Smart Safety Systems

Kee Guan Chia

 Agenda For Smart Safety Seminar
9:30 AM Safety Overview
10:15 AM Break
10:30 AM DeltaV SIS
11:15 AM Break
11:30 AM Safety Loop
12:15 PM Lunch
13:15 PM DeltaV SIS Demos
14:00 PM Break
14:15 PM DeltaV SIS Demos
15:40 PM Question and Answer
16:00 PM Conclusion

Safety Overview
Emerson Confidential, Jan-05, Slide 2
Safety Overview
 Agenda for This Presentation
z Introduction to Safety
z Key Standards – IEC 61511 and S84.01 2004
z What is a Safety Instrumented System (SIS)?
z What is a Safety Instrumented Function (SIF)?
z Risk and Risk Reduction
z Safety Integrity Level (SIL) Levels
z Applications
z Questions about Overview

Safety Overview
Emerson Confidential, Jan-05, Slide 4
 Agenda for This Presentation
z Introduction to Safety
z Key Standards – IEC 61511 and S84.01 2004
z What is a Safety Instrumented System (SIS)
z What is a Safety Instrumented Function (SIF)
z Risk and Risk Reduction
z Safety Integrity Level (SIL) Levels
z Applications
z Questions about Overview

Safety Overview
Emerson Confidential, Jan-05, Slide 5
 The World is Changing
z Raised awareness of the need for proven safety
– History of Disasters
– Regulations & Standards
z Extended Run Time Schedules
– Pressure on OPEX as well as CAPEX
z New Standards Drive New Practices
– Performance-based, not Prescriptive
– Global Commonality
z Constant drive to reduce costs – even for safety
– New technology is providing different solution options

Safety Overview
Emerson Confidential, Jan-05, Slide 6
 Pressure on Plant Management is
Increasing

Scarce Obsolete SIS Proof Test Do We Spurious Never-

Resources Requirements Provide Trips ending
Needs
Adequate causing Regulations
Modernization
Safety? Emissions – Always
Increasing

Safety Overview
Emerson Confidential, Jan-05, Slide 7
 Customer Requirements
1 Certified Safety System (SIL3) – Basic Requirement
2 Risk Management With High Availability
3 Integration With BPCS
End-users End-users
4 Flexible Architecture ExxonMobil Sasol
Shell International Paper
BP Atlantic LNG
5 Ease-of-use Degussa ConocoPhillips
Chevron Bayer
Koch Refining Flint Hills
Saudi Aramco WSRC
Consultants BASF Valero
Exida GASCO Rohm & Haas
AE Solutions Solutia Lubrizol

Safety Overview
Emerson Confidential, Jan-05, Slide 8
 Customer Requirements
1 Certified Safety System (SIL3) – Basic Requirement
2 Risk Management With High Availability
3 Integration With BPCS
End-users End-users
4 Flexible Architecture ExxonMobil Sasol
Shell International Paper
BP Atlantic LNG
5 Ease-of-use Degussa ConocoPhillips
Chevron Bayer
Koch Refining Flint Hills
Saudi Aramco WSRC
Consultants BASF Valero
Exida GASCO Rohm & Haas
AE Solutions Solutia Lubrizol

Safety Overview
Emerson Confidential, Jan-05, Slide 9
 What ’s More Important?
What’s
Safety Or Availability? Both!
CAPEX
OPEX
Total Cost of Ownership
Regulatory Compliance Acceptable Risk Levels

Key
Key is
is to
to meet
meet Safety
Safety Requirements
Requirements while
while maintaining
maintaining
maximum
maximum Plant
Plant Availability
Availability
Safety Overview
Emerson Confidential, Jan-05, Slide 10
 Systems Upgrade Increases Demand For
SIS

Grassroots
and Major Installed Base
Expansion Upgrades
21% 79%

10%
10% ofof this
this market
market is
is AA $65B
$65B Installed
Installed Base
Base
reclassified
reclassified to to SIS
SIS due
due Needing
Needing ToTo Upgrade
Upgrade
to
to new
new standards
standards (ARC
(ARC 2002)
2002)

