Issues regarding the determination of the security level for SIS system integrity
Thread Content
Recently, I encountered theoretical issues while working on a SIS system. The level of the field instruments is SIL2, and the integrity level of the system’s safety circuits is also SIL2. If a Hilscher SIL2 system is used, then dual controllers are required; why then can the manufacturers of wings meet the requirements with just a single SIL3 controller? I hope an expert can give a clear explanation.
In what situations is a two-out-of-three type of instrument needed?
I didn’t understand the question you asked. You mean that this SIF loop has a SIL of 2 after HAZOP.LOPA analysis? You have chosen safety instruments of SIL2 level as well as a control system of SIL2 level, but the safety failure score does not meet the SIL2 requirements. In such a case, would it be possible to use 1oo2 configuration for the field instruments? It’s much cheaper than replacing the control system, right?
It seems the original poster doesn’t understand the SIL verification for the circuit. The plan should not have been decided yet.
Based on what you said, the most likely scenario is that, after calculations, if the SIL controllers from Rockwell Automation are not configured with redundancy, the RRF of the entire safety circuit will be below 100； If we switch to another manufacturer (whether it’s the wings or the tail, haha), their controllers can achieve SIL3@HFT=0, resulting in a very small contribution to the safety loop PFDavg. Even with a single controller, the RRF of the entire loop is well above 100, so the requirements are certainly met.
The calculation of the SIL level for our unit is based on the minimum value of two scenarios: 1) the SIL level determined by the overall PFD of the control loop, and 2) the SIL level derived from the hardware composition of the loop and its hardware fault tolerance (HFT). Take the smaller of the two. If only one SIL3 controller is configured, the SIL level of the circuit may be determined as SIL2 based on HFT. The SIL level calculated based on the PFD may be ≥ SIL2, and it is ultimately determined that the requirements of SIL2 are met. Although it meets the computational requirements, controllers are generally equipped with redundancy. Welcome experts to offer guidance.