Basics of SIS

Safety Instrumented System

In Jumanda K
injumanda@gmail.com
0818 0205 4292
 Safety Standards Explained

What is a SIS (Safety Instrumented System)

What is SIL (Safety Integrity Level)

What is a SIF (Safety Instrumented Function)

How is a SIS different from DCS (BPCS)

Examples of SIF Loop Design

IJK & team 2

 Safety Acronyms
SIS Safety Instrumented System

SIF Safety Instrumented Function

SIL Safety Integrity Level

PFD Probability of Failure on Demand

PHA Process Hazard Analysis

LOPA Layer Of Protection Analysis

SRS Safety Requirement Specification

PES Programmable Electronic System

BPCS Basic Process Control System

IJK & team 3

 What is a SIS?
Formal Definition:

SIS instrumented system used to implement one or

more safety instrumented functions (SIF). A SIS is
composed of any combination of sensor(s), logic
solver(s), and final element(s) (IEC 61511 / ISA 84.01)

Informal Definition:
Instrumented System that detects out of control
conditions and automatically returns the process to a
safe state
Last Line of Defense
Not basic process control system (BPCS)
IJK & team 4
 IEC 61508 (Ref. 2) does not use the term SIS but instead
uses the term safety-related system.
Practitioners often prefer a more functional definition
of SIS such as: A SIS is defined as a system composed
of sensors, logic solvers and final elements designed
for the purpose of:
automatically taking an industrial process to a safe state
when specified conditions are violated;
permit a process to move forward in a safe manner when
specified conditions allow (permissive functions); or
taking action to mitigate the consequences of an industrial
hazard.

IJK & team 5

 What makes up a SIS?
Process Process

Input Output
IAS

SIS Program SV

Transmitter Safety
valve

Sensor(s) Logic solver(s) Final Element(s)

IJK & team 6

 How SIS are Different from BPCS?

IJK & team 7

 PENGERTIAN

IJK & team 8

 Safety PLC vs. standard PLC whats the difference?

Standard PLC has unknown failure modes dont know

how it will fail before it fails

Safety PLC is guaranteed to fail safely to within certified

probability (SIL 1, 2 or 3)

Safety PLC is certified by a 3rd party to international

standards IEC 61508, IEC 61511 TV

Certification includes certificate, report to the certificate

AND operation as per safety manual of PLC

Safety PLC must be configured by person with appropriate

safety competency
IJK & team 9
 Where would I need a SIS?
Typical applications for SIS
ESD: Emergency ShutDown System
F&G: Fire and Gas System
BMS: Burner Management System
TMC: Turbo Machinery Control System
HIPPS: High Integrity Pressure Protection System
WHCP: Well Head Control Panel

IJK & team 10

 What is a Safety Instrumented Function (SIF)?
Formal Definition:

SIF function to be implement by a SIS which is

intended to automatically achieve or maintain a safe
state for the process with respect to a specific
hazardous event. (IEC61511 ISA SP 84.01)

Informal Definition:

Independent safety loop or interlock that

automatically brings process to a safe state in
response to specific initiating events

IJK & team 11

 DEFINITION
In ANSI/ISA-84.00.01-2004 (IEC 61511 Mod), 3.2.71,
a safety instrumented function is defined as a safety
function with a specified safety integrity level which
is necessary to achieve functional safety.
This standard, 3.2.68, defines a safety function as a
function to be implemented by a SIS, other
technology safety-related system or external risk
reduction facilities, which is intended to achieve or
maintain a safe state for the process, with respect to
a specific hazardous event.
IJK & team 12
 SIS versus SIF
SIF
SIS

Logic
Solver

Sensors
Final elements

IJK & team 13

 Examples
Examples of potential safety instrumented functions
include the following:
Close outlet valve in a separation unit to prevent high pressure from
going downstream, which might result in vessel rupture and
explosion.
Cut off fuel flow in an industrial burner when fuel pressure is too low
to sustain combustion, which might result in flame-out and possible
explosion due to fuel build-up in the combustion chamber.
Open coolant flow valve to prevent column rupture due to over
Temperature.

IJK & team 14

 Examples
Close connection valve to isolate reactants to prevent
unit over pressure when reverse flow detected.

Close valve to stop material flow into a tank to prevent

spillage if high level is detected, which might result in
environmental damage.

Open sprinkler valve when a flame is detected in order

to reduce the size of a fire.

