Understanding Safety Instrumented Sytem SIL

8/3/2019 Understanding Safety Instrumented Sytem SIL

1/12

Understanding

Safety Instrumented

Systems

And Safety

Integrity Level

SIL

Worldwide Level and Flow Solutions

SIS

SM


2/12

M I L E S T O N E

TUV (Bavaria)Microcomputers inSafety-Related Systems (1984)

Health & Safety Executive (UK)

Programmable Electronic Systems in

Safety Related Applications (1987)

OSHA (29 CFR 1910.119) (1992):

Process Safety Management of

Highly Hazardous Chemicals

Instrument Society of America

ANSI/ISA 84 (2004):

Safety Instrumented Systems for

the Process Industries

International Electrotechnical

Commission (1998-2003)

IEC 61508 (2000): A general

approach to Functional Safety Systems

IEC 61511 (2003): Process sector

implementation of IEC 61508

THE NEW STANDARDS IN SAFETY

Protecting

People,Profitability

and Productivity

ndustrial safety in pre-digital eras centered mainly around safe

work practices, hazardous materials control, and the protective

armoring of personnel and equipment. Today, safety penetrates far

deeper into more complex manufacturing infrastructures, extending itsprotective influence all the way to a companys bottom line.

Contemporary safety systems reduce risk with operational advancements

that frequently improve productivity and profitability as well.

New Standards. Until the 1980s safety management was largely self-

regulated. Prompted by the ascendency of electronic control devices,

growing complexities in manufacturing systems, environmental protec-

tion mandates, and a greater need to protect plant assets, new interna-

tional safety standards have emerged and continue to evolve. With the

introduction of standards such as IEC 61508, IEC 61511 and ISA 84,

interest in Safety Instrumented Systems (SIS) and general instrumentreliability has grown. In the pages ahead well describe the basics of SIS

and Safety Integrity Level (SIL). Well conclude with an overview of

Magnetrols level and flow instrumentation products that are suitable for

these new standards in safety and well detail their reliability. Reliability

is the key, for even non-safety related people are now using analysis data

from these new regulations as an insight into device performance.

Understanding Risk.All safety standards exist to reduce risk, which is

inherent wherever manufacturing or processing occurs. The goal of elim-

inating risk and bringing about a state of absolute safety is not attain-

able. More realistically, risk can be categorized as being either negligible,tolerable or unacceptable. The foundation for any modern safety system,

then, is to reduce risk to an acceptable or tolerable level. In this context,

safety can be defined as freedom from unacceptable risk.

The formula for risk is:

RISK = HAZARD FREQUENCY x HAZARD CONSEQUENCE

Risk can be minimized initially by inherently safe process design, by the Basic

Process Control System (BPCS), and finally by a safety shutdown system.

A WWII-era safety poster

I

2


3/12

Layered Protection. No single safety measure can reduce risk and

protect a plant and its personnel against harm or mitigate the spread

of harm if a hazardous incident occurs. For this reason, safety exists

in protective layers: a sequence of mechanical devices, process

controls, shutdown systems and external response measures which

prevent or mitigate a hazardous event. If one protection layer fails,

successive layers will be available to take the process to a safe state.

As the number of protection layers and their reliabilities increase,

the safety of the process increases. Figure A shows the succession

of safety layers in order of their activation:

1. Process Design: The Basic Process Control System

(BPCS) provides safety through proper design of process control.

This level consists of basic controls, alarms, and operator supervision.

2. Critical Alarms: This layer of protection provides critical

alarms which alert operators to a condition that a measurement

has exceeded its specified limits and may require intervention.

3. Automatic SIS: The SIS operates independently of the

BPCS to provide safety rather than process control. The SIS performs

shutdown actions when previous layers cannot resolve an emergency.

4. Relief Devices: This active protection layer employs valves,

pressure relief devices, or a flare system (if combustibles are present)

to prevent a rupture, spill or other uncontrolled release.

5. Plant Response: This passive protection layer consists of

containment barriers for fire or explosions as well as procedures for

evacuation. (Some models combine this and the next layer into one

mitigation layer.)

