17.2 SIS Design, Device Selection, and Constraints

From SRS to hardware (5.D, first half)

Once Clause 10 exists, ISA/IEC 61511-1:2018 Clause 11 is the design and engineering of the SIS. The 2027 exam lists device selection, design constraints, SIL formulas, and FAT together under 5.D. This section is the constraints and selection half; the next section is the arithmetic.

The design has to implement this SRS: the same safe state, trip direction, response time, voting, bypass, and proof-test interval. Changing any of those in the field without updating the SRS is a modification under the lifecycle, not a clever shortcut.

Hardware fault tolerance

Hardware fault tolerance (HFT) is the number of dangerous failures a subsystem can sustain and still perform the SIF. HFT 0 is a single channel (1oo1): one dangerous undetected failure fails the function. HFT 1 means the function survives one dangerous failure (typical 1oo2 or 2oo3).

ISA/IEC 61511-1:2018 §11.4 (hardware fault tolerance) gives minimum HFT:

Two exam-critical footnotes travel with that table. First, additional redundancy can still be required so PFDavg or PFH meets 11.9 — architectural minimum is not automatic SIL success. Second, 61511 allows other routes: applying IEC 61508 hardware-fault-tolerance methods, or a one-step HFT reduction when devices are justified by prior use and faults that would be dangerous-undetected can be found by inspection/testing. Do not memorize slogans such as “SIL 2 always needs 1oo2.” Read SIL, mode, and the PFD result together.

Systematic capability versus random hardware

Random hardware failures (λ, PFDavg) are only one barrier. Systematic capability is the defense against specification errors, software defects, incorrect configuration, and poor procedures. A beautiful 1oo2 PFD with the wrong trip set point is still a failed SIF. 61511 attacks systematic failures with the lifecycle, competence, verification, validation, and application-program requirements (Clause 12)—not by adding another identical transmitter that shares the same wrong set point.

Prior use versus IEC 61508-assessed devices

Clause 11.5 gives two legitimate selection routes. Do not invent a unique NCEES list of accepted SIL certificates.

Prior use (proven in use). The user compiles evidence that the device has operated in a similar environment (process, diagnostics, maintenance, demand profile) with sufficient operating experience and a failure history that supports the claimed dangerous-failure behavior. A device that was reliable on clean lube oil is not automatically prior use on wet, plugging slurry. Prior use is a documented argument, not a feeling that “we have always used Brand X.”

IEC 61508 assessment. The manufacturer (often with a third-party certificate) assesses the device to IEC 61508 for hardware and systematic capability. That assessment is evidence that the product development process and failure data are suitable up to a claimed systematic capability, provided the device is used within the assessed configuration, diagnostics, and environment. A certificate does not SIL-rate the SIF. Sensors, logic, and final elements still have to meet HFT, PFD/PFH, independence, and the SRS as an assembled function.

A marketing line “SIL 3 capable” without matching route evidence, environment, and SIF-level verification is not a 5.D answer.

Separation from the BPCS

The SIS must be sufficiently independent of the BPCS to support the claimed SIL, including common-cause and common-mode analysis. Shared sensors, shared final elements, shared logic solvers, shared communications, or shared power/air can make the initiating event and the protection layer fail together. Integrated platforms are not automatically forbidden, but they are not automatically acceptable either: independence has to be shown for the SIL being claimed. Operator graphics that can force outputs around the SIS are a design constraint, not a DCS preference.

Energize-to-trip versus de-energize-to-trip

The SRS (Clause 10) already required the trip direction; Clause 11 has to implement it.

De-energize-to-trip (DTT) removes energy to reach the safe state: dump solenoid vents, spring-return valve moves to the specified fail position, motor starter drops out. Loss of power or instrument air tends toward the safe state, which is why most process ESD valves are DTT.

Energize-to-trip (ETT) applies energy to reach the safe state: some deluge and firewater skids, some machine trips where a de-energized actuator would be the wrong motion. ETT needs secure power, diagnostics, and a clear story for what happens on power loss—because power loss is not the trip.

Mixing DTT solenoids with an ETT narrative is a classic design/SRS mismatch.

Worked: 1oo1 versus 1oo2 versus 2oo3

The NCEES handbook notes (from SIS lifecycle practice) are the qualitative scoring key:

• 1oo1 — one dangerous failure fails the SIF; one safe failure is a trip. Lowest hardware cost; weakest safety and modest spurious-trip rate.
• 1oo2 — either channel can trip. Best safety among simple redundant pairs, more nuisance trips (either channel’s safe failure trips the process).
• 2oo2 — both must agree to trip. Best protection against nuisance trips, worst safety of the dual architectures (a single dangerous failure can prevent the trip).
• 2oo3 (and 1oo2D) — good safety and good spurious-trip behavior because two channels must agree, while a single dangerous failure does not blind the SIF.

Numeric illustration using the NCEES handbook simplified PFDavg models, λDU = 1.0×10⁻⁶ /h, TI = 8760 h (1 year), β = 0.05 as a fraction (5% common cause). Convert units so λ and TI match. If a stem says “5%,” use 0.05; do not plug 5 into λDU·β·TI/2.

• 1oo1: λDU·TI/2 = 4.38×10⁻³
• 1oo2: (λDU²·TI²)/3 + β·λDU·TI/2 ≈ 2.6×10⁻⁵ + 2.19×10⁻⁴ ≈ 2.45×10⁻⁴ (common cause dominates)
• 2oo3: λDU²·TI² + β·λDU·TI/2 ≈ 7.7×10⁻⁵ + 2.19×10⁻⁴ ≈ 3.0×10⁻⁴

Redundancy without a β term on the exam is an incomplete 1oo2/2oo3 story. Diversity (different technologies, separate taps, separate air headers) is how you reduce β; identical channels in one cabinet do not.

FAT of the logic solver versus field devices

ISA/IEC 61511-1 Clause 13 factory acceptance testing is typically performed on the logic solver, application program, diagnostics, and I/O with simulated field signals and forced outputs. FAT confirms that the program matches the SRS/cause-and-effect, that overrides behave as specified, and that detected faults take the specified action.

FAT does not stroke the installed ESD valves on the live unit, prove impulse-line installation, or replace site acceptance testing (5.E). Field sensors and final elements are validated during installation, commissioning, and SAT: loop checks, stroke tests, set-point confirmation, and response-time checks against PST. A clean logic-solver FAT with unproven sticky valves is not a verified SIF.