Safety Overview
Emerson Confidential, Jan-05, Slide 11
 Customer Requirements
1 Certified Safety System (SIL3) – Basic Requirement
2 Risk Management With High Availability
3 Integration With BPCS
End-users End-users
4 Flexible Architecture ExxonMobil Sasol
Shell International Paper
BP Atlantic LNG
5 Ease-of-use Degussa ConocoPhillips
Chevron Bayer
Koch Refining Flint Hills
Saudi Aramco WSRC
Consultants BASF Valero
Exida GASCO Rohm & Haas
AE Solutions Solutia Lubrizol

Safety Overview
Emerson Confidential, Jan-05, Slide 12
 What Is Desired Is Integration Yet
Separation

SIS DCS

Safety Overview
Emerson Confidential, Jan-05, Slide 13
 Interfacing a BPCS to an SIS Today Is
Messy & Risky
AMS OPs OPC ENGIN. SOE.

SOE Bus
Engineering Bus
OPC Bus

Safety Bus
Serial Bus

BUT: IEC 61511 REQUIRES the Control &

Safety Systems to be SEPARATE

Safety Overview
Emerson Confidential, Jan-05, Slide 14
 Customer Requirements
1 Certified safety system (SIL3) – Basic Requirement
2 Risk management with high availability
3 Integration with BPCS
End-users End-users
4 Flexible architecture ExxonMobil Sasol
Shell International Paper
BP Atlantic LNG
5 Ease-of-use Degussa ConocoPhillips
Chevron Bayer
Koch Refining Flint Hills
Saudi Aramco WSRC
Consultants BASF Valero
Exida GASCO Rohm & Haas
AE Solutions Solutia Lubrizol

Safety Overview
Emerson Confidential, Jan-05, Slide 15
 Agenda for This Presentation
z Introduction to Safety
z Key Standards – IEC 61511 and S84.01 2004
z What is a Safety Instrumented System (SIS)
z What is a Safety Instrumented Function (SIF)
z Risk and Risk Reduction
z Safety Integrity Level (SIL) Levels
z Applications
z Questions about Overview

Safety Overview
Emerson Confidential, Jan-05, Slide 16
 Where Faults Originate

Specification
44.1 %

Changes after Design &

Commissioning Implementation
21% 15%
Operation & Installation &
H/W Failures
Maintenance Commisioning
fall into 15% 6%
this category

Accidents Caused by Control and Safety System Failures

Source: Health & Safety Executive, UK

Safety Overview
Emerson Confidential, Jan-05, Slide 17
 Key Regulatory Standards
Has
Hasbeen
beenreplaced
replacedby
by International
International
61511
61511standard
standard Performance-Based
Performance-Based
Standard
StandardFor ForAll
All
Industries
Industries
AK (Applies
(Appliestotosuppliers)
AKRatings
Ratingsfor
for suppliers)
Logic
LogicSolvers
Solvers

Aimed
Aimedat atUsers
Usersand
and
integrators
integrators

Safety Overview
Emerson Confidential, Jan-05, Slide 18
 IEC 61508 Standard
z Requirements for suppliers of
process control equipment for
safety applications
z End-users typically seek
products certified to this
standard by reputable
independent agency

Safety Overview
Emerson Confidential, Jan-05, Slide 19
 T ÜV Is Widely Accepted
TÜV
z Safety Certifying
– Safety light curtains
– Nuclear power plants
– Intrinsic Safety
– Industrial devices (IEC 61508)
– Car tires
– Bottled water
z Internationally accepted certification
of Safety Instrumented Systems

Safety Overview
Emerson Confidential, Jan-05, Slide 20
 Relationship Between IEC 61508 and
IEC 61511
International Performance IEC61513 :
Based Standard For All Nuclear Sector
Industries
(Applies to suppliers)

IEC62061 : Machinery
Sector

IEC61511 : Specific To
Process Industry
Sector
(Applies to End Users
Safety Overview and integrators)
Emerson Confidential, Jan-05, Slide 21
 IEC 61508 Section 2 & 3 Supplier Standard
Applies to Loop Sub -Components
Sub-Components
IEC 61508 guides suppliers in developing and validating
hardware and software.