6. Community Response: The final (outermost) level ofprotection is the emergency response action taken by the community

and consists of fire fighting and other emergency services.

According to IEC standards, the methods that provide layers of protec-

tion should be: Independent Reliable Auditable Risk-specific in

design. The IEC definition of protective layers is rigorous because it

supports the use of safety layers in the determination of Safety Integrity

Level

Hazards Analysis. The levels of protective layers required is determined

by conducting an analysis of a processs hazards and risks known as aProcess Hazards Analysis (PHA). Depending upon the complexity of the

process operations and the severity of its inherent risks, such an analysis

may range from a simplified screening to a rigorous Hazard and

Operability (HAZOP) engineering study reviewing process, electrical,

mechanical, safety, instrumental and managerial factors. Once risks and

hazards have been assessed, it can be determined whether they are below

acceptable levels. If the study concludes that existing protection is insuf-

ficient, a Safety Instrumented System (SIS) will be required.

In-plant response layersPrevent hazardous occurrences.

External response layersMitigate hazardous occurrences.

Figure A

Layers of Protection*

PREVENTION LAYERS

MITIGATION LAYERS

3

*The above chart is based upona Layers Of Protection Analysis

(LOPA) as described in IEC61511 part 3 Annex F.


4/12

Safety InstrumentedSystems (SIS)

The Safety Instrumented System (SIS) playsa vital role in providing a protective layer

around industrial process systems. Whether

called an SIS, emergency or safety shutdown

system, or a safety interlock, its purpose is to

take process to a safe state when pre-deter-

mined set points have been exceeded or when

safe operating conditions have been trans-

gressed. A SIS is comprised of safety functions

(see SIF below) with sensors, logic solvers and

actuators. Figure B shows its basic components:

Sensors for signal input and power

Input signal interfacing and processing

Logic solver with power and communications

Output signal processing, interfacing and power

Actuators (valves, switching devices) for final control function

SIF: Safety Instrumented Functions. A Safety Instrumented Function

(SIF) is a safety function with a specified Safety Integrity Level which is

implemented by a SIS in order to achieve or maintain a safe state. A

SIFs sensors, logic solver, and final elements act in concert to detect a

hazard and bring the process to a safe state. Heres an example of a SIF:

A process vessel sustains a build-up of pressure which opens a vent

valve. The specific safety hazard is overpressure of the vessel. When

pressure rises above the normal set points a pressure-sensing instru-

ment detects the increase. Logic (PLC, relay, hardwired, etc.) then opens

a vent valve to return the system to a safe state.

Like the safety features on an automobile, a SIF may operate continu-

ously like a cars steering, or intermittently like a cars air bag. A safety

function operating in the demand mode is only performed when

required in order to transfer the Equipment Under Control (EUC) into a

specified state. A safety function operating in continuous mode operates

to retain the EUC within its safe state. Figure C shows the relationship

between SIS, the Safety Instrumented Functions it implements, and theSafety Integrity Level thats assigned to each Safety Instrumented

Function.

Safety Life Cycle. Earlier we mentioned how a Hazard and Risk

Assessment study will determine the need for an SIS. This assessment is

one part of a safety life cycle which all major safety standards have speci-

fied. The safety life cycle shows a systematic approach for the develop-

ment of a SIS. A simplified version is shown in Figure D.

SIL 2SIF 1

SIS

Figure C Every SIS has one or

more safety functions (SIFs) andeach affords a measure of risk

reduction indicated by its safety

integrity level (SIL). The SIS and

the equipment do NOT have an

assigned SIL. Process controlsare suitable for use within a

given SIL environment.

SIL 2SIF 2

SIL 2SIF 3

S I S S I F S I L

R E L A T I O N S H I P

Figure B Process schematicshowing functional separation of

SIS (red) and BPCS (blue).

4


5/12

Safety Integrity Level (SIL)

To what extent can a process be expected to perform safely? And, in

the event of a failure, to what extent can the process be expected tofail safely? These questions are answered through the assignment of

a target Safety Integrity Level (SIL). SILs are measures of the safety

risk of a given process.

