sponsored by: eguide on safety instrumentation · sponsored by: eguide on safety instrumentation...

Sponsored by:

eGuide on Safety Instrumentation

Sponsor Profile . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2

Intelligence At The Device . . . . . . . . . . . . . . . . . . . 3

Practice Safe Sensing . . . . . . . . . . . . . . . . . . . . . . 7

Process Safety Resources At Your Fingertips . . 10

Intrinsically Safe Or Explosion Proof? . . . . . . . . . . 11

Simplifying Plant Safety Instrumentation . . . . . 15

Table of Contents

http://www.ueonline.com/plant_safety.html

Sponsored by:


Sponsor Profile Intelligence at the Device

Practice Safe Sensing Process safety resources at your fingertips

Intrinsically Safe or Explosion Proof?

Simplifying Plant Safety Instrumentation

Sponsor ProfileUnited Electric Controls, a privately held corporation headquartered in Watertown, Massa-chusetts, USA, is a manufacturer of durable and reliable pressure and temperature switch-es and sensors used in industrial applications throughout the world. UE products provide a critical and independent layer of Plant Safety instrumentation that protects equipment, processes and personnel in a wide variety of challenging environments and operating con-ditions. Our reputation for dependable pressure and temperature solutions is a result of innovative design, superior manufacturing techniques, and a corporate focus on uncompro-mising quality and service to our customers.

Innovative Design• Solid-stateOneSerieselectronicswitchforplantsafetyapplications• Cost-effectivesolutionstomeetandexceedcustomerrequirements• Ruggedconstructionforthemostchallengingenvironments

Rapid Delivery• Leanmanufacturingformaximumproductivity• Practitionerofcontinuousimprovementandeliminationofwaste• One-piece-flowforoptimummanufacturingefficiency

Uncompromising Quality• ISO9001:2000certified• Customer-firstapproachthroughservice,deliveryandvalue• Wideselectionofproductsthatmeetglobalagencycertification

Three Manufacturing Divisions• UnitedElectricControls• AppliedSensorTechnologies• PrecisionSensors


Sponsored by:






Intelligence At The DeviceCover Story: As Components Get

Smarter And More Powerful, Manu-facturers Are Finding Themselves

Managing High-Performance Auto-mation And Control Systems Whose

Parts Are Capable Of Monitoring Themselves, Diagnosing Their Own

Problems, And Maybe Even Mak-ing A Decision Or Two, Economically

And Easily.

Jeanine Katzel for Control Engineering

Everythingissmarterthesedays,itseems:smartcars,smartappliances,smarttoys.It’snotsurprising,then,thatintelligentdevicesareontheriseinindustrialautomationandcontrolaswell.Smartmotors,smartsensors,smartflowmetersareonlyafewamongmanycomponentspackedwithmicroprocessorpowerinatrendthathasalltheearmarksofusheringindustryintoanageofunprecedentedproductandsystemperformance.

Computingpowertodayisseeminglyinfiniteanddatastorageandmemoryrelativelyinexpen-sive,saysJeffWoolfolk,businessdeveloperandconsultingengineerforSiemensIndustryInc.“ThenameofthegamenowishowmuchinformationcanIobtainefficientlyandhowcanIbestuseit.”

Itappearsmanufacturersareobtainingandus-inginformationquiteefficiently—andeffectively.Thankstotheadventoftechnologicaladvance-mentssuchassystemsonachip,multi-coreprocessing,andhigherlevelsofintegration,de-vicesaresmaller,lighter,faster,andsmarter.Theyarefindingtheirwayintoendlessapplicationsandreapingbenefitsinmanyareas.Theyareincreasinglymorecapable,asvendorsintroduceproductsthatareeasiertouse,energyefficient,self-diagnostic,andwireless;andtheyarefilledwithfeaturesthatarehelpingtodrivecompaniestothegreaterefficienciesandthrough-putsandhigher-levelprocessesthattheyneedtostaycompetitive.

Intelligent wireless devices analyze and transmit information from remote installations accurately and economically. Source: Emerson Process Management

Use Those Brains!Buildingcapabilityintocomponentsisnot

entirelynew.Smartmotors,drives,andmotioncontrolsystemsarefrequentsightsinmodernfacilities.“Thecomponentsinsidedrives—theIGBTs,theprocessors,”saysRichMintz,productmanager,SEWEurodrive,“werebuiltearlyontohandleharshplantfloorenvironments,andthatcapability,perhapsmorethanothers,hasenabledintelligencetomovetothedevicemorereadily.Forintelligencetomovetothedevicelevel,itmustbedesignedspecificallyforthatenvironment.Intelligentdevicesarenotthesamecomponentsfoundinstandardcontrolcabinetelectronicproducts.Manufacturershaveasked

forthesedevices,andsuppliershaveresponded,allowingtheprogressionfromcentralizedtode-viceintelligencetooccur.”

Inaddition,thoseinitialdevicesdidnothavethebenefitofthetremendouscomputingpower,memorycapacity,ordatatransmissioncapabilityemergingtoday.Currentmicroprocessorhorse-powercoupledwithlowpowerrequirementsarewhat’sallowingustoembedmoreandmoredecision-levelfirmwareandsoftwareintode-vices,saysRayRogowski,managerglobalprod-uctmarketing,fieldinstrumentation,HoneywellProcessSolutions.“Nottoomanyyearsago,youhadtogobacktotheDCStofindoutwhatwasgoingoninthefield.Nowyoucanpackageitrightupinthesensor.”

Initially,microprocessors“wentdowntothede-vicetoimproveperformance,”saysMarkSchum-acher,presidentofthe

Components such as Siemens Simocode Pro V current/voltage monitoring modules add intel-ligence to motor control center applications. Source: Siemens Energy & Automation


Sponsored by:






RosemountPressureBusinessforEmersonProcessManagement,“todothingsliketempera-turelinearizationandcompensation.Itisthatperformanceimprovementandreliabilitythatcontinuetobethefoundationforthegrowingap-plicationofintelligencedevices.”

Sincehiscompanyhashistoricallyfollowedaphilosophyofcentralizedcontrol,GrahamHar-ris,president,BeckhoffAutomation,arguesthatmulti-coreprocessingputsunprecedentedamountsofpoweronachiptocreatean“all-in-one”automation,control,andmeasurementplatformthatcandoeverythingfromperformingmachineconditioningandreal-timemeasure-menttomodifyingcontrolalgorithmsinrealtime.AccordingtoHarris,“UsingonepowerfulCPU,itismoreefficienttomanagenumerousdevicesinsoftwareversuscontrolviadistributedCPUsineverymeasurementandmonitoringdevice.PC-andEthernet-basedtoolsaresimilarinapproachtothehumanbrain,managing‘control’ofouror-gansandbodypartsviathenervoussystem.Thiskindofapproachinautomationiswhatwecall

‘scientificautomation,’anexcitinggrowthareaoftechnology.Withinfiveyears,engineerswillseeitinareaslikeadaptivecontrolandconditionmoni-toring,andinthedevelopmentofmoreintelligentmachinesoverall.”

Intelligent components, such as this microprocessor-based temperature trans-mitter, enhance measure-ment accuracy and reduce maintenance. Such devices are capable of continually monitoring a sensor, track-ing operation, diagnosing failures, and generating error messages. Source: Moore Industries-International Inc.

Benefits In BalanceIntelligentdevicesreapthreeprimarybenefits

forautomationandcontrol,saysRamiAl-Ashqar,motioncontrolproductmanager,BoschRexroth:

Thecontrollerdoesn’thavetodoeverything.Componentintelligencefreesthecontrollertodoothertasks.

Electronicequipmentonamachinecanbemoreeasilymodularized,allowingbettermainte-nanceandeasiertroubleshooting.

Flexibilityisincreased.Distributedintelligencefacilitatestheeasierincorporationofmorede-vices.Onecontrollerinterfaceswithmanydeviceswhichdothework.

