Chemical Engineering January 2011 - 45

DCS throttling
PLC on/off safety
Basic process
control system (BPCS)
Actuator
Solenoid valve
(connected to safety PLC)
Control valve
Digital valve controller
(connected to PBCS)
Control
valve
DCS throttling
PLC on/off safety
Safety PLC
BPCS
Actuator
Solenoid valve
(connected to
safety PLC)
On/off
actuator
Safety PLC
Digital valve
controller
(connected to
safety PLC)
Emergencyshutdown
valve
Final
control element
Redundant final control element
FIGURE 2. In this coniguration, a control valve is used in
both the BPCS and SIS. The smart digital valve controller
is connected to the BPCS (DCS throttling), which allows
for typical non-safety use. Meanwhile, the safety PLC is
actively monitoring conditions so in the case of a safety
demand, it will command the solenoid valve to act and
override the BPCS to take the valve to its safe state
tificates or generically available. This
failure rate information can be used
to calculate the probability of failure
upon demand (PFD), which can be correlated
to a safety integrity level (SIL).
The use of a control valve as a safety
valve provides economic efficiencies,
too, by increasing the number of common
parts that are maintained in inventory,
assuming that the SIS final
control element is the same product as
the one used in the BPCS.
Configuration 2: Single control
valve shared for safety and control.
This particular application of a
final control element should be considered
with great care. IEC 61511 sets
strict guidelines and advises that the
user should, whenever possible, keep
the SIS independent and separate
from the BPCS. Figure 2 shows the
final control element with digital valve
controller that is designed as part of
a BPCS throttling control. The valve
also has a solenoid that the safety
logic solver commands to perform its
safety function upon demand.
The advantage of this configuration
is that the final control element
is essentially self-testing. As the valve
is expected to throttle to perform its
BPCS function, the end user can be
confident that the valve is able to
move when commanded. Another advantage
is the resulting cost savings
that come from having only one valve
perform both BPCS and SIS functions,
as well as the benefit from having comDigital
valve controller (connected to BPCS)
FIGURE 3. The primary emergency shutdown valve is
pictured on the right, with the digital valve controller responding
to signals from the safety PLC. The redundant
inal control element is shown on the left, which is pictured
as dual use, with the digital valve controller positioning
to the BPCS (DCS throttling), and the solenoid valve connected
to the safety PLC
mon parts with other BPCS valves in
the facility.
However, the limitation associated
with applying a control valve in this
fashion is that the valve working for
the BPCS cannot cause the safety
event that the valve is expected to address
in the SIS. In other words, the
final control element cannot be the
cause of the problem it is expected to
mitigate - rather, it can only be used
for a safety function that is completely
independent of its purpose as a control
valve with the BPCS. For this reason,
this type of application is technically
a less-viable option, and should only
be utilized with a complete and thoroughly
considered up-front analysis
(including process suitability, HAZOP
and safety-lifecycle analysis) that ensures
that this potential conflict between
BPCS and SIS will not exist.
Configuration 3: Control valve
used as a redundant element. A
control valve can also be used as a
redundant element to an emergency
shutdown valve. Figure 3 shows the
control valve connected in a similar
way to what described in Configuration
2. The digital valve controller provides
throttling control, and the solenoid
valve waits for a signal from the
safety logic solver to perform the final
control element's safety function.
Figure 3 also shows a second valve
in series. Both valves will perform the
safety function upon a safety demand,
however, in the case that one experiences
an issue and cannot perform the
safety function, having a redundant
valve improves the likelihood that the
process will be shutdown safely. Two
final control elements in a redundant
configuration can also be solely used
to perform the SIF and not be dual use
(this is not pictured).
The scenario shown in Figure 3
will be a fail-closed valve. For a failopen
configuration, the redundant
elements should be in parallel, both
valves would be designed to be normally
closed, and both final control
elements would be connected to the
safety logic solver ready to respond to
a safety demand.
The advantage of using a control
valve as a redundant safety element is
that redundancy, when implemented
correctly, improves diagnostic coverage
and can improve the SIL rating.
The primary drawback of this type of
design is the cost of purchasing and
maintaining multiple final control
elements, as well as increased risk of
spurious trips.
n
Edited by Suzanne Shelley
Author
Afton Coleman, CFSP, is an applications engineer
at Emerson Process Management, Fisher
Div. (1704 Governor Rd. Marshalltown, IA 50158;
Email: afton.coleman@emerson.com; Phone:
1-641-754-3439). She has experience working
with valve applications in the chemical, petrochemical,
pulp-and-paper, metals-and-mining,
and nuclear industries. Coleman has been supporting
safety-instrumented systems in her current
role since 2006. She holds a B.S.Ch.E from
the University of Iowa, and has been employed
with Emerson Process Management since 2005.
CHEMICAL ENGINEERING WWW.CHE.COM JANUARY 2011 45
http://WWW.CHE.COM
Chemical Engineering January 2011

Table of Contents for the Digital Edition of Chemical Engineering January 2011
