Converge on Safety

Standards groups are still wrestling with safety networks, says Bud Adler, director of business development for process safety solutions at AE Solutions (www.aseolns.com). Adler sits on the ISA SP84 Safety Committee and on the working group that is addressing the use of buses in safety-related applications.

"The present safety standards (ANSI/ISA 84 and IEC 61508/ IEC 61511) do not endorse the use of digital bus communication for safety-related applications," says Adler. "There are several bus protocols with specialized application capability that have T…"V approval for safety applications. But T…"V approval typically is predicated on following the requirements for installation, operation, testing, documentation of change, and maintenance as described in the vendor's safety manual. Some of these manuals are quite intensive." As Adler understands it, most of the applications have been in machinery control applications.

What this means is that machine builders are among the lucky ones who can find an approved safety bus protocol. "One of our concerns as a company was the approval of this type [AS-i] of system for use in the U.S. by NEC committees," says Bill Elrod, engineer at Hartness Intl., manufacturer of packaging machinery in Greenville, S.C. "Now, with the recent acceptance of this method in the latest release of NFPA 79, which will allow the use of Control Systems Incorporating Software and Firmware Based Controllers,' we OEMs have options in designing integral systems."

Dan Stirpe, electrical engineer at Dauphin Graphic Machines, Millersburg, Pa., is another machine builder who is giving it a go. "We are working on a safety network for our next-generation control system, which will be deployed in 2004," says Stirpe. "We manufacture web printing machinery, or newspaper presses. Our current hardwired safety circuits became very complicated due to clutching, selectability of print units and folders, and flexible configurations. We are implementing a system that uses Profisafe in conjunction with failsafe CPUs and I/O."

Why Profisafe? "Primarily because we use Siemens hardware, and they have a very good selection of failsafe I/O, as well as CPUs," explains Stirpe. "This also allowed us to use a single network for safety and most of our lower-level control functions. We are just hardwiring the E-stop and guard circuits into failsafe I/O on a local failsafe PLC, and communicating over Profisafe to a master configuration PLC (also failsafe) to handle all of the selection and steering. This eliminates literally hundreds of force-guided relays as well as numerous safety monitoring relays."

Stirpe's actions highlight some of the advantages of safety networks: lower cost, fewer hardwired components, and flexibility. Now, add the ability to set up safety zones around equipment so that one safety infraction doesn't shut the entire machine or process down, and you begin to see the value of installing a network instead of hard-wired controls.

So what's holding up the technology? Standards organizations, of course. Piggin, author of the ARC study, says the international standards all center on IEC 61508, Functional Safety Of Electrical/Electronic/Programmable Electronic Safety Related Systems. "IEC 61508 has been criticized for being too generic and therefore difficult to implement," says Piggin. "Technical committees within the IEC must then make use of 61508 in preparation of their own standards. Hence, the developments of IEC 62061 (for machine builders), IEC 61511 (for process control), and other sector standards."

Process control people don't seem to like the standard either. "IEC 61508 has been regarded by some in the process industry as too prescriptive and vague, where ISA's S84 is performance based and sector specific," Piggin adds.

Piggin says some safety network manufacturers may claim compatibility with EN954-1, but this may not be enough. "EN954-1 is a generic safety standard that describes categories, requirements, functional characteristics, principles for the design of safety related control systems, and associated risk assessment," he explains. Risk assessment in this standard is a function of the severity of injury, the frequency of exposure, and the possibility of avoiding the hazard, and has little to do with how to set up a safety network. "Detailed guidance on specific data communication issues is not given,"Piggin warns.

There's simply more chaos than there should be, vendors are in a position to manipulate the standardization process, and everything related to safety networks is moving at a glacial pace. As Adler points out, ISA is a year away from making a decision. So, as far as the standards business goes, it's business as usual.

The lack of standards have never stopped aggressive vendors from offering products, so there are several perfectly workable safety networks on the market, all of which conform to one safety standard or another.

Some vendors have safety networks, but nobody knows about them, including their own customers. "Our preferred safety system vendor ,“ Triconex ,“ doesn't support safety networks," says an instrument engineer at Marathon Ashland Petroleum in Detroit. "Introducing new technology in refining takes time. I think it will happen, but I don't know when."

Another system integrator writes, "I am currently working with a major refiner, upgrading their safety systems as capital allows. They are employing Triconex controllers, which are all hardwired. No bus or comm system is even being considered."

All this comes as a surprise to Invenys-Triconex, which has had a safety network for years. "Triconex Peer-to-Peer (P2P) has been certified by T…"V to meet IEC 61508 Safety Integrity Level (SIL) 3 standards," says Mark Hammer, director of industry marketing. "Triconex has offered this certified network since 1995."