Theyalsocansaveenergy,addsMintz.“Havingintelligenceinsidemotorsanddrives,forexample,givesyouclosercommunicationsandconnectionsthatallowthecomponentstofunctionbettertogether.Themoreacontrollercancommunicatewithadrive,andthemorethedriveknowswhatisgoingoninthemotor,thebetterableanopera-tionistomakethosesmallprocesschangesthatmakeadifference.”

The need for easy-to-use smart devices is critical. To show easily even non-engineers can learn to develop intelligent systems, National Instruments has launched a robotics competition using Nitro. The Nitro control system platform is designed to help students elarn to use tools such as NI’s LabView and CompactRio to build intel-ligent robotic devices and solve challenging engi-neering problems. Source: National Instruments

Amongthemoreimportantaspectsofincor-poratingintelligentdevicesintoasystemiseaseofuse.SaysEmerson’sSchumacher,“Puttingmoreintelligenceintofielddevicesunquestion-ablymakesthemmorecomplicated.That’swhyitiscriticaltokeepdeviceseasytouse,adelicatebalanceandatoughengineeringchallenge.Noinformationfromadeviceisimportantifitisnoteasilyaccessible.Manyplants,today,arestaffedbyfewer,lessexperiencedworkers.Ontheonehand,vendorsmustconcentrateonbuildingeaseofuseintotheirintelligentproducts.Ontheother,end-usersmustbedisciplinedaboutwhatinfor-mationtheyreallyneedtoknow.”

Partoftheburden,addsArvesStolpe,Compac-tRioProductManager,forNationalInstruments,fallstosoftwaredeveloperstocreateapplicationsformodernmulti-processingsystemsthatareeasytouse.“Today’scomplexsystemsareex-tremelypowerful,butwithouttherighttools,theyarealsodifficulttoprogram,design,andmanage.


Sponsored by:






Weneedproductsthatdon’trequireamulti-processorembeddedsystemdevelopertoapplythem,”heinsists.“Ifwedon’tdothat,industrialandautomationengineerswillneedtobemorethancontrolexperts,theywillneedtobeembed-dedexperts.Andthatisreallyaskingalot.”

Integrated motor and drive mounted directly on a machine make it easy to configure a system in different ways. Continued integration of intelli-gent components is expected to increase moni-toring and control accuracy even further. Source: Bosch Rexroth

Buildingintelligenceintodevicesalsohasdrivendiagnosticstothecomponentlevel.“Itreducesmaintenancebecausethemachinecanbemodularized,”saysAl-Ashqar.“Iftheelectron-icsandthemachinearemodularized,itiseasiertoidentifyaproblem.Errormessagescanbedisplayedandproblemspinpointed.”

Firstgenerationsmartinstrumentscouldfailinunpredictablewaysduetoundetectedsoftwarefaults,addsCharlesLarson,directoroftechnologyforMooreIndustries-InternationalInc.“Butincreasedprocessingpoweravailableatlowpowerhasalloweddevicestoperformmoreextensivediagnostics.Sometemperaturetransmitterscandetectand

identifybrokenleadwiresandhighleadresistanceconditionswhenmulti-wiresensorconfigurationsareused.Temperaturetransmittersthatacceptdual-sensorinputsallowfallbacktosinglesensoropera-tionwhenasensorfailureisdetected.Whencoupledwithexternalwatchdoghardware,adevicethatisnotoperatingproperlycanbeguaranteedtogener-ateafaultsignal.Thatkindofreliabilityallowssmartinstruments,suchasintelligentsafetyalarmtrips,tobeusedeveninsafetyapplications.”

Manyuserstodaywanttoembracedevice-levelin-telligence,saysSiemens’Woolfolk,butarestillthink-ingintermsofoldschoolcapabilities.“Productstodayaresocapable,”hesays.“Themoreyouletthemdo

foryou,themorevaluablewillbethereturn.Intel-ligentcomponentsdomorethanmonitoracontactclosure.Theydiagnoseadevelopingproblemandletuserspreemptivelyheadoffafaultorafailurethatcouldshutdownproduction.”

John Deere saw a 25% savings in energy use on its storage retrieval system just by carefully coor-dinating movement of the X and Y axes. The action allowed the company to re-use the potential energy stored in the rack locations. Source: SEW Eurodrive

Technology Of ChoiceWhat,then,istheultimateinfielddeviceintel-

ligence?Wireless,agreemost.Itmaystillbe“agiantleapoffaith”formany,butcomfortwiththetechnologyisgrowingandmoreapplicationswillemergeaswirelessisproventowork.“Itwillbetheeasiest,mosteconomicaloption,whichwillmakeitthetechnologyofchoice,”saysEmerson’sSchumacher.“Thecostofdevicesismuchlessthanthecostofinstallingthem,”addsHoney-well’sRogowski.“Ifyoucaneliminatethewiringandstillhavedevicesthatarereliable,safe,androbust,thesavingsarehuge.”

Microprocessorperformanceandlowerpowerrequirementshaveenabledwirelesstechnologiestoexpandsignificantly,saysMarkMuldowney,fieldinstrumentstechnology,productarchitect,HoneywellProcessSolutions.“Advancesinsignalprocessingletdevicesnotjustgivedatatoendusers,buttoanalyzethedataandgenerateinfor-mationthatisactionable—givingusersinforma-tiontheyneedandinformationtheycantrust.”

Theconceptofintelligentsensorsevery-where—orubiquitoussensornetworksasUCLAresearcherscallthem—couldonedaybecomepartofourcontrolprocesses,musesStolpe,whosecompanyhasjustreleasedwirelesssensornodes.“Thecloserthesensorcanbetothedecision-makingprocess,thehigherqualitysignalpossible.Andreally,controldependsontheaccuracyofthemeasure-ments.Ifyouhaveanaccuratemeasurementwithlownoiseatthenode,youcanrespondtoanyinputquicklyandaccurately.”


Sponsored by:






To Make The Impossible, Possible And The Possible, EasyTohearthoseclosesttothetopic,thepo-

tentialforintelligentdeviceshasanexciting,varied,andlimitlessfuture.“Weseefurtherintegrationcoming,”saysMintz.“We’vegotalgorithmsthatuseasensoronthegearboxandintelligenceinthedrivetotellyouwhentodoanoilchange.Weseethenextgenera-tionintegratingfunctionsintosinglepack-ages:agearboxwitheverythinginsidethatyouplugintoanEthernetport.Itgivesmanypauseforthought.”

“Thepossibilitiesareincredible,”saysAl-Ashqar,recallingthatfewwouldhavepredicted20yearsagotheimpactofmobilephones.“AremotePLCmightonedayactasamastercontrollertakinginformationfrommultipleplants,communicatingittotherightpersonnel,andperhapsevenmakingdecisionsorrunningmachinesinmultiplelocations.”

Theabilitytoaddfunctionsmoreeas-ilywillcontinuetoexpand,offersWoolfolk.“Safetyfunctionswillbecomemoreandmoreimportant,”heobserves,“andarestartingtofindtheirwayintotheintelligentdevice.”

Ofcoursehurdlesremain,amongthempoweringintelligentdevicesandensuringwirelesslinkreliability.“Ubiquitoussensorswillhavetobeverylowpowerdevicesthatarenonethelessverypowerful;andwirelessstillmustsolveissueswithcommunicating

backtoacentralhost,especiallyinmissioncriticalapplications,”saysStolpe,buthebelievesthechallengeswillbeovercome.“Ifwecanmakeintelligentproductssufficientlycapableandeasytoapply,wewillallowoperationsandmanufacturingpersonneltobesuccessfulinwhattheyneedtodo.Wewilldriveintel-ligentdevicetechnologytothepointofbeingincrediblyusableandinsanelypowerful,makingtheimpossiblepossible,andthepossibleeasy.”

