ANSIISA–84.01–1996 - Application of SIS for Process Industri

AMERICAN NATIONAL STANDARD

ANSI/ISA–84.01–1996 Formerly ANSI/ISA–S84.01–1996

Application of Safety Instrumented Systems for the Process Industries

NOTICE OF COPYRIGHT This is a copyrighted document and may not be copied or distributed in any form or manner without the permission of ISA. This copy of the document was made for the sole use of the person to whom ISA provided it and is subject to the restrictions stated in ISA’s license to that person. It may not be provided to any other perso person n in print, electronic, electronic, or any other form form.. Violat Violations ions of ISA ISA’s ’s copyright will be prosecuted to the fullest extent of the law and may result in substantial civil and criminal penalties.

Approved 15 March 1997 TM

ISA–The Instrumentation, Systems, and Automation Society

The world's largest digital library

Try Scribd FREE for 30 days to access over 125 million titles without ads or interruptions! Start Free Trial Cancel Anytime.

























ANSI/ISA-84.01-1996 — Application of Safety Instrumented Systems for the Process Industries

ISBN: 1-55617-590-6

Copyright © 1996 by the Instrument Society of America. All rights reserved. Printed in the United States of America. No part of this publication may be reproduced, stored in a retrieval r etrieval system, or transmitted in any form or by any means (electronic, mechanical, photocopying, recording, or otherwise), without the prior written permission of the publisher. ISA



























Preface

This preface as well as all footnotes, annexes, and draft technical report 84.02 (ISA-dTR84.02) are included for informational purposes and are not part of ANSI/ISA-84.01 -1996. ISA-dTR84.02 was still in development at the time that ANSI/ISA-84.01 -1996 was published; for information, contact ISA. This standard has been prepared as part of the service of ISA, the international society for measurement and control, toward a goal of uniformity in the field of instrumentation. instrumentation. To be of real value, this document should not be static but should be subject to periodic review. review. Toward this end, the Society welcomes all comments and criticisms and asks that they be addressed to the Secretary, Secretary, Standards and Practices Board; ISA; 67 Alexander Drive; P. P. O. Box 12277; Research Triangle Park, NC 27709; Telephone Telephone (919) 549-8411; Fax (919) 549-8288; E-mail: [email protected]. The ISA Standards and Practices Department is aware of the growing need for attention a ttention to the metric system of units in general, and the International System S ystem of Units (SI) in particular, in the preparation of instrumentation standards, recommended practices, practices, and technical reports. reports. The Department is further aware of the benefits to USA users of ISA standards of incorporating suitable references to the SI (and the metric system) in their business and professional dealings with other countries. Toward this end, this Department will endeavor to introduce SI and acceptable metric units in all new and revised standards to the greatest extent possible. The Metric Practice Guide , which has been published by the Institute of Electrical and Electronics Engineers as ANSI/IEEE Std. 268-1992, and future revisions, will be the reference guide for definitions, symbols, abbreviations, and conversion factors. It is the policy of ISA to encourage and welcome the participation of all concerned individuals and interests in the development development of ISA standards. Participation in the ISA standards-making standards-making process by an individual in no way constitutes endorsement by the employer of that individual, of ISA, or of any of the standards, recommended practices, and technical reports that ISA develops. S84.01 has been developed with the intent that it will eventually become a part of a group of standards being developed by the International International Electrotechnical Commission Commission (IEC). This has resulted in a format and structure that may be somewhat different from previous ISA Standards. Some background information is, therefore, offered to assist the reader in better understanding the focus of S84.01. IEC has commissioned the development of a set of international standards encompassing all aspects of safety safety systems systems for all industries. industries. It is titled titled "Functional Safety: Safety: Safety-Related Systems." This effort is under the direction of IEC Technical Technical Committee No. 65, Subcommittee 65A, Working Group 10. It is titled IEC draft Publication 1508 and a nd is still in development but, as it exists today, today, there are seven parts: • Part Part 1 - General General requir requireme ements nts • Part 2 - Requirements for Electrical/Electronic Electrical/Electronic / Programmable Electronic Systems (E/E/PES)



























• Part 7 - Bibliograp Bibliography hy of technique techniques s and measures measures This work is to define requirements requirements common to all industries. It is IEC's intent that there will then be additional standards developed to reflect specific requirements for the various industry sectors, such as nuclear, pharmaceutical, aeronautical, process, etc. IEC has commissioned a subcommittee, identified as IEC 1511, for the development of an industry-specific international standard that addresses the application of safety instrumented systems for the process industries. ISA-S84.01-1995 has been written with the intent that it will will serve as the basis for that sector-specific sector-specific standard. The structure, format, and content of S84.01 has been developed in this context. context. There are significant differences differences in S84.01 from IEC draft Publication 1508-1995, as described in Clause 12. However, However, IEC draft Publication 1508 was still being developed at the time that S84.01 was published. As a result, ISA SP84 will will continue to support and monitor IEC draft Publication 1508 development and will modify S84.01 as needed when IEC draft Publication 1508 is published. The IEC style guide has been used to facilitate the harmonization of this material with the general standards and other sector-specific standards being developed for IEC draft Publication 1508.

The following people served as active members of ISA Committee SP84: NAME V. Maggioli, Chairman R. Boyd, Jr., Vice Chairman W. Calder III, Managing Director *R. Adamski R. Aldridge R. Bailliet N. Battikha L. Beckman R. Bell S. Bender P. Bennett K . B i ng h am W. Black J. Blagg R. Bloomfield * K . B ond K. Bosch S. Boyer *B. Bradley A. Brombacher D. Brown *L. Brown M. Cannon

COMPANY Feltronics Corporation Aramco Calder Enterprises Triconex Consultant Shell Offshore, Inc. ICI Canada, Inc. HIMA Americas, Inc. Technology & Health Sciences Division S.K. Bender & Associates Center for Software Engineering Hinz Consulting, Ltd. BP GRE Eco Waste Technologies Adelard Shell Oil Company G3 IQSE Iliad Engineering, Inc. Mobil Research & Development Corporation Eindhoven University of Technology Fisher-Rosemount Systems Arco Oil & Gas Industrial Equipment Company



























R. Dillman

Conoco, Inc.

