Safety instrumentation systems requirements

NFPA 85, Boiler and Combustion Systems Hazards Code, provides guidance for steam boilers and similar high reliability automatic combustion systems. In general, NFPA 85 combustion system control and safety instrumentation systems requirements exceed those defined in NFPA 86 and in API RP 556. 

Safety Instrumented System Requirements for Fieldbus and Control Components... 

The overall design of a safety instrumented system requires that the project participants have a broad knowledge of the hazards and risks as well as the intended protection measures. 

Where process, safety, and environmental considerations permit, vacuum protection may be provided by properly sized ever-open vents. Alternatively, active protective devices and systems are required. Vacuum breaker valves designed to open and admit air at a predetermined vacuum in the vessel are commonly used on storage tanks, but may not be suitable for some applications involving flammable liquids. Inert gas blanketing systems may be used if adequate capacity and reliability can be ensured. Where the source of the vacuum can be deenergized or isolated, suitably reliable safety instrumented systems (e.g, interlocks) can be provided. 

Layer of Protection Analysis (LOPA) Scenario- based Order-of- magnitude By preidentified scenario Processes likely to require independent protection layers, such as safety instrumented systems, to meet predefined risk criteria Dependent on comprehensiveness of scenario list identified by other method(s) Higher... 

Validation—The activity of demonstrating that the safety-instrumented system under consideration, after installation, meets in all respects the safety requirements specification for that safety-instrumented system. 

Once the severity and the probability corresponding to a scenario are estimated, that is, the risk is assessed, a decision can be made on the nature of the protection system to be implemented. If a safety instrumented system (SIS) is to be used, consisting of one or more independent protection levels (IPL), the required reliability of the protection system, constituting a so-called Safety Integrated Level (SIL) can be determined by using this risk assessment, respective of the required risk reduction. 

Determination of the Required Reliability for Safety Instrumented Systems... 

Assigning prooftest frequencies for complex, safety-instrumentation loops requires sound engineering judgment for simple systems. For more complex, interlock systems, the frequency is a function of the tolerable hazard rates. For example, DuPont Sabine River Works (Orange, Texas) reported it had 35,000 instruments in service. Every safety interlock is... 

Application of Safety Instrumented Systems for the Process Industries, ISA-S84.01, Instrument Society of America, ISBN 1-55617-590-6, Research Triangle Park, NC, 1996. The objective of this document is to define the requirements for Safety Instrumented Systems (SIS) for the process industries. The SIS addressed here includes electrical, electronic, and programmable electronic technology. 

Percentage of critical instruments or safety instrumented systems calibrated on time (e.g., within the timelines suggested by the assessment to meet the requirements of lEC (International Electrotechnical Commission Standard) 61511)... 

This International Standard addresses the application of safety instrumented systems for the Process Industries. It also deals with the interface between safety instrumented systems and other safety systems in requiring that a process hazard and risk assessment be carried out. The safety instrumented system includes sensors, logic solvers and final elements. 

The skills and knowledge required to implement any of the activities of the safety life cycle relating to the safety instrumented systems should be identified and for each skill, the required competency levels should be defined. Resources should be assessed against each skill for competency and also the number of people per skill required. When differences are identified, development plans should be established to enable the required competency levels to be achieved in a timely manner. When shortages of skills arise, suitably qualified and experienced personnel may be recruited or contracted. 

The functional safety achieved in any process facility is dependent on a number of activities being carried out in a satisfactory manner. The purpose of adopting a systematic safety lifecycle approach towards a safety instrumented system is to ensure that all the activities necessary to achieve functional safety are carried out and that it can be demonstrated to others that they have been carried out in an appropriate order. lEC 61511-1 ANSI/ISA-84.00.01-2004 Parti (lEC 61511-1 Mod ) sets out a typical lifecycle in Figure 8 and Table 2. Requirements for each lifecycle phase are given in Clauses 8 through 16 of lEC 61511-1 ANSI/ISA-84.00.01-2004 Part 1 (lEC 61511-1 Mod). 

The requirement here is to agree on the safety layers to be used and to allocate performance targets for the safety instrumented functions. In practice, safety functions are in many cases only allocated to safety instrumented systems where there are problems in using inherently safe designs or other technology systems. 

The outcome of the hazard and risk assessment and allocation process should be a clear description of the functions to be carried out by the safety systems, including potential safety instrumented systems together with safety integrity level requirements (along with mode of operation, continuous or demand) for any safety instrumented function. This forms the basis for the SIS safety requirements specification. The description of the functions should be clear as to what needs to be done to ensure that safety is maintained. 

Wherever possible, on-line modifications to a safety instrumented system should be avoided. If on-line modifications are required, the complete procedure should be documented and approved according to the safety planning. 

