Documenti di Didattica
Documenti di Professioni
Documenti di Cultura
ANSI/ISAS84.011996
Application of Safety
Instrumented Systems for
the Process Industries
--
| |||
|||||| |
|| |||
|||| || |
||||
|| | ---
|| | --|
||||
|
|||| || |
|| |||
|||||| |
| |||
--
ISBN: 1-55617-590-6
Copyright 1996 by the Instrument Society of America. All rights reserved. Printed in the United
States of America. No part of this publication may be reproduced, stored in a retrieval system, or
transmitted in any form or by any means (electronic, mechanical, photocopying, recording, or
otherwise), without the prior written permission of the publisher.
ISA
67 Alexander Drive
P.O. Box 12277
Research Triangle Park, North Carolina 27709
Preface
It is the policy of ISA to encourage and welcome the participation of all concerned individuals and
interests in the development of ISA standards. Participation in the ISA standards-making
process by an individual in no way constitutes endorsement by the employer of that individual, of
ISA, or of any of the standards, recommended practices, and technical reports that ISA develops.
S84.01 has been developed with the intent that it will eventually become a part of a group of
standards being developed by the International Electrotechnical Commission (IEC). This has
resulted in a format and structure that may be somewhat different from previous ISA Standards.
Some background information is, therefore, offered to assist the reader in better understanding
the focus of S84.01.
IEC has commissioned the development of a set of international standards encompassing all
aspects of safety systems for all industries. It is titled "Functional Safety: Safety-Related
Systems." This effort is under the direction of IEC Technical Committee No. 65, Subcommittee
65A, Working Group 10. It is titled IEC draft Publication 1508 and is still in development but, as it
exists today, there are seven parts:
Part 1 - General requirements
Part 2 - Requirements for Electrical/Electronic / Programmable Electronic Systems
(E/E/PES)
Part 3 -Software requirements
Part 4 - Definitions and abbreviations of terms
Part 5 - Guidelines on the application of Part 1
Part 6 - Guidelines on the application of Parts 2 and 3
ANSI/ISA-S84.01-1996
|
||||
|
|||| || |
|| |||
|||||| |
| |||
The ISA Standards and Practices Department is aware of the growing need for attention to the
metric system of units in general, and the International System of Units (SI) in particular, in the
preparation of instrumentation standards, recommended practices, and technical reports. The
Department is further aware of the benefits to USA users of ISA standards of incorporating
suitable references to the SI (and the metric system) in their business and professional dealings
with other countries. Toward this end, this Department will endeavor to introduce SI and
acceptable metric units in all new and revised standards to the greatest extent possible. The
Metric Practice Guide, which has been published by the Institute of Electrical and Electronics
Engineers as ANSI/IEEE Std. 268-1992, and future revisions, will be the reference guide for
definitions, symbols, abbreviations, and conversion factors.
--
This standard has been prepared as part of the service of ISA, the international society for
measurement and control, toward a goal of uniformity in the field of instrumentation. To be of real
value, this document should not be static but should be subject to periodic review. Toward this
end, the Society welcomes all comments and criticisms and asks that they be addressed to the
Secretary, Standards and Practices Board; ISA; 67 Alexander Drive; P. O. Box 12277; Research
Triangle Park, NC 27709; Telephone (919) 549-8411; Fax (919) 549-8288; E-mail:
standards@isa.org.
|| | ---
This preface as well as all footnotes, annexes, and draft technical report 84.02 (ISA-dTR84.02)
are included for informational purposes and are not part of ANSI/ISA-S84.01. ISA-dTR84.02
was still in development at the time that ANSI/ISA-S84.01 was published; for information, contact
ISA.
ANSI/ISA-S84.01-1996
|| | --|
||||
|
|||| || |
|| |||
|||||| |
Feltronics Corporation
Aramco
Calder Enterprises
Triconex
Consultant
Shell Offshore, Inc.
ICI Canada, Inc.
HIMA Americas, Inc.
Technology & Health Sciences Division
S.K. Bender & Associates
Center for Software Engineering
Hinz Consulting, Ltd.
BP GRE
Eco Waste Technologies
Adelard
Shell Oil Company
G3 IQSE
Iliad Engineering, Inc.
Mobil Research & Development Corporation
Eindhoven University of Technology
Fisher-Rosemount Systems
Arco Oil & Gas
Industrial Equipment Company
Stone & Webster, Inc.
W.R. Grace & Company
Sun Company
| |||
V. Maggioli, Chairman
R. Boyd, Jr., Vice Chairman
W. Calder III, Managing Director
*R. Adamski
R. Aldridge
R. Bailliet
N. Battikha
L. Beckman
R. Bell
S. Bender
P. Bennett
K. Bingham
W. Black
J. Blagg
R. Bloomfield
*K. Bond
K. Bosch
S. Boyer
*B. Bradley
A. Brombacher
D. Brown
*L. Brown
M. Cannon
J. Carew
L. Cheung
R. Desrochers (deceased)
COMPANY
--
NAME
R. Dillman
Conoco, Inc.
NAME
COMPANY
-| |||
|||||| |
|| |||
|||| || |
|
||||
|
|| | ---
J. Duran
P. Early
*R. Ewbank
T. Fisher
J. Forrest
*T. Frederickson, Jr.
R. Freeman
D. Fritsch
*K. Gandhi
R. Gardner
*F. Gellner
J. Gilman
R. Glaser
W. Goble
*C. Goring
*J. Gray
D. Green
T. Green
J. Greenwald
*R. Grehofsky
P. Gruhn
*A. Habib
*A. Hamers
A. Hammons
B. Hampton
C. Hardin
D. Haysley
*A. Heckman
*K. Hill
L. Hoffman
B. Humes
*D. Inverso
J. Jarvi
W. Jay
K. Jennings
D. Jensen
R. Johnson
*W. Johnson
*D. Karydas
K. Kassner
R. Kier
D. Leonard
*E. Lewis
J. Martel
*T. McAdams
Lagoven SA
ABB Industrial Systems, Inc.
Rhone-Poulenc, Inc.
Lubrizol Corporation
ABS Industrial Verification, Inc.
Triconex
Monsanto
Phillips Petroleum Company
M. W. Kellogg Company
DuPont Engineering
E. I. du Pont de Nemours & Company
Procter & Gamble Company
Dow Chemical Company
Moore Products Company
August Systems, Ltd.
Chevron Research & Technology Company
Rohm & Haas
Stubbs Overbeck & Associates
Fina Oil & Chemical Company
E. I. du Pont de Nemours & Company
Industrial Control Service, Inc.
Rhone-Poulenc, Inc.
Honeywell SMS
Chevron USA
Consultant
Hoechst Celanese Corporation
Murphy Oil Company
Bently Nevada
Mobil Research & Development Corporation
BASF Corporation
Bently Nevada
E.I. du Pont de Nemours & Company
Teknillinen Tarkastuskeskus
Entergy Operations, Inc.
Square D Company
Price Engineering Company
Kingwood Technology Group
E. I. du Pont de Nemours & Company
Factory Mutual Research Corporation
CALTEK Pacific-Minas Corporation
Kinetics Technology International
Consultant
Union Carbide Corporation
Exxon Chemical Company
Allen-Bradley Company
ANSI/ISA-S84.01-1996
ANSI/ISA-S84.01-1996
|| | --|
||||
|
|||| || |
*M. McElroy
F. McKenna
N. McLeod
R. McNab
*F. Mears
*W. Mostia, Jr.
I. Nimmo
J. Nye
*D. Ogwude
T. Ostrowski
*J. Palomar
J. Paques
B. Phelps
*W. Purser
R. Raghaven
G. Ramachandran
*K. Rashida
C. Richard
L. Richardson
*C. Rischar
*W. Robinson
G. Russcher
*D. Sanders
K. Schilowsky
J. Schroeder
R. Shah
T. Shephard
*J. Simon
I. Smith
S. Smith
J. Sottnik
R. Spiker
R. Spinks
*P. Stavrianidis
R. Stevens
H. Storey
L. Suttinger
H. Thomas
*C. Thurston
M. Toffolo
*W. Valerie
T. Walczak
D. Watkins
M. Weber
S. Weiner
|| |||
COMPANY
|||||| |
NAME
| |||
3M Company
--
S. McCormick
W. Welz, Jr.
*G. Wristen
This published standard was approved for publication by the ISA Standards and Practices
Board on February 15, 1996.
NAME
COMPANY
--
ANSI/ISA-S84.01-1996
| |||
|||||| |
|| |||
|||| || |
||||
|| | ---
|| | --|
||||
|
|||| || |
|| |||
|||||| |
| |||
--
Contents
Introduction ............................................................................................................................... 13
1 Scope ...................................................................................................................................... 15
1.1 Boundaries of the Safety Instrumented System (SIS) ................................................. 15
1.2 Exclusions ................................................................................................................... 16
Objective...................................................................................................................... 27
Input requirements....................................................................................................... 27
Safety functional requirements .................................................................................... 27
Safety integrity requirements ....................................................................................... 28
Objective...................................................................................................................... 29
General requirements .................................................................................................. 29
SIS logic solver ............................................................................................................ 30
Field devices................................................................................................................ 31
Interfaces ..................................................................................................................... 32
Power sources ............................................................................................................. 34
System environment .................................................................................................... 34
Application logic requirements..................................................................................... 34
Maintenance or testing design requirements............................................................... 35
Objective...................................................................................................................... 36
Installation ................................................................................................................... 36
Commissioning ............................................................................................................ 36
Pre-Startup Acceptance Test (PSAT).......................................................................... 36
ANSI/ISA-S84.01-1996
|
|||| || |
|| |||
|||||| |
| |||
--
||||
|| | ---
9.1
9.2
9.3
9.4
9.5
9.6
9.7
9.8
|||||| |
|| |||
|||| || |
|
||||
Objective...................................................................................................................... 38
Training........................................................................................................................ 38
Documentation ............................................................................................................ 38
SIS operating procedures ............................................................................................ 38
Maintenance program.................................................................................................. 38
Testing, inspection, and maintenance ......................................................................... 39
Functional testing ........................................................................................................ 39
Documentation of functional testing ............................................................................ 40
|
|| | ---
10
ANSI/ISA-S84.01-1996
E (Informative) Index........................................................................................................... 93
Figures
1.1
4.1
A.1
A.2
A.3
D.1
D.2
Tables
3.1
4.1
A.1
B.5.1
B.5.2
B.9.1
B.9.2
ANSI/ISA-S84.01-1996
--
| |||
|||||| |
|| |||
|||| || |
||||
|| | ---
11
--
| |||
|||||| |
|| |||
|||| || |
||||
|| | ---
Introduction
Purpose
This standard addresses the application of Safety Instrumented Systems (SIS) for the process
industries. The SIS addressed includes Electrical (E)/, Electronic (E)/ and Programmable
Electronic (PE) technology. This standard is process industry specific within the framework of the
International Electrotechnical Commission (IEC) draft Publication 1508 (References C.8 and
C.9). This standard follows the Safety Life Cycle presented later (see Figure 4.1).
This document is intended for those who are involved with SIS in the areas of
design and manufacture of SIS products, selection, and application
installation, commissioning, and Pre-Startup Acceptance Test
operation, maintenance, documentation, and testing
Objective
The objective is to define the requirements for Safety Instrumented Systems.
Organization
-| |||
This standard is organized into three major parts. The main body of the standard (Clauses 1-11)
present mandatory specific requirements. Clause 12 provides key differences between
ISA-S84.01 and IEC draft Publication 1508. Informative Annexes A through E present additional
non-mandatory (informative) technical information that is useful in SIS applications.
|||||| |
|| |||
Draft Technical Report 84.02 (ISA-dTR84.02), which is issued under separate cover, provides
non-mandatory (informative) technical guidance in Safety Integrity Level analysis.
|||| || |
|
||||
|
|| | ---
ANSI/ISA-S84.01-1996
13
-| |||
|||||| |
|| |||
|||| || |
|
||||
|
|| | ---
1 Scope
-| |||
|||||| |
|| |||
|||| || |
|
||||
a) Electromechanical relays;
|
|| | ---
ANSI/ISA-S84.01-1996
15
1.2.4 This standard does not address the codes, regulations, and other requirements that apply
only to the Nuclear Industry.
1.2.5 The activity of identifying process hazards by use of Process Hazards Analysis methods
is not part of this standard.
1.2.6
Defining the need for a Safety Instrumented Systems is not included in this standard.
1.2.7 This standard is not intended to be used as a stand-alone system purchase specification.
It will not eliminate the need for sound engineering judgment. It also does not mandate the use of
any particular technology.
1.2.8
The standard is not intended to apply to Basic Process Control Systems (BPCS).
1.2.9
16
ANSI/ISA-S84.01-1996
|
||||
|| |||
|||||| |
| |||
1.2.3 In jurisdictions where the governing authorities (Federal, State, Province, County, City, etc.)
have established Process Safety Design, Process Safety Management, or other requirements,
these laws shall in all cases take precedence over those requirements defined in this standard.
These factors must be integrated into the Safety Life Cycle at the appropriate step.
--
1.2.2 This standard does not address management of the non-SIS portion of the design or the
management of the startup process.
|||| || |
1.2.1 This standard identifies all the steps of the Safety Life Cycle (see Figure 4.1) but does not
define the method(s) that may be used in some of the steps.
|| | ---
1.2 Exclusions
1.2.10 This standard does not consider the use of technology that is not currently utilized in Safety
Instrumented Systems. As new technology evolves and becomes available (e.g., ISA SP50
Fieldbus) it will be addressed in scheduled (5 year) revisions to this standard. In the interim, if new
system performance justifies its use, new technology shall be user approved before use in safety
applications. In these cases, the new technology implementation may require exception to some
standard requirements of S84.01. Exceptions shall be documented to demonstrate that the new
approach satisfies the safety requirements.
1.2.11 Analysis of the capability of humans to act on human-machine interface information is part
of the Process Hazards Analysis and is outside the scope of this standard.
1.2.12 Instrumentation installed for the purpose of monitoring conditions that may lead to chronic
health effects is not covered by this standard.
