Hardware Configuration of Redundant Safety Integrated Systems _ Control Engineering
2
09/06/2013 Hardware configuration of redundant safety integrated systems Control system architects apply redundancy selectively to ensure reliability while minimizing false alarms. Here are some of the strategy options. Robert I. Williams, PE Major SIS (safety integrated system) suppliers provide redundant hardware configurations based on 1oo2 (1 out of 2), 2oo3, and 2oo4 configurations. Applications of these configurations are designed to provide a higher level of reliability while simultaneously reducing the probability of a false trip shutting down a process unnecessarily. This discussion reviews how these strategies developed along with a more detailed overview of two redundant architectures commonly applied in large-scale SIS SIL3 applications, namely 2oo3 and 2oo4 as applied by Triconex and Honeywell, respectively. These two major companies are only examples as similar hardware configurations are available from other SIS suppliers. This article is intended to stimulate discussion among users, SIS suppliers, and other SIS specialists to elaborate on the benefits, advantages, and disadvantages of implementing redundant hardware configurations according to relevant SIS industry standards from ISA and IEC. You can comment directly via the online version of this article, or by sending an email to the address listed at the end. Basic SIS architectures 1oo1—This simplex output circuit opens the switch to de-energize a device and shut down the process safely. A safe failure would be when the contacts open without an associated cause, which would be classified as a nuisance trip, although such events are not without their associated negative economic impact to the overall process facility. A dangerous failure would be if there was indeed a safety shutdown cause and the contacts failed to open. This could be caused by the contacts overheating and becoming welded closed over time. Such events are classified as a failure to operate on demand. 1oo2—This approach has two outputs (1oo1) in series for a normally closed and energized safety shutdown circuit. Only one SIS has to function to initiate a shutdown. Of course, having two 1oo1 circuits presents twice the potential for nuisance failures, which can be costly due to the loss of revenue for the overall process. However, it is a safer circuit since only one contact is required to operate to achieve a shutdown and the probability of a dangerous failure to operate on demand is much lower. Neither 1oo1 nor 1oo2 has any ability to reduce the potential for nuisance trips. 2oo2—These systems have the outputs wired in parallel, requiring both contacts to operate to initiate a process shutdown. Since the contacts are in parallel, nuisance trips by one contact are reduced but the obvious drawback that a dangerous failure scenario with a failure to operate on demand is doubled, making the system less safe. As shown, 1oo2 and 2oo2 systems are not effective for both safety and nuisance trips. However, with SIS diagnostics it is possible to achieve higher availability, referred to as 1oo2D (1oo2 with diagnostics). Advanced SIS architectures 2oo3 or triple modular redundancy (TMR) safety shutdown systems are commonly used for applications such as gas turbines, compressors, and heaters, and for individual process units within a refinery such as coker units. As the switching diagram indicates, the 2oo3 configuration requires two out of three channels to agree as to the output even though the third does not. If only one SIS trips its pair of contacts, one of the legs still remains closed so the process continues operating. Real-world systems use a voting scheme to maintain the output when 2oo3 are OK but the third signal is ignored, allowing for a fault tolerant configuration. Industrial implementations Industrial installations built by major vendors use more sophisticated versions of these basic concepts. The examples that follow describe how two major SIS suppliers provide diagnostics to achieve their 2oo3 and 2oo4 configurations. These companies and other suppliers that use similar approaches can provide the necessary data for MTBF (mean time between failures), failure probabilities, and failure to operate on demand, which serve as the basis for a complete SIS implementation evaluation. 2oo3 as triple modular redundancy Every Trident system contains three main processors (MPs), A, B, and C. Each MP controls a separate channel and operates in parallel with the other two. A dedicated I/O control processor on each MP manages the data exchanged between the MP and the I/O modules. A triple I/O bus, located on the base plate, extends from one column of I/O modules to the next using I/O bus cables. Hardware configuration of redundant safety integrated systems | Contr... http://www.controleng.com/single-article/hardware-configuration-of-r... 1 of 2 3/10/2015 5:38 PM
description
System voting for the safety instrumented system
Transcript of Hardware Configuration of Redundant Safety Integrated Systems _ Control Engineering
-
09/06/2013
Hardware configuration of redundant safety integrated systemsControl system architects apply redundancy selectively to ensure reliability while minimizing false alarms. Here are some ofthe strategy options.
Robert I. Williams, PE
Major SIS (safety integrated system) suppliers provide redundant hardware configurations based on 1oo2 (1 out of 2), 2oo3,and 2oo4 configurations. Applications of these configurations are designed to provide a higher level of reliability whilesimultaneously reducing the probability of a false trip shutting down a process unnecessarily. This discussion reviews howthese strategies developed along with a more detailed overview of two redundant architectures commonly applied inlarge-scale SIS SIL3 applications, namely 2oo3 and 2oo4 as applied by Triconex and Honeywell, respectively. These two majorcompanies are only examples as similar hardware configurations are available from other SIS suppliers.
This article is intended to stimulate discussion among users, SIS suppliers, and other SIS specialists to elaborate on thebenefits, advantages, and disadvantages of implementing redundant hardware configurations according to relevant SISindustry standards from ISA and IEC. You can comment directly via the online version of this article, or by sending an email tothe address listed at the end.