Author InformationJeanine Katzel is a contributing ed-itor to Control Engineering. Reach her at [email protected]

Intelligence In Action: Smart Devices Save EnergyPuttingintelligenceintoadevicecanimproveperformanceandsaveenergy,as

aretrofitprojectatatractormanufacturershowedrecently.AJohnDeerefacilitywantedtomodernizea25-year-oldstorage-and-retrievalmachinetoincorporateenergy-savingtechnologies,andturnedtoSEWEurodriveforassistance.

ThesysteminquestionincludedanXaxisthattravelsastorage-and-retrievalcraneandaYaxisthatmovesthepalletsupanddown.Typically,explainsRichMintz,productmanager,“Ifyouconfigureastorage-and-retrievalsystemtogofrompointAtopointBtoretrieveapalletofftherack,bothaxesstartmovingatonce.TheXaxisstartstomoveandtheYaxisstartstolift.Bothmotorsstartatthesametime.Butdotheyhaveto?IftheYaxisissettowaitasecondortwobeforeitstartslifting,itcanavoidasimultaneousinrushandreducedemandontheelectricalsystem.”

Thevendoralsolookedatwhathappenswhenthedrivesdecelerate.ContinuesMintz,“WhenyoudeceleratetheXaxis,youputenergybackintothedcbus.WhenyoudeceleratetheYaxis—whenthesystemisloweringthepallet,itisbleedingoffenergy.Itisbeingburnedupoverthebrakingresistor.Nowwhatifwetimedtheoperationsothatwhenonemotorisregeneratingenergy,insteadofburningitovertheresistor,wewaitanduseittomovetheothermotor?Whatifwetimewhenthesetwomotorsactsothatwhenoneisregeneratingpower,theotherisusingthatregenerativeenergyinsteadofgivingitupoverthebrakingresistor?”

Theanswersarethatenergyissavedandefficiencyisincreased.TheconceptswereappliedtotheexistingsystemusingSEW’sMOVIPLCmotioncontroller.Asaresult,Deerewasabletoreduceenergyconsumptionbythesystemsome25%withoutchangingthecyclerates—andtheydiditjustbyaddingintelligencetothecomponents.

“WetookaPLCcontrollerandputitinsideoneofthedrives,”explainsMintz,“andwereabletoachieveasignificantenergyreductiononalargesystemforamajormanufacturer.DoingitinsidethemainPLCwouldhaverequiredamorerobustandexpensiveunitaswellasadditionalprogramming.ButifyoutaketheloadoffthePLC,letataskcontrollertellintelligentdeviceswhichtaskstoper-form,andleteachintelligentdevicecontrolitself,bigsavingsintimeandmoneyarepossible.”


mailto:[email protected]

Sponsored by:






With Process Safety And Sensors, Sometimes Garbage In Equals More

Than Garbage Out. Because These Devices Measure Pressure, Tem-perature, Flow, Level, And Other

Process Parameters, They Play A Pivotal Role In Determining A Pro-cess Unit’s Output. A Wrong Read-ing Can Produce Waste Or Create A

Catastrophe That Costs Lives And Makes National News.

Hank Hogan for Control Engineering

Withprocesssafetyandsensors,sometimesgarbageinequalsmorethangarbageout.Be-causethesedevicesmeasurepressure,tempera-ture,flow,level,andotherprocessparameters,theyplayapivotalroleindeterminingaprocessunit’soutput.Awrongreadingcanproducewasteorcreateacatastrophethatcostslivesandmakesnationalnews.

Now,thankstoadvancesintechnology,sensorsystemshavegreaterintelligenceandthereforemorediagnosticcapabilities.Today,sensorscanbecertifiedbythirdpartiestomeetsafetyinteg-ritylevels,orSIL,designationsfoundinIEC61508.Onepositiveresultofthisisthepotentialtousefewersensorswithoutcompromisingsafety,

leadingtoadecreaseinwiringandinstallationcosts.Anotherpositiveeffectisthepotentialforimprovedprocesscontrol,largelyduetoincreas-inglyintelligentsensors.

“Certifiedproductsdeliverhigherdesignqual-ity,”assertsWilliamGoble,principalpartnerandco-founderofexida,acompanythatoffersfunctionalsafetytraining,technicalsupport,andexpertisefromitsNorthAmericanheadquartersinSellersville,PA.(Thecompany’sEuropeanbaseisinFischbachau,Germany.)Thisbetterdesignisduenottosuccessbutrathertofailure,notesGoble.“Nearlyhalfoftheproductsthatattemptcertificationfailonthefirsttry.Onlywhenthedesignprocessisimprovedanddiagnosticsareaddeddotheypass.”

Goble’sdatashowsthatthenumberofcerti-fiedsensorshasexplodedinrecentyears,withthecumulativetotalofsuchdevicesmovingfromfivein2003toeightin2005and24in2007.Therehavebeenindicationsthatvendorsareconvert-ing,orwillsoonconvert,entirefuturesensorlinestocertifiedproducts.Goblenotesthattakingfulladvantageofsuchsensorswillrequirethatsystemsbeconfiguredcorrectly.Forexample,runningdiagnosticsincertifiedsensorsmaysendthereadingoutofrange.Anincorrectlyconfig-uredcontrollerwillinterpretthisasafault,shut-tingdowntheprocessunnecessarily.Abetterap-proachwouldbetoimplementahold-last-valuestrategy,withactiontakenonlyifareadingstaysoutofrangeforlongerthanaspecifiedtime.

A loading bay for Shell petroleum products in the U.K. makes use of safety-certified mass flowmeters. Courtesy Endress+Hauser.

Known FailuresOneofthefirstcompaniestoofferacertified

sensorwasboughtafewyearsagobySiemensEnergyandAutomation(SEA).LouisDiNapoliisapplicationengineeringandtechnicalsupport

managerfortheSEAprocessinstrumentationunitthatmakessafetycertifiedsensors.DiNapolisaysthatthesesensorsdifferfromnon-certifiedequivalents.

Forexample,theyoftencontaintwomicro-processors,fromdifferentvendors,whicharebasedondifferenttechnologyandimplementa-tions.Eachmicroprocessortakesinputfromthetransducer,theunitthattranslatesthephysicalparameterintoanelectricaloutput.Theresults

Practice Safe Sensing


Sponsored by:






ofthetwodifferentcalculationscanthenbecompared,withsimilarresultsensuringthatthemicroprocessorsareperformingcorrectly.An-otherfailsafefeatureofthenewsensorsincludestheabilitytoforcethesensorviasoftwaretoapredeterminedlevel,suchas80%offullscale.Thisresultcanthenbemeasuredandcomparedtowhat’sexpected,providinganotherindicationthatthesensorisworkingcorrectly.

Akeypointtobeawareofregardingthesefeaturesisthattheydonotfunctiontoensureacorrectsensorreading.Theyalsodon’tpreventafailure.But,notesDiNapoli,that’snotwhatasafety-certifiedsensorisdesignedtoachieve.“Youdon’tcarethatitfails.Youcarethatitfailsinaknownfashion,”hesays.Whatistransmittedinthecaseofsensorfailureisaknown,pre-determinedquantity,allowingthatfailuretobedetected.Ofcourse,thesystemhastobeconfig-urednotonlytodetectthefaultbutalsonotactonthevalue,sinceitistheresultofafailure.

Whileinternalcomputationsandvaluestransmittedtotheoutsideworldarechecked,sensorsystemsmayhaveonlyonetransducerinthem.Thisfrontendoftheentirechain,saysDiNapoli,turnsouttobetheareawhereitismostdiffi-culttoassurereliableoperation,inpartbecausethere’sonlyoneprocessmeasurement.Sincethere’snothingtoprovideacheckorreference,assurancehastobeinferred.

