Logic solver redundancy

Logic solver (redundant) 1,3 x 10 including I/O interface (from certificate). 

SIL2 (PFD = 1(T2 to 10 3) These SIFs are typically fully redundant, including the sensor, logic solver, final control element, and requires periodic proof testing. 

The international working group that prepared lEC 61508 considered the above factors and specified the extent of fault tolerance required in lEC 61508-2. In preparing this sector-specific standard for the process sector it was considered that the requirements for fault tolerance of field devices and non PE logic solver could be simplified and the requirements in lEC 61511-1 ANSI/ISA-84.00.01-2004 Part 1 (lEC 61511-1 Mod) could be applied as an alternative. It should be noted that subsystem designs may require more component redundancy than what is stated in Tables 5 and 6 in order to satisfy availability requirements. 

After selection of the SIS architecture, application software may have to be specified for implementation of redundancy (for example, 1oo2) and/or diagnostics, as required for sensors, logic solver, and final elements. 

ANSl/lSA-84.00.01-2004 (lEC 61511 Mod) has a requirement for nainimum levels of "hardware fault tolerance" as a function of SIL level. This means that redundancy for purposes of achieving the safety function must be done depending on the SIL level target of the SIF. For field instruments and non-programmable logic solvers, the chart is shown in Figure 7-6. 

NOTE 1 An SIS usually consists of three architectural subsystems sensors, logic solver and final elements. Furthermore, subsystems could have redundant devices to achieve the required integrity level. 

NOTE 2 An SIS hardware architecture with redundant sensors may place additional requirements on the SIS logic solver (for example, Implementation of 1oo2 logic). 

A typical SIF consists of three subsystems 1) Sensor, 2) Logic Solver, and 3) Final Control Element. Each SIF subsystem should meet a minimum fault tolerance based on the target SIL. The fault tolerance requirements establish the need for redundant devices, such as redundant transmitters or redundant... 

Inputs - Redundancy, such as 2oo2 and 2oo3, can be employed on the inputs to prevent a single, safe failure of a device or circuit from causing a spurious shutdown. The inputs can also be connected to separate input modules on the logic solver to increase reliability even further. 

For LVL devices in demand-mode SIFs, redundancy and diagnostics alone are not sufficient to achieve higher SIL claim limits. LVL devices are significantly more complex, using embedded, utility, and multifunctional application software (e.g., logic solvers). For example, the following could be considered ... 

SIL 2 Requires more diagnostics and typically includes redundancy of the logic solver and sensors, with redundancy of final control elements as necessary. 

SIL 3 Typically requires redundancy in sensors, logic solver and final elements, and enhanced diagnostics and on-line validation of the SIF functionality to avoid the need for frequent testing. 

Electronic and PE logic solvers frequently include internal power supplies that convert electrical power source(s) to lower-level voltages for internal use. Power supply redundancy should be considered to meet the reliability requirements of the application. 

The potential for systematic failure in the process specification, programming, and checkout of the SIS is not considered in the safety system PFDavg calculation. That failure rate may have a significant contribution to the potential for loss of the ability to bring the process to a safe state. When there is a failure, whether you have redundancy or not, you need to provide a way to bring the process to a safe state. Clause 11.3 presents requirements for system behavior when a fault is detected. The manual shutdown does not have to be an emergency stop button, which activates the final elements of the SIS, Independent of the logic solver, but some alternate shutdown method should be provided. 

The selection of the logic solver technology is made...e.g. relays or PES. The architecture of the PES has to be decided. Do we need dual redundant architectures or will a single channel PES be acceptable ... 

The following 4 diagrams depict the conventions used for describing some of the more common single and redundant channel architectures including diagnostics. The conventions apply equally to SIS logic solvers, input sensors and output actuators. 

One advantage of using PES based logic solver systems is that they greatly increase the available decision making power to deal with redundancy options when compared with relay based systems. 

Case 1 employs a dual loo2 sensor pair as inputs to a single channel logic solver with diagnostics, lool D. A dual redundant pair of valves is used to shutoff feed to the process. The safety requirements specification for this function calls for SIL 2 integrity to protect against the hazardous condition that could arise as much as once per year (i.e D =l/yr). 

An architecture for SIS logic solvers to achieve fault-tolerance by a 2 out of 3 voting configuration using identical redundant modules. 

Used redundant power source for SIS logic solver, inputs, HMI, and diagnostic outputs. Provided time delay under voltage protection (30 cycles) for motor loads. 

---