1.2.13 This standard does not cover instrumentation installed principally for the purpose of property
protection.
1.2.14 Systems where operator action is the sole means required to return the process to a safe
state are not covered by this standard. (e.g., alarm systems, fire and gas monitoring systems, etc.)
--
ANSI/ISA-S84.01-1996
| |||
|||||| |
|| |||
|||| || |
||||
|| | ---
17
3.1 Definitions
For the purposes of this standard, the following definitions apply:
3.1.1
3.1.2
3.1.3 architecture: The arrangement and interconnection of the hardware components or modules that comprise the SIS.
3.1.4
3.1.5 Basic Process Control System (BPCS): A system that responds to input signals from
the equipment under control and/or from an operator and generates output signals, causing the
equipment under control to operate in the desired manner. Some examples include control of an
exothermic reaction, anti-surge control of a compressor, and fuel/air controls in fired heaters. Also
referred to as Process Control System.
3.1.6
3.1.7
common cause
3.1.7.1 common cause fault: A single source that will cause failure in multiple elements of a
system. The single source may be either internal or external to the system.
3.1.7.2 common cause failure: The result of a common cause fault.
3.1.8
communication
3.1.8.1 external communication: Data exchange between the SIS and a variety of systems or
devices that are outside the SIS. These include shared operator interfaces, maintenance/engineering interfaces, data acquisition systems, host computers, etc.
3.1.8.2 internal communication: Data exchange between the various devices within a given
SIS. These include bus backplane connections, the local or remote I/O bus, etc.
3.1.9
3.1.10 covert fault: Faults that can be classified as hidden, concealed, undetected, unrevealed,
latent, etc.
3.1.11 decommissioning: The permanent removal of a complete SIS from active service.
--
18
| |||
|||||| |
|| |||
|||| || |
||||
|| | ---
ANSI/ISA-S84.01-1996
3.1.12 de-energize to trip: SIS circuits where the outputs and devices are energized under normal
operation. Removal of the source of power (e.g., electricity, air) causes a trip action.
3.1.13 demand: A condition or event that requires the SIS to take appropriate action to prevent
a hazardous event from occurring or mitigate the consequence of a hazardous event.
3.1.14 diagnostic coverage: For SIS with active fault-detection capabilities, the ratio of detectable faults to the total number of faults.
3.1.15 diverse: Use of different technologies, equipment or design methods to perform a common
function with the intent to minimize common cause faults (see 3.1.45, 3.1.55, and B.2).
3.1.16 Electrical (E)/ Electronic (E)/Programmable Electronic Systems (PES) (E/E/PES):
When used in this context, electrical refers to logic functions performed by electromechanical
techniques, (e.g., electromechanical relay, motor driven timers, etc.), electronic refers to logic
functions performed by electronic techniques, (e.g., solid state logic, solid state relay, etc.), and
Programmable Electronic System refers to logic performed by programmable or configurable devices [e.g., Programmable Logic Controller (PLC), Single Loop Digital Controller (SLDC), etc.]
Field devices are not included in E/E/PES.
3.1.17 electronic (/E): See E/E/PES (3.1.16).
3.1.18 embedded software: See software (3.1.58.2).
3.1.19 energize to trip: SIS circuits where the outputs and devices are de-energized under normal
operation. Application of power (e.g., electricity, air) causes a trip action.
3.1.20 fail-safe: The capability to go to a predetermined safe state in the event of a specific
malfunction.
3.1.21 fault tolerance: Built-in capability of a system to provide continued correct execution of
its assigned function in the presence of a limited number of hardware and software faults.
3.1.22 field devices: Equipment connected to the field side of the SIS I/O terminals. Such
equipment includes field wiring, sensors, final control elements, and those operator interface devices hard-wired to SIS I/O terminals.
3.1.23 firmware: Special purpose memory units containing software embedded in protected
memory required for the operation of programmable electronics.
-| |||
3.1.24 forcing: A PES engineering station function that provides the capability to override the
application program and to change the states of inputs and outputs.
|||||| |
|| |||
3.1.25 functional testing: Periodic activity to verify that the SIS is operating per the Safety
Requirement Specifications Testing.
|||| || |
|
||||
3.1.27 hard-wired: Electrical connections accomplished without the use of software or firmware.
|
|| | ---
3.1.28 hazard: Chemical or physical condition that has the potential for causing injury to people
or the environment (Reference C.12).
ANSI/ISA-S84.01-1996
19
3.1.32 logic solver: E/E/PES components or subsystems that execute the application logic.
Electronic and programmable electronics include input/output modules.
|| | ---
||||
3.1.37 Pre-Startup Acceptance Test (PSAT): Process of confirming performance of the total
integrated SIS to assure its conformance to the Safety Requirement Specifications and design.
3.1.38 preventive maintenance: Maintenance practice in which equipment is maintained on the
basis of a fixed schedule, dictated by manufacturers recommendation or by accumulated data
from operating experience.
3.1.39 Probability of Failure on Demand (PFD): A value that indicates the probability of a system
failing to respond to a demand. The average probability of a system failing to respond to a demand
in a specified time interval is referred to as PFDavg. PFD equals 1 minus Safety Availability [see
safety availability (3.1.51)].
3.1.40 process industry sector: Refers to those processes involved in, but not limited to, the
production, generation, manufacture, and/or treatment of oil, gas, wood, metals, food, plastics,
petrochemicals, chemicals, steam, electric power, pharmaceuticals, and waste material(s).
3.1.41 Programmable Electronic System (PES): See E/E/PES (3.1.16).
3.1.42 protection layer: Engineered safety features or protective systems or layers that typically
involve special process designs, process equipment, administrative procedures, the Basic Process
Control System (BPCS), and/or planned responses to protect against an imminent hazard. These
responses may be either automated or initiated by human actions (see Annex A for guidance).
3.1.43 qualitative methods: Methods of design and evaluation developed through experience
and/or the application of good engineering judgement.
3.1.44 quantitative methods: Methods of design and evaluation based on numerical data and
mathematical analysis.
20
ANSI/ISA-S84.01-1996
|||||| |
| |||
3.1.36 permissive: Condition within a logic sequence that must be satisfied before the sequence
is allowed to proceed to the next phase.
--
3.1.35 overt faults: Faults that are classified as announced, detected, revealed, etc.
|| |||
|||| || |
3.1.45 redundancy: Use of multiple elements or systems to perform the same function. Redundancy can be implemented by identical elements (identical redundancy) or by diverse elements
(diverse redundancy).
3.1.46 reliability: Probability that a system can perform a defined function under stated conditions
for a given period of time.
-| |||
|||||| |
|| |||
3.1.48 reset: Action that restores the equipment under control to a predetermined normal enabled
or operating state.
|||| || |
|
3.1.49 risk assessment: Process of making risk estimates and using the results to make decisions.
||||
|
|| | ---
3.1.50 safe state: State that the equipment under control, or process, shall attain as defined by
the Process Hazards Analysis (PHA).
3.1.51 safety availability: Fraction of time that a safety system is able to perform its designated
safety service when the process is operating. In this standard, the average Probability of Failure
on Demand (PFDavg) is the preferred term. (PFD equals 1 minus Safety Availability; see 3.1.39.)
3.1.52 Safety Integrity Level (SIL): One of three possible discrete integrity levels (SIL 1, SIL 2,
SIL 3) of Safety Instrumented Systems. SILs are defined in terms of Probability of Failure on
Demand (PFD) (see Table 3.1).
Probability of Failure on
Demand Average Range
(PFD avg)
10-1 to 10-2
10-2 to 10-3
10-3 to 10-4
3.1.53 Safety Instrumented Systems (SIS): System composed of sensors, logic solvers, and
final control elements for the purpose of taking the process to a safe state when predetermined
conditions are violated (see Figure 1.1). Other terms commonly used include Emergency Shutdown
System (ESD, ESS), Safety Shutdown System (SSD), and Safety Interlock System.
3.1.54 Safety Life Cycle: Sequence of activities involved in the implementation of the Safety
Instrumented Systems from conception through decommissioning (see Figure 4.1).
3.1.55 separation: The use of multiple devices or systems to segregate control from safety
functions. Separation can be implemented by identical elements (identical separation) or by diverse
elements (diverse separation).
3.1.56 shall: Indicates a mandatory requirement.
3.1.57 SIS components: A constituent part of a SIS. Examples of SIS components are field
devices, input modules, output modules, and logic solvers.
ANSI/ISA-S84.01-1996
21
3.1.58 software
3.1.58.1 application software: Software specific to the user application in that it is the SIS
functional description programmed in the PES to meet the overall Safety Requirement Specifications (see Clause 5). In general, it contains logic sequences, permissives, limits, expressions, etc.,
that control the appropriate input, output, calculations, decisions necessary to meet the safety
functional requirements.
3.1.58.2 embedded software: Software that is part of the system supplied by the vendor and
is not accessible for modification by the end user. Embedded software is also referred to as
firmware or system software.
3.1.58.3 utility software: Software tools for the creation, maintenance, and documentation of
application programs. These software tools are not required for the operation of the SIS.
3.1.59 spurious trip: Refers to the shutdown of the process for reasons not associated with a
problem in the process that the SIS is designed to protect (e.g., the trip resulted due to a hardware
fault, software fault, electrical fault, transient, ground plane interference, etc.). Other terms used
include nuisance trip and false shut down.
3.1.60 systematic failures: Failures due to errors (including mistakes and acts of omissions) in
Safety Life Cycle activities that cause the SIS to fail under some particular combination of inputs
or under a particular environmental condition. Systematic failures can arise in any Safety Life
Cycle step.
3.1.61 Test Interval (TI): Time between functional tests.
3.1.62 user approved: Hardware, software, procedures, etc., that the user has evaluated and
determined to be acceptable for the application.
3.1.63 verification: Process of confirming for certain steps of the Safety Life Cycle that the
objectives are met.
3.1.64 voting system: Redundant system (e.g., "m" out of "n", one out of two [1oo2] to trip, two
out of three [2oo3], etc.) that requires at least "m" of the "n" channels to be in agreement before
the SIS can take an action.
3.2 Acronyms
BPCS:
CFR:
E/E/PES:
I/O:
Input/Output
MOC:
Management of Change
MTBF:
MTTF:
MTTR:
OSHA:
--
22
| |||
|||||| |
|| |||
|||| || |
||||
|| | ---
ANSI/ISA-S84.01-1996
PES:
PFD:
PHA:
PSAT:
PSSR:
SIL:
SIS:
WDT:
Watchdog Timer
4.1 Scope
The clauses in this standard are organized based on the Safety Life Cycle (see Figure 4.1). The
Safety Life Cycle covers the Safety Instrumented Systems (SIS) activities from initial conception
through decommissioning. Note that this standard does not address the method for performing
initial Safety Life Cycle activities, such as:
a) Performing conceptual process design
b) Performing Process Hazards Analysis & risk assessment
--
| |||
|||||| |
|| |||
|||| || |
|
||||
|
|| | ---
ANSI/ISA-S84.01-1996
23
|| |||
|||| || |
||||
|| | ---
(4.2.15)
--
| |||
|||||| |
24
ANSI/ISA-S84.01-1996
During the Safety Life Cycle of a SIS, there may be points where iterations are necessary. A few
of these are indicated in the Safety Life Cycle presented, but these should not be considered the
only points where iteration may be necessary.
The desire is to provide appropriate number of non-SIS protection layers, such that SIS
protection layer(s) are not required. Therefore, consideration should be given to changing the
process and/or its equipment utilizing various non-SIS protection techniques, before considering
adding SIS protection layer(s). The method for accomplishing this step is outside the scope of
this standard.
|| |||
|||| || |
|
||||
|
|| | ---
4.2.5 If an SIS is appropriate, the next step is establishing the requirements for the SIS by defining
a target Safety Integrity Level (SIL) (See Annex A for guidance). A SIL defines the level of performance needed to achieve the user s process safety objective. SILs are defined as 1, 2, and 3.
SISs above SIL 3 are not addressed in this standard. The higher the SIL, the more available the
safety function of the SIS. Performance is improved by the addition of redundancy, more frequent
testing, use of diagnostic fault detection, and use of diverse sensors and final control elements,
etc. Performance is also improved through better control of design, operation, and maintenance
procedures.
Associated with the SIL are Probability of Failure on Demand average (see Table 4.1).
0.99 to 0.999
0.999 to 0.9999
ANSI/ISA-S84.01-1996
10-2 to 10-3
10-3 to 10-4
25
The SIL concept is utilized in several steps of the Safety Life Cycle. See Annex A for guidance
on SIL determination. The method for accomplishing this step is outside the scope of this
standard.
4.2.6 The next step is developing Safety Requirement Specifications. The Safety Requirement
Specifications document functional and integrity requirements for the SIS (see Clause 5).
4.2.7 The next step involves developing the SIS Conceptual Designs that may meet the Safety
Requirement Specifications. Annex B provides guidance on the selection of architectures to meet
SIL requirements (see Clause 6).
4.2.8 Once SIS Conceptual Design is complete, the detailed design can be performed (see
Clause 7).
4.2.9
4.2.10 After installation is complete, the Commissioning and Pre-Startup Acceptance Test (PSAT)
of the SIS shall be performed (see Clause 8).
4.2.11 SIS Operation and Maintenance Procedures may be developed at any step of the Safety
Life Cycle and shall be completed prior to startup (see Clause 9).
d) Employee training has been completed and includes appropriate information about the
SIS.
|
||||
|
|||| || |
--
The planning and execution of this activity is outside the scope of this standard.
|| |||
c) PHA recommendations that apply to the SIS have been resolved or implemented.
|||||| |
| |||
a) Verification that the SIS was constructed, installed, and tested in accordance with the
Safety Requirement Specifications.
|| | ---
4.2.12 Prior to startup of the SIS, a Pre-Startup Safety Review (PSSR) shall take place. This
PSSR shall include the following SIS activities:
4.2.13 After PSSR, the SIS may be placed in operation. This step includes startup, normal operation, maintenance, and periodic Functional Testing (see Clause 9).
