CM-PE-516 Engineering Procedure for Implementation of Safety Instrumented Systems

Table of Contents

1. Purpose
2. General
3. Procedure
4. Responsibilities
5. Flowchart
6. References

1. Purpose

This procedure defines the work sequence and responsibilities for the engineering/design and implementation of Safety Instrumented Systems to achieve an intended safety function up to field installation and commissioning.

This procedure shall be applicable for the Company.

The instrumented system shall be referred to in this document as Safety Instrumented Systems (SIS).

2.General

For the engineering/design and implementation of SIS, the standards and working procedures of IEC-61508 are adopted.

The implementation of SIS shall be considered separately for each system regardless what level of integrity is expected.

The IEC-61508 defines the lifecycle of SIS (see figure 3.1). Each step in the lifecycle involves a number of actions to be taken by a designated responsible department, discipline and/or group.

The responsibilities for the individual steps are defined in chapter 4.

2.1 Abbreviations

2.2 Definitions

Electrical/Electronic/Programmable Electronic System

System for control, protection or monitoring based on one or more electrical/electronic/programmable electronic devices, including all elements of the system such as power supplies, sensors, other devices, data highways, communication path’s, actuators and other output devices.

Safety Integrity Level

Discrete level (one out of possible four) for specifying the safety integrity requirements of the safety functions to be allocated to the E/E/PES safety instrumented systems, where safety integrity level 4 is the highest level and safety integrity level 1 is the lowest level.

3. Procedure

The procedure for the implementation of SIS is divided in sequential steps as defined in the IEC-61508.

3.1 Concept (step 1)

3.1.1 Process Design

During the process design the likely potential sources of hazard for people, equipment and/or environment, when normal control functions fail, shall be determined.

3.1.2 Non Instrument Risk Reduction

Alteration of the process design and/or addition of non-instrument related safety functions might reduce the potential risk to a tolerable level. If this is not the case then it could be investigated if the application of a SIS would reduce the risk sufficiently.

3.2 Overall SIS Scope Definition (step 2)

During this step the scope for the hazard and risk analysis is defined.

3.3 Hazard and Risk Analysis (step 3)

The hazards and hazardous events of the equipment under control shall be determined under all reasonable foreseeable circumstances (including fault conditions, reasonable foreseeable misuse and relevant human factors) taking the overall scope definition of step 2 into account. The necessary risk reduction shall be determined for each hazardous event. The required Safety Integrity Level (herein after referred to as SIL) is determined.

Particular attention shall be given to abnormal or infrequent modes of operation.

3.4 Overall Safety Requirements (step 4)

Overall Safety Requirements

• Preparation of safeguarding narratives and Cause & Effect diagrams for the SIS.
• HAZOP Review Meeting

During the HAZOP reviews, all potential hazards and operability conditions are reviewed. The remedial actions to prevent a hazardous situation from occurring are then assessed.

Included in the HAZOP review is the requirements for in line/off line testing of safety functions and the operability of the equipment under control during testing.

3.5 Safety Requirement Allocation (step 5)

Determine the architecture and the required instrumentation (including on/off-line-testing facilities) for the realization of the SIS functions as defined in previous steps. The safety requirement allocation takes into account: the required SIL, the required separation from other systems and the required degree of diagnostic coverage.

3.6 SIS Operation and Maintenance Plan (step 6)

The operation and maintenance plan for the SIS is the Client’s responsibility. However it may be decided that RE&C has to prepare this as a special project requirement.

The operation and maintenance plan involves at least the following topics:

• maintenance procedures for E/E/PES (including software if applicable);
• testing and verification procedures (on and off line) of all involved equipment.

3.7 Safety Validation Plan (step 7)

The safety validation plan is Client’s responsibility. However it may be decided that RE&C has to prepare this as a special project requirement.

The safety validation plan defines the steps to be taken for safety validation as defined in step 13 (paragraph 3.13).

3.8 Installation and Commissioning Plan (step 8)

The installation and commissioning plan defines the step to be taken for installation, testing and verification of the SIS.

3.9 SIS Detailed Design (step 9)

3.9.1 Realization of the Safety Instrumented Systems

The realization of the SIS by equipment specifications and detailed installation design.

The equipment specification shall covers at least:

• requirements for all initiating equipment, including reliability and material certificates;
• requirements for all actuating devices, including reliability and material certificates;
• requirements for the E/E/PES, including reliability, hardware and software, communication with other systems and input/output channels.

The detailed installation design involves at least the preparation of:

• logic diagrams (alternative ladder diagrams) indicating the required function(s);
• instrument process hook-ups;
• instrument air supply hook-ups;
• instrument mounting hook-ups;
• cabling and wiring details.

3.9.2 Functional Safety Assessment

Investigation based on evidence, to judge the functional safety achieved by one or more E/E/PES safety related systems. A functional safety assessment is performed, for all SIL’s, (e.g. by applying the fault tree method) after completion of the design of each safety-instrumented function to confirm the requirements of the safety requirement specification. The detailed design of the SIS shall be according the requirements of IEC-61508-part 2 and part 3.