NAME

COMPANY

J. Duran P. Early *R. Ewbank T. Fisher J. Forrest *T. Frederickson, Jr. R. Freeman D. Fritsch *K. Gandhi R. Gardner *F. Gellner J. Gilman R. Glaser W. Goble *C. Goring *J. Gray D. Green T. Green J. Greenwald *R. Grehofsky P. Gruhn *A. Habib *A. Hamers A. Hammons B. Hampton C. Hardin D. Haysley *A. Heckman *K. Hill L. Hoffman B. Humes *D. Inverso J. Jarvi W. Jay K. Jennings D. Jensen R. Johnson *W. Johnson *D. Karydas K. Kassner R. Kier D. Leonard

Lagoven SA ABB Industrial Systems, Inc. Rhone-Poulenc, Inc. Lubrizol Corporation ABS Industrial Verification, Inc. Triconex Monsanto Phillips Petroleum Company M. W. Kellogg Company DuPont Engineering E. I. du Pont de Nemours & Company Procter & Gamble Company Dow Chemical Company Moore Products Company August Systems, Ltd. Chevron Research & Technology Company Rohm & Haas Stubbs Overbeck & Associates Fina Oil & Chemical Company E. I. du Pont de Nemours & Company Industrial Control Service, Inc. Rhone-Poulenc, Inc. Honeywell SMS Chevron USA Consultant Hoechst Celanese Corporation Murphy Oil Company Bently Nevada Mobil Research & Development Corporation BASF Corporation Bently Nevada E.I. du Pont de Nemours & Company Teknillinen Tarkastuskeskus Entergy Operations, Inc. Square D Company Price Engineering Company Kingwood Technology Group E. I. du Pont de Nemours & Company Factory Mutual Research Corporation CALTEK Pacific-Minas Corporation Kinetics Technology International Consultant



























S. McCormick

3M Company

NAME

COMPANY

*M. McElroy F. McKenna N. McLeod R. McNab *F. Mears *W. Mostia, Jr. I. Nimmo J. Nye *D. Ogwude T. Ostrowski *J. Palomar J. Paques B. Phelps *W. Purser R. Raghaven G. Ramachandran *K. Rashida C. Richard L. Richardson *C. Rischar *W. Robinson G. Russcher *D. Sanders K. Schilowsky J. Schroeder R. Shah T. Shephard *J. Simon I. Smith S. Smith J. Sottnik R. Spiker R. Spinks *P. Stavrianidis R. Stevens H. Storey L. Suttinger H. Thomas *C. Thurston M. Toffolo *W. Valerie T. Walczak

Pepperl + Fuchs Systems FMcK Associates, Ltd. Elf Atochem Arco Chemical Company Mobil Research & Development Corporation Amoco Corporation Honeywell, Inc. Exxon Research and Engineering Company Chevron Research & Technology Company Occidental Chemical Corporation Chevron Research & Technology Company Institut de Recherche Citgo Petroleum Corporation Shell Oil Company Consultant Cytec Industries, Inc. Allen-Bradley Company Mobil Oil Company UOP Allen-Bradley Company Amoco Corporation Westinghouse Electric Company August Systems, Ltd. Marathon Oil Company Tosco Corporation Koch Industries Caltex Services Corporation M. W. Kellogg Company Campbell Love Associates Touch Technology, Inc. United Engineers & Constructors GTI Industrial Automation Petrocon Engineering, Inc. Factory Mutual Research Corporation U.S. Department of Energy Shell Development Company Westinghouse Savannah River Company Air Products & Chemicals Union Carbide Corporation Elsag Bailey (Canada), Inc. Arco Oil & Gas GE Fanuc





























W. Welz, Jr. *G. Wristen

BHP Engineers & Constructors, Inc. E. I. du Pont de Nemours & Company

This published standard was approved for publication by the ISA Standards and Practices Board on February 15, 1996. NAME

COMPANY

M. Widmeyer, Vice President H. Baumann D. Bishop P. Brett W. Calder III H. Dammeyer R. Dieck W. Holland A. Iverson K. Lindner T. McAvinew A. McCauley, Jr. G. McFarland J. Mock E. Montgomery D. Rapley R. Reimer R. Webb W. Weidman J. Weiss J. Whetstone H. Wiegle C. Williams G. Wood M. Zielinski

Washington Public Power Supply System H. D. Baumann, Inc. Chevron USA Production Company Honeywell, Inc. Calder Enterprises Phoenix Industries, Inc. Pratt & Whitney Southern Company Services, Inc. Lyondell Petrochemical Company Endress + Hauser GmbH + Company Metro Wastewater Reclamation District Chagrin Valley Controls, Inc. Honeywell Industrial Automation & Control Consultant Fluor Daniel, Inc. Rapley Engineering Services Rockwell Automation A-B Pacific Gas & Electric Company Consultant Electric Power Research Institute National Institute of Standards & Technology Canus Corporation Eastman Kodak Company Graeme Wood Consulting Fisher-Rosemount

























































Contents

Introduction ......................... ...................................... .......................... .......................... .......................... ......................... ......................... .......................... ......................... ............ 13 1 Scope ......................... ...................................... .......................... ......................... ......................... .......................... .......................... .......................... ......................... ................... ....... 15 1.1 Boundaries of the Safety Instrumented System (SIS) .......................... ....................................... ....................... .......... 15 1.2 Exclusions ........................ ..................................... .......................... .......................... .......................... ......................... ......................... .......................... ............... 16 2 Conformance to this standard ...................... ................................... .......................... .......................... .......................... ......................... ................... ....... 17 2.1 Conformance guidance ......................... ...................................... .......................... .......................... .......................... ......................... ................... ....... 17 2.2 Existing systems ........................ ..................................... .......................... .......................... .......................... ......................... ......................... .................. ..... 17 3 Definition of terms and acronyms............. acronyms .......................... ......................... ......................... .......................... .......................... ....................... .......... 18 3.1 Definitions ......................... ...................................... .......................... .......................... .......................... ......................... ......................... .......................... ............... 18 3.2 Acronyms Acronyms............ ......................... ......................... ......................... .......................... .......................... ......................... ......................... .......................... ................ ... 22 4 Safety life cycle ......................... ..................................... ......................... .......................... .......................... ......................... ......................... .......................... ................ ... 23 4.1 Scope .......................... ....................................... ......................... ......................... .......................... .......................... .......................... ......................... ................... ....... 23 4.2 Safety Life Cycle steps ......................... ...................................... .......................... .......................... .......................... ......................... ................... ....... 25 5 Safety requirements specifications development ......................... ...................................... .......................... ....................... .......... 27 5.1 5.2 5.3 5.4

Objective .......................... Objective............. ......................... ......................... .......................... .......................... ......................... ......................... .......................... ................ ... 27 Input requirements............ requirements ......................... .......................... .......................... .......................... ......................... ......................... .......................... ............... 27 Safety functional requirements ........................ ..................................... .......................... .......................... .......................... ..................... ........ 27 Safety integrity requirements .......................... ...................................... ......................... .......................... .......................... ....................... .......... 28

6 SIS conceptual design............ design ........................ ......................... .......................... .......................... .......................... ......................... ......................... .................. ..... 28 6.1 Objectives ......................... ...................................... .......................... .......................... .......................... ......................... ......................... .......................... ............... 28 6.2 Conceptual design requirements ......................... ...................................... .......................... ......................... ......................... .................. ..... 28 7 SIS detailed design .......................... ....................................... ......................... ......................... .......................... .......................... .......................... ..................... ........ 29





