For the Process Sector, IEC 61508 applies only to loop

Safety Overview components, not the entire loop
Emerson Confidential, Jan-05, Slide 22
 The T ÜV Certification Program
TÜV
z Benefits vendor by
improving product and
minimizing the need to
supply evaluation systems
z Benefits user by supplying
impartial evaluation of
system

Safety Overview
Emerson Confidential, Jan-05, Slide 23
 The T ÜV Certificate
TÜV
z Vendor’s Objective:
– Obtain the TÜV certificate per IEC 61508 for
appropriate SIL application
z In order to get a TÜV certificate to IEC
61508 the vendor must perform in these
areas:
– Hardware: must meet target SIL
expectations measured by the “Safe Failure
Fraction (SFF)” and PFDavg (low dangerous
failure rate)

– Software: must meet software process

requirements for target SIL

– Must pass TÜV assessment

– Must operate per the published User Safety

manual

Safety Overview
Emerson Confidential, Jan-05, Slide 24
 Buyer BEWARE
z The certificate lists the SIL level for which
a product is qualified and the standards
used for the certification
z Some products are certified with
“restrictions”
– The restrictions essentially indicate when a
product does not meet some requirements of
IEC 61508
– The restrictions are listed in the safety manual
and must be followed if safe operation is
required

User
User has
has toto pay
pay
attention
attention to to all
all
Safety Overview
restrictions
restrictions
Emerson Confidential, Jan-05, Slide 25
 IEC 61511 Standard
z Targeted at End Users and integrators
z For the application of SIS in the process industries
z Covers the entire SIS Life Cycle
z Performance based (risk based design)
z Accepted worldwide
z End user applications
are not typically certified
z 3 sections
– Requirements
– Guidelines
– Examples

Safety Overview
Emerson Confidential, Jan-05, Slide 26
 IEC 61511 - End -user/Integrator Standard
End-user/Integrator
Applies to the Entire SIS Life Cycle
z Development of overall safety requirements
z Allocation of the safety requirement to Safety
Instrumented Functions (SIFs)
z Design for Safety Instrumented Systems
z Installation and commissioning
z Operation and maintenance
z System modification and retrofit
z Decommissioning or disposal

Safety Overview
Emerson Confidential, Jan-05, Slide 27
 IEC 61511 Covers The
Life Cycle Of A SIS

Analysis

Implementation

Operation

Safety Overview
Emerson Confidential, Jan-05, Slide 28
 The Emerson Representation of the
IEC 61511 Safety Lifecycle

Safety Overview
Emerson Confidential, Jan-05, Slide 29
 IEC 61511
z Applies:
– To implementers using certified or proven-in-use
equipment integrated into a system
z Does not Apply:
– To manufacturers wishing to claim that devices are
suitable for safety applications

Safety Overview
Emerson Confidential, Jan-05, Slide 30
 IEC 61511
z Applies:
– To application software in limited variability languages
for safety systems (by implementers)
z Does not Apply:
– To embedded code (by manufacturers)

Safety Overview
Emerson Confidential, Jan-05, Slide 31
 Safety Lifecycle Objectives
z Build safer systems that do not experience as
many of the problems of the past
z Build more cost effective systems that match
design with risk
z Eliminate “weak link” designs that cost much but
provide little
z Provide a global framework for consistent
designs

Safety Overview
Emerson Confidential, Jan-05, Slide 32
 Safety Certified Devices Simplify
Compliance With IEC61511

End User Check List For Devices Per IEC 61511

Prior Use Safety Certified
For each device, end user must verify For each device, end user must
9 Extensive history of successful performance obtain
9 List is updated and monitored regularly 9 3rd Party certificate to
9Devices added when experience is obtained IEC61508
9 Manufacturer has Management of Change System
9 Safety Manual
9 Adequate identification of components
9 Specification of components
9 Hardware revision
9 Software revision
9 Demonstration of performance
similar profiles
- Pressure Range
- Impulse piping
- Root valves
- Manifolds
- Transient protection
- Steam Tracing
Similar Environments
- Extreme operating temperatures
- Vibration
- Corrosive atmosphere
9 Volume of operating experience

Safety Overview
Emerson Confidential, Jan-05, Slide 33
 The IEC 61511 Safety Life Cycle

Proof
Tests

Safety Overview
Emerson Confidential, Jan-05, Slide 34
 Proof Test Intervals Should Be Extended
z In Some Cases where there is no diagnostic
coverage
– Test interval: 6 months (some require outages)

