Functional Safety 2016

Challenge for SIL assessment - frequency

• Frequency will depend on number of opportunities and operator error rate

• Clear definition of sequence of events which initiate the hazard essential

• What is the correct Operating Procedure? (not yet developed)

• Restart from different valve positions – e.g. which valves are closed in PSD or

ESD logic…. Requires C&E logic which may be subject to change

It’s important to later verify that the Operating Procedures written match the

assumptions made in the SIL assessment.

Very much the same questions for the multiple Cargo pump cases…