3.2 Functional Requirements Specification (FRS) & Functional Safety Requirements

3.2 Functional Requirements Specification (FRS) & Functional Safety Requirements

Where the User Requirements Specification (URS) establishes operational expectations, the Functional Requirements Specification (FRS) provides the rigorous engineering blueprint for system design and software logic implementation. Rooted firmly within Domain 2 (Definition) and serving as the technical handoff to Domain 3 (System Design), the FRS articulates precisely how the automated system must behave in response to operational inputs, process disturbances, operator interventions, and hardware faults.

A professionally drafted FRS leaves no room for programmer assumption or integrator interpretation. It translates high-level operational concepts into mathematical loop algorithms, Boolean truth tables, state transition diagrams, alarm rationalization baselines, and safety interlocks. When hazardous energy, toxic materials, or overpressure risks are present, the FRS directly incorporates the Functional Safety Requirements (FSR) mandated by international safety standards including ANSI/ISA-84.00.01 / IEC 61511 (Functional Safety - Safety Instrumented Systems for the Process Industry Sector).

---

Core Components of the Functional Requirements Specification

An industrial automation FRS decomposes complex plant behavior into three primary functional domains: continuous/analog loop control, discrete logic and interlocking, and state-based sequential automation.

1. Analog & Continuous Loop Specifications

For every proportional-integral-derivative (PID) or advanced regulatory control loop, the FRS must specify technical parameters well beyond simple setpoints:

• Algorithm Structure & Mode Selection: Standard ISA PID vs Parallel vs Series; Auto, Manual, Cascade, and Remote modes; bump-free transfer mechanics when switching between modes.
• Controller Action:
  • Direct Acting: Controller Output increases as the Process Variable ($PV$) increases above Setpoint ($SP$) (common in cooling water loops, pressure relief to flare, or level control that manipulates an outlet valve).
  • Reverse Acting: Controller Output decreases as $PV$ increases above $SP$ (standard for steam heating, or for level control that manipulates an inlet valve).
• Anti-Reset Windup & Clamping: Explicit logic for halting integral accumulation whenever the final control element reaches its physical travel limits (0% or 100%), or when an external override or trip condition is active.
• Engineering Units & Signal Conditioning: Defined raw analog ranges (e.g., 4–20 mA, 1–5 VDC), linear vs square-root extraction (for differential pressure flowmeters), digital filtering constants (first-order lag filter time constant $\tau_f$), and deadbands.
• Loop Execution Period (Scan Rate): Fast thermal loops vs slow composition loops; execution frequency (e.g., 50 ms for compressor surge, 250 ms for liquid level, 1.0 s for distillation column temperature).

2. Discrete Logic, Permissives, and Interlocks

Discrete equipment control (pumps, motors, automated isolation valves, agitators) requires unambiguous logical criteria governing initialization, continuous operation, and automatic shutdown:

• Permissive Circuits (Start Inhibit): Discrete conditions that must evaluate to TRUE prior to energizing equipment or opening valves, but which do not necessarily trip running equipment if the condition transitions after startup. Example: Lube oil pressure $> 2.0 \text{ bar}$ and suction valve 100% OPEN before a feed pump motor starter can be energized.
• Running Interlocks (Operational Trip): Continuous logical interlocks that immediately trip or de-energize running equipment if breached, designed to protect mechanical machinery from operational damage. Example: Tripping the feed pump if suction pressure drops below net positive suction head (NPSH) limits for longer than 2.0 seconds.
• Safety Interlocks: Highest-priority interlocks designed to avert catastrophic explosion, toxic dispersion, or loss of containment, operating independently of standard control logic.

3. Sequential and State-Based Control Logic

For batch operations, CIP cycles, or automated unit startup/shutdown sequences, the FRS must define equipment behavior using Finite State Machines (FSMs) or Sequential Function Charts (SFCs) per IEC 61131-3 and ANSI/ISA-88. Each operational state (e.g., Idle, Starting, Executing, Holding, Aborting, Stopping) must have explicitly defined entry conditions, active state actions, exit conditions, and deterministic fault-recovery pathways.