The required test interval time is determined/confirmed during the functional safety assessment.

The Functional Safety Assessment Report shall contain evidence that the equipment complies with the required SIL, assumptions for failure rates. Common causes and diagnostic features shall be qualified.

3.10 Other Technologies (step 10)

This is not part of this procedure.

3.11 External Risk Reduction (step 11)

This is not part of this procedure.

3.12 Overall Installation and Commissioning (step 12)

Installation, testing and commissioning shall be executed according the detailed design package as prepared under step 9.

3.13 Overall Safety Validation (step 13)

Validate that the SIS meets the overall safety requirements and safety integrity level. Verify that all required documentation is complete, this is a part of the functional safety assessment, which is carried out by an independent (external/internal) organization as intended in chapter 8 of IEC-61508.

In most countries, the Client is responsible for the correct implementation of SIS however certification of the complete SIS installation may be required from an authorized organization such as Sintef, TÜV etc. In Germany for example this is mandatory!

In order to follow the procedures correctly the selected organization should be involved as early as practical in the development of the SIS.

3.14 SIS Operation, Maintenance and Testing (step 14)

Operation, maintenance and testing are Client’s responsibilities, however testing and a regular testing interval are necessary for obtaining and maintaining the required SIL. The test methodology and test intervals are very important since they influence the SIL.

3.14.1 Operation

The operation of the SIS by the Client should be such that the safety availability remains at the same level as it was originally designed for. This is clearly the Client’s responsibility, however the SIS should be designed such that this is easily possible as a normal operation routine.

3.14.2 Maintenance

The Instrumentation needs to be maintained regularly (e.g. transmitter re-calibration, valve overhaul and stroking), this is the Client’s responsibility. The Client should follow the instructions from the manufacturers in detail (according to an approved quality procedure) to make certain that the once applied figures for functional safety assessment remains the same.

3.14.3 Testing

The regular testing of all the components in a SIS is a requirement for achieving the desired SIL. Without regular testing with pre-determined test intervals it is not possible to come to a reliable functional safety assessment.

There are three ways to determine the test interval time:

1. Client Dictates the Test Interval per SIS
   This has the possibility that the test interval is too long (Client’s regularly do not want to test very often because of the cost and the possible impact on production). In this case it affects the choice of the equipment. The equipment must be more reliable hence the equipment will be more expensive.
2. The Test Interval Depends on the Results of the Functional Safety Assessment.
   If the equipment has been selected, then after the functional safety assessment has been made, the Client can be advised as to what the test interval should be and when it should start after process start up. Normally the equipment is sufficiently reliable, therefore a reasonable test interval will be found.
3. Combination of 1 and 2
   The Client dictates the test interval for all SIS, which should operate in SIL 1 (the majority of all SIS). Depending on a realistic interval time this is acceptable for most systems.
   For the SIL 2 and SIL 3 the test interval is determined during the functional safety assessment. The Client should accept a higher test frequency as a result of the functional safety assessment for the given SIL.

3.15 Overall Modification and Retrofit (step 15)

If modification and retrofit of an existing SIS is required then a complete function and functional safety assessment shall to be done. The report of this assessment shall be the input to step 3 in the lifecycle for the definition of new requirements of the SIS, which may involve new or additional safety functions with the same SIL or increased/decreased SIL.

3.16 De-Commissioning or Disposal (step 16)

This is the Client’s responsibility and is not part of this procedure.

Figure 3.1 Life Cycle of Safety Instrumented Systems

4. Responsibilities

In order to comply with the requirements of IEC-61508 a responsibility plan should be followed, in which is defined who is responsible and what the deliverable(s) is for each step in the SIS lifecycle. The responsibilities for the implementation of SIS are indicated in relation to the SIS lifecycle in figure 4.1.

The following departments, discipline and group are responsible for the implementation of SIS:

• Process department;
• Process Control group;
• Instrumentation & Control Systems discipline;
• Quality Assurance department.

4.1 Process Design Concept (step 1)

4.2 Overall SIS Scope Definition (step 2)

4.3 Hazard and Risk Analysis (step 3)

4.4 Overall Safety Requirements (step 4)

4.5 Safety Requirement Allocation (step 5)

4.6 SIS Operation and Maintenance Plan (step 6)

4.7 Safety Validation Plan (step7)

4.8 Installation and Commissioning Plan (step 8)

4.9 SIS Detailed Design (step 9)

4.10 Other Technologies (step 10)

Not part of this procedure.

4.11 External Risk Reduction (step 11)

Not part of this procedure.

4.12 Overall Installation and Commissioning (step 12)

4.13 Overall Safety Validation (step 13)

4.14 SIS Operation, Maintenance and Testing (step 14)

Client’s responsibility.

4.15 Overall Modification and Retrofit (step 15)

4.16 Decommissioning or Disposal (step 16)

Client’s responsibility.

Figure 4.1 Responsibility Plan

5. Flowchart

None.

6. Reference