Fieldbus for Safety Instrumented Functions

By the time this column goes to press, Fieldbus Foundation will have held its demonstrations and press days for “Safety Instrumented Functions” implemented with fieldbus devices and logic solvers that get measurements using the “H1” (32.5 Kbaud twisted- pair) physical layer.

End users at Shell Global Solutions, BP (Gelsenkirchen),  Saudi Aramco and Chevron are each hosting parallel demonstrations that include logic solvers contributed by Invensys (Triconex), HIMA, Emerson, Honeywell and Yokogawa, and field devices from Emerson, Metso, Endress-Hauser, Magnetrol, Moore Industries, ABB, Smar, BIFFI, Yokogawa, Topworx and Westlock. SIS consultants TÜV and Risknowlogy are donating their time and expertise, and suppliers Pepperl + Fuchs, MTL, MooreHawke, Softing and Fieldbus Diagnostics are contributing physical layer hardware and other components. These represent an unparalleled interest in a new application of bus technology. Why so much enthusiasm?

Because fieldbus-capable SIS offers some key advantages.

Let’s begin with spare parts. As the owner of a fieldbus basic process control system (BPCS) and a conventional safety logic solver, my plant stocks spare parts for both fieldbus and HART-smart field devices.

Risk reviews may push BPCS devices into SIF services, so a small, but potentially vexing number of instruments originally specified as fieldbus have to be reincarnated as conventional or HART-smart devices. Besides having different electronics, devices chosen to change roles like this have to change junction boxes and conduit systems. But this is also a challenge for purely conventional plants. We try to segregate safety service devices in separate conduit systems and junction boxes, even if their BPCS counterparts are 4-20 mA.

This spare-parts motivation goes away if you decide “proven in use”—a standards-defined path to validating a class of devices for SIL-rated interlocks—is too demanding. If you insist on using only “SIL-x” certified devices in your safety instrumented functions, you’ll still have to stock two sets of spares, even if they are all fieldbus.

One of the biggest benefits is a simple one— dramatically fewer wires. Some end users determine that partial-stroke testing of final control elements is needed to meet a required SIL rating. If you choose to implement partial-stroke with discrete devices, typically additional limit switches, key switches, pushbuttons and bypasses will have to be individually hard-wired. On a large project, this can mean many kilos of copper, larger cable trays, junction boxes, more I/O cards and complex, error-fraught commissioning. Fieldbus capability can reduce that number to two pairs per valve and dramatically simplify commissioning.

Then there’s diagnostics. Engineering Consultant and FF-SIF leader at Saudi Aramco, Patrick Flanders, offers the following: “FF-SIF transcends the limitations of conventional safety system design by introducing new and innovative ways of thinking about safety. The greatest benefit is the integration of field device ‘self-diagnostics’ visible to the safety logic solver via FF-SIS. This capability will open up new options to improve safety and operability.”

While SIS consultants may bristle at the thought of incorporating device diagnostics overtly in shutdown logic, end users see opportunities for both improved safety and improved protection from spurious trips. A water-logged conductivity switch will not reveal itself until deliberately tested, but an integrated intelligent device and physical-layer diagnostics will alert the user more-or-less immediately. This is especially useful for transient fault conditions.

Look for FF-SIF products to appear in late 2008. With the number of power users, sizable budgets and the sheer numbers treading the path to achieving validated safety instrumented systems, there’s reason to be optimistic.