One critical defect in the SIL standards (and technical reports from ANSI/ISA 84 committees) to remember is they do NOT account for specific human errors of mis-calibration (especially critical for SIFs with multiple sensor) and or leaving in bypass. So, the PFD to use for the IPL is the PFD(avg) from the SIL verification calc PLUS the probability of the specific (not systematic) human errors mentioned above. The boundary of an IPL is more than just the hardware, which is all the SIL Verification calc covers. Once you include the probability of the specific human errors, you may have a PFD of .05 for a system you wish will have .01 or lower. In that case, you need to lower the probability of the human errors by compensating features or redesign; and then recalc the PFD after those features. After a lot of work, you may achieve a PFD for the SIF (full boundary IPL) of .01 or lower…. this is Very Tough to achieve, by the way. For a paper on this issue, please download the following free paper by me (at PII) and Hal Thomas (at exida).
http://piii.com/_downloads/Accounting_for_Human_Error_Probability_in_SIL_Verification_website.pdf
Bottomline: For 99% of the SIL verifications we have checked, the PFD of the SIF IPL is not even close to the “PFD” calculated from the SIL Verification calculation, if the SIL target is SIL 2 or 3 (for SIL 1 they are close). It is nearly impossible to achieve a PFD = to or less than 0.001, if the boundary of the IPL is taken as intended in LOPA. This is the finding of me and Art Dowell (the two co-inventors of LOPA and the primary authors of the LOPA book) and many others with similar experience in LOPA and establishing true IPLs.
