{"id":3733,"date":"2014-07-25T12:34:25","date_gmt":"2014-07-25T17:34:25","guid":{"rendered":"http:\/\/www.livingreliability.com\/en\/?p=3733"},"modified":"2025-11-06T05:35:51","modified_gmt":"2025-11-06T10:35:51","slug":"safety-instrumented-systems","status":"publish","type":"post","link":"https:\/\/www.livingreliability.com\/en\/posts\/safety-instrumented-systems\/","title":{"rendered":"Safety Instrumented Systems"},"content":{"rendered":"

Safety in a plant is provided by layers of protection. The diagram from Emerson SIS Course<\/em>[1<\/a>]<\/sup> shows the Safety Instrumented System (SIS) as the “safety layer” providing the final\u00a0preventive\u00a0layer\u00a0before the mitigation layers must engage.<\/em><\/p>\n

\"Emerson<\/a>
Figure 1. Emerson SIS Course 1: Depiction of Layers of Protection<\/figcaption><\/figure>\n

Typically, safety instrumented systems (commonly known as Emergency Shutdown (ESD), Emergency Venting (ESV)\u00a0or Safety Interlock Systems) consist of the three elements of Figure 2:<\/p>\n

\"EmersonSisCourse1_Components<\/a>
Figure 2. Emerson SIS Course 1: Components Of Safety Instrumented System<\/figcaption><\/figure>\n

The SIS must be\u00a0completely independent of the process control system. Its\u00a0sensors are dedicated to SIS service and have process taps which are separate and distinct from the process taps used by normal process control information sensors.\u00a0\u00a0Highly reliable logic solvers execute programmed actions in response to sensor signals to prevent a hazard. The\u00a0logic solvers must provide both fail-safe and fault-tolerant operation.<\/p>\n

IEC\u00a0Standard 61508 (Functional Safety of Electric, Electronic and Programmable Electronic Systems) is a general\u00a0standard that covers functional safety related to all kinds of processing and manufacturing plants. IEC Standard 61511\u00a0and ISA S84.01 (Replaced by ISA 84.00.01-2004) are standards specific to the process industries. These standards\u00a0specify precise levels of safety and quantifiable proof of compliance.<\/p>\n

IEC\u00a0standards specify four possible Safety Integrity Levels (SIL1, SIL2, SIL3, SIL4); however, ISA S84.01 only recognizes\u00a0up to SIL3 levels.<\/p>\n\n\n\n\n\n\n\n
SAFETY INTEGRITY LEVEL (SIL)<\/strong><\/td>\nREQUIRED SAFETY AVAILABILITY (RSA)<\/strong><\/td>\nAVERAGE PROBABILITY OF FAILURE ON DEMAND (PFD) =1-RSA<\/strong><\/td>\n<\/tr>\n
1<\/td>\n90 \u221299%<\/td>\n0.1 to 0.01<\/td>\n<\/tr>\n
2<\/td>\n99 \u221299.9%<\/td>\n0.01 to 0.001<\/td>\n<\/tr>\n
3<\/td>\n99.9 \u221299.99%<\/td>\n0.001 to 0.0001<\/td>\n<\/tr>\n
4<\/td>\n99.99% \u221299.999%<\/td>\n0.0001 to 0.00001<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

The Probability of Failure on Demand (PFD)\u00a0is\u00a0value that indicates the probability of a system failing to respond to a\u00a0demand. The average probability of a system failing to respond to a demand in a specified time interval is referred\u00a0as PFDavg. PFD equals 1 minus Safety Availability.<\/p>\n

