Dedicated Level Gauge for ESD LT

Redundant local indication of process variables such as level monitoring and control(s) are often required in critical process applications.

This method provides critical backup as well as a hands-on, physical confirmation of the level by operations personnel should the automated controls suffer failure or malfunction.

It can also allow manual operation of the process and safe shutdown if/when the automated controls fail or malfunction.

I have observed many instances wherein an instrument or instruments in a control loop were calibrated incorrectly and the local indications were the only way to identify which instrument had failed or was functioning incorrectly.

By mentioning a Safety Instrumented System (SIS), you have entered a whole new world, whether you realize it or not. You might or might not, but let's go over the basics.

First, it's important to realize and understand the differences between process control and safety control.

Process control systems are active and operate continuously. The main function of a process control system is generally to maintain process variables within prescribed limits.

Safety systems are totally the opposite they operate for extended periods of time monitoring process variable, but does essentially nothing (and hopefully never will) but initiates action (take the process to a safe state) when required.

Second: Almost all applicable standards strongly recommend separation of the Basic Process Control system (BPCS) and SIS.

Fer instance from IEC 61508, for all industries and covers the use of relay, solid state, and programmable safety systems: "The EUC (equipment under control) control system shall be separate and independent from the E/E/PE (electric, electronic, and programmable electronic systems) safety-related systems, other technology safety-related systems and external risk reduction facilities."

From ANSI/ISA-84.00.01-2004:

Clause 9.5.1 states, "The design…shall be assessed to ensure that the likelihood of common cause…and dependent failures between… protection layers and the BPCS are sufficiently low in comparison to the overall safety integrity requirements of the protection layers.

Clause 9.4.3 states, "If a risk reduction greater than 10 is claimed for the BPCS, it shall be designed to the standard."

Clause 11.2.4 states, "If it is intended not to qualify the basic process control system to this standard, then the basic process control system shall be designed to be separate and independent to the extent that the functional integrity of the safety instrumented system is not compromised."

Clause 11.2.10 states, "A device used to perform part of a safety instrumented function shall not be used for basic process control purposes, where a failure of that device results in a failure of the basic process control function which causes a demand on the safety instrumented function, unless an analysis has been carried out to confirm that the overall risk is acceptable."

There are "weasel words" in the above clauses from ANSI/ISA 84, but if you use/invoke them, be sure that you would be willing to present your justifications for doing so in a court of law.

And having a SIS implies having a safety lifecycle - and this lifecycle starts at the conceptual stage and ends at decommissioning. A safety lifecycle has so much more than just these few parts I've (barely) touched on here.

Suggested reading: "Safety Instrumented Systems: Design, Analysis, and Justification" by Gruhn & Cheddie. and "Safety Instrumented Systems Verification: Practical Probabilistic Calculations" by Goble & Cheddie.

The first covers the safety lifecycle, the second on calculating values for risk reduction for a safety loop.

Other similar books: "Safety Integrity Level Selection Systematic Methods Including Layer of Protection Analysis" by Marszal & Scharpf and "Control Systems Safety Evaluation and Reliability" by Goble.

Regarding existing plants: IEC 61511 and ANSI/ISA-84.00.01-2004 are identical except that ANSI/ISA-84.00.01-2004 has a grandfather clause added to it: "For existing SIS designed and constructed in accordance with codes, standards, or practices prior to the issue of this standard (e.g., ANSI/ISA-84.01-1996), the owner/operator shall determine that the equipment is designed, maintained, inspected, tested, and operating in a safe manner". That is all and nice, but has wording open to interpretation: what is 'a safe manner'? How does one 'determine', and in what way does one 'document', that things are operating 'safely'. However, the standards and guidelines do address these issues in more detail. The books I mentioned in the previous post also address those questions one by one in direct easy to understand language.

This leads to the question "Should a recommendation be made to segregate control systems?"

How can you recommend whether to segregate or not unless you have evaluated your existing system? And what criteria do you then evaluate it against? And what are those criteria based on? In short you need to go back into the safety lifecycle at the appropriate point. And what is the "appropriate point" - only you can answer that.

Two of the books I mentioned earlier:

"Safety Integrity Level Selection - Systematic Methods Including Layer of Protection Analysis" by Marszal & Scharpf and "Safety Instrumented Systems: Design, Analysis, and Justification" by Gruhn & Cheddie both address has some examples evaluating existing systems including cost/benefit in the latter.

As to the shared communication network for the DCS and ESD, that needs evaluation: mostly to answer this question: "Can the shared network, by its' failure, improper operation, etc. prevent/impair the ESD from fulfilling its function?" Actually, this is a subset of the more general question: Can the <shared item> prevent/impair the ESD from fulfilling its function?

In my cursory view, if the shared network is only used by the ESD to notify the DCS that the ESD has actuated/performed its safety function, then maybe not. That evaluation needs to be done - actually should have been done before purchase and installation; and done by a 3^rd party (e.g. TUV or exida). A phone call to the vendor/manufacturer is in order.

I just came across this free resource at:

http://www.rockwellautomation.com/global/industries/oil-gas/resources/process-safebook-1.page

Register, then download the "Process Safebook 1". It covers a lot of this material.

BTW: There is also a Safebook 4 (for machinery) you can also download. Oddly books 2 and 3 don't seem to exist for some reason.