Basic SIS architectures
1oo1This simplex output circuit opens the switch to de-energize a device andshut down the process safely. A safe failure would be when the contacts openwithout an associated cause, which would be classified as a nuisance trip,although such events are not without their associated negative economic impactto the overall process facility. A dangerous failure would be if there was indeed asafety shutdown cause and the contacts failed to open. This could be caused bythe contacts overheating and becoming welded closed over time. Such eventsare classified as a failure to operate on demand.
1oo2This approach has two outputs (1oo1) in series for a normally closed andenergized safety shutdown circuit. Only one SIS has to function to initiate ashutdown. Of course, having two 1oo1 circuits presents twice the potential fornuisance failures, which can be costly due to the loss of revenue for the overallprocess. However, it is a safer circuit since only one contact is required tooperate to achieve a shutdown and the probability of a dangerous failure tooperate on demand is much lower. Neither 1oo1 nor 1oo2 has any ability toreduce the potential for nuisance trips.
2oo2These systems have the outputs wired in parallel, requiring both contacts to operate to initiate a process shutdown.Since the contacts are in parallel, nuisance trips by one contact are reduced but the obvious drawback that a dangerous failurescenario with a failure to operate on demand is doubled, making the system less safe.
As shown, 1oo2 and 2oo2 systems are not effective for both safety and nuisance trips. However, with SIS diagnostics it ispossible to achieve higher availability, referred to as 1oo2D (1oo2 with diagnostics).
Advanced SIS architectures
2oo3 or triple modular redundancy (TMR) safety shutdown systems are commonly used for applications such as gas turbines,compressors, and heaters, and for individual process units within a refinery such as coker units.
As the switching diagram indicates, the 2oo3 configuration requires two out of three channels to agree as to the output eventhough the third does not. If only one SIS trips its pair of contacts, one of the legs still remains closed so the process continuesoperating. Real-world systems use a voting scheme to maintain the output when 2oo3 are OK but the third signal is ignored,allowing for a fault tolerant configuration.
Industrial implementations
Industrial installations built by major vendors use more sophisticated versions of these basic concepts. The examples thatfollow describe how two major SIS suppliers provide diagnostics to achieve their 2oo3 and 2oo4 configurations. Thesecompanies and other suppliers that use similar approaches can provide the necessary data for MTBF (mean time betweenfailures), failure probabilities, and failure to operate on demand, which serve as the basis for a complete SIS implementationevaluation.
2oo3 as triple modular redundancy
Every Trident system contains three main processors (MPs), A, B, and C. Each MP controls a separate channel and operatesin parallel with the other two. A dedicated I/O control processor on each MP manages the data exchanged between the MPand the I/O modules. A triple I/O bus, located on the base plate, extends from one column of I/O modules to the next using I/Obus cables.
Hardware configuration of redundant safety integrated systems | Contr... http://www.controleng.com/single-article/hardware-configuration-of-r...
1 of 2 3/10/2015 5:38 PM
-
Post a comment
Log in or create an account to submit your comment for this article.
No comments
The I/O control processor polls the input modules and transmits the new input data to the MPs. The MPs then assemble theinput data into tables, which are stored in memory for use in the voting process. The input table in each MP is transferred to itsneighboring MP by the TriBus. After this transfer, voting takes place. The TriBus uses a programmable device with directmemory access to synchronize, transmit, and compare data among the three MPs.
If a disagreement occurs, the signal value found in two out of three tables prevails, and the MPs correct the third tableaccordingly. One-time differences which result from sample timing variations are distinguished from a pattern of differing data.The MPs maintain data about necessary corrections in local memory. Built-in fault analyzer routines flag any disparity and useit at the end of each scan to determine whether a fault exists on a particular module.
Three good, four better?
One question to consider is whether the double redundancy concept, 2oo4, is considered safer or less safe due to theadditional hardware and software involved.
Quadruple modular redundant (QMR) architecture is based on 2oo4D (D refers to inherent diagnostics) voting, dual-processortechnology in each QPP (quad processor pack, the processing module of the system). This means that it is characterized byan ultimate level of self-diagnostics and fault tolerance.
The QMR architecture is realized with a redundant controller. This redundant architecture contains two QPPs, which results inquadruple redundancy making it dual fault tolerant for safety.
The 2oo4D voting is realized by combining 1oo2 voting of both CPUs and memory in each QPP, and 1oo2D voting between thetwo QPPs. Voting takes place on two levels: on a module level and between the QPPs.
Process safety practitioners have debated the pros and cons of various redundant configurations for many years. Have youbeen part of these conversations? Send us your thoughts on maintaining the delicate balance of overall safety vs. avoidingnuisance trips. Comment online or send me an email.
Robert I. Williams, PE, is a systems consultant specializing in DCS, SIS, and SCADA. Reach him at [email protected]
Key concepts:
An effective safety system must shut down a process in an emergency, but it must also avoid causing false alarms.Safety system architects have created a variety of strategies, some simple and some complex, to accomplish these twokey tasks.
ONLINE
http://iom.invensys.com
www.honeywellprocess.com
See related stories below.
Related News: Understanding SIS industry standards - 14.05.2013 14:53 Combining functional safety and cyber security - 30.11.2012 16:14 When can the process control system, safety system share field devices? - 12.04.2012 16:20
Hardware configuration of redundant safety integrated systems | Contr... http://www.controleng.com/single-article/hardware-configuration-of-r...
2 of 2 3/10/2015 5:38 PM