While our customers demand longer

periods between proof tests

z With Extended Diagnostics

– Test interval 5 years for the same level of safety!

z Reduced Costs

Safety Overview
Emerson Confidential, Jan-05, Slide 35
Standards Call For Competent Safety Professional
z IEC 61508 “…ensuring that applicable parties
involved in any of the overall E/E/PE or software
safety lifecycle activities are competent to carry
out activities for which they are accountable.”
z IEC 61511 “Persons,
departments, or
organizations involved
in safety lifecycle
activities shall be
competent to carry
out the activities
for which they
are accountable.”
Safety Overview
Emerson Confidential, Jan-05, Slide 36
 Certified Functional Safety Expert (CFSE)
Program
z Operated by the CFSE Governing Board
– To improve the skills and formally establish the
competency of those engaged in the practice of safety
system application in the process and manufacturing
industries.

z Certification audited by TÜV

z www.cfse.org

Safety Overview
Emerson Confidential, Jan-05, Slide 37
 Nonetheless, Ease Of Use Is Vital
z The SIF should be easy to deploy in all aspects
– Easy to design
– Easy to configure
– Easy to certify
– Easy to verify SIF health
– Easy to maintain
– Easy to use (start-up consideration)
– Easy to integrate into BPCS
– Easy to test SIF logic

Safety Overview
Emerson Confidential, Jan-05, Slide 38
 Smart SIS Training
z DeltaV SIS Overview (Couse 7301)
z DeltaV SIS Implementation (Course 7305)

– For more information visit our website:

www.emersonprocess.com/education

– Email: [email protected]

– Phone: (800) 338-8158

Safety Overview
Emerson Confidential, Jan-05, Slide 39
 Agenda for This Presentation
z Introduction to Safety
z Key Standards – IEC 61511 and S84.01 2004
z What is a Safety Instrumented System (SIS)
z What is a Safety Instrumented Function (SIF)
z Risk and Risk Reduction
z Safety Integrity Level (SIL) Levels
z Applications

Safety Overview
Emerson Confidential, Jan-05, Slide 40
 What is a Safety Instrumented System?
z A SIS is a set of
components such as
sensors, logic solvers, and
final control elements
arranged for the purpose of
taking the process to a safe
state when predetermined
conditions are violated.

Safety Overview
Emerson Confidential, Jan-05, Slide 41
 What is a Safety Instrumented System?
z Shutdown (e.g. ESD)
– Automatically takes an industrial process to a safe
state when specified conditions are violated
z Permissive (e.g. BMS during Start-Up)
– Permits a process to move forward in a safe manner
when specified conditions allow
z Mitigation (e.g. F&G)
– Takes action to
mitigate the
consequences
of an industrial
hazard

Safety Overview
Emerson Confidential, Jan-05, Slide 42 exida.com
 DEFINITION: PAS
(Process Automation System)
z A PAS operates under dynamic conditions with
outputs constantly being adjusted for control

Other terms for PAS:

z Distributed Control System
z Digital Automation System

Safety Overview
Emerson Confidential, Jan-05, Slide 43
 DEFINITION: BPCS
(Basic Process Control System)
z In safety circles, a PAS is known as a BPCS
(Basic Process Control System)

“PAS” = “BPCS”
~ “DCS”

Safety Overview
Emerson Confidential, Jan-05, Slide 44
 SIS Considerations
z A SIS is typically passive and takes action only
when a dangerous condition is detected
z Correct working order of all elements is critical
– Therefore SIS design must consider testing and
diagnostics

logic
logic
solver
solver

transmitter
transmitter
shutdown
shutdown
valve
valve

Safety Overview
Emerson Confidential, Jan-05, Slide 46
 Basic Process Control (BPCS) vs. Safety
Instrumented System (SIS)

Separation of BPCS from SIS is required. If

you share any loop elements, all SIS
requirements flow to BPCS.
Safety Overview
Emerson Confidential, Jan-05, Slide 47
 BPCS And SIS Comparison

BPCS SIS
For Control For Safe Shutdown
Dynamic Operation Static Operation
On-line diagnostics Highly effective on-line
useful for failure isolation diagnostics essential for
safety
Periodic test and
inspection required
Regulatory requirements