4.2.14 If modifications are proposed, their implementation shall follow a Management of Change
(MOC) procedure. The appropriate steps in the Safety Life Cycle shall be repeated to address the
safety impact of the change (see Clause 10).
4.2.15 At some time, the need for the SIS will cease. For example, this may be caused by plant
closure, or the removal or change of the process. The decommissioning of the SIS shall be planned,
and appropriate steps should be taken to ensure that this is accomplished in a manner that does
not compromise safety (see Clause 11).
26
ANSI/ISA-S84.01-1996
5.1 Objective
The objective is to develop specifications for Safety Instrumented Systems (SIS) design. These
Safety Requirement Specifications consist of both safety functional requirements and safety
integrity requirements. The Safety Requirement Specifications can be a collection of documents
or information.
A list of the safety function(s) required and the SIL of each safety function.
5.2.2 Process information ( incident cause, dynamics, final elements, etc.) of each potential
hazardous event that requires a SIS.
5.2.3
Process common cause failure considerations such as corrosion, plugging, coating, etc.
5.2.4
The definition of the safe state of the process, for each of the identified events.
5.3.2
5.3.3
The normal operating range of the process variables and their operating limits,
5.3.4
5.3.5 The functional relationship between process inputs and outputs, including logic, math functions, and any required permissives.
5.3.6
5.3.7
5.3.8
--
ANSI/ISA-S84.01-1996
| |||
|||||| |
|| |||
|||| || |
||||
|| | ---
27
5.3.9
Response time requirements for the SIS to bring the process to a safe state.
5.4.2
Requirements for diagnostics to achieve the required SIL (see B.9 for guidance).
5.4.3
5.4.4
6.1 Objectives
To define those requirements needed to develop and verify a SIS Conceptual Design that meets
the Safety Requirements Specifications.
--
28
| |||
|||||| |
|| |||
|||| || |
||||
|| | ---
ANSI/ISA-S84.01-1996
6.2.3
The desired SIL shall be met through a combination of the following design considerations:
a) Separation - identical or diverse (see B.1 for guidance)
b) Redundancy - identical or diverse (see B.2 for guidance)
--
| |||
|||||| |
|| |||
|||| || |
||||
|
|| | ---
7.1 Objective
To provide detailed requirements for the design of the Safety Instrumented Systems (SIS) to
achieve the requirements of the Safety Requirement Specifications and conceptual design.
The SIS design shall be capable of meeting the Safety Integrity Level (SIL).
7.2.2 The SIS may include sequencing functions to take the process to or maintain it in a safe
state.
ANSI/ISA-S84.01-1996
29
7.2.3
7.2.4 The SIS design documents shall be under control of a formal revision and release control
program.
7.2.5 The manufacturer of equipment used in SIS service shall maintain a formal revision and
release control program for the equipment, including applicable software. The use of visible markings or user interfaces to identify this information is acceptable (e.g., part #, serial #, batch #, etc.).
7.2.6 The design shall ensure that the hardware and software used in an application are compatible.
7.2.7 The action of any non-safety function, if implemented by the SIS, shall not interrupt or
compromise any SIS safety functions.
7.2.8 The required safe states of each SIS component required for the safety function shall be
defined.
7.2.9 The SIS shall be designed such that once it has placed the process in a safe state, it shall
remain in the safe state until a reset has been initiated. The requirement for a manual or automatic
reset shall be as defined in the Safety Requirements Specifications.
7.2.10 Manual means, independent of the logic solver, shall be provided to actuate the SIS final
elements unless otherwise directed by the Safety Requirements Specifications.
7.2.11 Any detected single fault that causes a SIS failure shall result in an automatic, predetermined, safe failure action; and/or a safe process condition if the appropriate response action is
undertaken.
7.2.12 The design shall apply codes and standards for environmental and hazardous area
classifications (e.g., NFPA 70, National Electrical Code, Article 500)(see C.5 for guidance).
7.2.13 SIS Input/Output power circuits shall be separated from circuits used for any other purpose
except where the sensor or final control element is shared as allowed in 7.4.2.2 and 7.4.3.1.
30
ANSI/ISA-S84.01-1996
|
||||
|| |||
|||||| |
| |||
7.3.4 The logic solver shall be separated (see B.1 for guidance) from the Basic Process Control
System (BPCS) except where some applications have combined BPCS and SIS functions in one
"logic solver" (e.g., gas turbines). In these cases, the BPCS/SIS logic solver shall meet the SIL
(see C.1 for additional guidance).
--
7.3.3 PES logic solvers shall have methods (internal and/or external) to protect against covert
faults (e.g., comparison of logic solver performance versus process action, embedded or application software testing the logic solver performance).
|||| || |
7.3.2 The logic solver supplier shall provide Mean Time To Failure (MTTF) data, covert failure
mode listing, and frequency of occurrence of identified covert failures. The method and data
sources for the above shall be provided.
|| | ---
7.3.1 The logic solver supplier shall provide an integrated design including, where applicable,
input module(s), output module(s), maintenance interface device(s), communication(s), and utility
software. The integrated design shall be documented.
7.3.5 The logic solver shall be designed to ensure the process will not automatically restart when
power is restored, unless Process Hazards Analysis indicates this is appropriate.
General requirements
7.4.1.1 Energize to trip discrete input/output circuits shall apply a method (e.g., end-of- line monitor,
such as pilot current continuously monitored to ensure circuit continuity; the pilot current shall not
be of sufficient magnitude to affect proper I/O operation) to assure circuit integrity.
7.4.1.2 When remote input/output is used, it shall be evaluated in conjunction with the logic solver
(see B.6 for guidance).
7.4.1.3 Each individual field device shall have its own dedicated wiring to the system Input/Output,
except in the following cases:
a) Multiple connected discrete sensors connected in series to a single input if the sensors
monitor the same process condition (e.g., motor overloads)
b) Multiple connected Final Control Elements (FCE) to a single output if each FCE services
the same process condition
c) User approved systems such as fire and gas detection systems
d) See 1.2.10 for ISA SP50 Fieldbus.
7.4.1.4 Field devices shall be selected and installed to minimize failures that could relate inaccurate
information due to conditions arising from the process and environmental conditions. Conditions
that shall be considered include corrosion, freezing of materials in pipes, suspended solids, polymerization, coking, and temperature and pressure extremes.
7.4.2
Sensor requirements
b) If the PHA determines that one or more protection layers other than the BPCS and the
SIS offers protection redundant to that provided by the sensor (for further guidance, see
Annex A).
7.4.2.3 Sensor diagnostics, vendor or user supplied , shall be provided as required to meet the
SIL (see B.9 for guidance).
ANSI/ISA-S84.01-1996
31
|
||||
|
|||| || |
|| |||
|||||| |
| |||
a) If redundant sensors are used, they may be connected to both the BPCS and the SIS
provided that any failure in the BPCS will not affect the proper operation of the sensor
or the ability of the SIS to read the sensor properly (see B.1.5).
--
7.4.2.2 Sensors for SIS shall be separated from the sensors for the Basic Process Control System
(BPCS). Two exceptions are allowed provided the failure of the sensor does not create a condition
that the SIS is intended to protect against:
|| | ---
7.4.2.1 Smart sensors shall be write protected to prevent inadvertent modification from a remote
location, unless appropriate safety review allows the use of read/write.
7.4.3
7.4.3.1 A control valve from the BPCS shall not be used as the only final element for SIL 3.
A safety review shall be required to use a single BPCS control valve as the only final element for
SIL 1 and 2. For additional information, see B.1.6.
7.4.3.2 Motor starters
Motor starters are typically common to both the BPCS and the SIS unless the Process Hazards
Analysis dictates otherwise (see B.10.4.3 for guidance).
7.5 Interfaces
This section addresses all human-machine and communication interfaces to the SIS. These can
include, but are not limited to
a) operator interface(s);
b) maintenance/engineering interface(s); and
c) communication interface(s).
7.5.1
Operator interface refers to that media (e.g., CRTs, indicating lights, push-buttons, horns,
alarms, etc.) used to communicate information between the operator and the SIS.
7.5.1.1 The operator interface system design shall take into consideration the loss of the SIS
operator interface and the resulting requirements as defined by appropriate safety review. The
design shall ensure that, upon failure of the SIS operator interface, sufficient alternate means shall
be provided for the operator to bring the process to a safe state and that the automatic functions
of the SIS are not compromised.
|| | ---
7.5.1.2 The SIS status information that is critical to maintaining the SIL shall be available as part
of the operator interface. This information may include
||||
d) indication that automatic action(s) such as degradation of voting and/or fault handling
has occurred;
--
| |||
32
|||||| |
|| |||
|||| || |
ANSI/ISA-S84.01-1996
7.5.1.3 Changes to the SIS application software shall not be allowed from the SIS operator
interface. Where the SIS maintenance/engineering interface is used as the operator interface to
the SIS, changes to application software from this interface shall require appropriate safety review
and access security. There may be some safety-related information that needs to be transmitted
from the BPCS to the SIS. For example, in batch systems a SIS may have different setpoints or
logic functions depending on the recipe being used. If so, the operator interface may be used to
select the appropriate logic function in the SIS or may be used to select recipe-specific tables. For
these types of applications, use only SIS systems that offer the ability to selectively allow writing
to a SIS variable that is accessible to the BPCS (see B.1.8 for additional guidance), and a confirmation procedure to ensure the proper selection has been transmitted and received in the SIS.
Enabling and disabling the read-write access shall be done only by a configuration or
programming process using the Maintenance/Engineering Interface with appropriate
documentation and security measures. An Operator Interface shall not be allowed to perform
this function.
7.5.2
Communication interface refers to hardware and software communication between the SIS and
other devices such as the operator interfaces, maintenance/engineer interfaces, BPCS, network
or peripherals.
7.5.3.1 The design of the communication interface of the SIS shall ensure that any failure of the
communication interface shall not adversely affect the ability of the SIS to bring the process to a
safe state.
7.5.3.2 Communication signals shall be isolated from other energy sources through the use of
good engineering practices, such as the use of shielded cable while maintaining a single ground
plane with a single dedicated power source, or the use of fiber optics.
--
| |||
|||||| |
|| |||
|||| || |
||||
|| | ---
ANSI/ISA-S84.01-1996
33
7.8.1.1 Only application logic under the control of a formal revision and release control program
shall be provided and considered for use on a SIS.
7.8.1.2 The application logic formal revision and release control program shall be provided and
maintained by the user.
7.8.1.3 The user shall ensure the application logic is documented in a clear, precise, and complete
way (see B.14 for guidance).
7.8.2
7.8.2.1 Only application logic under the control of a formal revision and release control program
shall be provided and considered for use on a SIS.
7.8.2.2 The application logic formal revision and release control program shall be provided and
maintained by the user.
7.8.2.3 The user shall ensure the application logic is documented in a clear, precise, and complete
way (See B.14 for guidance).
--
34
| |||
|||||| |
|| |||
|||| || |
||||
|| | ---
ANSI/ISA-S84.01-1996
7.8.3
Software discussed in this subclause addresses the SIS applications. Embedded and utility
software is discussed as far as it impacts application software.
7.8.3.1 Only software under the control of a formal revision and release control program shall be
provided and considered for use on a SIS.
7.8.3.2 The embedded software and utility software formal revision and release control programs
shall be provided and maintained by the SIS manufacturer(s). The manufacturer(s) shall also
provide and maintain a bug list and advise customers of any software faults which may lead to a
failure to function on demand.
7.8.3.3 The user shall not modify the SIS embedded or utility software.
7.8.3.4 The user shall ensure the application software is documented in a clear, precise, and
complete way (see B.3 and B.14 for guidance).
7.8.3.5 The application software formal revision and release control programs shall be maintained
by the user.
-| |||
|||||| |
|| |||
|||| || |
7.9.1 The design shall allow for testing of the overall system. It shall be possible to test final
element actuation in response to sensor operation. Where the interval between scheduled process
downtime is greater than the functional test interval, then on-line testing facilities are required.
|
||||
|
|| | ---
7.9.2 When on-line functional testing is required, test facilities shall be an integral part of the SIS
design to test for covert failures.
7.9.3 When test and/or bypass facilities are included in the SIS, they shall conform with the
following:
a) SIS shall be designed in accordance with the maintenance and testing requirements
defined in the Safety Requirement Specifications.
b) The operator shall be alerted to the bypass of any portion of the SIS via an alarm and/
or operating procedure.
c) Bypassing of any portion of the SIS shall not result in the loss of detection and/or
annunciation of the condition(s) being monitored.
7.9.4
Forcing of inputs and outputs without taking the SIS out of service shall not be allowed unless
supplemented by procedures and access security. Any such forcing shall be annunciated or
alarmed, as appropriate.
ANSI/ISA-S84.01-1996
35
8.1 Objective
8.1.1 The objective of this clause is to ensure that the Safety Instrumented Systems (SIS) is
installed per the detail design and performs per the Safety Requirement Specifications.
8.1.2 Any modification or change to SIS-specific equipment during installation, commissioning,
or Pre-Startup Acceptance Test (PSAT) shall require a return to the appropriate phase (the one
first affected by the change) of the Safety Life Cycle.
8.2 Installation
8.2.1
8.3 Commissioning
||||
8.3.2 The SIS commissioning activities shall include, but may not be limited to, confirmation that
the following are installed per the detailed design documents and are performing as specified in
the Safety Requirement Specifications:
|| | ---
8.3.1 Commissioning ensures the SIS is installed per the detailed design and is ready for the
Pre-Startup Acceptance Test.
|||| || |
|| |||
|||||| |
| |||
--
36
ANSI/ISA-S84.01-1996
b) Sensors, logic, computations, and final control elements perform in accordance with
Safety Requirement Specifications.
c) Safety devices are tripped at the setpoints as defined in the Safety Requirement
Specifications.
d) The proper shutdown sequence is activated.
e) The SIS provides the proper annunciation and proper operation display.
f) The accuracy of any computations that are included in the SIS.
g) That the system total and partial reset functions as planned.
h) Bypass and bypass reset functions operate correctly.
i) Manual shutdown systems operate correctly.
j) Test interval is documented in maintenance procedures consistent with SIL
requirements.
k) SIS documentation is consistent with actual installation and operating procedures.