Four Levels of Integrity. Historically, safety thinking categorized a

process as being either safe or unsafe. For the new standards, how-

ever, safety isnt considered a binary attribute; rather, it is stratified

into four discrete levels of safety. Each level represents an order of

magnitude of risk reduction. The higher the SIL level, the greater

the impact of a failure and the lower the failure rate that is

acceptable.

Safety Integrity Level is a way to indicate the tolerable failure rate of

a particular safety function. Standards require the assignment of a

target SIL for any new or retrofitted SIF within the SIS. The assign-

ment of the target SIL is a decision requiring the extension of the

Hazards Analysis. The SIL assignment is based on the amount of

risk reduction that is necessary to maintain the risk at an acceptable

level. All of the SIS design, operation and maintenance choices must

then be verified against the target SIL. This ensures that the SIS can

mitigate the assigned process risk.

Determining SIL Levels. When a Process Hazards Analysis (PHA)

determines that a SIS is required, the level of risk reduction afforded

by the SIS and the target SIL have to be assigned. The effectiveness

of a SIS is described in terms of the probability it will fail to per-

form its required function when it is called upon to do so. This is

its Probability of Failure on Demand (PFD). The average PFD

(PFDavg) is used for SIL evaluation. Figure E shows the relationship

between PFDavg, availability of the safety system, risk reduction and

the SIL level values.

Various methodologies are used for assignment of target SILs. The

determination must involve people with the relevant expertise and

experience. Methodologies used for determining SILs includebut

are not limited toSimplified Calculations, Fault Tree Analysis,

Layer of Protection Analysis (LOPA) and Markov Analysis.

Figure D The Safety Life Cycle is a

sequential approach to developinga Safety Instrumented System (SIS).

References to a Safety Life Cycle can

be found in ANSI/ISA 84.00.01 Parts13; IEC 61508 Part 1; and IEC 61511

Parts 13.

5


6/12

Assessing SIL-Suitable Controls. A Failure Modes, Effects and Diagnostic

Analysis (FMEDA) is a detailed performance evaluation that estimates the fail-

ure rates, failure modes, and diagnostic capability of a device.

The following concepts define key FMEDA data for SIL-suitable Magnetrol

controls shown on pages 7 to 10:

FITS. Column one shows failure rates are shown as Failures in Time

(FITs) where 1 FIT = 1 x 10-9 failures per hour. A second failure rate column

has been added showing Annual data as it is becoming a commonly used

value.

SERIES. The brand and model designation of the control, e.g. Eclipse 705.

SIL. A devices Safety Integrity Level per IEC 61511. Because combined

sensors can increase the SIL, it is often stated as 1 as 1oo1 /2 as 1oo2,

meaning: SIL 1 if the device is one-out-of-one used; SIL 2 if it is one-out-of-two

devices used.

INSTRUMENT TYPE. Type A units are devices without a complex

microprocessor on board, and all possible failures on each component can

be defined. Type B units have a microprocessor on board and the failure

mode of a component is not well defined.

SFF. Safe Failure Fraction indicates all safe and dangerous detected

failures. The formula for determining SFF is: The total failures minus the

dangerous undetected failures divided by the total failures.A SFF of 91%

for the Eclipse 705-51A, for example, means that 91% of the possible failures

are self-identified by the device or are safe and have no effect.

PFDavg. Average probability of failure on demand.

FAIL DANGEROUS DETECTED. Dangerous failures detected by internal

diagnostics or a connected logic solver.

FAIL SAFE. Failure that causes system to go to the fail-safe state with-

out a demand from the process.

FAIL DANGEROUS UNDETECTED. Dangerous failures that are not

detected by the device.

The regulatory control

system affects the size of

your paycheck; the safety

control system affects

whether or not you will

be around to collect it.

Irven H. Rinard

Professor and ChairmanChemical Engineering

City College of New York

SIL AVAILABILITY PFDavg Risk Reduction Qualitative Consequence

4 >99.99% 10-5 to


7/12

SAFETYIN

TE

GRIT

YLEVEL

7

SIL-Suitable Controls

The SIL indicated below is per IEC 61508/61511. Contact Magnetrol for complete FMEDA reports. Failure rates expressed in FITS and Annual. PFDavg is calculated according to a proof

test interval of one year, though other proof test intervals can be applied.