However,increasingintelligence,alongwithsomesophisticatedalgorithms,maymakesuchindirectcheckingeasiertodoso.Fiveyearsago,sensorpack-ageswererelativelydumb.Today,they’remuchmoreintelligentandprovideinformationthathelpsensuresafeoperationaswellasimprovetheprocess.

Forexample,sensorscanhaveregistersthatcounteverytimethepressuregoesaboveoneofthreesetpoints.Oneofthosepointscouldbetheprocessdesignmaximum.Fromthosecounts,asimplehistogramcouldrevealimportantinfor-mation,suchastheprocessbeingabovedesignmaximumpressureamajorityofthetime.Thesetypesofresultsmayindicateadesignflaworacontrolsystemisn’tworkingwell,saysDiNapoli.

Anothercompanywithalonghistoryinsafety-ratedsensorsisEndress+HauserofReinach,Switzerland.Thecompanyhaslocalsalescentersandrepresentatives,withtheU.S.headquartersinGreenwood,IN.Endress+HauseralsopartnerswithRockwellAutomation.

Safety-certified mass flowmeters are used in the oil and gas in-dustry. Courtesy Endress+Hauser

GeroldKlotz-Engmannisheadofdepartmenttechni-calsafetyforthecompany’sGer-mansalescenter.HenotesthatthecompanydesignsproductstoconformtoIEC61508;allnewproductdesignswillmeetthisstandard.

Achievingthatrequiresselfdiagnosticssothatpassiveinternalcomponentfaultscanbespotted,alongwithstepstoensurenosoftwareglitchesorproblems.

NearlyallcompanyproductshaveundergonethirdpartyassessmentandcanbeusedinSIL2orSIL3safetyinstrumentedsystems.Thesys-temarchitecturedetermineshowmanycompli-antsensorsshouldbeused.Forexample,ifaSIL2levelisrequired,thenthesituationisrelativelysimple,saysKlotz-Engmann.“NormallyasinglechannelarchitecturewithaSIL2compliantsen-sorissufficient.”Thingsgetmorecomplicatedifahigherlevelofsafetyisrequired,headds.Thenitmaybenecessarytousetwoorthreesensors,withthesensorsvotingtoarriveataconsensusmeasurement.Theadvantageofthethreesen-

sorarrangementisincreasedsafetyandgreateravailability,sincethetriowillcontinuetoprovideinformationevenifoneortwosensorsfail.

CarlSonoda,marketingmanagerforfieldinstrumentsolutionsattheYokogawaElectricCorporationofTokyo,saysthecompany’sfirstcertifiedsensorappearedin2003.Today,Yokoga-wahasaseriesoftemperaturesensors,pressuretransmitters,andmultivariabletransmitters,allsafety-ratedanddesignedtoachieveaSIL2or3performance.

Thebestpracticeforasafetyloopdesign,henotes,istousemultipletransmitters,witheachvoting.Addingtoredundancycostsarethenum-berofdevices,wiring,post-installationtesting,andongoingmaintenance.

Asafety-rateddevicecanhelpreducethenum-berofsensorsrequiredandtherebycutsuchex-penses.“OurIECSIL2/3certifiedtransmittercanprovidefunctionalitysothatit’spossibletouseonesafetytransmitterinsteadoftwostandardtransmitters,”saysSonoda.

Deployment Choice: Many Or FewThequestionabouthowmanysensorstouse

isn’tclearcut.DalePerry,pressuremarketingmanagerfortheChanhassen,MN-basedRose-mountdivisionofEmersonProcessManagement,notesthatusingfewersensorsisamixedbless-ing.Fewersensorsincreasethepossibilityofafalsealarm,whichcarriesacostsinceitmightshutdownaprocessneedlessly.Thus,thetotaloutlayofanysolutionwillhavetobecarefullyconsidered.Thecorrectanswerabouthowto


Sponsored by:






implementasensorstrategywilldependuponmanyfactorsinadditiontoinstallationandcom-missioningcosts.

A safety-certified transmitter helps keep a phar-maceutical process running smoothly and safely Courtesy Siemens Energy and Automation

Rosemount’shistorywithsafetycertifiedsensorsparallelsthatofothermanufactur-ers.Initially,safetycertifiedproductswereunique,andtheyfacedadistinctiverequire-mentinthattheyhadtomeettheapplicablestandard.Overtime,incorporatingthefea-turesneededforcertificationintostandarddevicesbecameacompanybestpractice.Thisevolutionexplainswhythepricedifferential

betweenstandardandsafety-ratedsensorshasdiminishedsignificantly.

However,itmayneverdisappearentirely.Acertifieddevicecarriesextraexpenses,notallofwhichcanbefoundinhardwareorsoft-ware.AtRosemount,forexample,Perrysaysincomingordersarecheckedtoensurethatalloptionsorderedwiththedevicearewithinthesafetycertificationscope.

Also,acopyoftheproductsafe-tycertificate,adocumentlistingthecertifiedfailuremodes,effects,anddiagnosticanalysis(FMEDA),aswellasthedeviceserialnum-berandfailuredataareshippedwitheachtransmitter.DoingsoprovidesrequireddocumentationsaysPerry.Thesameintelligencethatmakessensorssaferincreas-inglysuppliesothercapabilities,hesays.Usersdemandpredictivedi-agnosticsbeyondthesensor.Theywantthisfunctionalitybecausemoreinsightintoaprocesshelpspreventabnormal,andpotentiallyunprofitableordangerous,situa-tions.Thesedemandscouldleadtochangesinsafety-ratedsen-sors,saysPerry.“Weseetheseadvancedprocessdiagnostics,aswellasloopdiagnostics,beingincludedinfuturesafetycertifiedproducts.”

Year CumulativetotalSource: Control Engineering and exida

1996 11997 11998 2

1999 22000 22001 42002 42003 52004 72005 82006 122007 242008 342009 392010 46


Sponsored by:






Recently It Seems That Everyone Is Talking About Process Safety,

But More Than That, They’re Doing Something About It.

Peter Welander, Control Engineering

Recentlyitseemsthateveryoneistalk-ingaboutprocesssafety,butmorethanthat,they’redoingsomethingaboutit.ARCAdvisoryGroupsaysthatstronggrowthofsafetyinstrumentedsystemswillcontinuein2008.Currentsoftconditionsmaytemperitinsubsequentyears,buttheworldwidemarket,whichwasaround$1.4billionin2007,isex-pectedtogrowatacompoundannualgrowthrateofover12%peryeartoover$2.5billionin2012.ThisisfromanewARCstudy,“ProcessSafetySystemWorldwideOutlook—MarketAnalysisandForecastThrough2012.”

“Thesafetysystemmarkethasexperi-encedunprecedentedgrowthforthelasttwoyears.IncreaseddemandforoilandgasduetotheeconomicgrowthofChinaandIndia,alongwiththehighpriceofcrudeoil,isfuel-inginvestmentsinoilandgasproductionandinrefining,leadingtoincreaseddemandforsafetysystems,”accordingtoARCvicepresi-dentAsishGhosh,theprincipalauthorofthestudy.

Thecomplexityofsafetysystemshasin-creasedovertimebecauseofeffortstoaddcapabilitiesandmakethemeasiertoworkwithonanoperationalbasis.(Systemarchi-tectshaveperhapslearnedsomelessonsfromtheover-proliferationofalarmfunctionsincontrolsystems.)Theresultisthatcompaniesfrequentlyhavetoengageoutsidehelpwhendesigningnewsystemsorupgradinganexist-ingfacility.Thiscaninvolveaconsultinggroup,systemintegrators,oraprimaryautomationsupplier.

Majorprocessautomationsuppliersgen-erallyhavedepartments,divisions,orevenwholesubsidiarycompaniesdedicatedtoprocesssafety.Examplesinclude:

ABB—SafetySystems;GEFanuc—SafetyNet;Emerson—SmartSIS;Honeywell—SafetyManager;Invensys—Triconex;Rockwell—ICSTriplex;Siemens—SIS;andYokogawa—ProSafeRS.

