Chemical processing is an industrial activity that involves using, storing, manufacturing, handling, or moving chemicals. The process can be designed using inherently safer strategies to ensure safe operation under foreseen process upsets. An example of an inherently safer practice is to design a vessel to withstand the maximum and minimum operating conditions that exist under emergency operation. When the process is not designed to withstand emergency operation, process safety is achieved through implementation of safeguards, which act when the process conditions become dangerous.  Internationally, safeguards are maintained under a program referred to as functional safety management.

The owner/operator of the process has the responsibility to determine and document that the process is designed, maintained, inspected, tested, and operating in a safe manner, regardless of the means used to achieve safety. Safe operation of chemical processes is demonstrated through the data records and information gathered to comply with process safety management program.  The risk of unsafe operation can be lowered by leveraging the inherently safer strategies throughout the entire design, including the safeguard design.

Many types of equipment are implemented as safeguards within the process industry. Sustainability of safeguards can be significantly different, even when they are designed and managed to provide similar risk reduction. Automated systems, whether in manual or automatic mode, are complex systems where many different devices must work successfully to achieve the desired functionality.

The process control system, safety alarm system, and safety instrumented system (SIS) can achieve similar risk reduction, but the resilience of the SIS to human error is higher due to its more rigorous design, verification, and validation processes. A pressure relief valve and a check valve are both mechanical devices, yet the pressure relief valve has a more sustainable level of risk reduction in service than a check valve. Choosing protection layers that are more resilient to human error is an inherently safer practice. When manual operator actions are required, training with real-time simulators can yield faster troubleshooting, higher response effectiveness, and safer operation.

Safeguards are designed and managed using a safety lifecycle, which includes a myriad of activities, intended to identify and eliminate human errors. Many different skill sets and planned activities are needed to ensure that the safeguards work as desired when required. These activities include competency assessment, verifications, functional safety assessments, configuration management, management of change, audits, and metrics. Keeping up with all these activities and maintaining the necessary documentation requires a strong safety culture that cares about safeguard reliability. Sustaining attention on the numerous details associated with instrumented safeguard performance is a significant challenge.

Automation is undergoing a massive step-change that will take many years to become widely adopted. The latest architectures are IT networks that rely on countermeasures to secure increasingly open communication between plant automation and the outside world. Interconnectivity is highly desirable, but introduces sources of human error and cybersecurity risks that did not exist 20 years ago. “The way things are done” may not be good enough when practices haven’t kept up with technology change. Documentation, procedures, and training must evolve to keep up.

A new book by the Center for Chemical Process Safety, Guidelines for Safe Automation of Chemical Processes, was edited by SIS-TECH Solutions’ staff and is now available from retailers. The equipment installed for process control and safeguard applications often looks the same, and in many cases is the same technology. However, there are significant differences in their functional objectives and in the level of detail needed in the front-line procedures to achieve the required reliability. The book contains practical considerations on the design and management of both process control and instrumented safeguards.

---

 

 

HOUSTON — SIS-TECH has introduced the latest edition of the ICE-Tablet™. This innovative product reduces the time required to execute turnaround testing of instrumentation and controls in critical applications. The ICE-Tablet integrates “documentation, procedures and forms in a single platform for efficient field deployment,” according to Brant Smith, director of SIS-TECH’s instrumentation, controls and electrical (ICE) team.

The ICE-Tablet is constructed of rugged hardware suitable for hazardous environments, and its user interface is ergonomically configured for use in the field. Its innovative design, slim profile and HART (Highway Addressable Remote Transducer) compatibility supports in-service testing of any critical system, especially safety controls, alarms, interlocks and safety instrumented systems.

---

 

HOUSTON — SIS-TECH Solutions LP has been awarded its largest greenfield project to date by Koch Industries. The project is part of a $1.3 billion expansion at the Koch fertilizer plant located east of Enid, Oklahoma. SIS-TECH’s instrumentation, controls and electrical (ICE) team will provide field services associated with the construction of a 900,000-ton-per-year urea plant and improvements to existing ammonia plants.

The ICE team project includes execution of tests to validate the operation of critical instrumentation and control systems installed in the Koch fertilizer plant. The quality assurance of test records will be managed using SIS-TECH’s ICE-Tablet.