Risk is composed of probability (frequency of occurrence) and consequences (severity). The probability component of risk:<\/p>\n\n\n\n\n\n\n\n\n
RISK LEVEL<\/strong><\/td>\nDESCRIPTIVE WORD<\/strong><\/td>\nFREQUENCY OF OCCURRENCE<\/strong><\/td>\n<\/tr>\n
5<\/td>\nFrequent<\/td>\nOne per year<\/td>\n<\/tr>\n
4<\/td>\nProbable<\/td>\nOne per 10 years<\/td>\n<\/tr>\n
3<\/td>\nOccasional<\/td>\nOne per 100 years<\/td>\n<\/tr>\n
2<\/td>\nRemote<\/td>\nOne per 1,000 years<\/td>\n<\/tr>\n
1<\/td>\nImprobable<\/td>\nOne per 10,000 years<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

The severity component:<\/p>\n\n\n\n\n\n\n\n\n
RISK LEVEL<\/strong><\/td>\nDESCRIPTIVE WORD<\/strong><\/td>\nPOTENTIAL CONSEQUENCES TO PERSONNEL<\/strong><\/td>\n<\/tr>\n
5<\/td>\nCatastrophic<\/td>\nMultiple deaths<\/td>\n<\/tr>\n
4<\/td>\nSevere<\/td>\nDeath<\/td>\n<\/tr>\n
3<\/td>\nSerious<\/td>\nLost time accident<\/td>\n<\/tr>\n
2<\/td>\nMinor<\/td>\nMedical treatment<\/td>\n<\/tr>\n
1<\/td>\nNegligible<\/td>\nNo injury<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

The total overall risk can be determined by multiplying the Risk Level factors from the two tables to obtain\u00a0a number from 1 to 25. If this product falls between 15 and 25, the risk is considered high and would indicate a possible\u00a0need for a SIL3. For a product between 6 and 15, the risk is considered moderate and a SIL2 may be called for. If the\u00a0product falls between 1 and 6, the risk is considered low and a SIL1 may be adequate.<\/p>\n

An analysis needs to be performed for each hazardous event for each safety function. Once this is done, the analyst\u00a0needs to consider the level of protection that may be provided by other Independent Protection Layers (IPLs) such\u00a0as; basic process control functions, alarms and operator intervention, physical protection such as relief devices or\u00a0dikes, plant emergency response measures, community emergency measures, etc referred to in Figure 1. Taking all of these factors into consideration, the analyst then can assign an overall SIL target level to each SIS\u00a0system. The designer then must design the SIS system equipment to possess probability of failure on demand (PFD)\u00a0characteristics that will meet that Safety Integrity Level.<\/p>\n

\"Figure<\/a>
Figure 3 PFD of each component of SIS needs to be included in SIL calculation<\/figcaption><\/figure>\n

The PFD for the SIS system is the sum of PFDs for each element of the system (Figure 3). In order to determine the PFD of each element, the analyst needs documented, historical failure rate data for each element. This failure rate (dangerous[2<\/a>]<\/sup>) is used in conjunction with the Test Interval (TI)[3<\/a>]<\/sup> term to calculate the PFD. It is this test interval (TI) that accounts for the length of time before a covert fault is discovered through testing. Increases in the test interval directly impact the PFD value in a linear manner; i.e., if you double the interval between tests, you will double the Probability for Failure on Demand, and make it twice as difficult to meet the target SIL.\u00a0The governing standards for Safety Instrumented Systems state that plant operators must determine and document\u00a0that equipment is designed, maintained, inspected, tested, and operated in a safe manner. Thus, it is imperative that\u00a0these components of Safety Instrumented System be tested frequently enough to reduce the PFD and meet the target\u00a0SIL.<\/p>\n

Final Control Elements represent a significant\u00a0failure contribution in an SIS loop. If offline testing is not possible, then how do we test dormant valves that remain\u00a0in one position (by nature of the application) without any mechanical movement?<\/p>\n

Conventional methods and problems:<\/h3>\n\n\n\n\n\n
Test Strategy<\/strong><\/td>\nDrawbacks<\/strong><\/td>\n<\/tr>\n
Install a bypass valve around each safety valve. By placing the bypass in service, the safety valve can be full\u2212stroke tested without shutting down the process.<\/td>\n\n
    \n
  1. The process is left totally unprotected while the test is in progress.<\/li>\n
  2. Safety valve can be inadvertently left in the bypass position<\/li>\n<\/ol>\n<\/td>\n<\/tr>\n
Mechanical limiting travel methods by use of a mechanical device, such as a pin, a valve stem collar, a valve hand jack, etc. that will limit the valve travel to 15% or less of the valve stroke<\/td>\n\n
    \n
  1. Mechanical lock or pin may not be removed after testing is complete.<\/li>\n<\/ol>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