Thislistisjustabeginning,andtherearemanymoresafetysuppliersavailable.(Readthisarticleonlineatwww.controleng.com/ar-chiveforlivelinkstoallthesecompanies.)

Safety-on-fieldbusplatformsforprocessappli-

cationsexistorareindevelopmentandincludeAS-interface,ProfiSafe,andFoundationFieldbusSIF.Provenindiscreteapplications,theseeffortswillrequireadditionaltimetocom-pleteandbeadoptedbyendusers,butthepromiseisthere.

Resources GaloreIfyouwanttodosomeinitialresearchonthetopic,you

won’thavetogofar.Asearchatwww.controleng.comon“processsafety”willbringyousome10,000resultsthatcanbedividedintovarioussubtopics.

Also,Siemens,inpartnershipwithControlEngineeringandPlantEngineering,haslaunchedanewWebsiteatwww.safetybase.comwhichcontainsahugeamountofinformationonbothprocessanddiscretemanufacturingsafetyissues.

And,ofcourse,thereistheOSHAprocesssafetysiteatwww.osha.gov/SLTC/processsafetymanagement,whichlistsallrelevantstandardsrelatedtothepotential“re-leaseoftoxic,reactive,orflammableliquidsandgasesinprocessinvovlinghighlyhazardouschemicals.”

Ifyoupreferface-to-facecontact,nextmonth’sISAExpoinHoustonwillhaveadedicatedconferencetrackcalledSafetyExchange.ISApromisesthatitwillinclude“peer-reviewedtechnicalsessionscoveringtopicssuchassafetyinstrumentation,SISapplication,alarmmanage-ment,competency,andmore.Sessionsareplannedduringtheconference,including‘SISApplicationsinOilandGasProduction,’apresentationthatexploresthenewsafetyinstrumentedsystemengineeringtechniquesrequiredtomeetHSEstandardsforenergyfacilities.”

Allthattosay,thereisnoshortageofresourcesasyouexplorethiscriticalarea.Thereismuchtodiscoverandlearnatyourfingertips.

Process Safety Resources At Your Fingertips


www.controleng.com/archive

www.controleng.com/archive

www.controleng.com

www.safetybase.com

www.osha.gov/SLTC/processsafetymanagement

Sponsored by:






The Distinctive Ring From The Ra-dio Phone Told The Control Room Operator That The Person On The

Other End Would Be The Tank Level Technician. He Also Knew That If

A Call Was Coming In, Something Was Amiss At The Remote Site

Tank Farm. “I Can’t Get On The Last Tank” Said The Voice On The Other End.... Here Are Considerations For Deciding Between Intrinsically Safe

And Explosion-Proof.Jeanine Katzel for Control Engineering

Wireless temperature transmitters are among the intrinsically safe equipment used by chemical plants to reduce the hazards of explosive envi-ronments. Such devices are simple to install and maintain. Source: Emerson Process Management

Enraf radar level gauges measure product level and other parameters in bulk storage tanks, combining explosion-proof and intrinsically safe technologies to achieve a cost-effective, yet safe system for tanks containing hazardous sub-stances such as gasoline, crude oils, and liquid chemicals. Service technician uses an intrinsically safe, handheld device equipped with extensive diagnostics to commission a gauge safely while the tank is in full service. Source: Honeywell Process Solutions

Thedistinctiveringfromtheradiophonetoldthecontrolroomoperatorthatthepersonontheotherendwouldbethetankleveltechnician.Healsoknewthatifacallwascomingin,somethingwasamissattheremotesitetankfarm.

“Ican’tgetonthelasttank”saidthevoiceontheotherend.“There’sacatonthesteps.”Well,justshooitaway,thecontrolroomoperatorstartedtosay,butstoppedabruptlyasthetech-niciancurtlyinterrupted.“It’samountainlionandI’mnotgoingnearit,”hesnapped.“I’mcomingin.”Onetanklevelwouldremainunread.

Thesituationisunusual,andadmittedlyrareintoday’sworldofautomatedmeasurementsystems,butthiscaseistrue.Beforeautomat-

ingtankgaugingatadistantlocation,thiscompanyactuallyhadtodealwithamoun-tainliononthetanksteps.

Usingtoautomatedtankgaugingsystems,whichmanyhavedone,eliminatespersonnelhazardssuchastankclimbing,exposuretoproduct,andinclem-entweather,butraisesotherissues—amongthem,thetypeofprotectiontoselectforsuchhazardousap-plications.

Intrinsically Safe Or Explosion Proof?


Sponsored by:






Thedangersinvolvedintheproductionandpro-cessingoffuels,suchasexplosiveatmospheres,mayrequiretheuseofintrinsicallysafe(IS)devicesundersomecircumstances,orexplosion-proofenclosuresinothers.Whichoptionisbestforyourapplication?Whenshoulditbewireless?Whatbenefitsdoesonetechnologyholdovertheother?Thedecisionisnotalwayssimpleoreasy.

What Type Of Hazard Is It?Decidingwhichtypeofprotectiontoapplyis

rarelycut-and-driedforavarietyofreasons,fromequipmentinvolvedandtypeofhazardtocompanypolicyorpreference.Intrinsicallysafeandexplosion-proofenclosures,devicesandpracticeshavemorerelevanceincertainindus-triesthaninothers.Here,examplesfocusontheoilandgas,refining,andchemicalindustries,butsimilarsafetyrisksexistelsewhere.Inwaterandwastewateroperations,forexample,digestersreleasehazardousmethanegas.Agricultureandminingindustriesfacepotentiallyexplosivedusts.Butinoilandgasproductionandrefiningorinchemicaloperations,hazardousenvironmentsarecommon,andagiven.Inothercircumstances,“hazardous”mayindicatepoisonous.

Choosingexplosion-prooforintrinsicallysafedevicesisreallymoresite-thanapplication-spe-cific.Inpractice,suchdevicesareunderconsid-erationinonlyasmallpercentageofcases(lessthan5%).Therefore,amongthefirststepsanyfacilitywouldtakeinitshazardanalysiswouldbetoascertainifintrinsicallysafeorexplosionproofpracticesanddevicesareindeedrequired.

Intheanalysis,safetycompliancepersonnelsurveyanapplicationwhileitisoperatingusingsniffersorothersensingdevicestodetectthepresenceofhazardousgasesanddeterminethedegreeofthehazard[byNECclassanddivision].Ifhazardousgasesarepresentnormally,aClass1,Div.1situationexists.Iftheyarepresentonlyoccasionallyorunderunusualcircumstances,theareaisdesignatedClass1,Div.2.WithClass1,Div.2situations,non-incendivedevicestypicallyaresufficient.Anoverwhelmingmajorityofappli-cationsfallintothiscategory.Itisfortheremain-ingcases—thoseClass1,Div.1situations—thatISorexplosion-proofdevices(EXD)andpracticesareintended.

Briefly,explosion-prooftechnologyplacesadevicewithinanenclosuresturdyenoughtowithstandanexplosionofaspecifiedlevel.Shouldafireorexplosionoccurintheequipment,theeventwillbecontainedwithintheenclosureandanygaseswillcoolbelowignitionlevelbeforetheycanescapetotheatmosphere.

Explosion-proofenclosuresareratedandtestedbyindependentlaboratories(suchasFac-toryMutual)forspecifiedpressuresandflamelengths.Typicalapplicationsincludelightfixtures,engineswitches,pumps,andotherequipmentsuchasmotorsthatmustbeplacedinhazardousareas.Explosion-prooftechnologyshouldbethesoleoptiononlywhenanIS-rateddeviceisun-available.Apumporagitatorwithalargemotor,forexample,issimplyofasizethatcan’tbemadetobeintrinsicallysafe.Explosionproofequipmentandpracticesthenwouldbemandatory.