Pulsar Thru-Air

Radar Level Transmitter

The Pulsar pulse burst radar level

transmitter is the latest loop-

powered, 24 VDC thru-air radar

transmitter. It offers lower power

consumption, faster response timeand easy operation. Pulsars per-

formance is not process dependent.

Its 5.8/6.3 GHz frequency performs

well in turbulence, foam and vapor.

An optional PACTwareDTM interface

offers the leading-edge in configuration,

diagnostics and graphics.

Modulevel Displacer

Level Transmitter

Digital ES II electronic transmitters are

advanced, intrinsically safe two-wire

instruments. Features standard 4-20

mA output, microprocessor-based

electronics, HART compatible output,

remote calibration without level move-

ment, standard output range from 3.8 to

20.5 mA, push-button program local

calibration, and continuous self-test. An

optional PACTwareDTM interface

offers the leading-edge in configuration,


Modulevel Model ES II

SIL 1 as 1oo1

Instrument Type B

SFF 66.5%PFDavg 8.94E10-4

FITS Annual

Fail Dangerous

Undetected 204 1.79E-03

Fail Dangerous

Detected 257 2.25E-03

Safe 148 1.30E-03

Pulsar Model RX5

SIL 1 as 1oo1

Instrument Type B

SFF 73.7%

PFDavg 9.72E-04

FITS AnnualFail Dangerous


Fail Dangerous


Safe 314 2.75E-03

LEVEL and FLOW TRANSMITTERS Transmitter failure rates assume the logic solver can detect both over-scale and under-scale currents.

Eclipse Guided Wave RadarLevel Transmitter

The Eclipse guided wave radar level

transmitter is the latest generation of

loop-powered 24 VDC transmitters.

Eclipse interchanges with coaxial,

twin rod, and single rod probes. An

optional PACTware DTM interface

offers the leading-edge in configura-

tion, diagnostics and graphics.

Eclipse Model 705 (510) Model 705 (51A)

SIL 1 as 1oo1 2 as 1oo1

Instrument Type B B

SFF 84.5% 91.0%

PFDavg 8.06E-04 4.69E-04

FITS Annual FITS Annual

Fail Dangerous

Undetected 183 1.60E-03 106 9.29E-04

Fail Dangerous

Detected 567 4.97E-03 650 5.69E-03

Safe 431 3.78E-03 424 3.71E-03


8/12

8


Jupiter Magnetostrictive

Level Transmitter

The Jupiter magnetostrictive level

transmitter provides a 4-20 mA output

proportional to level. Unit can be external-

ly mounted to a magnetic level indicator or

directly inserted into a vessel. Features

4-20 mA output; LCD with push button

operation; simple set-up and configura-tion;easy attachment to an MLI; direct

insertion into a wide variety of vessels;

and optionalHART Communications. An

optional PACTware DTM interface offers

the leading-edge in configuration,


Jupiter Models 20X/22X/24X Model26X


Instrument Type B B

SFF 83.7% 90.7%

PFDavg 9.60E-04 5.45E-04


Fail DangerousUndetected 218 1.91E-03 123 1.08E-03

Fail Dangerous

Detected 698 6.11E-03 793 6.95E-03

Safe 421 3.69E-03 413 3.62E-03

Thermatel TA2 Mass

Flow Meter

Available in both in-line and insertion

styles, the Thermatel TA2 mass flowtransmitters provide reliable mass

measurement of air and gas flow. The

integral electronics are contained within

an explosion-proof enclosure. The units

come pre-calibrated and set up for the

user's applications. Easy to follow

software permits field changes in the

instrument's configuration.

