Functional Safety 2016

Page

This shows that BS EN 61511, and by implication it’s concepts, is for end users and not for

manufacturers. The issues raised by the Specialist Inspector relate to the site / operating

environment specific to the terminal operator.

The HSE provides guidance on ‘Demonstrating prior use of elements of a safety instrumented

function in support of BS EN 61511’ (CDOIF, 2012). This reinforces that in the case of field equipment

the demonstration (of Prior Use) is achieved by confirming extensive operating experience in an

equivalent (or near equivalent) process related system, which may or may not be safety related.

It is difficult to understand how the radar level transmitter manufacturer can take into account the

individual site / operating environment required to develop the Prior Use claim. The most important

factor in the ‘Prior Use’ route is the similar operating profiles and physical environments. If the end

user finds that the sensor is not working due to process induced factors such as fouling, sticking or

drifting out of calibration then realistically they will just clean, lubricate, reset or calibrate the

sensor, they will not report the issue back to the manufacturer. Further discussion of the issues

regarding certification and prior use claims can be found in a number of sources, for example

Dearden, 2016.

It is understandable and correct of the Specialist Inspector to reject the BS EN 61511 based claim

made by the manufacturer and certification body.

It is also disappointing that certification bodies issue SIL certificates for manufacturer’s products

quoting the BS EN 61511 based ‘Prior Use’ requirements. The end user and their design contractor

believed that they were buying a SIL 2 ‘certified’ transmitter based upon the certificate and report.

Would BS EN 61511 Ed 2 change the assessment?

In February 2016, Edition 2 of IEC 61511 Part 1 (IEC, 2016a) was released, although BS EN 61511 Ed 2

is not yet available. The supporting Part 2 of IEC 61511 Ed 2 (IEC, 2016b) has recently been released

in July 2016.

There are many changes in Edition 2, but we will concentrate on those that relate to the Specialist

Inspector’s decision to reject the SIL 2 certificate.

The two tables relating to HFT in BS EN 61511 Ed1 have been replaced by a single table in IEC 61511

Ed 2, reproduced below.

SIL

Minimum required HFT

1 (any mode)

2 (low demand mode)

2 (continuous mode)

3 (high demand or continuous mode)

4 (any mode)

Figure 7 – IEC 61511-1 Ed 2 Table 3 – Minimum HFT requirements according to SIL

At first inspection, a number of changes are apparent: -

SFF (the old Table 5) is no longer considered

Both low demand and continuous demand modes are explicitly detailed

Possibly a typo for SIL 3 which does not consider low demand – this was labelled as

‘any mode’ in the previous FDIS version

HFT requirements have been reduced; SIL 2 in low demand mode now requires HFT 0