Intrinsicallysafedevicesandassociatedwiringlimittheamountofpower(voltage,current,in-

ductance,capacitance)toandinadevice,sothatasparkcannotbegenerated.TheyarepoweredfrombeyondaZener-diodeorgalvanic-isolationbarrierinasafeareaawayfromthehazard,typicallyacontrolroom.Intrinsicallysafedevicescanbeopened,maintained,orotherwisehandledwhilepowered.Suchaninstrumentmightbeusedtomeasurethetemperatureinsideatankorapipeline,forexample,whereanenclosurewouldbeimpractical.ISoptionsareoftenlessexpensivethanexplosion-prooftechniques,buttendtobemorecomplicatedtoapply.

Ifariskassessmentrevealsanareaoraprocesstobeahazardousatmosphereinneedofoneoftheseprotectivetechnologies,man-agementmustthoroughlyfamiliarizeitselfwithallappropriatecodesandstandards(NEC,Atex,IEC)—atthecorporate,local,national,andinter-nationallevels—andfollowthemscrupulously,understandingthatstandardsaredynamicandthat,althoughprogressisbeingmadetowardglobalharmonization,variationsarestillsignifi-cant.Further,codesaresubjecttointerpreta-tion,andthelocalauthorityhavingjurisdictiontypicallyhasthefinalsayinwhatstandardsareapplicableandhow.

Acompanywithmultiplesitesshouldconsiderthatidenticalsituationsinplantsinseparategeographicallocationsmaybeinterpreteddif-ferently.Aswithanysafetytechnology,asafetyprofessionalwithexpertiseinthetechnologiesandallapplicablecodesandstandardsshouldbeconsultedbeforemovingaheadwithanyhazard-ous-areaproject.

Tank Farm ExampleWiththisbackgroundinmind,let’slookathow

thesetechnologiesplayoutinreal-liferefineryoperations.MarkMenezes,PEng.,ismeasure-mentbusinessmanager—CanadaforEmersonProcessManagement.Heoffersonereasonwhyrefineriesfacegreater-than-normalhazards:“Inthelast10yearsorso,manyrefinerieshaveupgradedtheirinstallationstooperateonheaviercrudeoils,suchasthosefoundintheCanadiantarsandsorinVenezuela.So,ifyouwanttooper-atearefineryusingsomeofthesefeedstocks,youneedtocrackthisheavyoilwithalotofsteamunderhighpressure.

“Alotofhydrogenisinusehere,usedtomaketheseheavyoilslighter.Hydrogenisoneofthemosthighlyflammablegasesthereare.Anyhydrogenleakathighpressureisverydangerous.Inaddition,sulfursarecommonlystrippedoutofthesesourheavyoils.Anyplantofthisnatureisgoingtopayalotofattentiontohazardousenvironments.”

Oneareaofspecialconcernisthetankfarm.Operationsneedstoknowhowmuchfuel,chemical,orotherliquidresidesineachtank.Thejob,explainsFrankVanBekkum,seniorproductmarketingmanager,HoneywellProcessSolutions,canbedonemanuallybysendingsomeonetothetank(asdescribedabove).Butthisapproachisdifficult,dangerous,andundesirable.Inaddition,hesays,“Tankfarmsareoftensituatedindeso-lateareas.Oil,gas,andchemicalproductsmaybehazardoustohealth;tankscanbedifficulttoreachthroughice,snow,or,inanotheractualcase,aneagle’snest.”


Sponsored by:






Modernrefineriesuseavarietyofequipmentformeasuringtanklevel.Options,saysVanBek-kum,includeradargaugesystemsthataretypi-callypoweredbythemainservice,equippedwithcommunications,andpackagedinanexplosion-proofbox.“Inaddition,”headds,“anintrinsicallysafetemperaturegaugingdeviceonthetankgoesintotheproduct.Sowhatwehaveisaseparatedevicesuppliedinanexplosion-proofboxwithaconnectionandtemperatureprobesthatgointothetankthatareintrinsicallysafe.Eveniftheprobe—whichisbasicallyastainlesssteelhose—shouldleakorfail,theinstallationisstillsafe.”

Theapproachisstraightforward,butthecomplexityofmanyoperationsmakesuchsafetysystemsdifficulttoapplycorrectly,warnsVanBekkum:“Intrinsicallysafedevicesaren’talwaysanoptioninatankfarm,becauseyouhavepumpsandcontrolvalvesthathavepowerandcommunicationrequirementsthatgobeyondthedefinitionofintrinsicallysafe.IfyouareusingISinstrumentationinthefield,itmustbekeptsepa-ratefromapowereddevicetoavoidanyconfu-sionastothetypeofdeviceitis.”

Intrinsically safe devices and practices are crticial at loading racks. Here, a load computer (bottom), and tang grounding equipment help achieve safe and efficient hydrocarbon loading. Grounding equipment for the road and rail tankers helps pre-vent accidents by slowly discharging static electric-ity without creating dangerous sparks. Once the discharge is complete, a permissive signal is trans-mitted to the system controlling the load process. Source: Honeywell Process Solutions.

Historical Views, Future DevelopmentsRegardlessofthetechnology,addsVanBek-

kum,mostproblemsresultfromhumanerror,andmostoccurnotwhennewequipmentisinstalled,butwhenmodificationsaremadewithoutad-equateplanningandcommunication.

“Forexample,anexistingtransmitterisre-placedwithanewtechnology,perhapsfromadifferentmanufacturer,andthemaintenancede-partmentisawareofthechangebuttheproduc-tiondepartmentisnot,”heexplains.“Caremustbetakentoensurespecificationsmatchandthatalltechniciansareinformedofanychanges.”

Oneconcernisthattheuseofbothtechnolo-giesinthesameareacouldleadtoconfusion,error,and,therefore,danger.Workersmustbetrainedspecificallyfortheareainwhichtheywillwork;indeedmanytodayarebeingcross-trainedtohandlebothtechnologiesasmorecompaniesfindthemselvesusingbothapproachesatthesamesite.MenezesandVanBekkumagreethat,inmostcases,theuseofonetechnologyortheotherisnotnecessarilyapplicationdriven.Rather,itisasite-by-sitedecision,influencedby,amongotherthings,habitandtraditionratherthantech-nologyandhazard.

IntheopinionofEmerson’sMenezes,explo-sion-proofpracticeshavehistoricallybeenmorecommoninNorthAmericavs.intrinsicallysafepracticesinEurope.“Intrinsicallysafeislikelytohaveaslightlylowerinstalledcost,butismorecomplextoimplement.YouhavetothinkaboutalotmorethingswithIS.Explosion-prooftech-


Sponsored by:






nologyisfairlysimpletoapply.Youbuyrobustdevicesthatwillcontainthepotentialexplosionandinstallthemusingrobustconduit.Suchprac-ticesensureifanexplosionoccurswithinadevice,itiscontained,andbythetimethegaseshaveescapedtheyhavecooledtothepointthattheyarenolongerdangerous.Productsusedinoilandgasoperationsandrefineriesarerobusttostartwithbecauseofthenatureoftheindustry.MostNorthAmericaoperationsaresousedtoinstall-ingrobustdevicesthattheyassumeallproductsareexplosionproof.”

Influence Of Bus Networks, WirelessBothMenezesandVanBekkumagreethatthe

worldismovingtowardintrinsicallysafeprac-ticesandawayfromexplosion-prooftechniques.IntrinsicallysafepracticesaregainingpopularityinNorthAmericafortworeasons:increasinguseofbustechnologiesandproliferationofwirelesssystems.NotesMenezes,“IfIhave,forexample,aFoundationfieldbusinstallation,Icanputonebarrierinthesafeareaandconnectfivetrans-mittersonthesamebus.Mycostisdividedby5.Manyuserswhohavehistoricallyusedexplo-sion-proofwiringpracticesturntointrinsicallysafewhentheyadoptFoundationfieldbus.Bustechnologiesarealsocatchingonwithmotors—notthepowertothemotor,butthesignal.Eightmotors,forinstance,connectedtogetheronanISlow-powerProfibusorDeviceNetbus,canbestartedatonce.”