---

Functional Safety Requirements (FSR) per IEC 61511 / ISA-84

In chemical plants, oil refineries, pharmaceutical facilities, and power generation stations, process upsets can escalate into catastrophic industrial disasters. The automation engineer must rigorously delineate between the Basic Process Control System (BPCS) and the Safety Instrumented System (SIS).

┌────────────────────────────────────────────────────────┐
│           Layer 4: Plant Emergency Response             │
├────────────────────────────────────────────────────────┤
│           Layer 3: Physical Relief (PSVs, Rupture Discs)│
├────────────────────────────────────────────────────────┤
│  Layer 2: Safety Instrumented System (SIS / IEC 61511)  │ <── Functional Safety
├────────────────────────────────────────────────────────┤
│  Layer 1: BPCS Alarms & Manual Operator Intervention   │
├────────────────────────────────────────────────────────┤
│  Layer 0: Basic Process Control System (BPCS / PID)    │ <── Normal Regulation
└────────────────────────────────────────────────────────┘

A Safety Instrumented Function (SIF) is a dedicated protective loop comprising three distinct subsystems:

1. Safety Sensors: Independent transmitters or switches detecting hazardous deviation (e.g., pressure transmitters configured in 2-out-of-3 voting architecture).
2. Safety Logic Solver: A certified industrial controller (e.g., SIL 2 or SIL 3 rated per IEC 61508) executing deterministic safety logic, logically and physically segregated from the BPCS.
3. Final Control Elements: Actuated fail-safe emergency isolation valves (ESVs), safety vent valves, or motor breaker trip coils that drive the process to a predefined safe state.

Target Safety Integrity Level (SIL) and Risk Reduction

The required reliability of a SIF is quantified by its Safety Integrity Level (SIL), determined through risk assessment methodologies such as Layer of Protection Analysis (LOPA) or Risk Graphs during the Definition phase.

Process Safety Time (PST) and SIF Response Time

A foundational concept tested heavily on the ISA CAP exam is the relationship between Process Safety Time (PST) and the total SIF Response Time:

• Process Safety Time (PST): The maximum elapsed time between a process deviation occurring (e.g., loss of cooling water causing an exothermic reaction runaway) and the occurrence of the physical catastrophic event (e.g., reactor overpressurization, vessel rupture, or toxic release).
• Total SIF Response Time ($t_{SIF}$): The total cumulative time required for the instrumented system to detect and completely mitigate the hazard:

$t_{SIF} = t_{sensor} + t_{logic} + t_{final\_element}$

Where:

• $t_{sensor}$ is the sensor response time (including sensing element lag and transmitter dampening);
• $t_{logic}$ is the safety controller input scan, logic execution, and output delay;
• $t_{final\_element}$ is the valve stroking time or breaker opening time.

$\text{Mandatory Safety Criterion: } t_{SIF} \ll \text{PST}$

IEC 61511 requires the SIF to reach the safe state in time to prevent the hazardous event, but it does not set a fixed percentage. A widely used industry rule of thumb keeps the total SIF response time at or below 50% of the Process Safety Time ($t_{SIF} \le \text{PST} / 2$) to leave margin for measurement delays and process variation.

---

Fail-Safe State Definitions and Circuit Design

The FRS must unambiguously define the fail-safe state for every automated device upon loss of electrical power, pneumatic instrument air supply, or communication bus integrity:

• Fail Closed (FC): Valve closes upon loss of motive power (e.g., toxic feed lines, heating steam valves).
• Fail Open (FO): Valve drives fully open upon loss of motive power (e.g., cooling water supply lines, emergency flare depressuring valves).
• Fail in Place / Fail Last (FP / FL): Valve locks in its last mechanical position, typically utilizing pneumatic lock-up valves (common in critical draft dampers or high-pressure gas headers where sudden movement creates violent process surges).
• Normally Energized (De-energize to Trip): Industrial safety circuits utilize normally closed dry contacts and continuously energized coils. If a wire breaks, a terminal loosens, or power is lost, the circuit automatically opens, de-energizes the coil, and initiates the fail-safe trip.