8.4.2 A PSAT shall be satisfactorily completed prior to the introduction of hazards the SIS is
designed to prevent or mitigate.
8.4.3 Accuracy of calibration of test instruments used in the PSAT shall be consistent with the
application. For example, the margin between the SIS setpoint and the hazardous process condition may be used to determine the required accuracy.
8.4.4 Documentation to substantiate completion of the Commissioning and PSAT shall be completed prior to the introduction of hazards the SIS is designed to prevent or mitigate.
As a minimum, this documentation shall include the following:
a) Identification of the SIS that has been tested
b) Confirmation that Commissioning is complete
c) Date the PSAT was performed
d) Reference to the procedures used in the PSAT
e) Authorized signature that indicates PSAT has been satisfactorily completed
--
ANSI/ISA-S84.01-1996
| |||
|||||| |
|| |||
|||| || |
||||
|| | ---
37
|| | ---
|| |||
|||||| |
The objective of this clause is to ensure that the Safety Instrumented Systems (SIS) functions in
accordance with the Safety Requirement Specifications throughout the SIS operational life.
|||| || |
||||
9.1 Objective
--
| |||
9.2 Training
9.2.1 Employees involved in the operation and maintenance activities of the SIS shall be properly
trained.
9.2.2 Employee training shall adhere to requirements specified in applicable regulation(s) (e.g.,
OSHA 29CFR1910.119, Reference C.11).
9.3 Documentation
The user shall have appropriate documentation (as noted in each Clause 9 subsection) and shall
keep the documentation current (see B.14 for guidance).
38
ANSI/ISA-S84.01-1996
9.5.2
SIS maintenance shall include, but not be limited to, the following:
a) Regularly scheduled functional testing of the SIS
b) Regularly scheduled preventative maintenance, as required (e.g., replacement of
ventilation filters, lubrication, battery replacement, calibration, etc.)
c) Repair of detected faults, with appropriate testing after repair
9.7.3.1 The SIS shall be tested at specific intervals based on the frequency specified in the Safety
Requirement Specifications (see B.15 for guidance). Note that different portions of the SIS may
require different periodic test intervals.
9.7.3.2 At some periodic interval (determined by the user), the frequency(s) of testing for the SIS
or portions of the SIS shall be re-evaluated based on historical data plant experience, hardware
degradation, software reliability, etc.
9.7.3.3 Any change to the application logic requires full functional testing. Exceptions to this are
allowed if appropriate review and partial testing of changes are done to ensure the SIL has not
been compromised.
--
ANSI/ISA-S84.01-1996
| |||
|||||| |
|| |||
|||| || |
||||
|| | ---
39
9.7.4
9.7.4.1 A documented functional test procedure, describing each step to be performed, shall be
provided for each SIS.
9.7.4.2 Any deficiencies found during the functional testing shall be repaired in a safe and timely
manner.
9.7.4.3 The functional testing procedures shall include, but not be limited to, verifying the following:
a) Operation of all input devices including primary sensors and SIS input modules
b) Logic associated with each input device
c) Logic associated with combined inputs
d) Trip initiating values (setpoints) of all inputs
e) Alarm functions
f) Speed of response of the SIS when necessary
g) Operating sequence of the logic program
h) Function of all final control elements and SIS output modules
i) Computational functions performed by the SIS
j) Function of the manual trip to bring the system to its safe state
k) Function of user diagnostics
l) Complete system functionality
b) exercising the output(s) as far as practical (e.g., output trip relay, shut down solenoid,
partial valve movement) during on-line testing.
40
ANSI/ISA-S84.01-1996
|
|||| || |
--
| |||
|||||| |
9.7.5.2 For those applications where exercising the final trip element may not be practical, the
procedure shall be written to include
|| |||
9.7.5.1 Procedures shall be written to allow on-line functional testing (if required).
||||
9.7.5
|| | ---
c) Serial number or other unique identifier of equipment (loop number, tag number,
equipment number, user approved number, etc.)
d) Results of inspection/test ("as-found" and "as-left" condition)
10.1 Objective
The objective of this clause is to ensure that the management of change requirements are
addressed in any changes made to an operating SIS.
| |||
|||||| |
|| |||
|||| || |
|
||||
|
10.2.2 The MOC procedure shall ensure that the following considerations are addressed prior to
any change:
|| | ---
ANSI/ISA-S84.01-1996
41
| |||
|||||| |
b) personnel from appropriate disciplines have been included in the review process.
|| |||
|||| || |
10.2.4 Personnel affected by the change shall be informed of the change and trained prior to
implementation of the change or startup of the process, as appropriate.
|
||||
|
|| | ---
10.2.5 All changes to the SIS shall initiate a return to the appropriate phase (first phase affected
by the modification) of the Safety Life Cycle. All subsequent Safety Life Cycle phases shall then
be carried out, including appropriate verification that the change has been carried out correctly
and documented. Implementation of all changes (including application software) shall adhere to
the previously established SIS design procedures.
11 Decommissioning
11.1 Objective
11.1.1 To ensure proper review prior to permanently retiring a Safety Instrumented Systems (SIS)
from active service.
42
ANSI/ISA-S84.01-1996
-| |||
|||||| |
11.2 General
|| |||
|||| || |
11.2.1 Management of Change procedures shall be implemented for all decommissioning activities (see Clause 10).
|
||||
|
|| | ---
11.2.2 The impact of decommissioning an SIS on adjacent operating units and facility services
shall be evaluated prior to decommissioning.
12 Differences
ANSI/ISA-S84.01-1996
43
12.1 Terminology
ISA-S84.01
Comment
E/E/PES Safety
Related System
SIS
IEC draft Publication 1508 refers to Safety Related Systems utilizing all technologies, while S84.01 refers only to
technologies utilizing Safety Instrumented Systems.
PES
PES
EUC
Process
Assessment
PSSR
Functional
Requirements
Specification
Safety
Requirement
Specifications
--
44
| |||
|||||| |
|| |||
|||| || |
||||
|| | ---
ANSI/ISA-S84.01-1996
ISA-S84.01
(5)
-| |||
|||||| |
|| |||
|||| || |
|
||||
|
|| | ---
ANSI/ISA-S84.01-1996
45
S84.01
Items:
7.5.2.4
7.5.2.6
7.5.2.7
7.5.2.2
7.5.2.3
7.5.2.5
ISA-S84.01
Comment
SIL 1, 2, 3, 4
SIL 1, 2, 3
Equipment Under
Control (EUC) control
system excluding the
safety controls
Basic Process
Control
System
(BPCS)
--
46
| |||
|||||| |
|| |||
|||| || |
||||
|| | ---
ANSI/ISA-S84.01-1996
Regardless of the method used to select SIL, it is done as part of process safety activities. The
team involved in making SIL decisions consists of participants with certain types of expertise. It
is generally appropriate to include the following expertise and qualifications on the process safety
team:
a) Ownership those who have direct responsibility for operating the equipment
b) Process Knowledge an understanding of the basic science and technology involved
in the process and equipment operation
c) Design Knowledge how the equipment or process should work, particularly
instrumentation for complex control systems
d) Operating Experience those with direct "hands on" operating and maintenance
experience
e) Others skill in running process hazards reviews and other appropriate knowledge
as needed
This annex does not provide enough information to adequately understand the use of any
method, and it does not indicate or imply any safety criteria, or recommend any particular
approach.
ANSI/ISA-S84.01-1996
47
|
||||
|
|||| || |
|| |||
|||||| |
| |||
Four example SIL determination methods were selected to illustrate the variety of approaches. A
simple matrix method was chosen to briefly present the key factors, recognizing that many more
comprehensive matrix methods are available. The consequences only method exemplifies a
straight-forward SIL selection method that involves adoption of some very conservative safety
premises. To illustrate a qualitative risk evaluation SIL determination method, a modified HAZOP
method was chosen. Quantitative risk assessment methods are represented by describing how
a fault tree analysis can be used to determine SIL.
--
This annex provides four examples of methods for determining SIL as part of process safety
activities. These examples provide only general information on the range and types of
approaches for determining SIL. These and additional methods are described in Reference C.1.
Determining where a SIS is appropriate, what process variables actuate it, and what final
process actions it takes, are beyond the scope of this annex. The four SIL determination
methods are applied to an example in only enough detail to show conceptually how SIL can be
determined. Details on how to use and understand these SIL determination methods, and
others, are described in the references.
|| | ---
A.1 Introduction
As described in Clause 4 of the standard, determination of Safety Integrity Level (SIL), for a
Safety Instrumented Systems (SIS) is a part of process safety activities. As depicted in the
Safety Life Cycle, (see Figure 4.1), steps 2, 3, 4, 5, and 6 summarize the process safety
concepts involved in determining SIL. These life cycle steps are as follows:
f) Step 2 - Evaluate consequences and likelihood for hazardous events
g) Step 3 - Evaluate preventive, protective and mitigating process safety features for these
events, other than SIS
h) Step 4 - Decide if a SIS is appropriate for this application
i) Step 5 - Determine target SIL for the SIS
j) Step 6 - Determine other process safety-related specifications and design criteria
Process safety activities, which include consequence analysis and process hazards reviews
(References C.14 and C.15), have the objective of helping to assure that the process will be safe
to operate. Hazards, and hazardous events, are identified, and means to control the risk and
potential consequences are decided upon, as part of these activities. Risk control and risk
reduction decisions are made on many process safety features of the process. These include
items, such as, procedures, basic process design, over-pressure protection, and SIS.
A.2 Safety Integrity Level (SIL) considerations and the process example
Safety Integrity Level (SIL) is a basic concept in this standard. SIL defines the level of safety
performance for a SIS. SILs are defined as 1, 2, or 3. The higher the SIL, the better the safety
performance of the SIS. Better SIS performance is achieved by higher availability of the safety
function. SIS performance is improved by the addition of redundancy, more frequent testing, use
of diagnostic fault detection, etc., as described in the standard and annexes.
Some understanding of how the three SIL levels will be implemented is important for the process
safety team making the SIL determinations. As the team learns the process, and how hazardous
events can occur, they should understand how the SIS will perform its safety function. With an
understanding of the important safety aspects of the SIS, including what is needed to achieve the
different SIL, the team helps to ensure that the process design and operation do not compromise
performance of the SIS.
Figure A.1 conceptually shows how the three SIL will be implemented in the example application.
The implementation depicted in Figure A.1 is specific to this example. As described in this
standard and ISA-dTR84.02 (Reference C.2), there are many ways to implement SIS to achieve
a specified SIL.
Figure A.2 depicts a simplified piping and instrumentation diagram for the process example. A
high pressure vapor is used to control pressure in a low pressure system. The low pressure
system is protected from over-pressure by
a) a pressure relief valve;
b) a pressure control system; and
c) an operator response to a high pressure alarm.
--
48
| |||
|||||| |
|| |||
|||| || |
||||
|| | ---
ANSI/ISA-S84.01-1996
Protection of the low pressure system is achieved by stopping flow from the high pressure
system, or by the pressure relief valve opening. The consequence of over-pressuring the low
pressure system is rupture of the low pressure vessel.
The process safety team has identified a potential SIS to prevent over-pressure from occurring in
the low pressure system. The SIS would be implemented by sensing pressure and closing
valves for the different SIL, with sensors, final elements, and logic solvers arranged as shown in
Figure A.1. Figure A.2 simply illustrates the process and is not intended to depict any specific
SIL requirements.
--
| |||
|||||| |
|| |||
|||| || |
||||
|| | ---
ANSI/ISA-S84.01-1996
49
Sensor
Logic Solver
SIL 1
...T
XXXX
Logic
Solver
Actuator
Figure A.1a
Logic
Solver
|| | ---
...T
XXXX
|||| || |
Logic
Solver
--
| |||
Note:
1) Sensors, logic solvers, and/or final elements may be redundant as safety availability requirements
dictate
Figure A.1b
|| |||
Note 1
|||||| |
...T
YYYY
||||
SIL 2
Logic
Solver
...T
XXXX
SIL 3
Note 2
...T
YYYY
Logic
Solver
2) The performance of two identical SIL 1 SISs may not equal that of one SIL 3 SIS.
Figure A.1c
...T
XXXX
SIL 3
...T
YYYY
Logic
Solver(s)
*
Figure A.1d
Figure A.1 Company ABC, Site XX, Specific SIL implementation techniques,
example only
50
ANSI/ISA-S84.01-1996
--
ANSI/ISA-S84.01-1996
| |||
|||||| |
|| |||
|||| || |
||||
|| | ---
51
than predicted by use of other SIL selection methods. Erring on the side of designing a higher
than necessary SIL level was felt to be conservative by this team. The team preferred to save
time that would be spent on risk evaluations and to incur the potential cost penalties imposed by
selecting a higher SIL than might otherwise result. Money spent on equal or better safety
performing SIS was felt to be a good investment in safety.
Figure A.3 Company ABC, Site XX, Example of a qualitative matrix for the
determining SIL
The method only requires an evaluation of the severity of consequences, should the SIS and
other protective safety items fail. Since this is a conservative method, this particular plant
decided to simplify the SIL selection process from three SIL choices to two SIL choices. This
was done by selecting only SIL 1 or SIL 3 designs. If the consequences are above a base
threshold, then a SIL 1 is selected. If they are above a "major" severity criteria, then a SIL 3 is
selected.
These two severity levels were defined to include injuries, property damage, and environmental
impact specific to this process. Risk was addressed in setting these guidelines, by the
underlying assumption that the frequence of occurrence of initiating events for all SIS
applications was assumed to be frequent, or likely.
The team evaluated the severity of consequences for the high pressure shutdown SIS in the
example and felt they exceeded the "major" criteria. Based on that evaluation, a SIL 3 was
selected.