Wirelessalsoispromotingtheadoptionofintrinsicallysafepractices.Manywirelessdevices

arebatteryoperatedand,inonesense,inherentlyintrinsicallysafe.Ifaplantneedstomonitorthetemperatureinareactor,itisrelativelyinexpen-sivetoinstallawirelesstemperaturetransmit-teronit.“Thepowerlevelisjustnotsufficienttogenerateahazard,”saysMenezes.“Ifthere’saproblem,forexample,withabatteryinsideatransmitter,thetechniciangoesintothefield,unscrewsthecap,removesthebattery,replacesitwithafreshone,andscrewsthecapbackonrightinthehazardousenvironment.Inmanyrespects,itisanISdesign.”

Menezesalsooffersamoredetailedexample:Thefailureofaprimaryseal.Apressuretrans-mittermaybecorrectlyinstalledusingeitherintrinsicallysafeorexplosion-proofpractices,heexplains,“butifahazardousfluidburststhroughtheprimaryseal(thetransmitterdiaphragmthatconnectsthedevicetotheprocess)andtheprocessfluidfindsitswayintothetransmitter,it’snotaleaptoseethattheprocessfluidmayburstthroughintoeverythingelseandfollowtheconduitintothecontrolroom.Youcouldconceiv-ablyhave2,000-psihydrocarbonsquirtingontothefloorofwhatissupposedtobeasafearea.Awirelessdevicewouldmeannoconnectionsfromthetransmitterinthehazardousareatothesafearea.”Headmitsthereareotherwaystosolvethisproblemusingdualsealingdevicesandcon-duitseals,buttheyaddcostandcomplexity.

“Withlegacysystems,theexplosionproofap-proachhasbeensimpler,morecomfortable,”saysMenezes.“Butonceyouhavemultipledevicesonabusorinstallationsusingwirelesstechnol-

ogy,intrinsicallysafebecomesmorecompelling,particularlywithinstrumentation.”

VanBekkumagrees,hisviewsonwirelessaresharedbycolleagueJeffBecker,HoneywellPro-cessSolutions’globalwirelessdirector.“Custom-ersareapplyingwirelesstechnologytomeasurepotentiallycriticalprocessvariablesinhazardouslocationsthatwerepreviouslyinaccessible,”saysBecker.“Applicationsarerelatedto,amongoth-ers,butanespherepressuremonitoring,inven-torymanagement,safetyreliefvalvemonitor-ing,safetyshowermonitoring,andrupturediscmonitoring—allcriticalpointsinarefineryorchemicalplant.”Wirelesshasempoweredandenabledtheseapplicationsandmetregulatoryneedsrelatedtoenvironment,explosiveclassifiedareas,safetyregulatory,andbottomlinecom-panyprofitabilityobjectives,headds.

“Althoughtherearestillsomeemotionalissuesassociatedwithwireless,theindustryismovingfasterandfastertowardwirelessandtherearealotofbenefits,”addsVanBekkum.“Whenmakingwirelessdecisions,it’scriticaltodevelopaninfra-structurefortheentireplantthatmeetscurrentandfutureneeds.Wirelessismorethanaone-to-onereplacementofcopperwire.Ifyoubuildagoodsystemaccordingtocurrentstandards,itwillbesafeandsecure.Nothingis100%foolproof,butyoumakethingsassafeaspossible.Youreducetherisktoanacceptablelevel.”


Sponsored by:




Process safety resources at your fingertips

Practice Safe SensingIntelligence at the Device

Sponsor Profile

Contributed by: Richard Frauton, Product Manager, United Electric Controls

Safetyimplementationtypicallyisdonebyagroupthatincludesplantinstrumentengineersandtechnicians,whoarechargedwithfindingsimpleandreliablesolutions.Often,thesesitu-ationsinvolvethequestionofwhentoshutaprocessdown.Suchdecisionsfrequentlyhingeonkeyprocessvariablessuchasflow,level,temper-atureandpressure.Thesemustbeinaspecifiedrangeatvariouslocationswithinchemicalplants,petrochemicalrefineries,powerplants,criticalprocessvesselsandevenateyewashstations.

Forsuchpointsafetyapplications,aproperlydesignedandimplementeddigitalswitchwithself-diagnosticscanbeanimportantpartofthe

answer.Asanelementofamultipletechnologysolution,adigitalswitch-basedapproachcanhelpeliminatecommon-modefailures,significantlyimproveresponsetime,achieveneededsafetyintegritylevels(SILs),andsimplifyplantsafetyinstrumentation.

Switch backgroundYearsago,manyswitcheswereblindmechanical

devicesactuatedelectromechanicallyorbypneu-matics.Theyofferednoindicationofreliability,suchassuccessorfailureinresponsetoacommand.Thislackoffeedbackwasparticularlyworrisomeinsafetyapplications.Theresultcouldbecatastrophic,shouldamalfunctionoccurinplaceoftheproperre-sponsetoatrippedpressureortemperaturealarm.

Partlybecauseofthispossibility,therehasbeenageneraltrendtowardothersolutions.Inparticular,onepopularimplementationhasbeentouseatransmittertogetherwithadedicatedcontrolsystem,onethatisseparateanddistinctfromthebasicprocesscontrolsystem.Abenefitofthisapproachisthattransmitterscancon-veyagreatdealofrelevantprocessinformation,whichcanbeusefulforsafety,controlandlateroptimization.Thistechnologyalsoensuresthatconnectionsareactiveandthetransmitterisworking,twocriticalrequirementsforanysafetyapplication.

Insuchsetups,transmittersprovideprocesscontinuousdata,andanalarmorprotection

systemactsuponthisinformation.Informalsurveyshaveshownthatsomewherebetween25and33percentoftransmitterstodayareinsuchloops.Thus,nearlyathirdofthetime,theresultisapointsafetysolutionofferingbinary,on-offactionatthecontrolroomthatiseffec-tivelyequivalenttowhathadbeenprovidedbyatraditionalswitch.

Whiletransmittershavebeenevolving,switch-eshavebeenundergoingtheirownrevolution.Switchesnowaredigital,withprogrammablesetpointsanddeadbands.Theyoffersuchcapabilitiesasself-diagnosticsolid-stateelectronics,plugportdetectionandnuisancetripfiltering.Theyalsohavefail-safe-openprogram-mingmodesthateliminatetheproblemofundetectedfailure.

Anexampleofhowthiscapabilitycanbeimplement-edisfoundinUnitedElectricControls’OneSeriesofdigitalpressureandtemperatureswitches.Whencondi-tionsarenormal,theswitchpulsesat20Hzbetweena1and0,sendingacontinu-ousheartbeatsignaleasilydetectedbyacontroller.Aprocessupsetwillbemarkedbyclosingtheswitchandtheoutputofacontinuous1.Iftheinstrumentdetectsa

fault,theswitchopensandtheoutputdropstoasteady0,thesameresultasisthecaseforawiringfault.Inthisarrangement,bothsuccessandfailureareclearlyindicated.

a. Whenprocessandinstrumentconditonsarenormal,apulsedoutputindicatesso.

b. Whenasetpointisreached,theswitchcloses.

c. Asconditonsreturntonormal,pulsedoutputresumes

d. Adetectedinstrumentfaultcausestheswitchtoopenandstayopen.