    Problem:<\/h2>\n

    Safety Instrumented Systems (SIS)\u00a0are required by standards IEC61508\/ISA S84.01 (Replaced by ISA 84.00.01\u22122004) to\u00a0be tested at a periodic interval based on HAZOP (Hazard Operation Analysis) design to achieve and meet a required\u00a0Safety Integrity Level (SIL). However, pressure to maximize production are forcing process\u00a0industries to extend shutdown intervals to 3, or in some cases, 5 years. Final Control Elements consisting of\u00a0dormant valves that remain\u00a0in one position without any mechanical movement remain untested for a longer time than required to achieve SIL. Workarounds such as mechanical valve limiters, and bypass piping\u00a0have two disadvantages: One, that the the SIS is unavailable during the test period, and two, that the limiting or bypass valve can be left inadvertently in test mode.<\/p>\n

    Solution – Digital Valve Controller:<\/h2>\n

    Using digital valve controllers on Safety Shutdown valves to detect dangerous failures\u00a0provides for local and remote testing while the plant is running. Not only is testing performed at the required TI but the\u00a0test data revealing valve condition\u00a0is documented and stored automatically thereby adding a CBM layer to the SIS that identifies\u00a0partially failing valves.\u00a0Should an emergency shutdown demand occur during testing, the digital valve controller will override the test,\u00a0driving the valve to its safe position.<\/p>\n

    \"digitalPositionerTest\"<\/a><\/p>\n

    The SIS has the capability to alert the operator if, during a test, a valve is stuck.\u00a0As the positioner begins the partial stroke, it continually checks the valve travel to see if it is responding properly. This\u00a0is important to reduce false trips. Conventional positioners, which do not see travel feedback, may exhaust actuator\u00a0pressure trying to move a sticking valve. If the spring force frees the stuck valve after air is depleted, a false trip could
    \noccur. However, the digital valve controller has configurable minimum partial stroke air pressure in microprocessor\u00a0memory. Should the valve be in the stuck position, the digital valve controller will abort the test before pressure drops\u00a0enough to cause a false trip, and alert the operator that the valve is stuck. This will prevent the valve from slamming
    \nshut if the valve does eventually break loose.<\/p>\n

    Digital valve controllers (aka\u00a0\u201csmart\u201d positioners) \u00a0are communicating, microprocessor-based current-to-pneumatic instruments with internal logic capability.\u00a0In addition to the traditional function of converting a current signal to a pressure signal to operate the valve, these digital\u00a0valve controllers use HART[4<\/a>]<\/sup>\u00a0communications protocol to give easy access to information critical to safety testing.<\/p>\n

    The\u00a0digital valve controller receives feedback of the valve travel position plus supply and actuator pneumatic pressures.\u00a0This allows the digital valve controller to diagnose the health and operation of itself and the valve and actuator to which\u00a0it is mounted.<\/p>\n

    The operator initiates testing by a simple button push, however the testing sequence itself is\u00a0completely automatic, thereby eliminating any errors and possible nuisance trips, and the labor capital cost of\u00a0conventional testing schemes.<\/p>\n

    Typically the partial-stroke test moves the valve 10% from its original position but can be up to 30% if allowed by plant\u00a0safety guidelines.\u00a0Partial-stroke testing does not eliminate the need for full-stroke testing. Full-stroke testing\u00a0is required to check valve seating, etc. Nevertheless, partial stroke testing\u00a0does reduce the required full-stroke testing frequency to the point where\u00a0it can most likely be tested during the scheduled plant turnaround.<\/p>\n

