SIS system design
Thread Content
We are currently facing a rather serious issue: the project design did not isolate the SIS from the DCS. As a result, the design firm made some changes. However, this isolated SIS simply includes emergency stop buttons that are used to control a few main isolation valves; there are no other input signals – no data related to pressure, temperature, or flow rate. It only has those emergency stop buttons. Can this meet the regulatory requirements?
It’s impossible to determine whether it complies or not based on what you’ve said. It is also common to create a separate manual emergency stop function within the SIS. You didn’t say what process you use. If the design institute can get approval, will they surely get approval from the safety supervision department? For newly approved projects, two sets of on-site isolation valves are also required as per regulations. One set of SIS, one set for normal control.
Which measurement points or interlock points need to be set in the SIS system is determined through analyses such as HAZOP/LOPA, or it is determined based on the requirements of the process package’s matrix diagram; it is necessary to review these documents to check whether the settings meet the requirements
During the preliminary design phase of the project, HAZOP & SIL loop assessments for the P&ID or process package will be carried out. This work will determine which circuits must be designed by the SIS system.
If it’s approved by the design institute, there should be no problems; the SIS will be responsible for emergency shutdown, which isn’t impossible either
It definitely does not meet the specifications. SIL2 certification requires that every point in the control circuit be certified to be at a level of SIL2 or higher. You only have an emergency stop button; there are no interlock signals related to temperature, pressure, etc. So how can interlocking be achieved? It makes no sense
The SIL loop doesn’t require SE\LS\FE to all be present, right? A brother up there said something that I agree with quite a bit: whether it is necessary to set an input signal should be determined by referring to the PID and the process package, as well as based on the results of the HAZOP analysis. Though, to be honest, this design is indeed quite rare in actual projects.
This post was last edited by Yunmu on 2019-3-26 at 12:34. As you described, it is an emergency shutdown system with incomplete functions; it does not meet the definition of a SIS system. According to IEC61511, a SIS is a system that carries out SIF functions, but your system lacks such SIF functions altogether, so it certainly cannot be considered a SIS system.