Safety Overview
Emerson Confidential, Jan-05, Slide 48
 What Components Go Wrong?
Logic
Solver
8%
Sensors
42%
Final
Elements
50%

Source: Offshore Reliability Database (OREDA)

Safety Overview
Emerson Confidential, Jan-05, Slide 49
 Engineering the Loop -
Fault Tolerance Requirements
Fault Tolerance is the ability of a component or subsystem to
continue to be able to undertake the required safety
instrumented function in the presence of one or more
dangerous faults. (Required Redundancy)

Required Fault Tolerance

IEC 61511-1

SIL Fault Tolerance

0 0
1 0
2 1
3 2
4 See 61508 Requirements

Safety Overview
Emerson Confidential, Jan-05, Slide 50
 Adjustments to Fault Tolerance
Requirements
z You may adjust the Fault Tolerance Requirement
down if you can document the following
– SMART devices allow adjustment of device
parameters only and have write protect (jumper or
password)
– … AND ...
– Device has been designated “Prior-Use” (Proven-in-
Use)
– … OR …
– Device is designed per IEC 61508 Sect 2/3 (Use
61508 Fault Tolerance table)

Safety Overview
Emerson Confidential, Jan-05, Slide 51
 Instruments Designed per IEC 61508
Section 2 and 3
z A device is designed per IEC 61508 when it
meets the following:
– Device Architecture ensures a Safe Failure Fraction
is larger than 90%
– Device hardware design meets the “rules” in
Section 2
– Device software development meets the “rules” of
Section 3
– Supplier has completed a FMEDA that determines
the failure rate data
– Supplier has completed a “Safety Manual”
z Certified by a Reputable Agency or Company
– TÜV, FM, UL, etc.

Safety Overview
Emerson Confidential, Jan-05, Slide 52
 Agenda for This Presentation
z Introduction to Safety
z Key Standards – IEC 61511 and S84.01 2004
z What is a Safety Instrumented System (SIS)
z What is a Safety Instrumented Function (SIF)
z Risk and Risk Reduction
z Safety Integrity Level (SIL) Levels
z Applications
z Questions about Overview

Safety Overview
Emerson Confidential, Jan-05, Slide 53
 Safety Instrumented Function (SIF)
A Safety Instrumented Function (SIF) is defined as the functionality
required to protect against a specific hazard. Often this is also interpreted
as the collection of equipment needed to implement that function. Many
systems are designed using a piece of equipment in more than one SIF.

Safety Overview
Emerson Confidential, Jan-05, Slide 54
 DEFINITION: SIF
(Safety Instrumented Function)
z A SIF or safety loop is a functional requirement for the
safety solution
z A logic solver typically contains many SIFs, each with its
own SIL rating

Safety Process What to do SIL

function conditions
SIF #1 Pressure too high Drive output 1 1
SIF #2 Pressure high-high Drive outputs 1 + 2 3

SIF #1
SIF #2
Safety Overview
Emerson Confidential, Jan-05, Slide 55
 Agenda for This Presentation
z Introduction to Safety
z Key Standards – IEC 61511 and S84.01 2004
z What is a Safety Instrumented System (SIS)
z What is a Safety Instrumented Function (SIF)
z Risk and Risk Reduction
z Safety Integrity Level (SIL) Levels
z Applications
z Questions about Overview

Safety Overview
Emerson Confidential, Jan-05, Slide 56
 Risk May Be Quantified
z Risk is a combination of the probability of
occurrence of harm and the severity of that harm

ACTUAL
ACTUAL RISK
RISK

Frequency
Frequency Consequence
Consequence

+ =

+ =
Safety Overview
Emerson Confidential, Jan-05, Slide 57
 Tolerable Risk
z Practically impossible to drive
risk to zero
z At some point we are willing to
accept the amount of risk
posed
z This point is referred to as
tolerable risk

Safety Overview
Emerson Confidential, Jan-05, Slide 58
 Risk Regions

P
r Increasing Risk

o
b
a unacceptable
As
b Pra Lo risk
ctic w
i ab As R
le
l (AL easo
i AR na
t P) bly
tolerable risk OK reg
y ion
Consequence

ALARP = As Low As Reasonably Practicable

Safety Overview
Emerson Confidential, Jan-05, Slide 59
 Inherent Risk

Safety
SafetyEngineer
Engineer
P determines
determinesprocess
processrisk
risk
r
o
b
a unacceptable
b risk
i
l
i
t
y tolerable risk OK
Consequence