    Because the positioner communicates via a bus HART protocol, the partial stroke test can be initiated from a\u00a0hand-held communicator, from the control panel, or from a panel-mounted push button hardwired to the\u00a0positioner terminals.\u00a0The operator can also schedule tests automatically on\u00a0a daily, weekly or monthly basis.<\/p>\n

    A final consideration – Verifying the TI via LRCM<\/h2>\n

    The discovery of a failed safety device is a valuable, yet largely ignored “data point” in\u00a0a Reliability Analysis (RA) sample. Such data points constituting a sample should be analyzed in order to determine whether the testing frequency is adequate by calculating the real reliability (MTBF) of the device, which could differ substantially in the actual operating context\u00a0from the manufacturers published data. Whenever a test is performed manually by the\u00a0operator \u00a0and a malfunction is reported, the resulting EAM work order should record the failure mode’s ending Event Type as a “Potential Failure”.[5<\/a>]<\/sup> Why would we call the functional<\/em> failure of a safety device a potential<\/em> failure? It is because the multiple failure, in other words the\u00a0the device being in a failed state at a moment when it is needed, has been prevented.<\/p>\n\n

      \n\t
    1. [1]<\/sup><\/strong>http:\/\/www.documentation.emersonprocess.com\/groups\/public_valvesprodlit\/documents\/training_info\/sis_training_course_1.pdf<\/a>↩<\/a><\/li>\n\t
    2. [2]<\/sup><\/strong>excluding the nuisance failures↩<\/a><\/li>\n\t
    3. [3]<\/sup><\/strong>Failure Finding Interval in RCM terminology.↩<\/a><\/li>\n\t
    4. [4]<\/sup><\/strong>Highway Addressable Remote Transducer<\/i>\u00a0Protocol is an implementation of Fieldbus<\/span>, a digital industrial automation\u00a0<\/span>protocol. It can communicate over legacy\u00a0<\/span>4-20 mA<\/a>\u00a0analog instrumentation wiring, sharing the pair of wires used by an\u00a0older system. T<\/span>he huge installed base of 4-20 mA systems throughout the world\u00a0makes\u00a0the HART Protocol is one of the most popular industrial protocols today.<\/span>↩<\/a><\/li>\n\t
    5. [5]<\/sup><\/strong>During scheduled shutdowns, if the device is replaced or renewed proactively, that action should be recorded as a suspension.↩<\/a><\/li><\/ol>\n","protected":false},"excerpt":{"rendered":"

      Safety in a plant is provided by layers of protection. The diagram from Emerson SIS Course shows the Safety Instrumented System (SIS) as the “safety layer” providing the final\u00a0preventive\u00a0layer\u00a0before the mitigation layers must engage. Typically, safety instrumented systems (commonly known as Emergency Shutdown (ESD), Emergency Venting (ESV)\u00a0or Safety Interlock Systems) consist of the three elements […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[89],"tags":[],"class_list":["post-3733","post","type-post","status-publish","format-standard","hentry","category-theory-and-definitions"],"_links":{"self":[{"href":"https:\/\/www.livingreliability.com\/en\/wp-json\/wp\/v2\/posts\/3733","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.livingreliability.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.livingreliability.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.livingreliability.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.livingreliability.com\/en\/wp-json\/wp\/v2\/comments?post=3733"}],"version-history":[{"count":1,"href":"https:\/\/www.livingreliability.com\/en\/wp-json\/wp\/v2\/posts\/3733\/revisions"}],"predecessor-version":[{"id":8723,"href":"https:\/\/www.livingreliability.com\/en\/wp-json\/wp\/v2\/posts\/3733\/revisions\/8723"}],"wp:attachment":[{"href":"https:\/\/www.livingreliability.com\/en\/wp-json\/wp\/v2\/media?parent=3733"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.livingreliability.com\/en\/wp-json\/wp\/v2\/categories?post=3733"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.livingreliability.com\/en\/wp-json\/wp\/v2\/tags?post=3733"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}