Emergency shutdown meets asset management

Q: I am working as an instrument engineer in the oil and gas industry. My questions involve emergency shutdown (ESD) systems and are below: 

1. Are HART protocols mandatory for emergency shutdown system I/O? If NOT, please clarify? As per manual it has been specified as "Instruments marked with "ia" may also be used in areas only requiring instruments marked with "ib" or "ic". If an instrument with "ia" marking has been used in an area with requirements in accordance with "ib" or "ic", can it no longer be operated in areas with requirements in accordance with "ia" afterwards"?
2. Most system vendors are not offering HART protocol configuration in IO cards, but do for field transmitters. Why does the system part not need to have HART configuration, but field instruments often require it? Please clarify what will be the impact on using of Ex ia device in Ex ib area for a period of time and afterwards again it is re-using in Ex ia area for few years? In order to carry out changes associated with certification, are there any alternate methods?
3. Are asset management systems often integrated with emergency shutdown (ESD) systems? And if HART protocol has not been used as part of the ESD system, then what is the use of having ESD integration with asset management? If I need to integrate my ESD system with asset management system, then do I have to have system side IOs with HART compatibility option? If I want to modify the existing ESD system that does not have HART compatibility, how can I achieve the integration of AMS with ESD? 
4. Also, do fire and gas (F&G) devices need integration with asset management systems to eliminate downtime risk? Because these devices have no HART compatibility and those IOs are interfaced with the F&G system and NOT with the asset management system, how is predictive maintenance/efficient proof test achieved?

Ulaganathan M
[email protected]

A1:

1. No, HART is not mandatory for ESD systems, but is preferred for the predictive maintenance features when paired with an asset management system. Most ESD final elements are discrete devices—that is open or close on a digital output signal. Where a regulating valve serves as the final element, it is preferred that they are HART-capable, as some additional capabilities are available such as partial stroke testing (PST), which helps prolong the time interval between full stroke tests. Some regulating final elements will also respond to a digital output command to completely shut as well.
2.  Most all distributed control systems (DCS) and safety instrumented system (SIS) suppliers aresupplying HART capabilities in the logic solver I/O, for both inputs and outputs. Most logic solvers are SIL2/SIL3 rated by TUV and I do not know of a supplier who does not supply HART in either the DCS or SIS. If you need SIL4, then yes, those logic solvers are not necessarily programmable and will not have HART capabilities. If HART was not specified with the SIS then the supplier probably quoted a less expensive non-HART alternative.
3. Most of the major system suppliers have device asset management systems that work with their own DCS and SIS platforms (e.g., Emerson’s AMS works with DeltaV SIS and Yokogawa’s PRM works with their ProSafe-RS.)  

The value of the asset management system for final elements is the ability to run the valve diagnostics, characteristic curves and PST. The valves also record other details that are reported to the asset management system such as open or close times, number of strokes, stiction issues and many other predictive diagnostics. Many of the asset management systems will work in tandem with both the DCS and SIS system. But you are right in that if you don’t have HART for either the DCS or SIS, an asset management system would provide nothing but an inventory of devices organized according to process unit and/or logic solver.

Bruce Jensen
BAJ Consulting
[email protected]

A2:

The field instrument is only one (the smallest) part of the ESD design. In other words, the hazardous area approval also depends on the complete wiring circuit and associated safe area equipment. These requirements are all spelled out in the certification documentation for the instrument. These installation requirements will be more stringent for ia.

As an example, you can have longer cabling to the field for ib instruments than for ia instruments. In many circumstances you can’t mix ia instruments with ib in the same field junction boxes and the same multi-pair cabling to the instrument room.

If you install the ia instrument in an ib installation the instrument there is no change to the instrument. It can be installed at some other time in an ia installation. 99% of the design work with intrinsic safety has to do with the wiring and cabling.

So, think of it as various cabling/wiring designs for ia, ib or ic. The ia instrument can be installed in any one of those circuits. The overall circuit approval rating will equal that of the lowest rated component.

Simon Lucchini
[email protected]

A3:

The application of intrinsic safety ia, ib and ic is as follows:

• ia is to be used in services where there always will be hazardous atmospheres present, both during normal operation and during upsets. It is equivalent to Zone 0 / Class I Division 1.
• ib is to be used in services where most of the time there will be hazardous atmospheres present, both during normal operation and during upsets. It is equivalent to Zone 1 / Class I, Division 1.
• ic is to be used in services where ocassionally there will be hazardous atmospheres present, both during normal operation and during upsets. It is equivalent to Zone 2 / Class I, Division 2.