---

 

HOUSTON — SIS-TECH Solutions LP has promoted Khaldon Batnij to associate design consultant on SIS-TECH’s instrumentation, controls and electrical (ICE) team. Batnij graduated from the University of Houston in computer and electrical engineering. He implemented the application software requirements for streamlining the distribution of maintenance procedures and the collection of mechanical integrity data in SIS-TECH’s ICE-Tablet.

In his new position, he works directly with turnaround teams for custom integration of the ICE-Tablet with site maintenance management systems.

---

 

Process safety safeguards must be capable of performing their required function in stopping the progression of a loss event. Since a process upset proceeds at a certain rate as determined by the process design, speed is a critical part of the functional specification. If a safeguard performs too slowly compared to the loss event, it provides no protection at all. Determining just how fast a safeguard needs to complete its action is an important project deliverable that impacts safeguard selection and setpoint specification.

The first task in specifying the safeguard response time is to look to the process design to determine how much time it will allow. The process safety time (PST) is the time between the process failure and the loss event that would occur if there were no safeguards.  The PST may be only seconds, which limits the types of safeguards that can be effective.  On the other hand, the process may take days to transition from the initial failure to the loss event, allowing for a sequence of safeguards.

A variety of engineering practices may be used to justify the selected PST. Expert judgment, based on individual or industry experience, can be a very useful starting point and may be the only method available for the initial PST estimation. Expert judgment alone may leave the operating facility with a weak rationale to support future management of change. Extrapolation or mass-and-energy balances can be used to determine the PST based on a specific process design. These simpler techniques may be insufficient for evaluating a complex process upset and are unlikely to reveal short-term transients during abnormal operation. Process simulation uses first principle models to determine the response of multiple process parameters to one or more process upsets. In dynamic simulation, the actual process equipment, including piping configurations, and process chemistry are incorporated into the model. With the capability to model complex reactive or multi-phase reactions, a dynamic simulation is more likely to reveal short duration transients and more likely to track the actual process conditions during a simulated upset. Tuning the model with startup and normal operational data helps increase confidence in the simulation accuracy. Operator testing using a simulator can increase alarm response effectiveness.

The second task is to specify the response time for each safeguard that must complete its action in order to stop the loss event. The response time is basically the time available for the safeguard to act given its setpoint and the process dynamics. The least conservative setpoint is determined based on time lags inherent to the safeguard hardware, application program delays, and measurement error.  Early in the project, simple tables of generic hardware delays and measurement error might be used.  Later project stages replace the early estimates with specific information as it becomes available.

It is not a good practice to design a safeguard based on the least conservative value. The generally accepted margin is to ensure that the safeguard completes its action in half the time allowed by the process dynamics. This design margin increases the likelihood that the safeguard is effective even when the real world slows things down a bit. On the other hand, having an setpoint too close to the operating limit can put a facility at risk for more frequent nuisance alarms and trips. Nuisance trips cause lost productivity and often cascade into other events. Ensuring enough time to act without causing nuisance events is a balancing act that is often negotiated among operations, process safety, and engineering. Dynamic simulation can provide detailed data to make this negotiation easier and the outcome more consistent.

Contact SIS-TECH to learn more about how a dynamic simulator can be used to improve process control, determine the process safety time, increase operator effectiveness, reduce operator response time, validate your alarms, and certify your operators.

---

 

SIS-TECH’s SIL Solver V7 recently completed an extensive review of its calculation algorithms, architecture, and failure rate database. It has been re-certified as complying with national and international standards for determining the likelihood that a safety-critical system will fail to operate as required or cause an unnecessary process disruption. The failure rate database derives from a 20-year history of gathering data giving the user confidence that it reflects real-world conditions in the general process industry. SIL Solver V7 is a platform for retaining the safety requirements specification for safety instrumented systems and supports the lifecycle management of this critical information.

---

 

SIS-TECH Solutions, LP is celebrating the 15 anniversary of SIL Solver with its V7 product. SIL Solver started as a computational tool and evolved into a lifecycle tool with V7. 1000s of users have analyzed their safety-critical systems and identified ways to improve their performance since SIL Solver V1. The built-in database expanded from simple process technologies to cover complex technologies with high diagnostic capabilities. Throughout it all, SIS-TECH’s technical staff mentored and trained SIL Solver users enabling them to quickly analyze system functions and to try different architectures to improve performance or reduce test requirements.