White Paper: Simplifying Plant Safety Instrumentation



Sponsored by:






Voting for an improved Safety Integrity LevelDigitalswitchtechnologyalsosatisfiesrequirementsneededto

achieveagivenSIL,whichisameasureoftherelativerisk-reductionprovidedbyasafetyfunction.AsdefinedbytheInternationalElec-trotechnicalCommission’sstandardIECEN61508,SILincludesbothahardwareandsystemcomponent.Onthehardwareside,integrityisdeterminedbyaprobabilisticanalysisofthedevice,withparticu-larSILsmeetingthetablebelowfordiscreteorlowdemandopera-tion.

Inthecaseofhighdemandorcontinuousoperation,thefol-lowingtableapplies.

DeterminingtheSILforasystemisamulti-steppro-cess.Itbeginswitharigorousriskanalysisofthesystem,followedbycalculationswiththeSIL,orpreferablyrawfailureprobabilitydata,forthedevicesdeterminedtobeinthecriticalpath.Fromthatanoverallreliabilityfigureisdetermined,whichthenyieldsthesystemSIL.

KnowingthisprovidesmethodsneededtoachieveagivenSIL.Forinstance,avotingschemeinvolvingthreeSIL2-compliantcomponentscanleadtoaSIL3-system,asdemonstratedbythefollow-ing:

Probs=Prob1xProb2xProb3

whereProbsistheprobabil-ityofsystemfailureinavotingschemebasedonindependentcomponentsandProbxistheprobabilityofcomponentxfail-ing

SinceratioofoneSILtoanotheris10:1,threecomponentvotingraisesthesystemSILfromoneleveltothenext.Italsoistheminimumnumberofcom-ponentsneededtobreakties.

Point safety applicationsSowhataresomeoftheapplicationsthatdemandagivenSILandapointsafetysolution?Exam-

plescanbefoundinprocessingplants,transportationandworkersafety.

Thefirstgroupinvolvesactiveprocessing,withinstancesfoundinchemicalandpetrochemicalplants,refineries,andoilandgasfacilities.Insuchsituations,thereisatleastone,andpossiblysev-eral,criticalprocessvessels,inwhichareactionoccursthatmustbemonitoredforlevel,flow,pres-sure,temperature,oracombinationofthese.

SIL Probabilityoffailureondemand Riskreductionfactor1 0.1-0.01 10-1002 0.01-0.001 100-10003 0.001-0.0001 1000-10,0004 0.0001-0.00001 10,000-100,000

SIL Probabilityoffailureondemand Riskreductionfactor1 0.00001-0.000001 100,000-1,000,0002 0.000001-0.0000001 1,000,000-10,000,0003 0.0000001-0.00000001 10,000,000-100,000,0004 0.00000001-0.000000001 100,000,000-1,000,000,000


Sponsored by:






Inpetrochemicalrefining,forexample,incomingcrudeoilundergoesdistillationwiththeoutputprocessedthroughanisomeriza-tionunittoalteritsstructurebeforeemergingasafuel.Isomerizationofteninvolvesheatingproductinthepresenceofacatalyst,suchasplatinumoranothermetal.Thecombinationofheatandachemicalreactioncanspiraloutofcontrol,ruiningproductandpossiblyleadingtoanexplosion.Thesameistrueforthesulfurremovinghydrotreaterunitsfoundinmultipleplaceswithinarefinery.Thus,thetempera-tureandpressuremustbemonitoredatmanylocations,and,ifneedbe,theprocessstopped.

Asecondsetofapplicationsinvolvestrans-portationorstorageofflammablematerials.Examplescanbefoundingrainelevatorsandpowerplantcoaldustconveyors.Inthefirstcase,grainmustbemovedintoandthenwithinastructure,whichisaccomplishedbyagrainelevator.However,anyfineairbornesus-pensionoforganicmaterialiscombustible.Forthatreason,stonesandmetallicfragmentsareremovedbeforegrainistransportedormilled.Still,theelevatoritselfcanbeasourceofheatorsparks.Thusthetemperaturewithinthemechanismhastobemonitoredandtransporthaltedifdangerousconditionsdevelop.

Thesamesituationprevailsinpowerplantsorotherfacilitieswithcoaldustconveyors.Ifaconveyorbearingorrollerbeginstooverheatandthesafethresholdexceeded,thismustbedetectedandtheconveyorshutdown.

Anexampleofafinalapplicationcategorycanbefoundineyewashorsafetystations.Theseareinstalledtoensureworkersafetyandmustfunctionflawlesslywhenneeded.Consequently,itiscriticalthatthewashsolutionbecoolenoughnottoscaldandwarmenoughnottofreeze.Thesestationsaresituatedinindustrialsettings,wheretemperatureextremesarepossible.Thus,amethodtomonitorthesituationandsignalacriticalalarmisimportant,intheeventthatthewashtemperatureistoohighorlow.

ConsiderationsAstheseexamplesshow,thereoftenisa

requirementtomonitorandreacttocriticalprocessvariables,suchastemperatureandpressure.Inimplementingasolution,engi-neersshouldkeepinmindthatmultipletech-nologiesarebetterthanone,speedcansave,andthatsafetysystemsmustbeindependentofthebasicprocesscontrolsystem.

Thefirstpointisimportantbecausemultipletechnologiesavoidcommon-modefailures.Takethecaseofatransmitter-controllerloopversusaswitch.Theformerwillsufferfromthepotentialofacommon-modefailureduetotherelianceonapossiblydistantcontrollerforaction.Becauseitisself-contained,theswitchcontinuestoworkregardlessofwhathappenstosomeothercomponent.

Aswitchisalsosignificantlyfaster.Forin-stance,theOneSerieshasaresponsetimeof

lessthan60mS,fivetimesbetterthanwhatcanbedonewithatransmitter.Anytimesav-ingscanbecrucialinpreventingormitigatinganunsafecondition.

Theself-containednatureofaswitchalsoensuresthatthesafetysystemcanbeinde-pendentofthecontrolsystem.Aswitchwilltakeitsownreadingsoftemperatureandpressure,forexample,andthenreactinre-sponsetoitsownprogramming.

However,itisimportantthatthisinde-pendencenotbetotal.Thatis,anysafetyinstrumentmustbeabletoreportonitsownconditionandinterfacewiththerestofaplantnetwork.InthecaseoftheOneSeries,thisisdonethroughself-diagnosticsthatallowextensivefaultdetection,includingpluggedportsandpowersupplyout-of-rangecondi-tions.Italsooffersmultipleoutputs,withbothaswitchfunctionanda4-20mAanalogout-put.Finally,itreportsfaultslocallyonitsowndisplayandremotelyviamultipleoutputs.

AfinalandimperativeconsiderationforanytechnologyinvolvesdeterminingtheSILratingforanentiresystem.Asdiscussedearlier,theuseofvotingcanallowSIL2componentstocreateaSIL3system.Insucharrangements,acriticalpieceofinformationisindependentverificationofsafetyratings.Partofsuchverificationwillincludefailuremodes,effectsanddiagnosticsanalysis.FEMDAdataispartoftheIECEN61508certificationandcanbeusedincalculatingoverallsystemSIL.

ConclusionAshasbeenshown,advancesintechnol-

ogyhavemadeswitchescapableofmonitor-ingtemperatureandpressurewhileconductingself-diagnostics,therebyremovingtheperilsofblindmechanicalaction.Thesedevelopmentsconstitutegoodnewsforengineerswhotodaywanttosimplifyinstrumentationinpointsafetyapplicationscommoninpetrochemicalplants,coaldusttransportation,criticallineorvesselprotection,oreyewashsafetystations.Suchswitchesofferimprovedsolutionsthroughavoid-anceofcommonmodefailures,fasterresponsetimes,independencefrombasicprocesscontrolsystems,andtheabilitytoachievedesiredSILviaavotingscheme.

For more information go to www.ueonline.com/plant_safety.html or email [email protected]


www.ueonline.com/plant_safety.html

mailto:[email protected]

sponsored by: eguide on safety instrumentation · sponsored by: eguide on safety instrumentation...

Documents