π Lesson 15
D5
SIL Determination Using LOPA & Fault Tree Analysis
SIL determination is figuring out how reliable a safety system must be to prevent a dangerous accident β like deciding if a blast warning system needs to work 99.9% or 99.99% of the time.
π― Learning Objectives
- β Apply LOPA methodology to identify independent protection layers and assign conditional modifiers
- β Construct a basic fault tree for a blast-related hazardous event (e.g., premature detonation) and calculate top-event frequency
- β Determine the required SIL for a SIF using LOPA results and IEC 61511 SIL targeting tables
- β Explain the relationship between PFD, PFH, and SIL targets with reference to IEC standards
- β Analyze common LOPA pitfalls (e.g., overcounting IPLs, incorrect enabling conditions) in mining SIS contexts
π Why This Matters
In open-pit and underground blasting operations, a single SIS failure β such as a misfired initiation signal or undetected misalignment in remote firing circuits β can lead to catastrophic consequences: flyrock injuries, structural damage, or uncontrolled ground vibration. SIL determination ensures that safety-critical functions (e.g., blast area perimeter interlocks, seismic lockouts, or emergency abort systems) are neither over-engineered (wasting cost and complexity) nor under-specified (leaving unacceptable risk). Itβs the bridge between hazard identification (like HAZOP) and hardware design β and itβs legally required under IEC 61511 and CCPS guidelines for all mining SIS deployments.
π Core Principles
SIL determination begins with identifying a specific hazardous scenario (e.g., 'unauthorized personnel entering blast zone during charging'). LOPA then estimates the initiating event frequency (e.g., 0.1/yr for gate bypass), applies consequence severity (C), likelihood (L), and existing Independent Protection Layers (IPLs) β such as physical barriers, procedural checks, or alarm-response actions β to determine residual risk. Each IPL must satisfy strict criteria: independence, reliability, auditable, and functional. Fault Tree Analysis (FTA) complements LOPA by modeling logical failure pathways (AND/OR gates) for complex SIF failures β especially when multiple component faults interact (e.g., dual-channel initiator failure + communication timeout). The required risk reduction factor (RRF = tolerable risk / estimated residual risk before SIF) maps directly to SIL: RRF β₯ 10 β SIL 1; β₯ 100 β SIL 2; β₯ 1000 β SIL 3; β₯ 10,000 β SIL 4.
π Risk Reduction Factor & SIL Targeting
The Risk Reduction Factor (RRF) quantifies how much a SIF must reduce risk to meet ALARP (As Low As Reasonably Practicable) criteria. It is calculated as the ratio of the estimated unmitigated frequency of the hazardous event to the tolerable frequency defined by corporate risk policy or regulatory thresholds (e.g., 1Eβ4 /yr for fatality). RRF directly determines minimum SIL per IEC 61511 Table A.2.
Risk Reduction Factor (RRF)
RRF = Ξ»_unmitigated / Ξ»_tolerableQuantifies required risk reduction by the SIF to achieve tolerable risk.
Variables:
| Symbol | Name | Unit | Description |
|---|---|---|---|
| Ξ»_unmitigated | Unmitigated event frequency | /year | Estimated frequency of hazardous event without SIF |
| Ξ»_tolerable | Tolerable event frequency | /year | Maximum acceptable frequency per risk policy or regulation |
Typical Ranges:
Fatal injury in surface mining: 1 Γ 10β»β΄ to 1 Γ 10β»β΅ /yr
Major environmental release: 1 Γ 10β»Β³ to 1 Γ 10β»β΄ /yr
π‘ Worked Example
Problem: A mineβs risk assessment identifies a hazardous event: 'Blast initiated while personnel remain in exclusion zone'. Estimated frequency without SIF = 2.5 Γ 10β»Β² /yr. Corporate tolerable risk threshold = 1 Γ 10β»β΄ /yr. Determine required SIL.
1.
Step 1: Identify unmitigated frequency (Ξ»_unmitigated) = 0.025 /yr
2.
Step 2: Identify tolerable frequency (Ξ»_tolerable) = 0.0001 /yr
3.
Step 3: Calculate RRF = Ξ»_unmitigated / Ξ»_tolerable = 0.025 / 0.0001 = 250
4.
Step 4: Refer to IEC 61511 Table A.2: RRF β₯ 100 but < 1000 β SIL 2
Answer:
The required SIL is SIL 2, corresponding to a target PFDavg of 0.01β0.001 (i.e., 99β99.9% probability of success on demand).
ποΈ Real-World Application
At Newmontβs Boddington Gold Mine (Western Australia), a LOPA was performed for the SIF controlling remote blast initiation via fiber-optic network. Initiating event: unauthorized local key switch activation (frequency = 0.05/yr). Existing IPLs included: (1) RFID-based personnel tracking (RRF = 10), (2) dual-operator console authentication (RRF = 20), and (3) audible/visual pre-blast warning (RRF = 5). Residual frequency = 0.05 / (10 Γ 20 Γ 5) = 5 Γ 10β»β΅ /yr. Tolerable frequency = 1 Γ 10β»β΄ /yr β RRF needed = 2. Since RRF < 10, no SIF was required β but FTA revealed common-cause failure in power supply affecting both authentication and RFID, leading to redesign with separate UPS feeds. Final SIF (SIL 1) was added only for network integrity monitoring.
π§ Interactive Calculator
π§ Open Process Safety & Risk Management Calculatorπ Case Connection
π Ammonia Refrigeration System PHA & LOPA Integration at Midwest Food Plant
Outdated PHA documentation; no SIL verification for emergency shutdown valves
π Nitric Acid Storage Tank MOC Failure Root Cause Analysis at Fertilizer Facility
Post-MOC leak occurred due to incompatible gasket material (EPDM vs. concentrated HNOβ)