Thermatel Flow Meter Model TA2

SIL 1 as 1oo1

Instrument Type B

SFF 69.0%

PFDavg 1.42E-03

FITS Annual

Fail Dangerous


Fail Dangerous


Safe 376 3.29E-03

LEVEL and FLOW TRANSMITTERS CONTINUED

Aurora Magnetic LevelIndicator

Aurora is a patented, redundant, Magnetic

Level Indicator combined with the

Magnetrol Eclipse Guided Wave Radar

Transmitter and optional Pactware DTM

interface. Aurora is designed and manufac-

tured for the most demanding applications

found in the process industries today.

Even in the event of a float failure due to a

major process upset or overpressure condi-

tion, the 4-20 mA output signal from the

Eclipse radar transmitter will continue toprovide output proportional to the liquid

level in the chamber and vessel.

Aurora/Eclipse 705 (510) 705 (51A)


Instrument Type B B

SFF 84.5% 91.0%

PFDavg 8.06E-04 4.69E-04


Fail Dangerous

Undetected 183 1.60E-03 106 9.29E-04

Fail Dangerous

Detected 567 4.97E-03 650 5.69E-03

Safe 431 3.78E-03 424 3.71E-03


9/12

SAFETYIN

TE

GRIT

YLEVEL

9


Echotel Dual PointUltrasonic Level Switches

Echotel Model 962 dual point

switches are designed for level

alarming or pump control. Featuresinclude pulse wave technology and

advanced diagnostics that continu-

ously check sensor and electronics.

An alarm will sound in the event of

electrical noise interference.

Echotel Model 962-5 Model 962-2/7

CURRENT SHIFT RELAY


Instrument Type B B

SFF 91.8% 91.5%

PFDavg 1.87E-04 2.31E-04


Fail Dangerous

Undetected 42 3.68E-04 52 4.56E-04

Fail Dangerous

Detected 362 3.17E-03 427 3.74E-03

Safe 110 9.64E-04 130 1.14E-03

Echotel Compact

Ultrasonic Level Switches

Echotel Model 940 (relay version)

and Model 941 (current-shift

version) switches are economical,

compact switches with pulsed

signal ultrasound and tip-sensitive

transducers. High-performance

pulsed signal technology excels in

difficult conditions and provides

excellent immunity from electrical

noise that is common in many

industrial applications.

Echotel Model 940 Model 941RELAY CURRENT SHIFT


Instrument Type B B

SFF 92.8% 86.7%

PFDavg 1.07E-04 1.90E-04


Fail Dangerous

Undetected 24 2.10E-04 43 3.77E-04

Fail Dangerous

Detected 220 1.93E-03 191 1.67E-03

Safe 91 7.97E-04 91 7.97E-04

LEVEL and FLOW SWITCHES

Echotel Single PointUltrasonic Level Switches

Echotel Model 961 single point

switches feature pulse wave technolo-

gy with a tip-sensitive set point. The

Model 961 is used as a high or low

level alarm. Features include

advanced diagnostics that continu-ously check sensor and electronics.

An alarm will sound in the event of

electrical noise interference.

Relay-only devices assume the relay is configured Fail-safe (i.e. de-energize upon alarm or failure). Current shift devices assume the logic solver can detect both over-scale and under-scale currents.

Echotel Model 961-5 Model 961-2/7

CURRENT SHIFT RELAY


Instrument Type B B

SFF 91.4% 92.0%

PFDavg 1.61E-04 1.77E-04


Fail Dangerous

Undetected 36 3.15E-04 40 3.50E-04

Fail Dangerous

Detected 288 2.52E-03 351 3.07E-03

Safe 96 8.41E-04 106 9.29E-04


10/12

SAFETYIN

TE

GRIT

YLEVEL

10


Thermatel TG Series Level,Flow, Interface Switches

Thermatel TG1/TG2 switches provide

a two-wire, intrinsically safe circuit

between the probe and remote dinrail enclosure. Switches are suitable

for liquid or gas flow, level, or

interface detection. TG1 (with red

alarm LED) and TG2 (no red alarm)

feature 24 VDC input power, mA

output signal for diagnostics and

repeatable flow/level indication, and

adjustable set point and time delay.