A.3.3 Example method - the modified HAZOP method
In order to determine the SIL, the modified HAZOP method includes the consideration of the
severity of the consequences, their probability of occurrence, along with other risk-related
--
52
| |||
|||||| |
|| |||
|||| || |
||||
|| | ---
ANSI/ISA-S84.01-1996
factors. Specific risk reduction recommendations can be evaluated in terms of their effectiveness
in reducing risk. The team decides on recommendations, or the adequacy of current risk controls,
based on this evaluation process.
Using an experienced leader in HAZOP methodology, the process segment is systematically
analyzed using a set of guide words to identify process deviations that could lead to hazardous
events. A spreadsheet format is used to associate the process deviation, with a specific upset
cause. The upset cause is followed by the potential consequences of the upset, factors that
prevent or protect against the consequences, and the action or judgement of the team on how to
control the associated risk. The team decides on recommendations or the adequacy of current
risk controls, based on this evaluation process.
Part of the modified HAZOP documentation for the example is summarized in Table A.1.
The modified HAZOP team also identified operator error when in manual mode during startup as
a cause of a high pressure upset.
Based on the severity of the consequences, the teams feeling for the likelihood of these upsets,
and overall performance of the protective systems, the team agreed a SIS was needed. Initially,
a SIL 2 or 3 was considered by the team for further evaluation. The team considered safety,
equipment reliability, and operation and maintenance costs then determined that an SIL 2 SIS is
more appropriate for this application.
CAUSE
CONSEQUENCES
PROTECTION
More Flow
Relief Valve
Operator response
to high pressure
alarms
High pressure
shutdown SIS
More Pressure
--
| |||
|||||| |
|| |||
|||| || |
||||
|| | ---
ANSI/ISA-S84.01-1996
53
in Reference C.1, page 56, and extensively covered in Reference C.13. Details of the fault tree
covering the example are too complex to describe or depict in this annex.
The first step in using the fault tree to determine SIL for the example was to develop the fault tree
logic diagram. The initial fault tree was based on the assumption of a high pressure shutdown
SIS designed as shown in Figure A.2, a SIL 1 design. Appropriate failure information were
determined for all the failure events associated with the example. For example, failure
frequencies were estimated for initiating events, such as the pressure control valve failing to
open. A top event frequency for vessel rupture was then calculated.
After reviewing the fault tree results, the team decided that the fault tree should be changed for
evaluation of an SIL 2 and 3 design for this SIS. Subsequent results of this fault tree evaluation
indicated a substantial safety improvement for the SIL 2 design, versus the SIL 1 design. The
top event vessel rupture frequency of occurrence decreased by a substantial percentage. A
similar comparison of SIL 2 versus SIL 3 designs, indicated only a small safety improvement, i.e.,
the top event frequency decreased only slightly. Based on these comparisons, the team selected
SIL 2 for the high pressure shut down SIS.
-| |||
|||||| |
|| |||
|||| || |
|
||||
|
|| | ---
54
ANSI/ISA-S84.01-1996
B.2
B.3
B.4
Technology selection
B.5
B.6
Architecture
B.7
Power sources
B.8
B.9
Diagnostics
B.10
Field devices
B.11
User interface
B.12
Security
B.13
Wiring practices
B.14
Documentation
B.15
--
ANSI/ISA-S84.01-1996
| |||
|||||| |
|| |||
|||| || |
||||
|| | ---
55
--
56
| |||
|||||| |
|| |||
|||| || |
||||
|| | ---
ANSI/ISA-S84.01-1996
--
ANSI/ISA-S84.01-1996
| |||
|||||| |
|| |||
|||| || |
||||
|| | ---
57
--
safety review and analysis. Measures to achieve write protection of the safety function
include but are not limited to
| |||
|||||| |
|| |||
|||| || |
|
||||
|
Use of this method may be acceptable for SIL 1. Use of this method for SIL 2 requires
additional safety review and analysis. Use of this method in SIL 3 is discouraged.
|| | ---
58
ANSI/ISA-S84.01-1996
d) the use of geographic diversity (e.g., alternate routes for redundant communications
media).
B.2.7 Some typical concerns with PES technology that could warrant diverse redundancy in SIS
would be undetected faults in
-| |||
a) hardware;
|||||| |
b) manufacturing;
|| |||
c) components;
|||| || |
d) operating system;
|
||||
e) communications;
|
|| | ---
f) firmware;
g) software;
h) application programming; and
i) environment.
ANSI/ISA-S84.01-1996
59
B.3.3.3 Programming languages that are mature and/or have been certified to accepted industry
standards are preferred.
B.3.3.4 Programming guidelines should be established to enforce consistent style among the
design team. Implementation of a software quality plan may facilitate development of a consistent
programming style.
B.3.3.5 To avoid unnecessary complexity and features that make the behavior of the system
difficult to predict, the following should be considered:
a) The software should have a definite order and structure so that it ensures understanding
of where you are in the application software at all times
b) If nested sequences are used, nesting should be limited to as few layers as possible
c) Peer reviews of application software
B.3.3.6 To verify that the software design meets each of the requirements established in the Safety
Requirement Specifications, consider the following:
a) An analysis to demonstrate that each of the requirements established in the Safety
Requirement Specifications is implemented in the design
b) Peer review of designs of safety critical functions
|
||||
a) Tests should be developed to exercise the software beyond the normal bounds for data,
commands, keyboard inputs, and other actions.
|| | ---
B.3.3.7 Confirm that the application software meets the requirements established in the Safety
Requirement Specifications under all expected operating conditions. Consider the following:
|| |||
|||||| |
|||| || |
--
| |||
60
ANSI/ISA-S84.01-1996
| |||
b) has the proper "fail-to-shelf" position (e.g., position when completely disconnected)
characteristics when installed;
--
ANSI/ISA-S84.01-1996
|
|||||| |
|| |||
|||| || |
B.4.4.2.3 Successful users of relays in safety applications have followed some simple guidelines.
They include using a relay that
||||
B.4.4.2.2 Standards and guidelines for implementing electromechanical relays in SIS applications
are available to users (see Reference C.4). Unsafe failure modes of relays can also be quantified.
|| | ---
B.4.4.2.1 Electromechanical devices include relays and timers. Relays are often used where
simple logic functions are adequate to provide the necessary safety logic. Extensive operating
experience with relays and their mature technology make acceptance of this device in a SIS
widespread.
61
B.4.4.2.8 Electromechanical relays may not be suitable for SIS applications with
a) high duty-cycles resulting in frequent state changes;
b) timers or latching functions;
c) complex math functions;
d) analog measurements; and
e) large logic applications.
B.4.4.3 Motor driven timers
-| |||
|||||| |
|| |||
B.4.4.3.1 Motor driven timers provide acceptable performance for key safety applications such as
burner purge timing. Most motor driven timers require a locking device or appropriate modification
to eliminate tampering with critical settings. Motor driven timers are limited in timing resolution and
the ability to handle high duty cycles.
|||| || |
|
||||
|
|| | ---
B.4.5.1.1 Solid state relays are used in high duty-cycle application and have unsafe failure modes
that can be identified and quantified. Appropriate design features should be added to handle these
unsafe failure modes. Some additional applications of solid state relays are described in the
following paragraphs.
B.4.5.2 Solid state timers
B.4.5.2.1 Solid state timers are used where the applications complexity does not warrant a PES.
Solid state timer technology can be categorized as either Resistor-Capacitor (RC) circuit or pulse
counting. RC timing devices may not be suitable for safety applications because of poor repeatability and unsafe failure modes. Note that RC circuitry is often used in the time setting portion of
pulse-counting timers; this does not preclude the use of these timers.
B.4.5.2.2 The pulse-counting timer, sometimes referred to as a digital timer, can use a number of
methods to achieve pulse counting. These include
a) a line frequency (50 or 60 Hz);
b) an electronic oscillator; and
c) a quartz crystal oscillator.
B.4.5.2.3 A user-approved safety crystal oscillator (e.g., quartz) timer is recommended because
of high repeatability and good reliability.
B.4.5.3 Solid state logic
B.4.5.3.1 Solid state logic refers to the transistor family of components like Complimentary Metal
Oxide Semiconductor (CMOS), Resistor-Transistor Logic (RTL), transistor-transistor logic (TTL),
and High Noise Immunity Logic (HNIL). These components are assembled in stand-alone modules,
plug-in board modules, or in highly integrated, high-density chips. They differ from typical computer-type equipment in that they have no Central Processing Unit (CPU). They perform according
to the logic obtained by the direct-wiring techniques of interconnecting the various logic components
such as ANDs, ORs, and NOTs. These systems have limitations in fail-safe requirements (e.g.,
indeterminate failure modes) that should be recognized.
62
ANSI/ISA-S84.01-1996
B.4.5.3.2 Solid state logic has generally been integrated with direct-wiring and relay schemes for
SIS. Solid state logic is not recommended for SISs unless provided with additional diagnostics to
test for unsafe failure modes. PESs are sometimes used as a diagnostic tool to make solid state
logic systems suitable for SIS.
B.4.5.4 Pulsed electronic logic
B.4.5.4.1 Pulsed electronic logic generates pulses with a specified amplitude and period. A pulse
train is recognized as a logic "true or "one," while all other signals (e.g., grounds, non-specified
pulses, and continuous "on" or "off") are recognized as a logic "false" or "zero."
B.4.5.4.2 Pulsed electronic logic can be considered in a SIS if it meets the requirements noted in
this standard and is user approved.
B.4.5.4.3 Pulsed electronic logic can offer high safety integrity. However, PES designs offer some
functions that may not be available with pulsed solid state systems or electronic logic such as
calculation capability, improved communications, and networking.
B.4.6 PES technology used in SIS
B.4.6.1 The PES can be a programmable controller, a distributed control system controller, or an
application-specific stand alone microcomputer. Caution should be used when using personal
computers, since they generally do not have the safety integrity required for SIS applications.
B.4.6.2 The use of PES results in many difficult to recognize failure modes, many of which can
be unsafe.
--
B.4.6.3 Some techniques that can be used to minimize the unsafe failure modes of PES are
| |||
|||||| |
|| |||
|||| || |
|
||||
|
|| | ---
ANSI/ISA-S84.01-1996
63
B.5.2 Tables B.5.1 and B.5.2 list some of the possible faults which should be considered in the
design of SIS.
Failure Mode
Device(s)
Failure Mode
Timing faults
Noise
Welded contacts
Stuck armature
Contact fidelity
64
Wiring fault
Ground fault
Noise/dynamic faults/
x-talk
Noise
Open/short
Counter failure
Pilot device fault
Stuck open/closed/
intermediate
Wrong signal
Mechanism stuck
Corrupt data
Energy source
Incorrect data
Incorrect source/
destination
Incorrect handshaking
Conversion fault
||||
Isolation failure
|| | ---
FINAL ELEMENT
COMMON MODE
Over-voltage, current,
pressure, etc.
Under-voltage, current,
etc.
Loss of connection
Loss of receiver/
transmitter
Backup-Energy failure
(UPS)
Response timeout
Temporary energy
fluctuations
Corrosion
Loss of redundant
channel
Electromagnetic
interference
ANSI/ISA-S84.01-1996
Ground fault
Duplicate source/
destination
|||| || |
Open/short
|| |||
EXTERNAL
COMMUNICATION
Drift/Calibration Fault
|||||| |
BARRIER/
TERMINATION
| |||
WIRING/CONNECTORS
ELECTROMECHANICAL
RELAY/TIMER
--
Up/Downscale stuck;
Incorrect signal
Failure Mode
Device(s)
Wrong timer
Access time
Timeout / overrun
Timebase fault
Device specific
(custom IC)
x-talk on Input /
Output lines
Stuck on/off
Upscale / Downscale /
conversion fault
Drift calibration
Unstable input
Isolation fault
Timeout / multidrop
conflict
Linearization /
Compensation
Deadlock (comm)
OUTPUT
Stuck on / off /
Conversion fault
Upscale / Downscale
Drift / Calibration
Unstable output
x-talk (DMA)
Isolation fault
Loss of Input/Output
communication
Linearization/
Compensation
--
ANSI/ISA-S84.01-1996
x-talk (DMA)
Wrong Input /
Output line
PES
Failure Mode
| |||
|||||| |
|| |||
|||| || |
||||
|| | ---
65
B.6 Architecture
B.6.1 Selection of the SIS architecture is an activity performed during the conceptual design step
of the Safety Life Cycle. The architecture has a major impact on the overall safety integrity of the
SIS. The architecture also influences SIS reliability (likelihood of spurious trips) (Reference C.3).
B.6.2 Some of the activities involved in determining the SIS architecture are
a) selection of energize to trip or de-energize to trip design;
b) selection of identical or diverse redundancy for the SIS sensors, logic solver, and final
control elements;
c) selection of redundancy for power sources and SIS power supplies;
--
| |||
|||||| |
|| |||
e) selection of data communications interfaces between SIS and other subsystems (e.g.,
BPCS) and their method of communication (e.g., read only or read/write).
|||| || |
|
B.6.3 A SIS may utilize architectures (e.g., 2oo3 sensor, 1oo1 logic solver, 1oo2 final element)
for reasons that may include different
||||
|
|| | ---
b) testing requirements;
c) equipment reliability and failure modes; and
d) user interfaces.
B.6.4 Architecture that may typically meet the SIL performance requirements includes:
SIL 1 - A 1oo1 architecture with a single sensor, single logic solver, and a single
final control element.
SIL 2 - Requires more diagnostics and typically includes redundancy of the logic
solver and sensors, with redundancy of final control elements as
necessary.
SIL 3 - Typically two separate and diverse 1oo1 arrangements, each with their
own sensor, logic solver, and final control element. The 1oo1
arrangements would be connected in a 1oo2 voting scheme. Diverse
separation, redundancy, and exhaustive diagnostic capabilities are
considered significant aspects of a SIL 3 system.
The user must determine the failure rates of the system components, diagnostic coverage, test
intervals, redundancy, etc., and evaluate each specific SIS to validate its performance (see
ISA-dTR84.02 for additional guidance).
66
ANSI/ISA-S84.01-1996
||||
b) frequency range;
|||| || |
c) harmonics;
|| |||
d) non-linear loads;
|||||| |
e) ac transfer time;
| |||
--
g) lightning protection;
ANSI/ISA-S84.01-1996
67
h) protection against transients such as spikes, surges, brown outs, and electrical noise;
i) protection against undervoltages;
j) protection against overvoltages; and
k) grounding.