ALARP = As Low As Reasonably Practicable

Safety Overview
Emerson Confidential, Jan-05, Slide 60
 Tolerable Risk

P
r
o
b
a
b
i Plant
Planttolerable
tolerablerisk
risk
l determined
determinedbyby
i regulators,
regulators,corporation,
corporation,
t insurance
insurancecompany
companyor or…
…
y

Consequence

ALARP = As Low As Reasonably Practicable

Safety Overview
Emerson Confidential, Jan-05, Slide 61
 Non -SIS Consequence Reduction
Non-SIS

P
r
o
b
a Non-SIS
Non-SISConsequence
ConsequenceReduction:
Reduction:
b e.g.
e.g.material
materialreduction,
reduction,containment
containment
i dikes,
dikes,physical
physicalprotection
protection
l
i
t
y

Consequence

ALARP = As Low As Reasonably Practicable

Safety Overview
Emerson Confidential, Jan-05, Slide 62
 Non -SIS Probability Reduction
Non-SIS

P
r
o
b
a Non
NonSIS
SISProbability
Probability
b Reduction,
Reduction,e.g.
e.g.Pressure
Pressure
i Relief
ReliefValves
Valves
l
i
t
y

Consequence

ALARP = As Low As Reasonably Practicable

Safety Overview
Emerson Confidential, Jan-05, Slide 63
 SIS Risk Reduction

P
r
o
b
a
b SIS
i SISinstallation
installationfurther
furtherlowers
lowers
probability
probabilityor
orconsequence
consequence––the the
l amount
i amountofofrisk
riskreduction
reductionisiscalled
called
Risk
RiskReduction
ReductionFactor
Factor(RRF)
(RRF)
t
y

Consequence

ALARP = As Low As Reasonably Practicable

Safety Overview
Emerson Confidential, Jan-05, Slide 64
 Risk Reduction Through Layers Of
Protection

x x
Emergency response

Mitigate Passive protection

Mitigate
(example: bund)

Active protection
(example: Relief valve,
Incident rupture disk)

SIS
(SIFs)
Trip level alarm
Prevent
Prevent
operator BPCS
intervention (HMI & Alarm Handling)
process alarm

Process BPCS
Value normal behavior (Process Control)

Safety Overview
Emerson Confidential, Jan-05, Slide 65
 Risk May Be Reduced In Many Ways

Calculated Process Risk

Process Design Changes

Other Risk Reduction such

as alarming, procedures,
etc.
Risk

Safety Instrumented
System
Tolerable Level of Risk
(defined by Customer per application)

Safety Overview
Emerson Confidential, Jan-05, Slide 66
 Quantifying Risk
z Every Safety Application is assigned a Risk
Reduction Factor

z The Level of Required Risk Reduction Factor

Defines the Acceptable Probability of Failure on
Demand (PFD) for that SIF
– RRF = 1/PFD

z PFD is often referred to in terms of levels known

as Safety Integrity Levels (SIL)

Safety Overview
Emerson Confidential, Jan-05, Slide 67
 Risk Reduction Classification

RRF PFDavg
(Risk Reduction (Probability of Failure
Factor) on Demand = 1/RRF)
10,000 to 100,000 1/ to 1/10,000
100,000

1,000 to 10,000 1/ to 1/1,000

10,000

100 to 1,000 1/ to 1/100

1,000

10 to 100 1/ to 1/10
100

Safety Overview
Emerson Confidential, Jan-05, Slide 68
 A PFD Is Kept Low Through Proof Tests

Pressure Transmitter PFD

PFD

Proof Test Interval (years)

IfIf aa user’s
user’s application
application is
is SIL
SIL 3,
3, then
then the
the pressure
pressure transmitter
transmitter
needs
needs toto be
be tested
tested 1.6
1.6 years
years (or
(or less)
less)
Safety Overview
Emerson Confidential, Jan-05, Slide 69
 Agenda for This Presentation
z Introduction to Safety
z Key Standards – IEC 61511 and S84.01 2004
z What is a Safety Instrumented System (SIS)
z What is a Safety Instrumented Function (SIF)
z Risk and Risk Reduction
z Safety Integrity Level (SIL) Levels
z Applications
z Questions about Overview

