Functional safety is not achieved by purchasing a safety PLC or specifying SIL-rated equipment. It is achieved by managing Safety Instrumented Functions through a lifecycle that begins with hazard identification and continues through design, installation, operation, maintenance, modification and decommissioning.
IEC 61511 provides the process-industry framework for this lifecycle. The standard is widely used for safety instrumented systems in oil and gas, chemicals, energy and other process facilities. Its central idea is straightforward: the required safety performance must be identified, specified, achieved, verified and maintained over time.
Why a lifecycle approach is necessary
A SIF can fail even when every individual component is high quality. Failure can arise from incorrect requirements, common-cause dependencies, poor application programming, inadequate proof testing, bypasses left in place, undocumented modifications or assumptions that no longer reflect the process.
A lifecycle approach addresses these issues by connecting technical design with management activities and independent assessment.
Stage 1: Hazard and risk assessment
The lifecycle begins with understanding the hazards. Studies such as HAZID and HAZOP identify scenarios that may require risk reduction.
Where instrumented protection is being considered, the scenario should be defined clearly enough to establish the initiating event, consequence, existing safeguards and tolerable risk target. LOPA is commonly used to determine whether additional risk reduction is required.
Stage 2: Allocation of safety functions
Risk reduction can be achieved through several layers, including inherently safer design, mechanical protection, process control, alarms, relief systems and instrumented functions. Functional safety should not automatically become the default solution to every hazard.
If part of the required risk reduction is allocated to a SIF, the target Safety Integrity Level is determined. Our guide to SIL assessment and classification explains this step.
Stage 3: Safety Requirements Specification
The SRS converts the risk-analysis outcome into an engineering specification. It should define the purpose of each SIF, trip setpoint, safe state, process safety time, voting, reset requirements, bypass philosophy, proof-test interval, environmental constraints and integrity target.
A strong Safety Requirements Specification is one of the most important lifecycle documents because design, testing and operations all depend on it.
Stage 4: SIS design and engineering
The Safety Instrumented System is designed to meet the SRS. This includes sensors, logic solver, final elements, power supplies, interfaces, communications and diagnostic features. Architecture, independence and common-cause vulnerabilities need to be considered.
The design should also address practical aspects such as maintainability, accessibility, environmental conditions, fault response and how operators interact with the function.
Stage 5: SIL verification
Verification demonstrates that the proposed SIF architecture can achieve the required integrity. For low-demand functions, this commonly includes calculation of average probability of failure on demand, or PFDavg.
Failure rates, diagnostic coverage, proof-test intervals, test effectiveness, common-cause factors and repair times can materially affect the result. See our guide to SIL verification and PFDavg.
Stage 6: Application programming
Logic associated with safety functions should be developed and managed under appropriate lifecycle controls. Requirements need to be traceable into code, testing should cover expected and abnormal conditions, and changes should be controlled.
The software lifecycle should also address configuration management, version control and separation between safety and non-safety functions where required.
Stage 7: Installation and commissioning
The installed SIF must match the approved design. Instrument ranges, valve fail positions, wiring, impulse lines, logic configuration and interfaces should be verified before the function is accepted.
Commissioning is also the point where temporary bypasses, overrides and construction modifications can create risk if they are not carefully managed.
Stage 8: Safety validation
Validation demonstrates that the complete SIF performs the required function in the installed plant. It is broader than checking individual instruments. The test should confirm the end-to-end response from process input through logic to final action, including setpoints, timing, voting and operator interfaces as applicable.
Validation should be performed against an approved plan and the SRS.
Stage 9: Operation and maintenance
Functional safety must be maintained after start-up. Proof testing, fault repair, demand monitoring, bypass control, management of overrides and competence all influence real performance.
A design calculated to meet SIL 2 may no longer achieve the intended risk reduction if proof tests are missed or test coverage is poorer than assumed. Our article on SIF proof testing and bypass management discusses this operational side.
Stage 10: Modification and management of change
Changes to process conditions, setpoints, sensors, logic, valves, test intervals or operating procedures can affect the SIF. Modification should therefore trigger an assessment of whether the SRS, SIL verification, validation or hazard analysis requires update.
Functional safety should be integrated with the facility Management of Change process rather than managed as a separate engineering database.
Stage 11: Decommissioning
Removing a SIF can create risk if the hazard still exists. Decommissioning should confirm that the safety function is no longer required or that equivalent risk reduction is provided elsewhere before equipment or logic is removed.
Functional Safety Assessment
Functional Safety Assessments provide independent confirmation that lifecycle activities have been completed appropriately before key decisions or transitions. The required timing and independence depend on the project and applicable framework.
See our guide to Functional Safety Assessment for the purpose and typical evidence reviewed.
Functional safety management
The lifecycle also depends on management systems: defined roles, competence, procedures, document control, verification planning and assessment. Technical calculations alone do not compensate for weak lifecycle governance.
For project organisations, early definition can reduce redesign later. XGEN’s discussion of engineering support from concept to delivery reflects the same principle: requirements that are made clear early are easier to carry through design and execution.
Functional safety support
Pro Engineers provides support across SIL assessment, SRS development, SIL verification, functional safety review and related process safety studies. We focus on maintaining a clear line from hazard scenario to requirement, design evidence and operating controls.
To discuss functional safety scope for a new project, brownfield modification or operating facility, contact Pro Engineers.