B.7.1.11 A checklist of DC electrical power considerations includes
a) voltage range and current range including inrush current; and
b) non-linear loads.
B.7.2 Grounding
B.7.2.1 Grounding is critical in E/E/PE technology to ensure personnel safety (Reference C.5)
and proper equipment performance. This subclause deals only with the voltages found in SIS
applications (typically 240 volt AC or below, and 125 volts DC and below).
B.7.2.2 Note that the grounding becomes more restrictive when moving from electrical to electronic
and from electronic to programmable electronic. Therefore, electrical equipment grounding can
be easily achieved in a grounding system designed for electronic and/or Programmable Electronic
equipment, and electronic equipment grounding can be easily achieved in a grounding system
designed for programmable electronic equipment. Programmable Electronic equipment installed
in a grounding system designed for electrical technology may not be appropriate.
B.7.2.3 For ungrounded systems, consider using ground fault detection relays and alarms as
appropriate.
B.7.2.4 Note that electrical or electronic technologies may integrate Programmable Electronic into
their equipment to enhance performance through improved communication, diagnostics, humanmachine interfaces, etc. In those cases, treat the grounding as if it is Programmable Electronic
grounding, unless vendor installation guidelines dictate a different approach.
--
B.7.2.5 The grounding system should meet the manufacturers recommendations. Deviations
should have safety review and analysis.
| |||
a) corrosion protection;
|| |||
|||| || |
b) cathodic protection;
|
|| | ---
||||
68
ANSI/ISA-S84.01-1996
a) Pressure
|
b) Moisture
||||
c) Contaminants
|||| || |
B.7.4.1 Hydraulic power is typically used where high motive force is required, such as very large
valves.
B.7.4.2 Hydraulic power checklist:
a) Pressure
b) Volume
c) Contaminants
d) Fluid properties
ANSI/ISA-S84.01-1996
69
--
| |||
|||||| |
|| |||
e) Volume
B.8.3 Common cause faults or systematic errors may be reduced during design using appropriate
fault avoidance measures. Consider using the following methods:
a) Provide supplier with application-specific information (e.g., codes, model number(s),
etc.)
b) Verification
c) Diverse separation
d) Diverse redundancy
e) Identical redundancy
f) Identical separation
B.8.4 A number of functionally separate SIS may share the same environment, cabinet, operator
interface, and maintenance/engineering interface. These separate systems may however require
physical separation of power and logic solver to accomplish testing maintenance or modification.
The impact of these activities should be considered during system layout.
B.9 Diagnostics
B.9.1 General considerations
-| |||
B.9.1.1 Diagnostics are tests performed periodically and automatically to detect covert faults that
prevent the SIS from responding to a demand (see ISA-dTR84.02 for further guidance).
|||||| |
|| |||
B.9.1.2 Various types of faults that can occur are included in Table B.9.1:
|||| || |
|
||||
|
|| | ---
Fault Type
Example
B.9.1.3 A covert fault in a system may prevent the SIS from responding to a demand. This can
be the first fault in a single channel system or a combination of faults in a multi-channel system.
Therefore it is important to not only discover critical faults but also potentially critical faults before
they accumulate.
70
ANSI/ISA-S84.01-1996
--
ANSI/ISA-S84.01-1996
| |||
|||||| |
|| |||
|||| || |
||||
|| | ---
71
Chip error
Software
detection
Address
Processing
detection
Wrong constants
Indexing
Wrong circuit
Event
Event verification
Component out of
specification
Scheduling
Scheduler monitor
Algorithm
Assertions
Plausibility check
Reverse
computation
diversity
Voter fault
|| | ---
Time
possible cause
B.10.1.2 Two analog sensors, two discrete sensors (switches), or one of each could be selected.
If one analog device and one discrete device are selected to provide diversity, as opposed to two
analog devices, the advantage of continuous comparison of signals is lost. Proper operation of
the discrete device can only be verified by testing or the occurrence of a process demand. If two
analog devices are selected, they can be continuously compared. This comparison significantly
reduces Mean Time To Detection of failure thus providing more available protection.
B.10.1.3 The following SIS considerations related to field devices may enhance the application
of field devices:
a) Continuously compare redundant sensors while system operates (e.g., alarm or shut
down on unacceptable deviation)
72
ANSI/ISA-S84.01-1996
--
| |||
B.10.1.1 Many common cause failures of field devices may be avoided by properly applied redundancy and/or diversity. One example is an application requiring redundant sensors using
different principles of operation and/or different manufacturers.
|||||| |
|| |||
|||| || |
||||
d) If SIS has a built-in feature that displays the last good value on a bad value of the field
sensor, this feature should be defeated (For SIS applications the signal should be
permitted to go to its extreme value)
|| |||
|||| || |
f) Alarm if field devices change state without a command from the SIS
||||
|
|| | ---
Current/voltage alarm trips: current/voltage alarm trips convert current and voltage (e.g.,
4 - 20 mA or 0 - 10 V DC) analog inputs into discrete signal outputs. The trip value is field
adjustable. These switches have unsafe failure modes; appropriate analysis and design features
should be provided to ensure safe operation.
Valves:
Relays:
coil inoperative, contacts held in their "normal" positions, contacts welded closed,
contacts worn resulting in high resistance/restricted current flow, and stuck
armature
B.10.2.2 Given these failure modes, consider selecting components with built in features that drive
the device to one of its detectable extremes in a high percentage of its failure modes.
B.10.3 Sensor selection criteria
B.10.3.1 Some considerations for the selection of sensors include
a) analog devices are preferred to discrete types;
b) where possible, try to obtain redundancy and/or diversity by measuring different
variables where each is indicative of the same abnormal condition;
ANSI/ISA-S84.01-1996
73
|| |||
|||||| |
f) where it will meet the requirements, consider the use of a modulating control valve as
one of the final valve elements since the proper operation of the control loop verifies
the valve is not stuck in a single position;
|||| || |
||||
| |||
--
h) materials suitability/comparability;
i) carefully weigh the use of devices that are foreign to a plant's maintenance organization;
j) fail position considerations; and
k) valve position indication.
B.10.4.2 Solenoid valves
B.10.4.2.1 Some considerations in the application of solenoid valves include
a) consider temperature, voltage, area classification, loading, etc., when selecting solenoid
valves;
b) effects of air pressure, minimum or maximum, on the valve;
c) ensure the solenoid valve is sized properly;
d) adjustable flow paths provide an opportunity for defeating an SIS function if improperly
adjusted;
e) mounting the solenoid between the positioner and the valve;
74
ANSI/ISA-S84.01-1996
--
| |||
|||||| |
ANSI/ISA-S84.01-1996
|| |||
|||| || |
||||
|| | ---
75
B.11.1.1.2 SIS data displayed to the operator should be updated and refreshed at the rate required
to communicate between the operator and the SIS during emergency conditions so safe
response(s) can be attained.
B.11.1.1.3 Displays relating to the SIS should be clearly identified as such, avoiding ambiguity or
potential for operator confusion in an emergency situation. Operators should have easy access
to safety-related displays, preferably by a single key-stroke or touch-screen stroke giving entry into
a display hierarchy.
|
||||
|
|||| || |
|| |||
| |||
B.11.1.1.6 The operator interface and associated system (such as a Distributed Control System)
may be used to provide automatic safety-related event logging and alarming functions. Conditions
to be logged should include SIS events (such as trip and pre-trip occurrences), whenever the SIS
is accessed for program changes, and diagnostics.
|||||| |
B.11.1.1.5 Display layout is also important. Too much information on one display may lead to
operators misreading data and taking wrong actions. Use colors, flashing indicators, and judicious
data spacing to guide the operator to important information and to reduce the possibility of
confusion. Messages must be clear, concise, and unambiguous.
|| | ---
B.11.1.1.4 Give the operator enough information on one display to rapidly convey critical
information. Display consistency is important. Provide the same access methods, alarm
conventions, and display components as are used in the non-safety-related displays.
--
B.11.1.2 Panel(s)
B.11.1.2.1 Panels should be located to give operators easy access.
B.11.1.2.2 Arrange panel to ensure that the layout of the push buttons, lamps, gauges, and other
information is not confusing to the operator. Shutdown switches for different process units or
equipment that look the same and are grouped together may result in the wrong equipment being
shut down by an operator under stress in an emergency situation. Physically separate the shutdown
switches and boldly label their function. Provide means to test all lamps.
B.11.1.3 Printer(s)
B.11.1.3.1 Printers connected to the SIS should not compromise the safety function if the printer
fails, is turned off, is disconnected, runs out of paper, or behaves abnormally.
B.11.1.3.2 A SIS connected to a BPCS may use BPCS facilities to perform its safety-related
logging and reporting functions.
B.11.1.3.3 Printers are useful to document Sequence Of Events (SOE) information, diagnostics,
and other safety-related events and alarms, with time and date stamping and identification by tag
number. Report formatting utilities should be provided.
B.11.1.3.4 If printing is a buffered function (information is stored, then printed on demand or on a
timed schedule), then the buffer should be sized so that information is not lost, and under no
circumstances should SIS functionality be compromised due to filled buffered memory space.
B.11.2 Maintenance/Engineering interface(s)
B.11.2.1 Maintenance/Engineering interfaces consist of means to program, test, and maintain the
SIS. Interfaces are devices used for functions such as:
a) System hardware configuration
76
ANSI/ISA-S84.01-1996
--
B.12 Security
B.12.1 General
B.12.1.1 Means should be provided to control access to SIS including the logic solver, SIS maintenance interfaces, test and bypass functions, SIS alarms, sensors, and final elements. The access
protection may be in the form of locked cabinets, "read only" communication, access codes, passwords, administrative procedures, etc.
B.12.1.2 For guidance in the application of these options see Reference C.1, Section 6.1.9.
B.12.2 Exceptions
Protection against the following are beyond the scope of this annex:
a) Malicious modification
b) Modification errors
B.12.3 Additional PES considerations
B.12.3.1 Access control and security may be provided by a combination of application logic and
host functions for any SIS user-interface device that could interfere with performance of the safety
function:
a) Parameters that are appropriate for operator interaction should be accessible.
b) Parameters that may be changed on-line with appropriate review should come under
access control.
c) Parameters or functions that require validation after change should be accessible only
off-line.
B.12.3.2 The ability to restrict access to the SIS operating mode, program, and data should be
an integral feature of the SIS.
ANSI/ISA-S84.01-1996
|
| |||
|||||| |
|||| || |
|| |||
B.11.2.3 Maintenance/Engineering Interfaces should provide means for copying application programs to storage media.
||||
|| | ---
77
|
|||| || |
--
| |||
|||||| |
|| |||
B.13.6 Use caution when using solid state inputs or outputs because leakage current may falsely
actuate final control elements.
||||
B.13.5 Electronic and programmable electronic logic solvers may require a more restrictive wiring
approach because inductive or capacitive coupling may falsely turn on inputs.
|| | ---
B.13.4 Electronic and programmable electronic logic solvers use internal low level logic signals.
Use of low level logic outside the shielded controller cabinet may be inappropriate.
78
ANSI/ISA-S84.01-1996
B.14.1 A list of the documentation that may be used to implement a SIS, includes the following:
||||
|| | ---
B.14 Documentation
|||| || |
b) Application logic
|| |||
c) Design documentation
|||||| |
| |||
--
ANSI/ISA-S84.01-1996
79
|| | --|
||||
|
|||| || |
|| |||
|||||| |
| |||
--
NOTES
1.
2.
3.
Within the body of the text and the Index, references are cited by the reference numbers (in
italics and brackets) given below.
[Ref. C.13]
Guidelines for Chemical Process Quantitative Risk Analysis, New York, 1989
[Ref. C.14]
[Ref. C.1]
Available from:
AIChE
345 East 47th Street
New York, NY 10017
[Ref. C.15]
Available from:
[Ref. C.15]
Available from:
--
ANSI/ISA-S84.01-1996
| |||
|||||| |
|| |||
|||| || |
||||
Tel: 44 71 8343399
|| | ---
81
-| |||
|||||| |
|| |||
|||| || |
||||
|
NOTE IEC draft Publication 1508 is in development; for more information, contact your
national committee.
|| | ---
Available from:
IEC
P.O. Box 131
3, rue de Varembe
1211 Geneva 20
Switzerland
[Ref. C.7]
Available from:
IEEE
P.O. Box 1331
445 Hoes Lane
Piscataway, NJ 08855-1331
ISA
[Ref. C.2]
ISA-dTR84.02-1996
[Ref. C.6]
ISA-S91.01-1995
[Ref. C.3]
Available from:
82
ISA
P.O. Box 12277
67 Alexander Drive
Research Triangle Park, NC 27709
ANSI/ISA-S84.01-1996
MCGRAW-HILL, INC.
[Ref. C.16]
Available from:
McGraw-Hill, Inc.
1221 Avenue of the Americas
New York, NY 10020
[Ref. C.5]
NFPA 70-1993
Available from:
[Ref. C.4]
UL Standard 508-1989
(15th Edition)
Available from:
UL
333 Pfingsten Road
Northbrook, IL 60062
[Ref. C.10]
Available from:
-| |||
|||||| |
|| |||
|||| || |
|
||||
|
|| | ---
ANSI/ISA-S84.01-1996
83
29 CFR 1910.119-1992
(Final Rule:
February 24, 1992)
[Ref. C.12]
40 CFR Part 68
(Proposed rules:
October 23, 1993)
Available from:
-| |||
|||||| |
|| |||
|||| || |
|
||||
|
|| | ---
84
ANSI/ISA-S84.01-1996
This example reviews the development of the Safety Requirement Specifications (Clause 5),
addresses the issues in SIS Conceptual Design (Clause 6), and briefly touches on Detail Design
(Clause 7). Subsequent functions (Commissioning, Pre-Startup Acceptance Test, Maintenance,
etc.) are not addressed except as they pertain to the design of the SIS.
|
||||
|
|| | ---
ANSI/ISA-S84.01-1996
85
The level inside the process surge tank must be maintained. The level is sensed and transmitted
by a level transmitter (LT-1) to a controller (LC-1) which in turn regulates the position of a control
valve (LV-1) by transmitting a 4 - 20 mA signal to a current-to-air transducer (I/P-1). The tank
(1-101) is provided with a relief valve to prevent over-pressure due to overfilling or fire. The relief
valve discharges directly to the atmosphere.