9 SIS operation and maintenance ......................... ...................................... .......................... ......................... ......................... .......................... ............... 38 9.1 9.2 9.3 9.4 9.5 9.6 9.7 9.8

Objective .......................... Objective............. ......................... ......................... .......................... .......................... ......................... ......................... .......................... ................ ... 38 Training............. Training .......................... ......................... ......................... .......................... .......................... .......................... ......................... ......................... .................. ..... 38 Documentation ......................... ..................................... ......................... .......................... .......................... .......................... ......................... ................... ....... 38 SIS operating procedures ......................... ...................................... .......................... ......................... ....................... ........................ .................. ..... 38 Maintenance program............. program .......................... ......................... ......................... .......................... .......................... .......................... ..................... ........ 38 Testing, inspection, and maintenance ........................ ..................................... .......................... .......................... ....................... .......... 39 Functional testing ........................ ..................................... .......................... .......................... ......................... ......................... .......................... ................ ... 39 Documentation of functional testing ........................ ..................................... ......................... ......................... .......................... ............... 40

10 SIS Management Of Change (MOC) .......................... ....................................... .......................... ......................... ......................... .................. ..... 41 10.1 Objective Objective............. ......................... ......................... .......................... .......................... .......................... ......................... ......................... .......................... ............... 41 10.2 MOC procedure ......................... ...................................... .......................... .......................... ......................... ......................... .......................... ................ ... 41 10.3 MOC documentation............. documentation .......................... ......................... ......................... .......................... .......................... .......................... ..................... ........ 42 11 Decommissioning ........................ ..................................... .......................... ......................... ......................... .......................... .......................... ....................... .......... 42 11.1 Objective Objective............. ......................... ......................... .......................... .......................... .......................... ......................... ......................... .......................... ............... 42 11.2 General .......................... ...................................... ......................... .......................... .......................... ......................... ......................... .......................... ................ ... 43 12 Differences .......................... ....................................... ......................... ......................... .......................... .......................... .......................... ......................... ................... ....... 43 12.1 Terminology ........................ ..................................... .......................... ......................... ......................... .......................... .......................... ....................... .......... 44 12.2 Organizational differences .......................... ....................................... ......................... ......................... .......................... ......................... ............ 44 12.3 Technology differences ...................... ................................... .......................... .......................... .......................... ......................... ................... ....... 46 Annexes A (Informative) — Information and examples illustrating methods for determining Safety Integrity Level (SIL) for a Safety Instrumented System (SIS) ........ .......... 47 A.1 Introduction .......................... ....................................... .......................... ......................... ......................... .......................... .......................... ....................... .......... 47 A.2 Safety Integrity Level (SIL) considerations and the process example ......................... ......................... 48 A.3 Example methods for selecting SIL ......................... ...................................... ......................... ......................... .......................... ............... 50 B (Informative) — SIS design considerations .......................... ....................................... .......................... ......................... ................... ....... 55 B.1 Separation - identical or diverse .......................... ....................................... .......................... ......................... ......................... .................. ..... 55 B.2 Redundancy - identical or diverse 58





























D (Informative) — Example ......................... ...................................... .......................... ......................... ......................... .......................... ......................... ............ 85 D.1 D.2 D.3 D.4 D.5 D.6

Introduction to the example problem ....................... .................................... ......................... ......................... .......................... ............... 85 Safety Life Cycle (Figure 4.1) ......................... ...................................... .......................... .......................... .......................... ..................... ........ 85 Safety requirement specification ......................... ...................................... .......................... ......................... ......................... .................. ..... 85 Safety integrity requirements (5.4) ........................ ..................................... ......................... ......................... .......................... ................ ... 88 Conceptual design (6.0) ....................... .................................... .......................... .......................... .......................... ......................... ................... ....... 89 Detail design (7.0) ......................... ...................................... .......................... .......................... ......................... ......................... .......................... ............... 90

E (Informative) — Index............. Index ......................... ......................... .......................... .......................... .......................... ......................... ......................... .................. ..... 93 Figures 1.1 4.1 A.1 A.2 A.3 D.1 D.2

— Definition of Safety Instrumented Systems (SIS) .......................... ....................................... .......................... ..................... ........ 16 — Safety Life Cycle .......................... ...................................... ......................... .......................... .......................... .......................... ......................... ................... ....... 24 — Company ABC, Site XX, Specific SIL implementation techniques, example only ..... ......... ...... 50 — Process example ......................... ..................................... ......................... .......................... .......................... .......................... ......................... ................... ....... 51 — Company ABC, Site XX, Example of a qualitative matrix for the determining SIL ..... ......... ...... 52 — Basic process control scheme ......................... ...................................... ......................... ......................... .......................... ......................... ............ 86 — Tentative design solution ......................... ...................................... .......................... .......................... .......................... ......................... ................... ....... 91

Tables 3.1 4.1 A.1 B.5.1 B.5.2 B.9.1 B.9.2

— Safety Integrity Level (SIL)............. (SIL) .......................... .......................... .......................... ......................... ......................... .......................... ............... 21 — Safety Integrity Level performance requirements .......................... ...................................... ......................... .................. ..... 25 — Modified HAZOP documentation example .......................... ...................................... ......................... .......................... ................ ... 53 — Typical SIS failure modes ......................... ...................................... .......................... ......................... ......................... .......................... ................ ... 64 — Typical Programmable Electronic Failure Modes ....................... .................................... .......................... ..................... ........ 65 — Fault types............. types ......................... ......................... .......................... .......................... .......................... ......................... ......................... .......................... ............... 70 — Diagnostic tests for programmable electronics .......................... ....................................... .......................... ..................... ........ 72





























































Introduction

Purpose This standard addresses the application of Safety Instrumented Systems (SIS) for the process industries. The SIS addressed includes Electrical Electrical (E)/, Electronic (E)/ (E)/ and Programmable Electronic (PE) technology. This standard is process industry specific within the framework of the International Electrotechnical Commission (IEC) draft Publication 1508 (References C.8 and C.9). This standard follows the Safety Life Cycle presented presented later (see Figure 4.1). 4.1). This document is intended for those who are involved with SIS in the areas of • design design and manufacture manufacture of SIS products, products, selection selection,, and application application • installati installation, on, commissionin commissioning, g, and Pre-Startup Pre-Startup Acceptance Acceptance Test • operation, operation, maintenance maintenance,, documentatio documentation, n, and testing testing Objective The objective is to define the requirements for Safety Instrumented Systems.





























































1 Scope

NOTE — THIS CLAUSE IS PART OF THIS STANDARD STANDARD AND AN D CONTAINS MANDATORY MANDATORY REQUIREMENTS. This standard addresses Electrical/Electronic/Programmable Electronic System (E/E/PES), associated sensors, final elements, and interfaces used in automated Safety Instrumented Systems (SIS) for the the process industries (Reference (Reference C.6). Examples of the E/E/PES technologies are: a) Electr Electrome omecha chanic nical al relays; relays; b) Soli Solid d stat state e logi logic; c; c) PES; d) Mot Motoror-dri driven ven timers timers;; e) Solid Solid state state rela relays ys and and timers timers;; f) Ha Hard rd-w -wir ired ed logi logic; c; and g) Com Combin binati ations ons of the the above above..

