8.4 Safety Instrumented Systems (Supplemental Awareness)

Safety Instrumented Systems (SIS) & Functional Safety

In industrial process control, the Basic Process Control System (BPCS), such as a DCS or PLC, is responsible for normal, everyday operation. However, no control system is perfect. Where hazard analysis assigns a Safety Instrumented Function, the SIS is an independent protection layer intended to move the process to its specified safe state when its demand condition occurs; other processes may use different protection layers.

The Safety Lifecycle and Standards

Functional safety is governed by international standards, primarily IEC 61508 (for manufacturers of safety equipment) and IEC 61511 / ISA-84 (for process industry end-users). These standards define a comprehensive "Safety Lifecycle"—a cradle-to-grave framework for designing, implementing, operating, and maintaining safety systems.

The Safety Lifecycle begins with a Process Hazard Analysis (PHA) to identify risks. If the inherent risks are too high, layers of protection are added. A specific loop designed to mitigate a specific hazard is called a Safety Instrumented Function (SIF). A collection of SIFs makes up the SIS. For example, a high-pressure trip loop on a reactor vessel (consisting of pressure transmitters, a logic solver, and a shutdown valve) is a single SIF.

Safety Integrity Levels (SIL)

Not all hazards carry the same consequences. The standards use Safety Integrity Levels (SIL) to quantify the required risk reduction for a specific SIF. SIL ranges from SIL 1 (lowest risk reduction) to SIL 4 (highest risk reduction). In the process industries, SIL 1 to SIL 3 are common, while SIL 4 is exceedingly rare and usually indicates the process is fundamentally too dangerous to operate.

SIL is defined by two key metrics:

1. Risk Reduction Factor (RRF): How much the SIF reduces the baseline risk. An RRF of 100 means the process is 100 times safer with the SIF than without it.
2. Probability of Failure on Demand (PFD): The statistical likelihood that the SIF will fail to perform its safety function when an emergency occurs.

Achieving a higher SIL requires highly reliable components, increased redundancy, and more frequent testing.

SIS Architectures and Voting Logic

To achieve the required PFD, SIS designs often employ redundant components configured in voting architectures. Voting logic balances the need for safety (ensuring a trip when needed) with the need for availability (avoiding false trips that shut down production unnecessarily).

1oo1 (One-out-of-One)

A single transmitter feeds a logic solver. If the transmitter trips, the process shuts down. It is simple but has no redundancy. A single failure can cause a failure to trip (dangerous) or a nuisance trip (safe but expensive).

1oo2 (One-out-of-Two)

Two identical transmitters monitor the process. If either transmitter (1 out of 2) detects a hazard, the system trips.

• Advantage: Highly safe. It reduces the Probability of Failure on Demand (PFD) significantly.
• Disadvantage: High rate of spurious (false) trips. If either transmitter malfunctions, the plant shuts down.

2oo2 (Two-out-of-Two)

Two transmitters monitor the process. Both transmitters (2 out of 2) must detect a hazard to initiate a trip.

• Advantage: A single sensor voting to trip does not by itself initiate a 2oo2 trip, which can reduce some sensor-caused spurious trips.
• Disadvantage: Less safe than 1oo2. If one sensor fails "dangerously," the system will not trip when it should.

2oo3 (Two-out-of-Three)

Three transmitters monitor the process. If any two detect a hazard, the system trips. 2oo3 is one common arrangement that can tolerate some single-sensor faults, but it is not automatically the correct architecture or a guarantee against nuisance trips. Common-cause failures, diagnostics, proof-test coverage, repair time, bypass state, logic solver, and final element all affect achieved SIL and availability; the safety-requirements specification governs.

Final Control Elements and Testing

The final control element in a SIF is usually an Emergency Shutdown (ESD) valve. Unlike control valves that constantly modulate, ESD valves remain fully open or fully closed for months or years, only moving during an emergency. Because they sit static, they are prone to mechanical sticking.

Proof Testing

To maintain the target SIL, SIS components must undergo regular proof testing to uncover "hidden" dangerous failures. A proof test involves simulating an emergency to ensure the sensors, logic solver, and ESD valve operate correctly. The time between these tests is the Proof Test Interval. For a simple low-demand component with an approximately constant dangerous undetected failure rate, average PFD often increases roughly with proof-test interval. Real SIF calculations must also include architecture, diagnostics, proof-test coverage, repair time, common cause, and final-element behavior.

Partial Stroke Testing (PST)

A full-stroke proof test can require a shutdown or a formally engineered test/bypass arrangement, depending on the process and SIF design. Partial Stroke Testing (PST) is a technique where smart positioners move the ESD valve slightly (e.g., 10% closed) and monitor the pressure and friction response. The observed partial movement can detect some stuck or degraded conditions without a full trip, but it does not prove the entire stroke or every dangerous failure mode. PST can detect only the failure modes covered by the partial movement. Any credit or change to a full-stroke proof-test interval must be justified in the validated SIF calculation and approved procedure; PST never removes the need to test the remaining dangerous failure modes.