After the hazard analysis, each required risk reduction is allocated to protection layers: inherent design, the basic control system, alarms with operator response, the SIS, mechanical devices (relief valves, check valves) and mitigation (detection, deluge, bunds).
Principles
- Prefer inherent safety and passive protection where practical.
- Allocate to the layer that can deliver the integrity reliably and independently.
- A control system function claimed as a protection layer has a limited credit (a risk reduction factor of no more than 10 under the process standard) and must be independent of the initiating cause.
- Functions needing more than that belong in the SIS.
Typical allocation
| Risk reduction needed | Typical layer |
|---|---|
| Up to 10 | Control system function or alarm with operator response (if independent) |
| 10 to 100 | SIL 1 SIF, or a mechanical IPL |
| 100 to 1,000 | SIL 2 SIF, or SIL 1 plus another IPL |
| 1,000 to 10,000 | SIL 3 SIF, or a combination of independent layers |
Record it
The allocation and its reasons belong in the hazard analysis records and the SIF list, so later changes can be checked against them.
Written for First Out AI as engineering guidance. It supports engineering work and does not replace it; check every value against your standards, certificates and company rules with a competent functional safety engineer.