---

Alarm and Trip Setpoint Engineering per ISA-18.2

The FRS establishes the alarm rationalization baseline compliant with ANSI/ISA-18.2 (Management of Alarm Systems for the Process Industries). A common design error is clustering alarm thresholds and automatic trip setpoints too close together, leading to alarm flooding and operator confusion.

Process Limit: Vessel Design Pressure (10.0 bar) ─────────────────── [Catastrophic Failure]
                                                                         ▲
Safety Instrumented System (SIS) Trip: PSHH-104 (8.5 bar) ────────── [Automatic SIF Action]
                                                                         ▲ (Buffer: Action Time)
BPCS High-High Operator Alarm: PAH-103 (7.8 bar) ─────────────────── [Urgent Operator Intervention]
                                                                         ▲ (Buffer: Operator Response)
BPCS High Alarm: PA-102 (7.0 bar) ────────────────────────────────── [Early Warning Operator Action]
                                                                         ▲
Normal Operating Window: Maximum Normal Pressure (5.5 bar)

• Deadbands: Every analog alarm needs an engineered deadband to prevent chattering caused by normal process noise. Starting values often cited from ISA-18.2 guidance (ISA-TR18.2.3) are about 5% of the operating range for flow and level, 2% for pressure and 1% for temperature, refined during rationalization.
• Alarm Shelving & Suppression: The FRS must specify automated alarm suppression logic during defined sequence states (e.g., suppressing low-pressure alarms during pump shutdown) to prevent alarm floods.

---

Realistic Industrial Scenario

In a continuous hydrocracker unit at an oil refinery, hydrogen gas is reacted with heavy gas oil at 140 bar and 420°C. An exothermic runaway reaction can occur if the hydrogen-to-hydrocarbon ratio falls below critical stoichiometry. Process modeling established that once temperature excursion begins without cooling, the reactor wall reaches its metallurgical stress rupture limit in 24 seconds (Process Safety Time, $\text{PST} = 24.0 \text{ s}$).

During FRS authoring, the safety engineering team detailed the High-Integrity Pressure Protection and Quench SIF (SIF-301):

1. Sensor Subsystem: Triple-modular redundant (TMR) temperature transmitters configured in a 2-out-of-3 (2oo3) voting matrix ($t_{sensor} = 1.2 \text{ s}$ including thermowell thermal lag).
2. Logic Solver Subsystem: Certified safety PLC executing 2oo3 voting logic and trip algorithms ($t_{logic} = 80 \text{ ms} = 0.08 \text{ s}$).
3. Final Element Subsystem: Dual redundant fail-open cold hydrogen quench valves equipped with high-capacity pneumatic exhaust boosters ($t_{final\_element} = 3.5 \text{ s}$ total stroking time to 100% full travel).

$\text{Total SIF Response Time: } t_{SIF} = 1.2 + 0.08 + 3.5 = 4.78 \text{ seconds}$

Because $4.78 \text{ s} \le 24.0 \text{ s} / 2$ (12.0 s), the SIF design meets the project's 50%-of-PST design criterion, leaving a wide margin before the reactor wall reaches its rupture limit.

---

ISA CAP Exam Pitfalls & Traps

• Trap 1: Violating BPCS and SIS Segregation. An exam scenario may propose sharing a single 4–20 mA pressure transmitter between the BPCS pressure control loop and the SIS emergency shutdown interlock to save capital expenditure. Under IEC 61511 / ISA-84, this is strictly prohibited unless extensive, rigorous diagnostics prove that a failure in the BPCS cannot compromise the safety function. A single common transmitter creates a shared point of failure that disables both control and protection layers simultaneously.
• Trap 2: Confusing Process Safety Time with SIF Response Time. Candidates often mistakenly believe that the SIF has until the end of the Process Safety Time to begin moving the valve. The total SIF response time (detection + logic + valve travel to final safe position) must complete before the Process Safety Time expires.
• Trap 3: Overlooking De-Energize to Trip Fail-Safe Logic. When reviewing cause-and-effect diagrams or electrical schematics, remember that standard industrial safety circuits de-energize to trip. An energized circuit to initiate a trip (normally open contact closing to send power) is vulnerable to severed cables or blown control power fuses, which would silently disable the safety system.