1.1 Boundaries of the Safety Instrumented System (SIS)































Figure 1.1 — Definition of Safety Instrumented Systems (SIS)

1.2 Exclusions 1.2.1 This standard identifies all the steps of the Safety Life Cycle (see Figure 4.1) but does not define the method(s) that may be used in some of the steps. 1.2.2

This standard does not address management of the non-SIS portion of the design or the

































1.2.10 This standard does not consider the use of technology that is not currently utilized in Sa fety Instrumented Systems. Systems. As new technology technology evolves and becomes available (e.g., ISA ISA SP50 Fieldbus) it will be addressed in scheduled (5 year) year) revisions to this standard. In the interim, if new system performance justifies its use, new technology shall be user approved before use in safety applications. In these cases, the new technology implementation implementation may require exception to some standard requirements of S84.01. Exceptions shall be documented documented to demonstrate that the the new approach satisfies the safety requirements. 1.2.11 Analysis of the capability of humans to act on human-machine interface information is part of the Process Hazards Analysis and is outside the scope of this standard. 1.2.12 Instrumentation installed for the purpose of monitoring conditions that may lead to chronic health effects is not covered by this standard. 1.2.13 This standard does not cover instrumentation installed principally for the purpose of property protection.

































3 Definition of terms and acronyms

NOTE — THIS CLAUSE IS PART OF THIS STANDARD STANDARD AND AN D CONTAINS MANDATORY MANDATORY REQUIREMENTS.

3.1 Definitions For the purposes of this standard, the following definitions apply: 3.1. 3.1.1 1

appl applic icat atio ion n progr program am:: See software (3.1.58.1). (3.1.58.1) .

3.1. 3.1.2 2

appl applic icat atio ion n soft softwa ware re:: See software (3.1.58.1). (3.1.58.1) .

































3.1.12 de-ene 3.1.12 de-energiz rgize e to trip: trip: SIS circuits where the outputs and devices are energized under normal nor mal operation. Removal of the source of power (e.g., electricity, electricity, air) causes a trip action. 3.1. 3.1.13 13 dema demand nd:: A condition or event that requires the SIS to take appropriate action to prevent a hazardous event from occurring or mitigate the consequence of a hazardous event. 3.1.14 diagno 3.1.14 diagnosti stic c covera coverage: ge: For SIS with active fault-detection capabilities, the ratio of detectable faults to the total number of faults. 3.1. 3.1.15 15 dive divers rse: e: Use of different technologies, equipment or design methods to perform a common function with the intent to minimize common cause faults (see 3.1.45, 3.1.55, and B.2) B.2).. 3.1.16 Electrical Electrical (E)/ Electronic (E)/Program (E)/Programmable mable Electronic Electronic Systems (PES) (E/E/PES): (E/E/PES): When used in this context, electrical refers to logic functions performed by electromechanical techniques, (e.g., electromechanical relay, motor driven timers, etc.), electronic refers to logic functions performed by electronic techniques, (e.g., solid state logic, solid state relay, etc.), and Programmable Electronic System refers to logic performed by programmable or configurable de-

































3.1.29 3.1 .29 input/ input/out output put modules modules 3.1.29.1 input module: E/E/PES or subsystem that acts as an interface i nterface to external devices and converts input signals into signals that the E/E/PES can utilize. 3.1.29.2 output module: E/E/PES or subsystem that acts as an interface to external e xternal devices and converts output signals into signals that can actuate external devices. 3.1. 3.1.30 30 inte interf rfac ace: e: Shared boundary through which information is conveyed. 3.1.31 3.1 .31 integr integrati ation: on: Process of assembling multiple components or subsystems to form a system. 3.1.32 logic 3.1.32 logic solver solver:: E/E/PES components or subsystems that execute the application logic. Electronic and programmable electronics include input/output modules. 3.1. 3.1.33 33 offoff-lin line: e: Process, to which the SIS is connected, is shut down. 3.1. 3.1.34 34 on-li on-line ne:: Process, to which the SIS is connected, is operating. op erating.

































3.1.45 redund 3.1.45 redundanc ancy: y: Use of multiple elements or systems to perform the same function. Redundancy can be implemented by identical elements (identical redundancy) redu ndancy) or by diverse elements (diverse redundancy). 3.1. 3.1.46 46 relia reliabil bilit ity: y: Probability that a system can perform a defined function under stated conditions conditions for a given period of time. 3.1.47 3.1 .47 replace replacemen mentt in kind: kind: A replacement that satisfies the design specification. 3.1. 3.1.48 48 rese reset: t: Action that restores the equipment under control to a predetermined p redetermined normal enabled or operating state. 3.1.49 risk assessm 3.1.49 assessment ent:: Process of making risk estimates and using the results to make decisions. 3.1. 3.1.50 50 safe safe stat state: e: State that the equipment under control, or process, shall attain as defined by the Process Hazards Analysis (PHA).



































3.1. 3.1.58 58 soft softwa ware re 3.1.58.1 application software: Software specific to the user application in that it is i s the SIS functional description programmed in the PES to meet the overall Safety Requirement Specifications (see Clause 5). In general, it contains logic sequences, permissives, limits, expressions, etc., that control the appropriate input, output, calculations, decisions necessary to meet the safety functional requirements.

































PES:

Programmable Electronic System

PFD:

Probability of Failure on Demand

PHA:

Process Hazards Analysis

PSAT:

Pre-Startup Acceptance Test

PSSR:

Pre-Startup Safety Review

































































During the Safety Life Cycle of a SIS, there may be points where iterations are necessary. necessary. A few of these are indicated in the Safety Life Cycle presented, but these should not be considered the only points where iteration may be necessary.