If the relief valve discharges, the resulting spray could cause serious personnel injury due to the
hazardous chemicals inside the tank. In addition, since the fluid is also flammable, the potential
for a fire or explosion exists, which could also result in serious injury to personnel.
The PHA team has identified two possible causes of an overfill event in the tank:
a) LV-1 fails in an open position due to foreign material in the pipeline.
b) LT-1 fails indicating a low level which causes the level controller to open LV-1.
Although the instruments in service (LT-1, LC-1, and LV-1) have been reliable in the past, the
PHA team believes that due to the number of safety issues involved, additional safeguards
should be added to reduce this risk.
--
86
| |||
|||||| |
|| |||
|||| || |
||||
|| | ---
ANSI/ISA-S84.01-1996
One possibility would be to eliminate the relief valve. However, this option is barred by the ASME
Code and could lead to a catastrophic failure of the tank in the event of over-pressure due to an
external fire. Another option is to install a catch tank on the line from the relief valve. An alarm
could be provided to indicate the presence of a liquid in the tank, which would in turn indicate that
Tank 1-101 has overflowed. In this particular case, the PHA team is very concerned about
contamination in the catch tank, pluggage of the overflow line, and also believes that the catch
tank could overflow. This option was rejected. Since an intrinsic safety fix is not easy and/or may
create additional safety problems, a SIS will be installed.
D.3.1.2 Safety Integrity Level of each safety function (5.2.2)
The PHA team agreed that the SIS for this application shall be designed and maintained to
provide SIL 2 performance.
D.3.1.3 Process common cause failure consideration (5.2.3)
The design team should be aware of the following process common cause failure possibilities:
a) There is a potential for chemical buildup on the level sensor. Consideration should be
given to selecting the best sensor that guards against this failure and installing it so that
the buildup does not take place or is reduced to a maintainable level.
b) Valves should also be selected that guard against this same concern (chemical buildup).
Therefore, full port-line size ball valves should be considered.
D.3.1.4 Regulatory requirements (5.2.4)
Because of the significant quantity of hazardous chemicals used in this process, the SIS shall be
required to adhere to OSHA 29 CFR 1910 (Reference C.11).
D.3.2 Safety functional requirements (5.3)
D.3.2.1 The process safe state is to shut off all raw material feeds into Tank 1-101.
D.3.2.2 Process inputs to the SIS and their trip points (5.3.2)
All feeds to the tank are to shut off when the level reaches ninety percent.
D.3.2.3 Normal operation range (5.3.3)
The normal operation is twenty to eighty percent of tank level.
D.3.2.4 Process outputs from the SIS and their action (5.3.4)
Redundant (1oo2) shutoff valves are required, one of which is shared with the BPCS (LV-1).
Both valves are to fail closed.
D.3.2.5 Functional relationships between process inputs and outputs, including logic, math
functions, and any required permissives (5.3.5)
For complex control system functional relationships, logic diagrams are provided and in some
cases may have to be supplemented with text to properly communicate the functional
requirements. In this example, the logic is so simple a P&ID with narrative is sufficient.
D.3.2.6 Selection of de-energized to trip or energized to trip (5.3.6)
This SIS shall be de-energized to trip.
--
ANSI/ISA-S84.01-1996
| |||
|||||| |
|| |||
|||| || |
||||
|| | ---
87
88
--
| |||
|||||| |
|| |||
|||| || |
||||
|| | ---
ANSI/ISA-S84.01-1996
f) Architecture requirements
Using internal KIS2 Corporation guidelines, the architectural requirements for a SIL 2
is as follows:
Sensor
Logic Solvers
Valves
1oo1
1oo1
1oo2
g) Power sources
The electrical and pneumatic system power sources required for this batch process
shall be provided using good engineering practices. This shall include
1) dedicated power source from a separately derived system (Reference C.5,
Sections 250-5 and 250-26);
2) power sources capable of being individually maintained;
3) power sources with no common mode failure mechanisms due to failure of
non-related power sources (except the main power source header); and
4) grounding using good engineering practices.
An Uninterruptible Power Supply is not required because of the high system reliability
experienced with the plant electrical power system.
--
ANSI/ISA-S84.01-1996
| |||
|||||| |
|| |||
|||| || |
||||
|| | ---
89
h) Common cause
Sensors and valves selected to reduce chemical buildup problems.
i) Diagnostics
Limit switches on the shutoff valve will be used to compare the position of the valve with
the signal from the logic solver. If they dont agree, the operator will be notified (by an
alarm and/or printer) that there is an equipment failure.
j) Field devices
Smart transmitters shall be utilized for all process measurements.
k) User interface
User interface shall be panel-mounted alarm panel, manual reset switch, and manual
shutdown switch.
l) Security
The KIS2 facility is secure. The SIS logic solver shall be located in the equipment
control room.
The SIS sensors and final control elements are red tagged (in addition to standard
identification) to note their safety functional status to plant personnel.
All smart transmitter communication to the SIS logic solver shall be write protected to
prevent changing the transmitter settings while on-line.
Any communication link between the SIS and the BPCS shall be write protected to
prevent inadvertent program changes to the SIS from the BPCS.
m) Wiring practices
The wiring shall be in accordance with the National Electrical Code (Reference C.5),
local codes and regulations, and SIS equipment supplier guidelines.
Two separate raceway systems, one for electrical power (e.g., 120/240V) and one for
instrument signal (e.g., 4 - 20 mA) shall be provided.
SIS wiring can use the same terminal box as BPCS wiring, but clearly identified
separate terminals shall be provided for all SIS wiring.
n) Documentation
Compliance with OSHA 29 CFR 1910 documentation requirement is mandatory.
--
90
| |||
|||||| |
|| |||
|||| || |
||||
|| | ---
ANSI/ISA-S84.01-1996
--
| |||
|||||| |
|| |||
|||| || |
||||
|| | ---
ANSI/ISA-S84.01-1996
91
|| | --|
||||
|
|||| || |
|| |||
|||||| |
| |||
--
1
1oo1 28, 66, 89
1oo2 22, 28, 58, 66, 87, 89
|| | ---
||||
ANSI/ISA-S84.01-1996
--
| |||
|||||| |
|| |||
|||| || |
abnormal stress 69
AC transfer time 67
access 33, 35, 65, 76, 77
access method(s) 76
accuracy 37, 73
Accuracy of calibration 37
achitecture(s) 66
actuator 74
adequacy of current risk controls 53
adhere 38, 42, 59, 87
administrative controls 39
administrative procedure(s) 20, 77
aeronautical 4
air 19, 66, 69, 74, 86, 88
air conditioning 34
air filtration 34
alarm convention(s) 76
alarm systems 17
alarm(s) 32, 33, 35, 40, 48, 53, 66, 68, 72, 73, 76, 87, 88, 90
algorithm(s) 72
alternate 32, 59, 67, 74
ambient 74
ambiguity 76
American National Standards Institute (ANSI) 44
amplifier(s) 75
amplitude 63
analog 57, 62, 63, 66, 72, 73
analog devices 72, 73
analytical measurement(s) 73
annunciator(s) 66, 75
anti-surge control 18
application program(s) 18, 19, 22, 59, 79, 89
application software 18, 22, 30, 33, 35, 42, 59, 60, 77, 79
application specific 70, 71
appropriate technology 25
arc suppression 61
architecture(s) 18, 19, 26, 28, 29, 58, 63, 66, 89, 91
armature 64, 73
as-found 41
as-left 41
assessment 46
authorization requirements 42
93
automated 15, 20
automatic 30, 32, 71, 76
automatic reset 30
automatic transfer 67
automatically restart 31
auxiliary contact(s) 75
availability 18, 42, 48, 68
avionics 43
B
backed up 69
backup 64, 67, 79
barrier 64
basic events 53
Basic Process Control System(s) (BPCS) 16, 18, 20, 22, 30, 31, 36, 46
batch # 30
battery(ies) 39, 67
benign faults(s) 70
boundaries 15
brown outs 68
buffer 65, 76
buffered 76
bug 35
bug-reporting 60
built-in test(s) 71
bypass 56
bypassed 32, 39
bypassing 18, 35, 39
C
C.1 30, 38, 47, 51, 54, 59, 69, 74, 77, 81, 87
C.2 48, 82
C.3 66, 82
C.4 61, 83
C.5 30, 68, 83, 89, 90
C.6 15, 82, 86
C.7 78, 82
C.8 13, 82
C.9 13, 82
C.10 83
C.11 41, 45, 46, 84
C.12 19, 84
C.13 54, 81
C.14 48, 81
C.15 48, 81
C.16 68, 83
cabinet wiring 78
cabinet(s) 70, 77, 78
calculation 22, 63
calibration 33, 39, 64, 65, 69
capacitive 78
cathodic protection 68
caution 63, 78
Central Processing Unit (CPU) 62
certified 60
certify 40
channel(s) 22, 58, 64, 70
checklist 67, 68, 69
chronic health effects 17
circuit common(s) 78
--
94
| |||
|||||| |
|| |||
|||| || |
||||
|| | ---
ANSI/ISA-S84.01-1996
--
ANSI/ISA-S84.01-1996
| |||
|||||| |
|| |||
|||| || |
||||
|| | ---
95
D
decommissioning 18, 21, 23, 26, 43, 46
dedicated power source 33, 89
dedicated wiring 31
de-energize(d) to trip 19, 27, 66, 67, 87
de-energized 19, 61
defects 39
definitions 3, 18
degradation 32
demand 19, 20, 39, 43, 56, 70, 72, 76
demand mode 43
demand rate 41
design considerations 29, 55, 67
designer 58
detail design 36, 85, 90, 91
detectability 71
detectable 19, 71, 73
detected faults 39
detection 19, 35, 67, 72, 73, 88
diagnostic coverage 18, 19, 60, 66, 71
diagnostic fault detection 25, 48
diagnostic testing 59
diagnostic(s) 28, 29, 32, 33, 40, 63, 66, 67, 68, 70, 71, 72, 76, 77, 88, 90
diagram 15
differences 4, 13, 34, 43
digital 19, 79
digital timer 62
direct-wired 60
direct-wiring 62, 63
dirt 75
disabling 33
discrete 21, 57, 72, 73
discrete input/output 31
discrete sensor(s) 31, 60, 72, 75
disk(s) 79
display(s) 37, 53, 73, 75, 76, 77
distributed control system 63, 76
diverse 19, 21, 25, 29, 66
diverse redundancy 21, 58, 59, 66, 70
diverse separation 21, 55, 56, 57, 66, 70
diversity 72, 73, 74
document control procedure 42
document(s) 13, 25, 26, 27, 30, 36, 41, 42, 76, 91
documentation 13, 22, 29, 33, 37, 38, 40, 42, 45, 46, 53, 57, 77, 78, 79, 90
downscale 64, 65, 73
drain wire 78
dropout 61
dTR84.02 3, 13, 48, 63, 66, 70, 79, 82
duty cycles 62
dynamic random fault(s) 71
dynamics 27, 86
E
electrical area classification 34
electrical fault 22
electrical noise 67, 78
electrical technology 60, 68
Electrical/Electronic/Programmable Electronic System (E/E/PES) 15
Electro Magnetic Interference (EMI) 34, 67
electromechanical 19
--
96
| |||
|||||| |
|| |||
|||| || |
||||
|| | ---
ANSI/ISA-S84.01-1996
electromechanical devices 61
electromechanical relay 19
electromechanical relay(s) 15, 61, 62, 64
electronic technology 62
electrostatic discharge 34
embedded software 19, 22, 35, 59
emergency 26, 76, 88
Emergency Shutdown System 21
end-of-line detection 71
energize(d) to trip 19, 27, 31, 66, 67, 87
equipment reliability 53, 66
equipment under control 18, 21, 46
event logging 76
explosive 53
external risk reduction 45, 46
F
factory floor 75
fail position 74
fail-safe 19, 61, 62
failure mode(s) 29, 61, 63, 64, 65, 66, 71, 73, 89
failure rate(s) 29, 41, 53, 56, 63, 66, 89
failure state(s) 73
failure to function on demand 35
false 53, 63, 74
false shut down 22
falsely 78
fault avoidance 70
fault detection 72
fault source 58
fault tolerance 19, 58, 63
fault tree analysis 47, 53
fault tree logic diagram 53, 54
fault tree(s) 53, 54
fault type(s) 70
feedback 73
fiber optic(s) 33, 78
field control element(s) [See field device(s).]
field device(s) 19, 21, 29, 31, 36, 69, 72, 73, 75, 90
field element(s) [See field device(s).]