For more information Ex ic, see https://www.mtl-inst.com/images/uploads/EATON_WP_Ex_ic_171016.pdf 

Equipment rated as ia can be used in ia, ib and ic zones. Any equipment rated as ia can be used in ia, ib or ic areas for any period of time and then moved back to an ia zone. During the design stage, area classification drawings will define the different zones to be used. During this stage all mitigation actions are performed to assure the use of correct equipment.

Alejandro (Alex) Varga Meder
[email protected]

A4:

I worked in the process control world for many years and have very serious beliefs about safety.

1. There are no simple and cheap solutions and the more you know about safety the more you will be concerned.
2. HART is a communication protocol, very popular and widely used. Use for safety is possible, not required. 
3. To properly design and maintain any safety system we must understand the process very well, we must consider all the aspects of any part of the control and safety system and finally, be certain that it is installed and maintained properly.
4. Aids to do all this are widely available. ISA and other organizations have published a number of very good references. Consultants are available. World standards were published years ago generated by very knowledgeable committees after study.
5. Your suppliers will be happy to aid you in your search for knowledge. Please do not underestimate the dangers both physical and economic in all of this. Never rely on some casual promise from a supplier or anyone. When I observe a casual response, I suggest they visualize themselves in a court room witness chair being asked, "And you allowed this when you knew the risk?”

cullen langford
[email protected]

A5:

Generally speaking, HART-enabled I/O cards used in ESD and safety system have pass through functionality. As you are aware, HART rides as a superimposed digital signal on a 4-20 analog signal. This digital transmission is passed through by HART-enabled I/O via communication link from ESD to the asset management system. Non-HART enabled IO (relating to ESD) can be wired directly to the asset management system. Thus, with a single asset management system you will be able to calibrate field devices and at the same time monitor diagnostic messages in real-time.

F&G systems are standalone systems. Their sensors cannot be integrated with an asset management sytem. Most ESD and safety devices (final control elements) are designed to fail in de-energized state. F&G systems require final control elements to fail in the energized state. You have to design separate proof-tests for F&G systems as distinct from ESD safety systems.

Raj Binneybin
[email protected]

A6:

If you purchase a new process measurement instrument or control valve positioner from any of the major instrumentation suppliers, it will transmit HART digital signals over the same 4-20 mA wire pair connecting to either a single loop controller, a DCS or a SIS. All suppliers of modern DCS and SIS sell new analog input (AI) and analog output (AO) interface circuit boards with the ability to receive HART digital data from the field instruments and positioners. Many systems installed more than 5-7 years ago and older did not have HART capability on the AI and AO circuit boards. Even today, some suppliers sell AI and AO circuit boards without HART capability just to reduce their selling price by a small amount.

The purpose of HART is to provide access to the condition data present in analog transmitters and control valve positioners. It is also true of HART analog instruments that they are built with wide-range capability so that they can be “re-ranged” after purchase to improve the precision of the measurement signal. Thus, one instrument can be scaled to send the 4-20mA signal over a range of perhaps 0-100 psi or say 40-240 psi. This reduces the inventory requirements for both manufacturers and in end-user spare-parts stockrooms. HART instruments can send digital data such as the local temperature of the field transmitter, and for control valve positioners, the accumulated valve stem mileage. This is the information accumulated/collected by asset management systems. If your DCS or SIS is too old to support HART interfaces via the AI and AO circuit boards, then an external HART multiplexer must be installed, or the DCS/SIS replaced with a more modern unit.

If your SIS system supplier did not supply the AI and AO circuit boards with HART capability, they did not supply a fully qualified system. One of the questions safety engineers need to ask prior to a shutdown: is the data being supplied reliable? With digital input (DI) data, we achieve reliability by redundancy; we install three DI switches for the same datum and logically select 2 out of 3. But this is too expensive for analog data so we depend upon the asset management system to use HART data to validate measurement datum to be within measuring range. Remember, a false shutdown (due to bad data) is costly. A shutdown that does not occur because of bad analog data can be a disaster.

If you have old field instrument without HART capability, then the asset management system cannot access the condition information. However, check that your instrumentation itself does not have HART. Practically all instruments from the major suppliers actually have HART installed since about 1995. Just because your SIS cannot read HART data, does not mean that the instruments do not have HART capability.

A HART multiplexer, or MUX, receives the 4-20mA signal, “strips” the HART data, and sends the 4-20mA signal to the AI/AO interface card filtering out the 1200 Hz signal for some older AI/AO interface cards that may become unstable with the HART signal.

Dick Caro
https://dickcaro.blogspot.com/
[email protected]