIS

Ignition Ex. mix

High Fuel Flow

Fuel feed too high Oxidant feed too low Ratio Trip Fails

FT-1 fails low FC-1 fails high FT-2 fails high FC-2 fails low Oxidant fan fails

Copyright ProSalus Ltd 2011 5

Functional Safety Engineer

Exercise No: 2 – SIL Verification

Task 1 Calculate the single channel PFDavg and spurious trip rate for the high
temperature trip example. Draw a single channel reliability block diagram and
calculate using the failure rates in the table the PFDavg and the spurious trip rate
for each sub system and the overall system using a proof testing interval of 6
months.
Assume the system uses 2 relays, 1 relay in the sensor subsystem and 1 relay in
the logic solver subsystem, The trip actuation uses a solenoid valve and to vent
the air cylinder on a valve that will drive open and release quench water into the
reactor.
Task 2: Recalculate the PFDavg and spurious trip rate for the SIF using the
second diagram showing 3 high temperature transmitters on a reactor configured
2oo3 on the basis of proof testing every 6 months, Beta Factor 10% and MTTR of
24 hours.
The 3 temperature transmitters each transmit to a trip amplifier device that acts as
a high temperature trip device leading to a single channel actuation as in task 1

Table of fault rates for the Devices

3/4/11

Copyright ProSalus Ltd 2011 6

Functional Safety Engineer

Drench Tank
1oo1 Relay trip
TSH

Single Channel
High temperature
Trip TT

TE

Reactor

Sensor Logic Actuator

PFD = .088 PFD = .0005 PFD =.03

Proof Test Practical 6: Step 1
Interval = 0.5 yr
Single Channel: PFD = 0.118

Copyright ProSalus Ltd 2011 7

Functional Safety Engineer

Drench Tank
2oo3 Relay trip
TSH TSH TSH

TT TT 2oo3 Input Voting

High temperature
TE TE Trip

TT TE

Reactor

Practical 2: Step 2,
calculate new values for λs and λd when sensors
are changed to 2oo3
Sensor Common
Cause Factor = 10%

Sensor

Sensor
Sensor Logic Actuator
Common

Sensor

Copyright ProSalus Ltd 2011 8

Functional Safety Engineer

Practical 2: Step 3, calculate new PFD values

Sensor

Sensor
Sensor Logic Actuator
Common

Sensor
Proof Test Interval = Ti = 0.5 yr

PFD = 0.031 PFD = .0088 PFD = .0005 PFD =.03

Overall PFD = 0.07

Practical 2: Step 3. New Spurious Trip Rate

for 2oo3 section

Sensor

Sensor
Sensor Logic Actuator
Common

Sensor

Let MTTR = 24hrs = 24/8760 yrs = 0.0027yr

Copyright ProSalus Ltd 2011 9

Functional Safety Engineer

Practical 2: Step 4. New Spurious Trip Rate

for overall loop

Sensor

Sensor
Sensor Logic Actuator
Common

Sensor

Practical 2: Step 5
Compare Results

Sensor Logic Actuator

Single Channel: PFD = 0.118

Sensor

Sensor
Sensor Logic Actuator
Common

Sensor
Overall PFD = 0.07

Copyright ProSalus Ltd 2011 10

Functional Safety Engineer

Exercise No: 3 - Determination of SIL by Risk Graph

This practical exercise requires participants to determine the required SIL of a
proposed safety-instrumented system using the basic principles and risk graphs
and calibration parameters for safety, environment and asset loss described in this
module
The process is a reactor with a continuous feed of fuel and oxidant. Two flow
control loops are operated under a ratio controller set by the operator to provide
matching flows of fuel and oxidant to the reactor. An explosive mixture can occur
within the reactor if the fuel flow becomes too high relative to the oxidant flow.
Possible causes are: Failures of the BPCS or an Operator error in manipulating
the controls leading to sudden loss of oxidant feed.
A SIS is proposed with a separate set of flow meters connected to a flow ratio
measuring function that is designed to trip the process to safe condition if the fuel
flow exceeds the oxidant flow by a significant amount
The tag number for this function is FFSH- 03

Assume that the following information has been decided for the reactor.
The total frequency of the events leading to an explosive mixture is
approximately once every ten years.
The consequence of the explosion has been determined to be a vessel
rupture causing death or serious injury to 1 person
The occupancy in the exposed area is less than 10% of the time and is not
related to the condition of the process.
The onset of the event is likely to be to be fast with a worst-case time of
10 minutes between loss of oxidant and the possible explosion.
The material released from an explosion is not harmful to the
environment.
The reactor will cost in excess of £250, 000 to replace.
Determine the target SIL, EIL and AIL
Determine the overall target integrity for the SIF

Copyright ProSalus Ltd 2011 11

Functional Safety Engineer

Copyright ProSalus Ltd 2011 12

Functional Safety Engineer

IEC 61511 Risk parameters chart (part 3 Annex D)

EIL = a / AIL = a
Risk Parameters: W3 W2 W1

C – Consequence a - -
CA
CA: PA
CB: 1 a -
CB PB
the chance of death is 1
CC:
CD: per event (Range >0.1 to Starting P 2 1 a
1.0) = Cc point
FA PA
CC B
F –Occupancy
PA
3 2 1
FA: occupancy is less than 0.1 = FA
FB: CD PB
4 3 2
P – Hazard avoidance probability PA
PA:
PB:
the explosion has a rapid onset (< 10
minutes) (Range >0.1 to < 1.0) = PB
PB b 4 3
W – Demand rate in the absence of - = No safety requirements
the SIF under consideration a = No special safety requirements
W1: b = A single E/E/PES is not sufficient
W2: demand rate is estimated at 0.1/yr Gives W2 1,2,3,4 = Safety integrity level
W3:

Copyright ProSalus Ltd 2011 13

Functional Safety Engineer

Exercise No: 4 - Determination of SIL by LOPA

This practical exercise requires participants to determine the
required SIL of a proposed SIS using the basic principles and
LOPA parameters described in this module
Liquid is transferred manually to a holding tank before delivery to
the plant, the operator must stop the pump at 75% Tank Level.
A Tank Over pressurisation hazard has been identified by the
HAZOP team, two causes have been identified:
• Operator fails to stop pump : 0.1 per year
• Level Control Failure: 0.1 per year
Determine the required target SIL for personnel safety of the High
Pressure Vent SIF to Flare
ProSalus Limited

Exercise No: 4 - Determination of SIL by LOPA

The tolerable risk for the hazard is 1.0E-05

The Holding tank has a relief valve installed which is sized for full
flow and vented to Flare
The process design is not considered to be fit for purpose

ProSalus Limited

Copyright ProSalus Ltd 2011 14

Functional Safety Engineer

Flare

liquid
PZH

LICA

Operator Stops
Pump at required
level
P 101

ProSalus Limited

LOPA Worksheet

ProSalus Limited

Copyright ProSalus Ltd 2011 15

Functional Safety Engineer

Copyright ProSalus Ltd 2011 16