Thermatel Models TG1 / TG2

SIL 1 as 1oo1

Instrument Type B

SFF 79.4%

PFDavg 5.04E-04

FITS Annual

Fail Dangerous


Fail Dangerous


Safe 255 2.23E-03

LEVEL and FLOW SWITCHES CONTINUED

Thermatel TD Series Level,Flow, Interface Switches

Thermatel Model TD1/TD2 flow, level,

interface switches feature continuous

diagnostics with fault indication,

temperature compensation, narrow

hysteresis and fast response time.

Non-linear mA output signal can be

used for trending, diagnostics and

repeatable flow/level indication.

Models will detect minimum flow

or the presence or absence of flow.

Thermatel Model TD1 Model TD2


Instrument Type B B

SFF 69.3% 73.0%

PFDavg 6.13E-04 7.05E-04


Fail Dangerous

Undetected 140 1.23E-03 161 1.41E-03

Fail Dangerous

Detected 252 2.21E-03 390 3.42E-03

Safe 65 4.69E-04 46 4.03E-04

Sealed Cage MechanicalLevel Switches

External cage type level switches

are completely self-contained units

designed for side mounting to a tank

or vessel with threaded or flanged

pipe connections. These float-

actuated controls have proven

their reliability in process control

for decades. Nearly 30 Magnetrol

mechanical switch models are suitable

for SIL 2 and SIL 3 environments.

Cage Switches SPDT DPDT

(Low Level Applications only)


Instrument Type A A

SFF 76.1% 82.6%

PFDavg 4.82E-05 3.50E-05


Fail Dangerous

Undetected 11 9.64E-05 8 7.01E-05

Fail Dangerous

Detected 0 0.00E+00 0 0.00E+00

Safe 35 3.07E-04 38 3.33E-04


11/12

11

Visitmagnetrol.comfor more information on SIL-suitable Magnetrol controlsincluding complete FMEDA reports. For further information regarding SIS, SIL and

general process safety we recommend these online resources:

Subject: www:

IEC standards & bookstore................................iec.ch/home

ISA standards & bookstore................................isa.org

Exida engineering guides...................................exida.com

TUV functional safety services...........................tuv-global.com

UK Health & Safety Executive............................hse.gov.uk

Institution of Chemical Engineers...................... icheme.org

IHS/Global engineering documents...................global.ihs.com

Factory Mutual process safety...........................fm global.com

OSHA process safety standards........................osha.gov

Center for Chemical Process Safety..................aiche.org


12/12

CORPORATE HEADQUARTERS

5300 Belmont Road Downers Grove, Illinois 60515-4499 USA

Phone: 630-969-4000 Fax: 630-969-9489

magnetrol.com [email protected]

EUROPEAN HEADQUARTERS

Heikensstraat 6 9240 Zele, Belgium

Phone: 052 45.11.11 Fax: 052 45.09.93

BRAZIL: Av. Luis Stamatis 620-Jacana Sao Paulo CEP 02260-001

CANADA: 145 Jardin Drive, Units 1 & 2 Concord, Ontario L4K 1X7CHINA: Room #8008 Overseas Chinese Mansion 129 Yan An Road (W) Shanghai 200040

DEUTSCHLAND: Alte Ziegelei 24 D-51491 Overath

DUBAI: P.O. Box-293671 803, Green Tower, Baniyas Street Dubai, United Arab Emirates

INDIA: C-20 Community Centre Janakpuri, New Delhi 110 021

ITALIA: Via Arese, 12 20159 Milano

SINGAPORE: No. 48 Toh Guan Road East #05-123 Enterprise Hub Singapore 608586

UNITED KINGDOM: Regent Business Centre Jubilee Road Burgess Hill, West Sussex RH15 9TL

Magnetrol & Magnetrol logotype, Echotel, Eclipse, Modulevel, Thermatel, Pulsar,

Aurora and Jupiter are trademarks of Magnetrol International.

PACTware is trademark of PACTware Consortium

Copyright 2007 Magnetrol International. All rights reserved. Printed in the USA.

B ll ti 41 299 0 Eff ti A t 2006

Understanding Safety Instrumented Sytem SIL

Documents

Transcript of Understanding Safety Instrumented Sytem SIL