People from across the world come up this blog and get some great questions from time to time. The most recent example is questions about safety instrumented systems (SIS) and the IEC 61511 standards. I thought I’d run them by two experienced Emerson safety experts, Len Laskowski in the Refining and Chemical industry center and Stephane Boily in the Hydrocarbon and Energy industry center.
As safety professionals incorporate these performance-based international safety standards, I thought sharing their answers with you might help your safety planning efforts. Len answers the four questions and Stephane adds his thoughts looking at the SIS installation components.
What are the standards that define the best rules for installation of field equipment of a SIF/SIS, on site?
IEC 61511 or ISA-S84-2003 (which is really the same thing, plus a grandfather clause) are intended for application in the process industry. They do the best job of defining what one needs to be concerned with for field instruments. The guidance may be considered somewhat minimal but the critical safety issues are there. Whatever would make a good installation for the basic process control system (BPCS) is a good installation for the SIS also. However, some different issues need to be recognized. First, the instruments need to be reliable. One measurement, referred to as “proven in use” means reliability data must be available for safety integrity level (SIL) calculations. If not then SIL-rated instruments are an option. Next one must consider fault tolerance requirements for the Safety Instrumented Function (SIF). This is a function of the SIL level for each SIF in the SIS. There will of course always be the need to make sure the instruments are calibrated routinely and tested per the proof test requirement. If this is online then the engineer needs to make sure that those facilities plus the ability to do maintenance is designed into the project. Typically sensors need their own root valve and final control elements may need bypasses or means for partial stroke testing.
The routing of the individual cables of transmitter that is in a 2oo3 voting system–the same route, different routes?
Some reliability engineers would want to try to convince you that a different route is required. While everyone would like a diverse routing from a common mode point of view, (a fire, dropped crane load, chemical spill could destroy all the cables in the same tray, etc.) it is many times impractical to route differently. One deciding factor is availability. If high availability is require diverse routine is a good idea, but again not mandatory. Some companies may have internal standards on this subject. The other factor is whether or not the SIS fails safe. If a loss of a cable, causes the System to have a spurious safe trip the system is safe, but you have to deal with the cost of the spurious trip. If the SIF is energized-to-trip, one needs to look at separate routing. Also, end of line monitoring etc.
Can I install the three field devices in battery or in different places to avoid, common failure, e.g., vibration, risk of fire?
Field instruments are designed for the outdoor industrial environment. Utilize them correctly for their application. If it is a bad installation for the BPCS it is bad for the SIS also. While many SIS logic solvers have been industrially hardened to operate in a broad range of environmental conditions with numerous successful applications, it just stands to reason that putting them in environmentally controlled areas will improve potential reliability plus the ability to do maintenance.
Yes one must always be careful with respect to common mode. Common mode can wiped out the reliability gains of redundancy. That is why it is required to do SIL Calculations to verify that the common mode effect is not so strong that it renders the SIF ineffective.
Must I use the normal practices of engineering or do rules or recommendation exist for the installation of field equipment for the SIF/SIS?
One has to ask whose normal practices?? If we mean industry best normal practices the answer is yes again but one needs to follow the entire IEC-61511 Life Cycle to determine what that really means for each project. What is an acceptable solution for one plant may not work for another. The questions you ask really points out that to safely design a plant, the project needs to execute the IEC61511 Safety Life Cycle. Hazards are identified early in the project and solutions are designed around those hazards. The questions you asked should all be covered in the Safety Requirements Specification (SRS). There are 27 questions that cover the topics you have asked and more, much more. Inexperienced engineers may not be aware of this list of questions that define an IEC61511 SRS. This is why you should work with experienced organizations. A study done by the Health and Safety Executive in the UK has shown that the majority of problems with SIS systems today are actually specified into the project. (Or shall we say not specified into the project, one does not know what one does not know.) Failure to execute the life cycle activities early and properly can have serious safety, schedule and cost implications on a project.
Stephane adds these thoughts on the installation components:
Sensor-To reduce common mode each sensor should have a separate process connection. There have been some good arguments made with regards to using different technologies in order to reduce common mode but one must look at practicality vs. benefits and risk reduction. Also, although the use of diverse technologies can reduce common cause it will not eliminate it completely.
Transmitters-For sensors integrated (or separate) with the transmitter, the geographical locations of the voted transmitters should be away from each other to the extent possible (so that in the event of a fire–all transmitters are not affected–as an example!)
Junction Boxes-Separate JBs for each transmitter / 2 core cable is preferred.
Multicore Cables-If separate JBs not possible, run each transmitter pair in separate multicore cables to the control room.
Cable Trays-Run the multicore cables in separate trays which have separate routes to the control room when practical. Availability would be the determining factor.
Safety Logic Solver-Each transmitter signal could be connected to separate SLS, on separate carriers. This would slightly compromise on the PFD value however and could also make the SIF configuration more complicated, but reduces common cause. SLS installed in two different cabinets in different control rooms would be even better! However common sense needs to be used and practicality. Same logic could be used for the output signals.
The extent to which one would go in segregating will depend on ALARP – As low as reasonably practicable (here ‘low’ refers to the risks involved). The Risk Reduction Factor (RRF) of the SIF and how much of the risk is the engineer / company ready to absorb, will dictate the decision. The common cause calculator (based on such segregation) is given in IEC 61508-6, Table D.5.