With anti-surge measures added to the SIS system, can the SIL assessment of the SIS still be passed?
Thread Content
There is currently an alkylation unit and a compressor; can the anti-surge system and the SIS share the same station? Is this approach feasible for SIL assessment? Are there any documents I can refer to? Thank you. It’s just about whether we can save on the cost of a control station. ;P
A control station for the device’s SIS and unit anti-surge system
If anti-surge protection is not considered a safety instrument function, then it is necessary to consider the SIL level of other instrument safety functions; if all of them are SIL1, then they can be used together somewhat. According to GBT50770 8.2.1, SIL1 safety instrument functions should be separated from the process control system. If it’s SIL2 or higher, it’s hard to say. If anti-surge protection is also considered a safety instrument function, it should be regarded as a high-demand operation mode (with analog control)
The SIS system and the DCS system share a station, and this requires consideration from two aspects: first, whether the hardware and software capabilities are available, and second, whether the regulations permit it. At present, in terms of manufacturing standards alone, there is no problem. Secondly, according to GBT50770, if the safety function circuit SIF is of SIL1 level, it can be shared. Recommendations at SIL2 and above should be separated. If the DCS system is upgraded to meet the requirements of SIL2 or higher (in other words, if a SIS system controller is used to carry out DCS control), would that work? In principle, it is possible, but it is not recommended according to the guidelines; however, there are no regulations that prohibit its use. Generally, DCS meets the SIL1 level.
To add to what the two people above mentioned, the explanatory notes for GBT 50770 clearly state that basic process control systems should not implement safety instrumented functions of SIL1, SIL2, or SIL3.
Thank you. We have a separate DCS; what we need now is an SIS system for this unit, as well as an anti-surge system for it. Currently, it is planned that the SIS system and the anti-surge system will share one controller, while the cards and wiring will be located in separate cabinets for the SIS and the anti-surge system. I’m not sure if this is a valid way to conduct a SIL assessment.
Sure, that’s how we do it here. The unit control EDS and the control system are integrated together, both using Tricon; our SIS also uses Trion. When we add new compressor controls, we do so within the SIS. The acceptance tests can be passed, and anyway, the inspectors won’t know whether you’ve integrated them or not
Although the card components and wiring are separated, the logic controller is shared. If regulatory officials who are familiar with the standards and control principles become insistent, it becomes problematic to follow the standards.
Yes, being too picky really won’t work. Besides, your original controller must at least undergo SIL verification to determine what SIL level it is suitable for. Check the MTTF (in days) specified in its manual; it should be at least 50 days, which would allow it to reach SIL1 level. If the SIF circuits you are requesting to add currently do not exceed SIL1, the entire circuit still needs to be verified.
Agreed, SIL1 cannot be shared
First, to decide whether to install an SIS system, it is necessary to determine the SIL rating of the compressor; if a SIL rating exists, then considering the installation of an SIS system becomes necessary； Secondly, if there are SIL levels, let’s consider the compressor’s own independent ITCC. Generally speaking, the ITCC can be regarded as a safety control system; in that case, I believe the ITCC is capable of fulfilling the emergency shutdown function of a SIS, and it should meet the requirements