Safety Overview
Emerson Confidential, Jan-05, Slide 70
 Risk Reduction Classification

RRF PFDavg SIL

(Risk Reduction (Probability of Failure
(Safety Integrity Level)
Factor) on Demand = 1/RRF)
10,000 to 100,000 1/ to 1/10,000 4
100,000

1,000 to 10,000 1/ to 1/1,000 3

10,000

100 to 1,000 1/ to 1/100 2

1,000

10 to 100 1/ to 1/10 1
100

Safety Overview
Emerson Confidential, Jan-05, Slide 71
 Installed cost of a SIF

$ $ $ $
$ $ SIL4
SIL3

SIL1/2

$
Source: Exida

Safety Overview
Emerson Confidential, Jan-05, Slide 72
 Trends in SIL for North America
$USK - Millions
$50

$45

$40

$35

$30 2000
2001
$25 2002
2003
2004
$20

$15

$10

$5

$0
SIL 4 ESD SIL 3 ESD SIL 2 ESD SIL 1 ESD
Reference exida 2001 Market Report – used with permission

Safety Overview
Emerson Confidential, Jan-05, Slide 73
 Trends – Europe, Middle East and Africa
$USK - Millions
$50

$45

$40

$35

$30 2000
2001
$25 2002
2003
2004
$20

$15

$10

$5

$0
SIL 4 ESD SIL 3 ESD SIL 2 ESD SIL 1 ESD
Reference exida 2001 Market Report – used with permission

Safety Overview
Emerson Confidential, Jan-05, Slide 74
 SIL Rating Is A Measure Of Risk
z High SIL rated applications (example SIL=4) are
dangerous applications that need process and
equipment changes to drive risk to an acceptable
level
z Low SIL rated applications (example SIL=1)
require careful handling but risk associated with
these applications is far less
z End Users are responsible to ensure that their
actual risk < tolerable risk over the life cycle of
the plant

Safety Overview
Emerson Confidential, Jan-05, Slide 75
 SIL Rating Applies To Each Safety Loop
z The PFD of the loop is dependent on the correct
operation of all the components of the SIF
– Transmitter PT-101 reading pressure correctly?
– Logic solver operating?
– Valve FV-101 moving on demand?

PFDSIF1 = PFDFV-101 + PFDPT-101 + PFDlogic solver

FV-101
PT-101

Safety Overview
Emerson Confidential, Jan-05, Slide 76
 Agenda for This Presentation
z Introduction to Safety
z Key Standards – IEC 61511 and S84.01 2004
z What is a Safety Instrumented System (SIS)
z What is a Safety Instrumented Function (SIF)
z Risk and Risk Reduction
z Safety Integrity Level (SIL) Levels
z Applications
z Questions about Overview

Safety Overview
Emerson Confidential, Jan-05, Slide 77
 SIS Applications by Type
Total SIS Market
$ 700 Million
Others
Turbo
5%
2%

BMS
16%

ESD
F&G 65%
12%

Safety Overview
Emerson Confidential, Jan-05, Slide 78 Source: Exida Market Analysis Aug-2003
 Emergency Shutdown Systems
z 65% of all Safety Applications

z SIL Requirements:
– SIL1
– SIL2
– SIL3 (Negative trend)

z System Size:
– All Sizes possible
– Typical 200 I/O

Safety Overview
Emerson Confidential, Jan-05, Slide 79
 Emergency Shutdown System
ESD
=
A layer of protection
that will Shut the application Down
in a Controlled manner
when pre-set conditions are violated

Safety Overview
Emerson Confidential, Jan-05, Slide 80
 Why an ESD?
Plant and x x
Emergency Emergency response layer
Response

Mitigate Dike Passive protection layer

Relief valve,
Rupture disk
ESD Active
will protection layer
trip
Safety Emergency
Instrumented Safety layer
System Shut Down
Prevent Operator Trip level alarm
Operator
Process failed
Process control layer
Intervention Shutdown

Basic Control Process alarm

Process
Process
Control Value failed
Normal behavior
Process control layer
System

Safety Overview
Emerson Confidential, Jan-05, Slide 81
 Typical ESD Loop
Reset S

P
E R

P
E 2oo3
Air Air

P
E Shutdown!!!

