Reliability Allocation and Assessment of Safety-Instrumented Systems

Safety-instrumented systems (SISs) are technical systems that are used to protect humans, the environment, or assets from hazardous events. It is therefore important to ensure that these SISs are reliable. \citeauthor{61508} is an international standard that can be used to achieve this reliability for SISs in all industries. It is also used to develop sector-specific standards such as \citeauthor{61511} for the process industry. \citeauthor{61508} frames the activities needed to ensure reliable SISs in a safety life cycle. Requirements for design, installation, operation, maintenance, and so on is given in the safety life cycle. The methods and terminology presented in \citeauthor{61508} is clarified in this thesis. If the risk of a system is higher than what can be tolerated, the necessary risk reduction is defined as the difference between actual risk and tolerable risk. The tolerable risk is achieved by defining safety functions that reduce the risk. A safety-instrumented function (SIF) is a safety function performed by a SIS. When a SIF is defined, an integrity requirement is set. The integrity requirement is divided into four safety integrity levels (SILs). A SIL is a measure of how reliable the SIF is. The reliability of a SIF determines its ability to prevent an undesired hazard. This way, the integrity requirement can be translated into a reduction in risk for the system that the SIF protects. The process of defining SIFs and determining their integrity requirements to achieve tolerable risk is called SIL allocation. There are many ways to conduct SIL allocation. Some of these methods are examined and discussed in this thesis. An end-user of a SIS, for example an oil company, does usually not design their own SISs. They analyze the system where a risk reduction is necessary and specify functional requirements and integrity requirements for the SIS. These requirements are gathered in a safety requirements specification. The content of the safety requirement specification is presented and discussed in this thesis. One of the application areas of a SIS is in subsea installations. To reduce the cost of flowlines at the Kristin field, high integrity pressure protection systems are installed. The flowlines are rated to a lower pressure than the pressure at the wellhead of the subsea well. To be able to install these flowlines, a HIPPS is installed as an extra safety measure to block high pressure flow to enter the flowline if the control system fails. The high integrity pressure protection have to achieve a SIL3 rating, which is the second strictest SIL rating. To verify that the high integrity pressure protection at Kristin achieves a SIL3 rating, the average probability of failure on demand is calculated. This is a measure of the reliability of a SIS that operates in a low-demand mode according to \citeauthor{61508}. Low demand mode means that the SIF, on the average, is demanded less often than once per year. The calculations show that the SIL3 requirement is met if all tests suggested in the case was implemented. It is also worth mentioning that common cause failures represent a large proportion of unavailability of the SIF. Common cause failures arise due to dependencies between some of the elements of the SIS. To achieve a SIL3 rating, the SIS also has to fulfill requirements to robustness. These requirements are called the architectural constraints. As shown in this thesis, the high integrity pressure protection system also fulfills the SIL3 according to the architectural constraints. Assumptions and simplifications are made in the reliability assessments to enable the calculation of reliability measures such as the average probability of failure on demand. This introduces uncertainties in the calculations. The reliability data that is used will also constitute uncertainty. It is discussed in the thesis that \citeauthor{61508} maybe should introduce a framework for uncertainty assessments as the uncertainty in cases with small margins might be decisive