IJK & team 15

 Common Misconceptions
Over temp on the burner exhaust is a SIF
Generating an operator alarm indication is a SIF
Detectinga flammable gas cloud is a SIF
Detectingsmoke or fire is a SIF

None of the above include an action, associated with a final

element that automatically bring the plant to a safe state

IJK & team 16

 What is (SIL) Safety Integrity Level?

Safety Informal Definition:

Integrity Level
SIL ..the Safety Integrity Level of a specific Safety
Instrumented Function (SIF) which is being implemented by
SIL 4 a Safety Instrumented System (SIS).
OR
SIL 3
The amount of risk reduction achieved by a specific Safety
Instrumented Function (SIF)
SIL 2

SIL 1

IJK & team 17

 SIL expressed as PFD
PFD:
PFDavg = DU TI / 2 Probability of Failure on
Demand

PFD (t)
DU:
Dangerous Undetected
Failures
SIL 1
SIL 2 TI:
SIL 3 PFDavg Test Interval (proof)
SIL 4 test interval

time

IJK & team 18

 Different levels of SIL

Safety Probabilityof Failure

Safety Risk Reduction Factor
Integrity Level on Demand

SIL 4 > 99.99% 0.001% to 0.01% 100,000 to 10,000

SIL 3 99.9% to 99.99% 0.01% to 0.1% 10,000 to 1,000

SIL 2 99% to 99.9% 0.1% to 1% 1,000 to 100

SIL 1 90% to 99% 1% to 10% 100 to 10

IJK & team 19

 What is Risk?
the likelihood of a specified undesired event Serious consequence x
high likelihood =
occurring within a specified period or in specified higher risk
circumstances.

RISK = Likelihood x consequence

Likelihood
high

moderate

Minor consequence x
low likelihood = low
low risk
minor serious extensive
Consequence

IJK & team 20

 Effects of taking too much risk
Injury / death to Personnel

Likelihood Environmentdamage and consequential clean up costs

high

Damage and loss of equipment/ property

moderate

Business interruption associated losses

low

minor serious extensive Legal liability, litigation &duty of care defense

Consequence

Company image

Lost market share

IJK & team 21

 Tolerable Risk
Moral, Legal and financial responsibility to limit our risk

In some countries, the law mandates tolerable risk levels

Meeting OSHA requirements as minimum

Make plant as safe as

possible, disregard cost
Comply with regulation as
written, regardless of cost Legal Moral
or level of risk

Financial

Build the lowest cost plant and

keep operating budget as small
as possible
IJK & team 22
 Reducing Risk

Inherent Process Risk

Likelihood

Unacceptable
Risk Region

Tolerable Risk
Region
IJK & team Consequence 23
 Reducing Risk

Inherent Process Risk

Active Protection
e.g. PRV
Likelihood

Unacceptable
Risk Region

Tolerable Risk
Region
IJK & team Consequence 24
 Reducing Risk

Inherent Process Risk

Passive Protection Active Protection
e.g. Containment Dyke e.g. PRV
Likelihood

Unacceptable
Risk Region

Tolerable Risk
Region
IJK & team Consequence 25
 Reducing Risk

Inherent Process Risk

Passive Protection Active Protection
e.g. Containment Dyke e.g. PRV
Likelihood

Unacceptable
SIS Applied
Risk Region

Tolerable Risk
Region
IJK & team Consequence 26
 Reducing Risk

Inherent Process Risk

Passive Protection Active Protection
e.g. Containment Dyke e.g. PRV

SIL 1
Likelihood

SIL 2

SIL 3
Unacceptable
SIS Applied
Risk Region

Tolerable Risk
Region
IJK & team Consequence 27
 Conceptual Design
Select Technology
Device Failure Rate
Certifications (TUV) for use in SIS applications
Read Safety Manual for Certified Equipment Restrictions

IJK & team 28

 Conceptual Design
Select Architecture / Voting
Select degree of fault tolerance required for Safety
Select degree of fault tolerance for plant availability
Apply required redundancy to BOTH field devices and logic solver
Identify potential common-cause failures that could defeat
(mengalahkan) redundant architecture

IJK & team 29

 Conceptual Design
Functional Proof Tests
Frequency
Online or during Shutdown
Full Functional Test or Partial Test

Diagnostic Testing
Frequency
Response to detected fault

IJK & team 30

 Terima Kasih
IJK & team 31