ANSI/ISA-84.00.01 (2004) Functional Safety Safety Instrumented Systems for the Process Industry Sector - Part 3 Guidance for the Determination of the Required Safety Integrity Levels,... 

Functional safety is thus the primary objective in designing a safety instrumented system (SIS). To achieve an acceptable level of functional safety, several issues must be considered that may not be part of the normal design process for automation systems. These issues are provided as requirements in international standards. 

A plan is created for the installation and commissioning. This step includes a comprehensive test to validate that all requirements from the original SRS have been completely and accurately implemented. Also needed is a revalidation plan that is a subset of the validation plan. When the installed system is tested and validated, the safety instrumented system is ready to provide protection when actual operation begins. 

A safety instrumented system, like a basic process control system, is also composed of sensors, controUer(s), and final elements. Although much of the hardware appears to be similar, safety instrumented systems and basic process control systems differ very much in function. The primary function of a control loop is generally to maintain a process variable within prescribed limits. A safety instrumented system monitors a process variable and initiates action when required. 

Another difference between Basic Process Control System design and Safety Instrumented System design is that per ANSl/lSA-84.00.01-2004 (lEC 61511 Mod) these systems are designed and implemented to meet different risk reduction requirements presented by the various hazards. (Chapter 1)... 

A failure occurs when a device at some level (a system, a unit, a module, or a component) fails to perform its intended function. To many, the definition is clear. Disagreement may occur, but when this happens it is usually a matter of properly defining "intended function." For safety instrumented systems, the definition of intended function is usually clear and should be properly recorded in the safety requirements specification. 

Current functional safety standards, lEC 61508 and ANSl/lSA-84.00.01-2004 (lEC 61511 Mod), (Ref. 1 and 2) state that probabilistic evaluation using failure rate data be done only for random failures. To reduce the chance of systematic failures, the standards include a series of "design rules" in the form of specific requirements. These requirements state that the safety instrumented system designer must check a wide range of things in order to detect and ehcninate systematic failures. 

Most analysts doing safety instrumented system modeling use either fault trees or Markov models. Both methods provide a clear way to express the reality of multiple failure modes. Both methods, however, require careful modeling and appropriate solution techniques. Realistic levels of detad... 

ANSI/ISA-84.00.01-2004 (lEC 61511 Mod) requires that equipment used in safety instrumented systems be chosen based on either lEC 61508 certification to the appropriate SIL level or justification based on "prior use" criteria (ANSI/ISA-84.00.01-2004 (lEC 61511Mod), Part 1, Section 11.5.3). However the ANSI/ISA-84.00.01-2004 (lEC 61511 Mod) standard does not give specific details as to what the criteria for "prior use" means. Most agree however that if a user company has many years of documented successful experience (no dangerous failures) with a... 

Sensors in a safety instrumented system measure process variable conditions in order to recognize a potential hazard. Usually these are the same process variables that are used for control. So the first and perhaps most important consideration when selecting sensors for safety applications is that they accurately and reliably measure the process variable. Another key parameter is that any process wetted materials must be compatible with the chemicals of the process. These are two of the key principles required in a "well designed system."... 

Although some consider fire and gas systems to be outside the scope of a safety instrumented system, many others classify these functions as safety instrumented functions. The criteria is based on needed risk reduction. When consequence or likelihood reduction is achieved by these functions and the risk reduction needed is greater than 10, ANSl/lSA-84.00.01 (lEC 61511 Mod) (Ref. 9) requires the hmction be classified as a SIR... 

Use of multiple SIS Multiple Safety Instrumented Systems are sometimes used to provide a higher SIL capability, e.g., the use of two SILl systems to possibly satisfy the needs for a SIL2 system. Generally this will not work. When using multiple SIS a careful analysis is required to ensure that maintenance, common cause issues are properly analyzed. There is also the issue of "SIL capability." When a PLC is certified, it must follow a rigorous quality process according to the SIL level (see Chapter 7). A SIL 1 PLC will not likely have the quality needed for SIL 2. A SIL 2 PLC will not likely have the quality needed for SIL 3. 

All equipment used in the SIS must be classified as a safety instrumented system. The design, installation, operation and maintenance process must follow all the rules of ANSl/lSA-84.00.01-2004 (lEC 61511 Mod), put there to prevent systematic faults. If this is not done, the standard clearly states that any safety instrumented function cannot have a risk reduction greater than 10. This is the bottom of SlLl range so, in effect, that design cannot meet SIL 1 requirements. The practical effect of this requirement is that a designer cannot combine control functions and safety functions in the same equipment imless the equipment is classified as a safety instrumented system and follows aU the design rules of the standard. 

Functional safety—safety instrumented systems for the process industry sector—Part 1 Framework, definitions, system, hardware and software requirements (lEC 61511-1 2003 + Corrigendum 2004) German version EN 61511-1 2004... 

---