Hydrocarbon Processing - July 2021 - 77

Valves, Pumps and
Turbomachinery
M. HOYME and J. MILLER,
Emerson, Marshalltown, Iowa
Extending proof test intervals by improving
SIS final element reliability
Large chemical and refinery units
often run up to 5 yr between plant outages,
and many would extend that time
even longer to maximize production.
These processes usually involve hazardous
chemicals and dangerous reactions
and often employ a safety instrumented
system (SIS) to protect equipment, personnel
and the environment.
An SIS is critical for plant operations
and must work reliably, a task made more
difficult because safety equipment may
not be called upon to function for years.
Proof testing is required to verify the
components of an SIS will function as
intended, but these tests can often interrupt
operations.
This article will discuss methods to
mitigate the negative effects of proof tests
on production, with suggestions included
for implementation.
SIS protection. A SIS is a group of equipment
intended to implement one or more
safety instrumented functions (SIFs). SIFs
are designed to respond to conditions
within a plant that may be hazardous, or
if left unchecked, generate a hazardous
event. A SIS is composed of three major
elements: sensor(s), a logic solver and a final
control element (FIG. 1). Many facilities
follow IEC 61508 or ISA 84.01 standards
when designing their safety systems, with
failure rates calculated to demonstrate
their ability to perform the intended SIF.
The sensors are typically instruments
used to measure process parameters, each
of which sends measurement data to the
logic solver. The logic solver is some type
of an electronic safety controller, or possibly
a simple hardwired device for the most
basic of systems. In either case, it monitors
the sensor readings and detects trip
conditions. Should a trip be required, the
logic solver activates the final element(s)
to bring the plant to a safe condition.
The final elements are usually one
or more valve assemblies, each of which
must be driven to a predetermined position.
Valves typically close to stop raw
material feeds, block steam to turbines,
isolate equipment or perform other operations.
Valves may also be configured
to open to vent process to flare systems,
introduce a chemical to stop a reaction or
perform other operations.
Reliability is obviously crucial for a
SIF, as it is typically the last line of defense
against a major incident. A SIF's reliability
is indicated by its safety integrity level
(SIL). A SIL 1 loop must work at least 90%
of the time when called to function; a SIL
2 loop must work > 99% of the time and a
SIL 3 loop must work > 99.9% of the time.
SIL calculations are used to determine
the probability of failure on demand
(PFD), and the SIF sensors, logic solver
and final elements are chosen to satisfy
the required SIL. Redundancy is not required
but is often used to improve reliability;
therefore, 2oo3 (two out of three
voting arrangement) sensors and 1oo2
(redundant) final elements are common
in SIL 2 and SIL 3 applications.
A SIF may fail in several ways, but failures
generally fall into four categories:
safe detected, safe undetected, dangerous
detected and dangerous undetected.
A safe failure is one that fails in a safe
state, with either the final element tripping
or a sensor calling for a trip. This
may cause unplanned outages, but the
SIF can still function.
Dangerous failures are more problematic,
as they may disable the trip and
block the safety function. Dangerous detected
failures create a bad but manageable
condition. The SIF cannot function,
but the plant knows it cannot function
and can work quickly to repair the condition
and restore the safety function.
FIG. 1. A SIS provides an independent layer of protection against dangerous incidents and is
composed of three major components: a logic solver, sensor(s) and final elements.
Hydrocarbon Processing | JULY 2021 77

Hydrocarbon Processing - July 2021

Table of Contents for the Digital Edition of Hydrocarbon Processing - July 2021