---

 

SIS-TECH Solutions LP, Houston, TX has selected Denisse Corbett to lead a new initiative on process control system and interface optimization. Along with her over 15-year experience in the control systems field, Denisse is a certified functional safety professional and holds a FS Eng (TÜV Rheinland) certificate. Denisse’s new position builds on her expertise in the lifecycle management of safety instrumented systems, including design, engineering, application software programming, and systems integration.  She is fluent in English and Spanish and can execute technical work in either language.

---

 

Automation equipment in control applications is selected primarily based on operational needs, such as functionality, reliability, repeatability, accuracy, communication options, and ease of maintenance. Demonstrated in-service performance earns the equipment and its manufacturer a coveted place on the approved equipment list. Equipment in safety applications must also support the risk reduction requirements in addition to meeting the operational needs. For safety instrumented systems (SIS), the concept of approving the initial selection and continued use of equipment based on in-service performance is referred to as proven in use in IEC 61508 [2010] and prior use in IEC 61511 [2016]. Ultimately, the intent of both standards is to collect data that proves that the installed equipment is capable of providing satisfactory in-service performance.

Manufacturers often make safety integrity level (SIL) claims on their products, but SIL is a loop concept and not a device property. A SIL 1 sensor connected to a SIL 1 logic solver with an output to a SIL 1 final element may not achieve a SIL 1 loop. Like links in a chain, the integrity is limited by the weakest link, but the chain is only as strong as the whole. In many cases, it is necessary to design some, if not all, of the subsystems (the links) to achieve a higher SIL claim so that the loop (the chain) meets the required SIL.

The most troublesome result of the IEC 61508 certification process is how non-conservative the manufacturer claims appear to be. The failure rate data published by various industry data collection programs has revealed that in-service dangerous failure rates are significantly higher than what is claimed in the majority of 3rd party approval reports. For field devices, the reported values are generally 3 to 10 times lower than what is seen in actual installations. For PLCs, the manufacturer’s claims can be non-conservatively lower than in-service performance by a factor of 10 or more. This means that a lot of certified equipment is being sold based on a SIL claim at least one level higher than achievable in the installation.

IEC 61511 only requires the use of IEC 61508 compliant equipment when applying PLCs in SIL 3 applications. For all other technologies, IE  61511 clause 11.5.2.1 states, “Devices selected for use as part of a SIS with a specified SIL shall be in accordance with IEC 61508-2:2010 and IEC 61508-3:2010, and/or 11.5.3 to 11.5.6, as appropriate.” This clause lists two forms of evidence that can be used to select devices for SIS applications:

• Evaluation for compliance with IEC 61508 Part 2 (hardware) and Part 3 (software). This typically involves a 3rd party approval of a specific configuration of a product.
• Prior use or historical data. This data is typically derived from the device’s performance in similar operating environments.

When weighing these two forms of evidence, recognize that the more relevant the information is to the in-service environment, the higher the certainty that the actual failure rate will be in alignment with the assumed reliability parameters. In-service data is essential to understanding the real potential for human (or systematic) errors. In contrast to IEC 61508 compliance information, prior use identifies not only hardware failures and their root causes, but also systematic failures, which is essential for achieving industry benchmarked performance.

IEC 61511 acknowledges the importance of in-service records for justifying the continued use of existing equipment. For example, clause 5.2.5.4 states that “for existing SIS designed and constructed in accordance with codes, standards, or practices prior to the issue of this standard the user shall determine that the equipment is designed, maintained, inspected, tested, and operating in a safe manner.” The newly required stage 4 functional safety assessment involves a periodic examination of site operating and maintenance records to determine whether the installed SIS is being managed as planned and complies with the safety requirements specification.

IEC 61511’s quality metrics are also appropriate for proving the fitness for purpose of equipment in any safety control, alarm, and interlock application. Fundamentally, this approval process involves making an engineering judgment of the equipment’s design quality, functional capabilities, use factors, in-service history, failure rate in the operating environment, and ability to fulfill the safety requirements specification for the particular application.

---

 

With 12 years designing Safety Instrumented Systems (SIS) at SIS-TECH Solutions, LP, Pete Fuller knows what it takes to keep on track when it involves compliance with today’s standards. With over 35 years of experience in the instrument world (originating at NASA), Pete continues to meet the ever challenging task to come up with a design to meet target SIL’s.  Earning the FS Eng (TÜV Rheinland) certificate in 2013, demonstrates that Pete can talk the talk when it comes to process safety. Besides his specialty of designing single SIS Systems for SIS-TECH, reach out to Pete for any SIS requirement including calculations, training, and commissioning of SIS Systems.

---