field sensor(s) 55, 73
field wiring 19
fieldbus 17, 31
fire and gas detection systems 31
fire and gas monitoring systems 17
fire resistance 74
firmware 19, 22, 41, 58, 59
fixes 59
flooding 34
flow 49, 53, 73, 74, 88
fluid 69, 86
forcing 19, 35
foreign 74, 86
formal revision and release control program(s) 30, 34, 35
formatting utilities 76
fouling 69
freezing 31, 74, 75
frequency 34, 39, 54, 62, 67, 79
frequency of occurrence 30, 53, 54
frequency(s) of testing 39
fuel/air controls 18
functional description 22
--
ANSI/ISA-S84.01-1996
| |||
|||||| |
|| |||
|||| || |
||||
|| | ---
97
|| | ---
|||| || |
||||
--
| |||
|||||| |
|| |||
H
hands on 47
hardware 18, 19, 22, 30, 33, 58, 59, 69, 71, 72, 76
hardware degradation 39
hardware fault(s) 22, 58, 60
hard-wired 19, 57
hard-wired logic 15
harm 51
harmonics 67
hazard and risk analysis 45, 46
hazard(s) 16, 19, 20, 25, 37, 44, 48, 53
hazardous 28, 37, 39, 86, 87
hazardous area classifications 30
hazardous event(s) 19, 25, 27, 48, 51, 53, 86
HAZOP 53
heaters 18
hermetically sealed 61
hidden fault(s) 71
High Noise Immunity Logic (HNIL) 62
high pressure 48, 49, 50, 51, 52, 53, 54
highly recommended 45
historical data 39
horns 32
host 18
host functions 77
human actions 20
human machine interface(s) 17, 28, 69, 88
humidity 34, 69
hybrid 60
hydraulic power 66, 69
hydraulic(s) 16, 60
98
ANSI/ISA-S84.01-1996
I
identical 21
identical redundancy 21, 29, 66, 70
identical separation 21, 29, 55, 56, 57, 70
IEC 3, 4
IEC draft Publication 1508 3, 4, 13, 43, 44, 45, 46
impedance 71
incident cause 27
indeterminate failure modes 62
indicating lights 32
indicators 33, 75, 76
inductive 61, 78
industry 4
industry sectors 4
industry standards 60
inherently 61
inherently safe 71
inhibit 39, 71
initiating event(s) 51, 52, 54
injury 19, 86
input requirements 85
input/output devices 28, 75
input/output modules 20, 21, 30, 71, 77
inrush current 67, 68
insect(s) 75
inspection(s) 40, 41
installation 13, 26, 36, 37, 46, 63, 68, 75
instrument gas 69
insulation 67
integration 20
interface(s) 15, 20, 30, 32, 33, 66, 68, 75, 76, 77
interlock(s) 30, 56
internal 18, 30, 63, 67, 78, 89, 91
internal communication 18
intrinsic safety barrier 68
ISO 9000 45
isolation 64, 65, 78
K
keyboard 60
--
| |||
|||||| |
|| |||
|||| || |
||||
|| | ---
label(s) 76
lamp(s) 75, 76
latching 62
laws 16
layers 20, 51, 60
layout 70, 76
leakage 74, 78
legislation 41
level controller 56, 86
level of risk 25
level of safety 46, 48
level sensor 56, 87
life cycle 48, 57
ANSI/ISA-S84.01-1996
99
M
magnetic tape 79
maintenance 20, 22, 26, 28, 30, 33, 35, 38, 39, 46, 47, 57, 69, 70, 74, 77, 85, 88
maintenance costs 53
maintenance procedures 25, 26, 37, 39, 79
maintenance program 38
maintenance/engineering interface(s) 18, 32, 33, 70, 75, 76, 77
major criteria 52
major severity 52
malicious modification 77
management 16, 45
Management of Change (MOC) 22, 26, 41, 44, 45, 46
Management of Change (MOC) documentation 79
Management of Change (MOC) procedure(s) 26, 43
manual mode 53
manual reset 30, 90
manual shutdown 27, 37, 88, 90
manual trip 40
manufacture 13, 20, 58
manufacturer 20, 30, 35, 59, 68, 72, 78, 79
material(s) 4, 20, 31, 61, 74, 86, 87
math functions 27, 62, 87
mathematical analysis 20
matrix method(s) 47
mature 60
mature technology 61
Mean Time Between Failures (MTBF) 22
Mean Time To Detection (MTTD) 72, 73
Mean Time To Failure (MTTF) 22, 30
Mean Time To Repair (MTTR) 22
measure(s) 3, 17, 33, 45, 57, 58, 70, 72
measurement(s) 58, 62, 73, 90
medium 51, 79
memory 19, 42, 65, 76
metallic covering 78
microcomputer 63
minimum level of independence 45
mitigate 19, 25, 37, 58
mode(s) 33, 43, 63, 77
modification errors 77
modification(s) 22, 25, 26, 31, 36, 41, 42, 46, 62, 70
modified HAZOP method 47, 52
modular design 59
modulating 73, 74
moisture 69
monitoring 17, 71, 77
motor driven timer(s) 15, 19, 62
--
100
| |||
|||||| |
|| |||
|||| || |
||||
|| | ---
ANSI/ISA-S84.01-1996
motor overload(s) 31
motor starter(s) 32, 75
motor(s) 39
mounting 74, 75
N
name(s) 40
National Electrical Code (NEC) 30, 78, 90
nested 60
network 33, 36
networking 63
NFPA 70 30
noise 64, 68
non-linear 67, 68
non-safety function 30
non-safety related display(s) 76
non-SIS protection layers 23, 25, 45
normal operating range 27
normal operation 19, 26, 87
normal operation range 87
not recommended 59, 63
Nuclear Industry 16
nuisance trip 22
numerical data 20
O
objective(s) 13, 17, 22, 25, 27, 36, 38, 41, 48, 89, 90
off-line 20, 42, 77
on scale 73
on-line 20, 35, 40, 42, 77, 79, 90
on-line testing 35, 40
open 53, 54, 56, 61, 64, 73, 86
operating conditions 60
operating experience 20, 47, 61, 79
operating limits 27
operating procedure(s) 35, 37, 38, 41, 42, 56, 79
operating system(s) 59
operational bypasses 38
operator action 17
operator error 53
operator interface(s) 18, 19, 32, 33, 66, 70, 75, 76
operator response 48, 51, 53
operator(s) 18, 32, 35, 46, 75, 76, 77, 88, 90
organization(s) 13, 45, 74
oscillator 62
OSHA 22, 38, 41, 44, 45, 46, 87, 90
output(s) [See input/output devices and input/output modules.]
output trip relay 40
overload 67
over-pressure 48, 49, 53, 86, 87
override(s) 19, 56
overt 63, 71
overt fault(s) 20, 28, 88
overvoltage(s) 68
owner/operator 17
ownership 47
oxidation 61
--
| |||
|||||| |
|| |||
|||| || |
ANSI/ISA-S84.01-1996
||||
|| | ---
101
P
panel(s) 33, 75, 76, 88, 90
parameter(s) 77
part # 30
partially open 73
password(s) 58, 77
peer review(s) 60
period(s) 21, 42, 63, 73, 74
periodic inspection program 39
periodic test intervals 39
permanent random fault(s) 71
permissives 22, 27, 38, 73, 87
personal computer(s) 63, 77
personnel safety 68
PES logic solver(s) 30, 75
PFD Average Range 25
pharmaceutical(s) 4, 20
physical 19, 70
piping and instrumentation diagram (P&ID) 48
plant 26, 39, 52, 61, 74, 89, 90
plugging 27, 58, 75
pneumatic(s) 16, 60, 66, 69, 89
poll fault 65
polymerization 31, 74
possible cause(s) 72, 86
power 19, 20, 28, 30, 31, 66, 67, 68, 69, 70, 75, 89, 90
power distribution 67
power source(s) 29, 34, 66, 67, 78, 89
power supply (supplies) 15, 58, 67
predictability 73
pressure 31, 48, 49, 53, 58, 64, 69, 73, 74
pressure control valve 53, 54
pressure relief valve 48, 49, 51
pressure sensor 53
Pre-Startup Acceptance Test (PSAT) 13, 20, 23, 26, 36, 37, 45, 79, 85
Pre-Startup Safety Review (PSSR) 23, 26
pre-trip 76
preventive 48
preventive maintenance 20
printer(s) 75, 76, 88, 90
Probability of Failure on Demand (PFD) 20, 21, 23, 25
Process Control System 18
process deviation(s) 53
Process Hazards Analysis (PHA) 16, 17, 21, 23, 27, 31, 32, 85
process hazards review(s) 44, 47, 48
process industry sector 20
process industry(ies) 4, 13, 15, 46
process knowledge 47
process risk 51
Process Safety Design 16
Process Safety Management 16
process safety team 47, 48, 49, 51
process variable(s) 27, 47
program(s) 33, 40, 76, 77, 90
programmable controller 63
Programmable Electronic Failure Mode(s) 65
Programmable Electronic System(s) (PES) 3, 15, 19, 20, 22, 23
Programmable Logic Controller (PLC) 19
programming 28, 33, 57, 59, 60
programming guidelines 60
programming language(s) 60
programming terminal(s) 33
proof testing frequency 60
--
102
| |||
|||||| |
|| |||
|||| || |
||||
|| | ---
ANSI/ISA-S84.01-1996
Q
qualitative 20, 51, 79
qualitative matrix 51, 52
qualitative risk evaluation SIL determination method 47
quality 59, 60, 63
quality system(s) 45
quantified 61, 62, 75
quantitative 20, 79
quantitative risk assessment 47
quartz 62
R
radiated noise 78
raised floor grounding 68
Random Access Memory (RAM) 71
random failure(s) 71
read 31, 85
read only 57, 66, 77
read/write 31, 57, 58, 66
reading(s) 73, 74
read-write access 33
recipe 33, 63
redundancy 21, 25, 48, 58, 63, 66, 67, 72, 73, 75, 89
Redundant 87
redundant 22, 31, 56, 58, 59, 64, 69, 71, 75, 89
redundant sensors 31, 72
references [See Annex C page 81 and C.1 - C.16.]
regulation(s) 16, 22, 38, 44, 90
regulatory requirement(s) 27, 87
relay(s) 61, 63, 64, 68, 69, 73
reliability 21, 28, 58, 62, 66, 67, 69, 74, 89
reliability experience 56
relief valve 53, 86, 87
remote I/O 18, 31
repair 39, 88
repeatability 62
replacement in kind 21, 41
reporting 76
reset 21, 30, 38, 65, 88
reset function(s) 28, 37, 88
resistor-capacitor (RC) 62
Resistor-Transistor Logic (RTL) 62
resolution 60, 62
response action 28, 30, 88
response time 42, 88
response time requirements 28, 88
--
| |||
|||||| |
|| |||
|||| || |
ANSI/ISA-S84.01-1996
||||
|| | ---
103
-| |||
|||||| |
|| |||
|||| || |
|
||||
|
|| | ---
S
safe process condition(s) 30
safe response(s) 70, 71, 76
safe state(s) 17, 19, 21, 27, 28, 29, 30, 32, 33, 38, 40, 87, 88
safety and health 22, 41
safety availability 18, 20, 21
safety availability range 25
safety critical function(s) 60
safety function(s) 15, 18, 21, 25, 27, 28, 30, 46, 48, 57, 58, 76, 77, 87
safety functional requirements 22, 27, 87
safety functionality 55
Safety Instrumented Systems (SIS) 4, 13, 15, 16, 17, 21, 23, 27, 28, 29, 36, 38, 42, 43, 48, 60, 85
safety integrity 42, 56, 57, 58, 63, 66, 67
Safety Integrity Level (SIL) 13, 21, 23, 25, 28, 29, 45, 46, 48, 79, 85, 87
safety integrity requirements 27, 28, 55, 56, 67
Safety Interlock System 21
safety layer matrix 51
Safety Life Cycle 13, 16, 21, 22, 23, 24, 25, 26, 36, 42, 45, 48, 66
safety logic 61
safety management 45
safety plan 45
safety related display(s) 76
safety related system(s) 45
Safety Requirement Specifications 19, 20, 22, 26, 27, 28, 29, 30, 34, 35, 36, 37, 38, 39, 41, 60, 72, 78, 85, 90, 91
safety review 31, 32, 33
safety review and analysis 56, 57, 58, 68, 78
Safety Shutdown System (SSD) 21
science 47
scope 17, 23, 25, 26, 45, 46, 47, 60, 77
security 28, 29, 33, 35, 77, 90
self revealing 39
self-tests 71
sensor diagnostics 31
separate(s) 13, 66, 67, 70, 76, 79, 89, 90
separated 30, 31
separating 78
separation 21, 55, 57, 70, 78, 89
Sequence Of Events (SOE) 76
sequence(s) of failure(s) 53
sequencing functions 29
serial # 30, 41
setpoint(s) 37, 40, 56
severity 51, 52
severity of (the) consequences 51, 52, 53
shield 68, 78
shielding 67, 78
shock 34
short circuit 67
shutdown 22, 37, 39, 50, 51, 52, 53, 54, 56, 73, 82, 88
104
ANSI/ISA-S84.01-1996
--
| |||
|||||| |
|| |||
|||| || |
|
||||
|
|| | ---
T
tag # 41, 76
tampering 62
target SIL 25, 48, 71
team 27, 47, 48, 52, 53, 54, 60, 85, 86, 87
technology selection 29, 89
ANSI/ISA-S84.01-1996
105
--
| |||
|||||| |
|| |||
|||| || |
|
||||
|
|| | ---
U
undervoltage(s) 68
ungrounded 68
Uninterruptible Power Supply (UPS) 67, 89
unreliable 61
unsafe failure mode(s) 56, 61, 62, 63, 73, 75
upscale 64, 65, 73
upset 53
upset cause 53
uptime 69
user approved 17, 22, 31, 41, 61, 62, 63, 77
user interface(s) 15, 29, 30, 66, 75, 77, 90
utility software 22, 30, 35, 59
V
validate(s) 66
validation 46, 77
valve(s) 39, 40, 49, 56, 69, 73, 74, 87, 88, 89, 90
variable(s) 33, 58, 73, 77
vendor(s) 22, 31, 39, 68, 72, 73
vent(s) 75
ventilation 34, 39
verification(s) 22, 26, 42, 45, 46, 70, 72, 79
verify 19, 28, 60, 74, 75
vessel rupture 53, 54
vessel(s) 49, 53, 85
vibration 34, 69
video display(s) 75
visible markings 30
voltage(s) 64, 67, 68, 73, 74, 75
volume 69
vortex flow 58
voting 22, 28, 32, 33, 66
106
ANSI/ISA-S84.01-1996
--
| |||
|||||| |
|| |||
|||| || |
||||
|| | ---
ANSI/ISA-S84.01-1996
107
--
| |||
|||||| |
|| |||
|||| || |
||||
|| | ---
-| |||
|||||| |
|| |||
|||| || |
|
||||
|
|| | ---
-| |||
|||||| |
|| |||
|||| || |
|
||||
|
|| | ---
ISBN: 1-55617-590-6