4.2 Safety Life Cycle steps

































The SIL concept is utilized in several steps of the Safety Life Cycle. See Annex A for guidance on SIL determination. The method for accomplishing this step is outside outside the scope of this standard. 4.2.6 The next step is developing Safety Requirement Specifications. Specifications. The Safety Requirement Specifications document functional and integrity requirements for the SIS (see Clause 5).



































































































































































































































































































































































































































































































































































































































































































































































































































































































B.4.4.2.8 Electromechanical relays may not be suitable for SIS applications with a) high duty-cy duty-cycles cles resultin resulting g in frequent frequent state changes changes;; b) timers timers or latch latching ing funct function ions; s; c) comple complex x math math fun funct ctions ions;; d) ana analog log measur measureme ements nts;; and and e) large large lo logic gic applica applicatio tions. ns. B.4.4.3 Motor driven timers B.4.4.3.1 Motor driven timers provide acceptable performance for key safety applications such as burner purge timing. Most motor driven timers require require a locking device or appropriate modification modification to eliminate tampering with critical settings. settings. Motor driven timers are limited in timing resolution resolution and the ability to handle high duty cycles. B.4.5 Electronic technology used in SISs B.4.5.1 Solid state relays B.4.5.1.1 Solid state relays are used in high duty-cycle application and have unsafe failure modes that can be identified and quantified. Appropriate design features should be added to handle these unsafe failure modes. Some additional applications of solid state relays are described described in the following paragraphs. B.4.5.2 Solid state timers B.4.5.2.1 Solid state timers are used where the application’s complexity does not warrant a PES. Solid state timer technology can be categorized as either Resistor-Capacitor (RC) circuit or pulse counting. RC timing devices may not be suitable for safety safety applications because of poor repeatrepeatability and unsafe failure modes. Note that RC circuitry is often often used in the time setting portion of pulse-counting timers; this does not preclude the use of o f these timers. B.4.5.2.2 The pulse-counting timer, sometimes referred to as a digital timer, can use a number of methods to achieve pulse counting. These include a) a line line freque frequency ncy (50 (50 or 60 60 Hz); Hz); b) an elect electroni ronic c oscill oscillato ator; r; and c) a quartz quartz cryst crystal al oscil oscillat lator. or. B.4.5.2.3 A user-approved safety crystal oscillator (e.g., quartz) timer is recommended because of high repeatability and good reliability. B.4.5.3 Solid state logic B.4.5.3.1 Solid state logic refers to the transistor family of components like Complimentary Metal Oxide Semiconductor (CMOS), Resistor-Transistor Logic (RTL), transistor-transistor logic (TTL),



























B.4.5.3.2 Solid state logic has generally been integrated with direct-wiring and relay schemes for SIS. Solid state logic is not recommended recommended for SISs unless provided with with additional diagnostics to test for unsafe failure modes. PESs are sometimes used as a diagnostic tool to make solid state logic systems suitable for SIS. B.4.5.4 Pulsed electronic logic B.4.5.4.1 Pulsed electronic logic generates pulses pulses with a specified amplitude and period. A pulse train is recognized as a logic "true” or "one," while all other signals (e.g., grounds, non-specified pulses, and continuous "on" or "off") are recognized as a logic "false" or "zero." B.4.5.4.2 Pulsed electronic logic can be considered in a SIS if it meets the requirements noted in this standard and is user approved. B.4.5.4.3 Pulsed electronic logic can offer high safety integrity. However, However, PES designs offer some functions that may not be available with pulsed solid state systems or electronic logic such as calculation capability, capability, improved communications, and networking. B.4.6 PES technology used in SIS B.4.6.1 The PES can be a programmable controller, a distributed control system controller, or an application-specific stand stand alone microcomputer. Caution should be used when using personal personal computers, since they generally do not have the safety integrity required for SIS applications. B.4.6.2 The use of PES results in many difficult to recognize failure modes, many of which can be unsafe. B.4.6.3 Some techniques that can be used to minimize the unsafe failure modes of PES are a) extensive extensive diagnos diagnostics tics to detect detect covert covert faults faults (see B.9 for guidance); guidance) ; b) use of redundancy, redundancy, fault fault tolerance tolerance (e.g., 2oo3), 2oo3), and similar similar architecture architectures; s; c) use of Watchd Watchdog og Timers, Timers, both both internal internal and external; external; and and d) use of outputs outputs with diagnost diagnostics ics to detect detect output output module failures failures.. B.4.6.4 Select PES technology for SIS when a) there are are large numbers numbers of Input/ Input/Outpu Output, t, or many analog analog signals; signals; b) logic requiremen requirements ts are complex, complex, or the logic includes includes computationa computationall functions; functions; c) extensive extensive data data communicati communications ons with with the BPCS is require required; d; and d) different trip points are required for for different operations (e.g., batch application recipe selection).

B.5 Failure rates and failure modes B.5.1 Failure rate is the average rate at which faults occur within within the SIS components. The failure rate for the overt failure mode of a component may be quite different than the failure rate for the



























B.5.2 Tables B.5.1 and B.5.2 list some of the possible faults which should be considered in the design of SIS.

Table B.5.1 — Typical SIS failure modes Device(s) SENSOR

Failure Mode

Device(s)

Failure Mode

Isolation from process Sensor/X-mitter stuck Up/Downscale stuck; Incorrect signal

WIRING/CONNECTORS

BARRIER/ TERMINATION

EXTERNAL COMMUNICATION

ELECTROMECHANICAL RELAY/TIMER

Wiring faults; Coil burn out; Relay race

Drift/Calibration Fault

Timing faults

Noise

Welded contacts

Conversion time fault; Conversion fault

Stuck armature

Incorrect supply voltage

Contact fidelity

Open/short

SOLID STATE LOGIC

Wiring fault

Ground fault

Noise/dynamic faults/ x-talk

Noise

Stuck gates (on-off)/ back-plane faults

Open/short

Counter failure

Ground fault

FINAL ELEMENT

Pilot device fault

Isolation failure

Stuck open/closed/ intermediate

Wrong signal

Mechanism stuck

Corrupt data

Energy source

Incorrect data

Conversion time fault

Incorrect source/ destination Incorrect handshaking

Conversion fault

Duplicate source/ destination

COMMON MODE

Over-voltage, current, pressure, etc.

Incorrect Input/Output addressing

Under-voltage, current, etc.

Loss of connection

Total loss of energy

Loss of receiver/ transmitter

Backup-Energy failure (UPS)

Response timeout

Temporary energy fluctuations

Faulty error correction

Temperature too high or



























Table B.5.2 — Typical programmable electronic failure modes Device(s) PES

Failure Mode Stuck bit / multiple bits

Device(s) PES

Failure Mode x-talk (DMA)

Dynamic faults / x-talk

Bus request stuck (DMA)

Instruction time / Wait states / stall

Transfer time incorrect (DMA)

uCode / macro code

Wrong sample time

Arithmetic Logic Unit (ALU) faults

Timer register fault

Access time wait state logic

Wrong timer

Access time

Timeout / overrun

Stuck Interrupt Request (IRQ)

Timebase fault

Stuck / loss of timing

Set / reset fault

Device specific (custom IC)

IRQ / poll fault (Timer)

Stuck Input/Output bit

Trigger pattern (WDT)

x-talk on Input / Output lines

Trigger too early / late (WDT)

Wrong Input / Output line

INPUT

Stuck on/off

Data direction fault (I/O Port)

Upscale / Downscale / conversion fault

Signal too fast / slow (I/O Port)

Drift calibration

Lost bit / byte / message (comm)

Unstable input

Wrong sender / receiver / message

Isolation fault

Timeout / multidrop conflict

Linearization / Compensation

Deadlock (comm)