Normal Operation = Energized

De-energize to Trip
BPCS

Safety Overview
Emerson Confidential, Jan-05, Slide 82
 SIS Applications by Type
Total SIS Market
$ 700 Million
Others
Turbo
5%
2%

BMS
16%

ESD
F&G 65%
12%

Safety Overview
Emerson Confidential, Jan-05, Slide 83 Source: Exida Market Analysis Aug-2003
 Fire & Gas Market
z 12% of all Safety Applications

z SIL Requirements:
– No SIL
– SIL1
– SIL2

z System Size:
– Many I/O

z Industries Where Highly Flammable and Toxic Materials Are Handled

z National Rules & Requirements

– EN 54, NFPA 72

Safety Overview
Emerson Confidential, Jan-05, Slide 84
 Fire & Gas System
Fire & Gas System
=
Layer of Protection to Mitigate the
consequences of a hazardous situation

Safety Overview
Emerson Confidential, Jan-05, Slide 85
 Why Do I Need a Fire System?

Detect

Alarm

Extinguish

Safety Overview
Emerson Confidential, Jan-05, Slide 86
 Why Do I Need a Gas System?

Detect
Flammable Gas

Detect
Toxic Gas

Alarm

Safety Overview
Emerson Confidential, Jan-05, Slide 87
 Typical Fire & Gas Loop

Real S
Trip S
S Spray
S
S Energize-to-Trip
OR
S
S
S
Normal Operation
S =
S De-Energized

Safety Overview
Emerson Confidential, Jan-05, Slide 88
 Why Wire Break Detection?

Real S
Trip S
S Wire No
Break Spray
S
S
OR
S
NoNormal Operation
Line Monitoring
S =
I am Blind
De-Energized
S
S
S

Safety Overview
Emerson Confidential, Jan-05, Slide 89
 Why Short Circuit Detection?

Short Circuit Detection

AND
Short
S
S
S Spray
S
S
OR Wet System
S
S
S
S
S
Safety Overview
Emerson Confidential, Jan-05, Slide 90
 SIS Applications by Type
Total SIS Market
$ 700 Million
Others
Turbo
5%
2%

BMS
16%

ESD
F&G 65%
12%

Safety Overview
Emerson Confidential, Jan-05, Slide 91 Source: Exida Market Analysis Aug-2003
 Burner Management System

The purpose of a BMS is to

Safeguard and Control
Fuel Burning Equipment

Safety Overview
Emerson Confidential, Jan-05, Slide 92
 Burner Management System
z 16% of all Safety Applications

z Several Applications
– Heating water and steam generation
– Power plants and waste incineration plants
– Process technology

z Basic principle of incineration always the same:

Typical I/O per incinerator: 14 DI 7 DO 5 AI

z National Rules & Requirements

– NFPA 8501

z SIL Requirements?

Safety Overview
Emerson Confidential, Jan-05, Slide 93
 How Does a BMS Work?
z Transitions from one state to the next:
– Step 1: Pre-firing Purge
– Step 2: Firing Ignition
– Step 3: Firing Main Fuel
– Step 4: Continuous Monitoring
– Step 5: Post-firing Purge

Safety Overview
Emerson Confidential, Jan-05, Slide 94
 BMS Applications
Complexity
Capacity

Application
Heating Water &
Steam Generation

Safety Overview
Emerson Confidential, Jan-05, Slide 95
 BMS Applications
Complexity
Capacity

Application
Heating Water & Power Plant
Steam Generation Waste Incineration

Safety Overview
Emerson Confidential, Jan-05, Slide 96
 BMS Applications
Complexity
Capacity

Application
Heating Water & Power Plant Process
Steam Generation Waste Incineration Technology

Safety Overview
Emerson Confidential, Jan-05, Slide 97
 Agenda for This Presentation
z Introduction to Safety
z Key Standards – IEC 61511 and S84.01 2004
z What is a Safety Instrumented System (SIS)
z What is a Safety Instrumented Function (SIF)
z Risk and Risk Reduction
z Safety Integrity Level (SIL) Levels
z Applications
z Questions about Overview

Safety Overview
Emerson Confidential, Jan-05, Slide 98
Safety Overview
Questions