🎓 Lesson 18
D5
ISA-84 SIL Verification for SCADA-Controlled SIFs
SIL verification is checking whether a safety system—like a SCADA-controlled emergency shutdown—works reliably enough to prevent dangerous incidents.
🎯 Learning Objectives
- ✓ Calculate PFDavg for a SCADA-integrated SIF using fault tree analysis and component failure rate data
- ✓ Apply architectural constraints (e.g., redundancy, proof test coverage) to determine achievable SIL per ISA-84 Table A.2
- ✓ Analyze and justify SIL assignment against Layer of Protection Analysis (LOPA) results for a mining overpressure SIF
- ✓ Explain how SCADA limitations (e.g., non-safety-certified controllers, communication latency) impact SIF integrity and SIL claims
📖 Why This Matters
In open-pit and underground mines, SCADA systems often monitor critical parameters like conveyor belt temperature, ventilation airflow, or slurry pipeline pressure—and trigger automated shutdowns when hazardous conditions arise. But if the SCADA-based shutdown function fails silently during an emergency, lives and infrastructure are at risk. SIL verification ensures that these automated safety actions are *proven reliable*, not just assumed safe. Regulatory bodies (e.g., MSHA, Australian WHS Regulators) increasingly require documented SIL verification for any SIF integrated into plant-wide control systems—especially where legacy SCADA platforms are repurposed for safety-critical roles.
📘 Core Principles
SIL verification rests on three pillars: (1) Quantitative reliability modeling—using PFDavg (for low-demand SIFs) or PFH (for continuous-demand SIFs); (2) Architectural validation—ensuring hardware fault tolerance (e.g., 1oo2 vs. 2oo3 voting) and diagnostic coverage meet SIL requirements per ISA-84 Annex A; and (3) Systematic capability assessment—verifying that development processes, documentation, and proof testing comply with IEC 61511 lifecycle requirements. For SCADA-controlled SIFs, special attention is required because standard SCADA components (PLCs, HMIs, network switches) are rarely certified for functional safety—so verification must either restrict their use to non-safety functions, apply rigorous justification for 'non-certified but qualified' use, or integrate certified safety modules (e.g., SIL-rated I/O or safety PLCs) within the SCADA architecture.
📐 PFDavg Calculation for Low-Demand SIF
For most mining SIFs (e.g., emergency shutdown on gas detection), demand frequency is <1/year, so PFDavg is the appropriate metric. It combines hardware failure rates, proof test interval (TI), and diagnostic coverage (DC). The simplified formula assumes constant failure rates and perfect proof testing of detected failures.
💡 Worked Example
Problem: A SCADA-linked pressure relief SIF uses a single SIL-2-certified pressure transmitter (λDU = 1.2 × 10⁻⁶ /hr, λDD = 0.8 × 10⁻⁶ /hr), a non-certified SCADA controller (treated as λDU = 4.5 × 10⁻⁶ /hr, DC = 0% due to lack of self-diagnostics), and a certified SIL-2 solenoid valve (λDU = 0.9 × 10⁻⁶ /hr). Proof tests occur every 6 months (TI = 4380 hr). Assume β = 0.05 (common cause factor). Calculate PFDavg.
1.
Step 1: Aggregate DU failure rates: λDU_total = 1.2 + 4.5 + 0.9 = 6.6 × 10⁻⁶ /hr
2.
Step 2: Apply beta factor for common cause: λDU_ccf = β × λDU_total = 0.05 × 6.6 × 10⁻⁶ = 3.3 × 10⁻⁷ /hr
3.
Step 3: Compute PFDavg ≈ (λDU_total × TI)/2 + λDU_ccf × TI = (6.6e-6 × 4380)/2 + (3.3e-7 × 4380) = 0.0144 + 0.0014 = 0.0158
4.
Step 4: Compare to SIL targets: SIL 2 requires PFDavg ∈ [10⁻³, 10⁻²] → 0.0158 = 1.58 × 10⁻² → marginally exceeds upper bound (fails SIL 2); redesign needed.
Answer:
The result is 0.0158 (1.58 × 10⁻²), which exceeds the SIL 2 upper limit of 1.0 × 10⁻². To achieve SIL 2, increase diagnostic coverage, reduce TI, or add redundancy (e.g., 1oo2 transmitter voting).
🏗️ Real-World Application
At the Cadia East gold mine (NSW, Australia), a SCADA-controlled SIF was implemented to shut down high-pressure slurry pumps if pipeline pressure exceeded 12 MPa. The original design used a single transmitter and non-certified SCADA logic solver. LOPA assigned SIL 2. SIL verification revealed PFDavg = 2.1 × 10⁻² — failing SIL 2. Engineers redesigned the SIF by adding a certified safety relay (exida SIL 2 rated) between SCADA and final element, implementing dual transmitters with 1oo2 logic, and introducing quarterly partial stroke testing. Recalculation yielded PFDavg = 4.7 × 10⁻³ — meeting SIL 2. Documentation was audited and accepted by NSW Resources Regulator under the Work Health and Safety Regulation 2017.