OUTPUT

Stuck on / off / Conversion fault

Parity generator fault

Upscale / Downscale

Frame fault / buffer overrun

Drift / Calibration



























B.6 Architecture B.6.1 Selection of the SIS architecture is an activity performed during the conceptual design step of the Safety Life Cycle. The architecture has a major impact on the overall safety safety integrity of the SIS. The architecture also influences SIS SIS reliability (likelihood of spurious trips) trips) (Reference C.3). B.6.2 Some of the activities involved in determining the SIS architecture are a) selection selection of energize energize to to trip or de-energi de-energize ze to trip design; design; b) selection of identical or diverse redundancy for the SIS sensors, logic solver, and final control elements; c) selection selection of redundanc redundancy y for power power sources sources and SIS power power supplies; supplies; d) selection of operator interface interface components (e.g., CRT CRT, alarm annunciator, pushbuttons) pushbuttons) and their method of interconnection to the SIS; and a nd e) selection of data communications communications interfaces between SIS and and other subsystems subsystems (e.g., BPCS) and their method of communication (e.g., read only or read/write). B.6.3 A SIS may utilize architectures (e.g., 2oo3 sensor, 1oo1 logic solver, 1oo2 final element) for reasons that may include different a) SILs SILs in in the the same same SIS SIS;; b) testin testing g requi requirem rement ents; s; c) equipment equipment reliabi reliability lity and ffailure ailure modes; modes; and d) user user int inter erfa face ces. s. B.6.4 Architecture that may typically meet the SIL performance requirements includes: SIL 1 -

A 1oo1 architectur architecture e with with a single single sensor, sensor, single single logic solver, solver, and and a single single final control element.

SIL 2 -

Requires Requires more diagnostics diagnostics and typica typically lly includes includes redunda redundancy ncy of the the logic logic solver and sensors, with redundancy of final control elements as necessary.

SIL 3 -

Typically Typically two separate separate and divers diverse e 1o 1oo1 o1 arrangem arrangements, ents, each with their own sensor, logic solver, and final final control element. The 1oo1 arrangements would be connected in a 1oo2 voting scheme. Diverse separation, redundancy, and exhaustive diagnostic capabilities are considered significant aspects of a SIL 3 system.

The user must determine the failure rates of the system components, diagnostic coverage, test intervals, redundancy, etc., and evaluate each specific SIS to validate its performance (see ISA-dTR84.02 for additional guidance).

B.7 Power sources





























B.7.1 Electrical power power source B.7.1.1 The electrical power source should be designed to meet the safety integrity and reliability requirements of the application. B.7.1.2 Electrical power source redundancy is frequently provided to improve the reliability of the SIS, although redundancy may not be necessary to meet the safety integrity requirements for deenergized to trip applications. For energize to trip applications, electrical electrical power source redundancy is typically provided to meet the safety integrity requirements. B.7.1.3 Electrical power source redundancy can be provided using an alternate source with automatic transfer, an Uninterruptible Power Supply (UPS), or battery backup by an alternate source. Design considerations when transferring to alternate sources include a) detection detection of of fault prior to to impacting impacting SIS SIS operation; operation; b) transfer transfer to back-up back-up source source without without impacting impacting SIS operation; operation; c) ability ability to maintain maintain UPS or batteries batteries without without impactin impacting g SIS operation; operation; and d) minimize minimize common common cause failures. failures. B.7.1.4 Consider providing power source(s) diagnostics that will not allow SIS startup unless all power sources are available. B.7.1.5 Electronic and programmable electronic SIS frequently include internal power supplies that convert electrical power source(s) source(s) to lower level voltages for internal use. Power supply redundancy should be considered to meet the reliability requirements of the application. B.7.1.6 Electronic and programmable electronic SIS typically are more sensitive to electrical noise (e.g., radio frequency interference interference or electromagnetic interference) Utilize shielding, good wiring practices (see B.13), B.13) , and proper grounding (see B.7.2). B.7.2) . B.7.1.7 Electronic and programmable electronic SIS typically have a lower insulation breakover voltage rating than an electrical electrical SIS. Therefore, additional surge protection protection may be required. B.7.1.8 Programmable electronic SIS may require electrical power with lower lo wer total harmonic distortion than electrical or electronic SIS. B.7.1.9 Input/Output (I/O) may have separate power distribution, fused to minimize common cause





























h) protection against transients such such as spikes, surges, surges, brown outs, outs, and electrical noise; i) protec protectio tion n aga agains instt und underv ervolt oltages ages;; j) protec protectio tion n again against st o over vervol voltag tages; es; and k) groun roundi ding ng.. B.7.1.11 A checklist of DC electrical power considerations includes a) voltage voltage range and and current current range includi including ng inrush current current;; and b) nonnon-li linea nearr load loads. s. B.7.2 Grounding B.7.2.1 Grounding is critical in E/E/PE technology to ensure personnel safety (Reference C.5) and proper equipment performance. This subclause deals only with with the voltages found in SIS applications (typically 240 volt AC or below, and 125 volts DC and below). B.7.2.2 Note that the grounding becomes more restrictive when moving from electrical to electronic and from electronic to programmable programmable electronic. Therefore, electrical equipment grounding can can be easily achieved in a grounding system designed for electronic and/or Programmable Electronic equipment, and electronic equipment grounding can be easily achieved in a grounding system designed for programmable electronic equipment. Programmable Electronic equipment installed installed in a grounding system designed for electrical e lectrical technology may not be appropriate. B.7.2.3 For ungrounded systems, consider using ground fault detection relays and alarms as appropriate. B.7.2.4 Note that electrical or electronic technologies may integrate Programmable Electronic into their equipment to enhance performance through improved communication, diagnostics, humanmachine interfaces, etc. etc. In those cases, treat the grounding as if it is Programmable Electronic grounding, unless vendor installation guidelines dictate a different approach. B.7.2.5 The grounding system should meet meet the manufacturer’s recommendations. Deviations should have safety review and analysis. B.7.2.6 A checklist of grounding considerations includes a) corros corrosion ion protec protectio tion; n;





























B.7.3 Pneumatic power B.7.3.1 Instrument air (or other gas) is typically used with final elements such as control valves. The solenoid valve acts as an electrical electrical to instrument gas relay. The instrument gas should be filtered, dried, and continuously monitored to assure proper pressure is maintained, and the system should be backed up to attain the uptime required to meet the reliability. B.7.3.2 Instrument air checklist: a) Pres Pressu sure re b) Mo Mois istture ure c) Co Cont ntam amin inan ants ts d) Lub Lubric ricati ation on where where requi required red e) Volume B.7.4 Hydraulic power B.7.4.1 Hydraulic power is typically used where high motive force is required, such as very large valves. B.7.4.2 Hydraulic power checklist: a) Pres Pressu sure re b) Volume c) Co Cont ntam amin inan ants ts d) Flui Fluid d prop proper erti ties es

B.8 Common cause failures B.8.1 Common cause faults can be caused by a single (non-redundant) (non-redunda nt) component or by systematic errors in redundant components. B.8.2 Some examples of common cause faults include





























B.8.3 Common cause faults or systematic errors may be reduced during design using appropriate fault avoidance measures. measures. Consider using the following methods: a) Provide supplier supplier with with application-specific application-specific information (e.g., codes, model number(s), etc.) b) Verif erific icat atio ion n c) Dive Divers rse e separ separat atio ion n d) Dive Divers rse e redund redundan ancy cy e) Ide Identi ntical cal redunda redundancy ncy f) Iden Identi tica call sepa separa rati tion on B.8.4 A number of functionally separate SIS may share the same environment, cabinet, operator interface, and maintenance/engineering interface. These separate systems may may however require physical separation of power and logic solver to accomplish testing maintenance or modification. m odification. The impact of these activities should be considered during system layout.

