Logic solver controller requirements

SIL1 (PFD = 10-1 to 10 2) These SIFs are normally implemented with a single sensor, a single logic solver, a single final control element, and requires periodic proof testing. 

Manual means that are independent of both the SIS logic solver and the BPCS control system may be provided to allow the operator to initiate a shutdown in an emergency. The requirements for manual shutdown are normally defined in the SRS. 

It seems logical to list the following equipment for this safety instrumented function pressure transmitter, logic solver, inlet feed valve, pump control relay, and outlet isolation valve. However, for each piece of equipment ask the question, "Is this piece of equipment needed to protect against the specific hazardous event " In this case, the pump is turned off just to protect the pump from backpressure burnout. (NOTE - This may be part of another safety instrumented function.) The outlet isolation valve is closed in order to avoid process disruptions in the remainder of the plant. Neither is required to protect against the hazard and should not be included in the SIF verification calculation. The pump control relay may be part of another SIF intended to protect the pump. However, it is likely that this SIF may have a lower safety integrity requirement. 

The RPS is a sort of SIS (Safety Instrumented System) (Torrres et al., 2009). A SIS is defined as an instrumented system used to implement one or more safety instrumented control functions. A SIS is composed of any combination ofsensors, logic solver and final elements" (lEC 61511, 2003). The standard lEC 61508 requires every safety function to achieve a determined Safety Integrity Level (SIL). For low demand operating systems the SIL levels are defined in terms of average probability of failure on demand (PFDavg, see Table 2). 

There are two SIL levels to consider. The first is the target SIL level. This is the SIL level required to reduce the risk to as low as reasonably practical. The second is calculated SIL level— this is the calculated as per standards SIL level of the proposed solution to show that the target SIL level is achieved. The calculated SIL level of the proposed control loop solution must include the sensors, logic solver, actuators, architecture and systematic capability. 

NOTE This data represents typical programmable logic controllers and distributed control systems. Lower Allure rates can be achieved by BPCS logic solvers that meet the requirements of lEC 61508 or ANSI/ISA-84.00.01-2004-1, Clause 11.5. 

ANSI/ISA-84.00.01-2004-1 does not require physical separation. However, many owners/operators do use physical separation and diverse logic solvers. It is paramount to remember the primary purpose of many SIS. The SIS is designed to restore the plant to a safe state when the process moves out of the normal operating envelope for a number of causes, including a failure or erroneous operation of the control functions. The need for the SIS to act as a layer of protection in the event of control function failure has resulted in many standards and practices recommending that SIF and control functions be implemented in physically separate and diverse equipment. 

A typical SIF consists of three subsystems 1) Sensor, 2) Logic Solver, and 3) Final Control Element. Each SIF subsystem should meet a minimum fault tolerance based on the target SIL. The fault tolerance requirements establish the need for redundant devices, such as redundant transmitters or redundant... 

The minimum fault tolerance requirements are documented in ANSI/ISA-84.00.01-2004-1, Clause 11.4. Clause 11.4.2, Table 5, provides the required fault tolerance for PE Logic Solvers. Clause 11.4.4, Table 6, provides the required fault tolerance for Sensors, Final Control Elements, and non-PE Logic Solvers. 

It may also be able to justify less fault tolerance than required by Table 6, when the dangerous failure modes of the SIF devices and associated process interfaces are well understood. Clause 11.4.4 states that if the selection of a device is based on prior use, then, under specific conditions, the fault tolerance for sensors, final control elements, and non-PE logic solvers can be reduced by 1. The reduction of fault tolerance is acceptable, since prior use establishes the field application data, which includes the random hardware failures for the device itself and the random failures due to the process and field device interfaces. 

SIL 2 Requires more diagnostics and typically includes redundancy of the logic solver and sensors, with redundancy of final control elements as necessary. 

The ability to shutdown the process, independent of the BPCS controller and SIS logic, solver may be required for some applications. The current editions of NFPA 85 and NFPA 86 require independent means for equipment covered by these practices. The SIS logic solver has a very low failure rate, but what will you do when it fails Even with the very low failure rate, programmable electronic systems can fail. Equipment safety manuals may specifically require independence, especially for SIL 3 applications. When non-fail-safe design is used, e.g., energize to shutdown, independent shutdown facilities should be provided that do not require the SIF support system to be operational. 

Requirements of SIS for field bus, sensor, logic solvers, and final control elements failure rates, specification, selection procedure. Alarm management layers of protections. 

It is quite a common feeling in people s minds that there are special requirements for SIL instruments. Alternatively, some put a lot of stress on selecting SIL for a logic solver as it controls the loop. What is a safety loop To answer these issues, it is important to understand how the safety of a loop can be assessed. In this clause the emphasis will be on calculation of SIL for the safety loop and what this actually means. 

As per lEC 61511-3 2003 Clause 9.4.3, operator action as part of safety instrument functions (SIFs) can be credited with a level of risk reduction greater than 10 when the system from the sensor to the final element can be designed and evaluated as an SIS per the requirements of lEC 61511. A typical automated SIS, popularly known as an industrial automation and control system (LACS), from the sensor to the final element can be conceived, as shown in Fig. VIII/1.4-1 or Fig. VII/1.3-1 where the main constituents are sensor, logic solver, and final element. When an operator action such as through the display/alarm is necessary this needs to be as shown in Fig. XI/2.4.3-1. 

---