SIS Glossary

FMEAs are done on the Equipment level (when the Equipment is being defined, i.e., when a Master Equipment is connected to the Equipment).

By default, for each Equipment, three Failure Modes (FMs) are defined and analyzed:

• FMC: Failures common to identical devices.
• FMCC: Failures common to diverse devices within the same Equipment family (e.g., pneumatic, and electronic smart pressure transmitters are both “pressure sensing devices”).
• FMO: Other failures not covered by any of the other specified failure modes.

For each FM, the Equipment’s overall random failure rate λ is split into a safe (λ_s) and dangerous failure rate (λ_d). Safe failures are failures that may result in a too early or immediate but inadvertent acting of the SIF. These failures are also known as “spurious” failures. Dangerous failures are failures that result in a too late or no acting of the SIF. These failures are also known as “unrevealed or dormant” failures.

Coverage factors (“L” and “H”) are defined for each of the Equipment’s defined Tests (e.g., “Full Functional Test” or “Overhaul Test”), per FM. When a Diagnostic in combination with a Response on Failure is added to a FM the maximum safe and dangerous Diagnostic Coverage Factors (DCFs) are determined.

Each Subsystem has a Fault Tolerance. This depends on the Equipment design, as well as the integrity requirements and the Success Criteria.

The Fault Tolerance and implementation check considers:

• Base fault tolerance - Based on integrity requirement, i.e., the SIL, as defined in the Ruleset. E.g., for SIL 2 the Base fault tolerance = 1 (based on the “IEC-61511 acc to Shell” Ruleset).
• Fault tolerance modifier - the maximum of the modifiers (fail save, prior use, write protect) – defined on the Equipment Details page
• Inherent fault tolerance - defined on the Equipment Details page
• Fault tolerance required – the sum of above > 0
• Equipment type allowance - is the Equipment type allowed
• Energize to trip (ETT) allowance - Based on integrity requirement, i.e., the SIL, as defined in the Ruleset. E.g., “IEC-61511 acc to Shell” Ruleset states that below SIL 2, ETT is ok.

It is possible that different Causes can have the same Consequence. In this case you can create a copy of the first Consequence and then link the Consequences (manually). The Consequence's child objects (Existing safeguards and Recommendations) will then automatically be replicated and linked as well (even when you create a new child object, it will also be replicated and linked). 

When objects are linked, they will always be synced, with one exception: On the Existing safeguard the Validation section remains unlinked. This way it is possible to indicate that an Existing safeguard is "Not Valid" for a specific Cause-Consequence combination.

When a LOPA is connected to a Consequence, it will thus also automatically be connected to all linked Consequences and their associated Causes. All the associated Causes will be copied to the LOPA as Initiating Events.

(Nodes, Deviations and Causes cannot be linked.)

The SIF Analysis Performance check in IMS considers two criteria:

• Sensor Accuracy
• Tight Shut-Off (TSO) for valves

The Success Criteria is defined in terms of the Equipment-Actors. 

You can define Success Criteria for each Subsystem for achieving the safety mission. E.g., for a 1oo2 sensor Subsystem, the Success Criterion would be “sensor A OR sensor B should work to achieve the safety mission.”

IMS SIS has 2 layers of Success Criteria: 

• High level Success Criteria, per Subsystem type
• Lower level Success Criteria, per Subsystem

This is the moment when control over the hazard is lost. It is usually what we consider to be an unsafe state that is not yet an accident. Therefore, Top events, while not being disasters themselves, have the potential to become one if nothing is done to control them. See the figure below.

IMS SIS has the following default Top events for defining Consequence in the HAZOP: Damage, Exposure, Human error, Loss of Containment, Loss of Control, and Loss of Primary Containment. For some the Hazard(s) must also be specified, e.g., Loss of Containment. In Settings\Maintenance\SIS Specific data\HAZOP\Top event the SIS ADMIN can list your site’s Top events and define which require a Hazard.