B.9 Diagnostics B.9.1 General considerations B.9.1.1 Diagnostics are tests performed periodically and automatically to detect covert faults that prevent the SIS from responding to a demand (see ISA-dTR84.02 for further guidance). B.9.1.2 Various types of faults that can occur are included in Table B.9.1:

Table B.9.1 — Fault types Fault Type

Example

Faults that immediately disable the capability of the SIS to respond to a demand (critical faults)

Stuck-on or stuck off of a critical output point

Faults that in combination with other faults disable the capability of the SIS to respond to a demand (potential

Diagnostic of a critical output point not performed





























B.9.1.4 Faults can result in two types of failures: a) Random Random failures, failures, a spontaneou spontaneous s failure failure of a component component b) Systematic Systematic failures failures (or errors), errors), a hidden hidden fault in design or implementat implementation ion B.9.1.5 Hardware is prone to random failures, but can also have systematic failures (incorrect timing, components used outside their specified range, etc.). B.9.1.6 Software is generally free of random failures, but has a high probability of systematic failures. Once a systematic failure failure becomes overt, it can be corrected and will cease to exist. exist. B.9.1.7 Random failures occur spontaneously spontaneously.. Depending on the persistence of the the fault over time two conditions are possible: a) Permanent Permanent random random faults faults persist persist until they they are repaired. repaired. b) Dynamic Dynamic random faults faults (cross-talk (cross-talk,, thermal faults, faults, etc.) occur under under certain circumstances and disappear. B.9.2 Diagnostic tests B.9.2.1 Diagnostics may be accomplished using a variety or combination of methods, including: a) hardware hardware integrity integrity monitoring monitoring (e.g., impedance impedance monitoring monitoring in thermocouple thermocouples); s); b) automatic built-in built-in tests provided within the purchased SIS equipment (e.g., Input/Output Input/Output module self-tests); c) automatic automatic test incorpora incorporated ted as part of the application application specific specific design (e.g., (e.g., readback readback of output signals through input points); d) Watchdog Timers, signal comparison, comparison, end-of-line end-of-line detection, etc.; and e) compar comparing ing redund redundant ant signal signals. s. B.9.2.2 An inherently safe response to a fault may replace the requirement for a diagnostic d iagnostic for that fault. However, a so called "safe" "safe" design of a component may not always result in a safe response of the SIS, as this is application app lication specific. B.9.3 Diagnostic coverage































B.9.3.4 For each diagnostic implemented, the following should be identified: a) Testing esting interv interval al b) Resulting Resulting action action on fault detection detection c) Both criteria criteria should should meet the Safety Safety Requirem Requirement ent Specificati Specifications ons B.9.3.5 Where certain diagnostics are not "built-in" to the vendor-supplied equipment, appropriate diagnostics may be implemented at the system or application level. B.9.3.6 Diagnostics may not be capable of detecting systematic errors (like software bugs). However, However, appropriate precautionary measures to detect possible systematic faults may be implemented.

Table B.9.2 — Diagnostic tests for programmable electronics Hardware possible cause Data

Chip error

Software detection

Hardware fault testing

Processing

detection

Wrong constants Indexing

Hard limit checking

Wrong circuit

Event

Event verification

Component out of specification

Scheduling

Scheduler monitor

Algorithm

Assertions

Address Time

possible cause

Voter fault

Random voter test































b) Compare Compare flow or other related related variables variables to modulati modulating ng valve position position c) At each shutdown, shutdown, compare compare sensor sensor readings readings with known shutdown shutdown conditio conditions ns and each other (e.g., use these comparisons as permissives for the next startup. This reduces Mean Time To To Detection of field device failures. This applies also to valve positions monitored by limit switches.) d) If SIS has a built-in built-in feature feature that displays displays the the last good value value on a bad value of the field field sensor, this feature should be defeated (For SIS applications the signal should be permitted to go to its extreme value) e) Feedback Feedback to alarm when when a final element element fails fails to go to its commanded commanded state state f) Alarm if field field devices devices change change state state without without a command command from the the SIS g) Vendo endors rs MTB MTBF F data data h) Predic Predicta tabil bility ity of failur failure e modes i) Performance Performance following following long periods in tthe he same same positi position on j) Avoid Avoid using measurem measurements ents outside outside the the accuracy accuracy limit limit of the sensors sensors (e.g., accuracy/ accuracy/ turndown; for example, where zero flow is to be verified, a flow sensor should not be used) k) Identifica Identification tion (typing, (typing, color color code, code, etc.) etc.) l) With analytic analytical al measuremen measurements, ts, try try to design design the system system to to provide provide a comparison comparison between analytical readings and related basic measurements such as pressure, temperature, etc.































c) carefully review review process/ambient process/ambient conditions conditions that could effect effect tthe he filling/emptying filling/emptying of impulse lines; d) verify verify seal liquids liquids in diaphragm seal applicati applications ons for resistance resistance to amalgamati amalgamation, on, freezing, polymerization, all of which can cause false readings; e) devices that are selected to achieve diversity should should have sufficient sufficient reliability to meet system reliability requirements or alternate approaches to diversity should be considered; and f) carefully carefully weigh weigh the use of devices devices that that are foreign foreign to a plant’s plant’s mainte maintenance nance organizat organization. ion. B.10.3.2 A minimum number of shutoff valves should be employed between the process and a sensor in SIS service. Each sensor requiring a process shutoff shutoff should have its own dedicated connection and valve (see ( see Reference C.1, C.1 , Figure 5.11). B.10.4 Final element application considerations considerations B.10.4.1 Some considerations in the application of valves used as final control elements include a) ope openin ning/c g/clos losing ing speeds speeds;; b) shutoff shutoff different differential ial pressure pressure in both directio directions ns of flow; c) leakage leakage (degree (degree of of shutof shutofff requirem requirements) ents);; d) fire resistance — body and actuator; e) performance performance followi following ng long periods periods in the same same position; position; f) where it will meet meet the requirem requirements, ents, consider consider the use use of a modulatin modulating g control control valve valve as































f) some solenoids are mounting position sensitive — consider installation detail requirements; and g) solenoid solenoid vents should should have protection protection against plugging, plugging, dirt, insects, insects, freezing, freezing, etc. etc. B.10.4.3 Motor starters B.10.4.3.1 In general, redundant motor starters starters are not used. Redundancy is applied in the form of contacts in the control circuit. Auxiliary contacts may be fed back to the SIS to verify starter status (position). B.10.5 Input signal conditioners and and output output amplifiers Input/output interface devices are special purpose solid state relays. They have unsafe failure modes that should be identified and quantified. Appropriate design features should be added to handle these unsafe failure modes before they can be approved for use in a SIS. Input/output interfaces are required as the signal conditioners for solid state logic systems or PESs. Input signal conditioners receive sensor signals at the strength required for suitable operation on the factory floor (e.g., 120 V, V, 48 V, 24 V, V, 4 - 20 mA). The purpose of the inputs and outputs in a solid state SIS is to isolate the low energy logic system (typically low voltage DC) from the high energy field system (typical signal levels are ar e 120 volt AC and 24 volt DC). Low energy signal levels are utilized in the logic system to achieve signal processing speed. High energy signal levels are used in the field devices to ensure a high signal to noise ratio over long transmission distances and to assure that contacts on discrete sensors used as input devices have sufficient power (voltage and current) to provide appropriate contact-wetting. Output amplifiers receive the low energy signal from the solid state or PES logic solver and convert it to a signal suitable for driving the final element (e.g., solenoid valve).































B.11.1.1.2 SIS data displayed to the operator should be updated and refreshed at the rate required to communicate between the operator and the SIS during emergency conditions so safe response(s) can be attained. B.11.1.1.3 Displays relating to the SIS should be clearly identified as such, avoiding ambiguity or potential for operator confusion confusion in an emergency situation. Operators should have easy access to safety-related displays, preferably by a single singl e key-stroke or touch-screen stroke giving entry into a display hierarchy. hierarchy. B.11.1.1.4 Give the operator enough information on one display to rapidly convey critical information. Display consistency consistency is important. Provide the same access methods, alarm conventions, and display components as are used in the non-safety-related displays. B.11.1.1.5 Display layout is also important. important. Too much information on one display may lead lead to operators misreading data and taking wrong actions. Use colors, flashing indicators, and judicious data spacing to guide the operator to important information and to reduce the possibility of confusion. Messages must be clear, concise, and unambiguous. B.11.1.1.6 The operator interface and associated system (such as a Distributed Control System) may be used to provide automatic safety-related event logging and alarming functions. Conditions to be logged should include SIS events (such as trip and pre-trip occurrences), whenever the SIS is accessed for program changes, and diagnostics. B.11.1.2 Panel(s) B.11.1.2.1 Panels should be located to give operators easy access. B.11.1.2.2 Arrange panel to ensure that the layout of the push buttons, lamps, gauges, and other

































b) Applicatio Application n software development development,, documentation, documentation, and downloading downloading to the SIS, logic solver c) Access Access to application application software software for for changes, changes, testing, testing, and monitoring monitoring d) Viewing Viewing SIS system system resourc resource e and diagnostic diagnostic inform information ation e) Changing Changing SIS security security levels and access access to application application software software variables variables B.11.2.2 Maintenance/Engineering Interfaces should have capabilities to display the operating and diagnostic status of all SIS components (such as Input/Output modules, processors, etc.) including the communication among them. B.11.2.3 Maintenance/Engineering Interfaces should provide means for copying application programs to storage media. B.11.2.4 A user-approved personal computer may be used as a Maintenance/Engineering Interface.

































B.13 Wiring practices B.13.1 Wiring practices should meet the manufacturers’ recommendations and NEC requirements. Deviations should have safety review and analysis. B.13.2 Consider enhancing wiring practices by: a) Eliminating Eliminating circuit circuit common commons s for multiple multiple circuits circuits;; b) Adding circuits circuits for bette betterr isolatio isolation; n; c) Adding fuses fuses to isolat isolate e faults faults in a way that reduces reduces common common cause; cause; d) Imp Implem lement enting ing test test facilit facilities ies;; e) Eliminatio Elimination n of g ground round loop problem problems; s; an and d f) Separating Separating SIS termina terminations tions from all other other termina terminations tions..

































B.14 Documentation B.14.1 A list of the documentation that may be used to implement a SIS, includes the following: a) Safety Safety Requ Requiremen irementt Specificati Specifications ons b) Appl Applic icat atio ion n logic logic c) De Desi sign gn docume document ntat atio ion n d) Commissioni Commissioning ng Pre-Startup Pre-Startup Acceptance Acceptance Test Test procedure(s) procedure(s) e) SIS oper operati ating ng proce procedur dure(s e(s)) f) SIS mainte maintenan nance ce proced procedure ure(s) (s) g) Functi Functional onal test test procedu procedure( re(s) s) h) Management Management of Change documentat documentation ion

































































Annex C (Informative) — Informative references

NOTES 1.

Utiliz Utilize e late latest st editio edition n of of the the refere reference nce..

2.

In c case ase of c confli onflicting cting informatio information, n, ISA-S84 ISA-S84.01 .01 ttakes akes precedence. precedence.

3.

Within Within the body body of the the text and and the Index, Index, referen references ces are are cited by the referen reference ce numbers numbers (in italics and brackets) given below. bel ow.

AMERICAN INSTITUTE OF CHEMICAL ENGINEERS (AIChE)



































INTERNATIONAL ELECTROTECHNICAL COMMISSION (IEC) [Ref. C.8 & C.9]

Parts 1-7 IEC draft Publication 1508-1995, Functional safety of electrical/electronic/programmable electronic safety-related systems

NOTE — IEC draft Publication 1508 is in development; for more information, contact your national committee.

































MCGRAW-HILL, INC. [Ref. ef. C.16 C.16]]

Dict Dictio iona narry of Scie Scient ntif ific ic and and Techn echniical cal Term erms , fifth edition, 1993

Available from:

McGraw-Hill, Inc. 1221 Avenue of the Americas N Y k NY 10020

T l (800) 262 4729

































UNITED STATES STATES CODE OF FEDERAL REGULATIONS (CFR) [Ref. C.11]

29 CFR 1910.119-1992 (Final Rule: February 24, 1992)

Process Safety Management of Highly Hazardous Chemicals, Explosives, and Blasting Agents

[Ref C 12]

40 CFR Part 68

Risk Management Programs for Chemical

































Annex D (Informative) — Example

NOTE — THIS CLAUSE IS NOT A REQUIREMENT OF THIS STANDARD. STANDARD. IT IS PROVIDED

































D.3.1.1 Process information information description description (5.2.1) (5.2.1) Process information description (dynamics, sensors, final elements, etc.) of each potential hazardous event that requires a SIS (Reference C.6). The process as shown in Figure D.1 contains hot wash water with varying amounts of flammable organics and other hazardous chemicals.











































































































































































































































































































































































































































































































































































































ANSIISA–84.01–1996 - Application of SIS for Process Industri

Recommend Documents