Chemical plants treat safety as a top priority and install a variety of safety equipment and systems. However, changes in technology as well as new standards suggest that plants take a fresh look at their safety systems. Many facilities may be missing an opportunity to improve safety via a fieldbus. The majority of fieldbus protocols now have an approved safety bus. In addition, many automation vendors today favor integrating the safety instrumented system (SIS) with the process control system.
Figuring out what makes sense for your plant requires an understanding of fieldbuses (see "Take Advantage of Fieldbus") and of the pros and cons of the various fieldbus safety approaches, including integration. Using fieldbuses for safety and integrating the safety system with process control systems are relatively new concepts in the chemical industry — so, many operating companies remain wary of both. Hopefully this article will shed some light on some of the tradeoffs to help you make an informed decision consistent with your-risk management practices.
Conventional fieldbus networks aren't suitable for safety-related controls. Additional error detection and avoidance mechanisms are required for the communications between devices to detect connection or device failures and to implement necessary emergency shutdown action to avoid danger.
The majority of fieldbus systems use a "black channel" approach to their safety communications bus. This basically means the physical layer is the same as their "regular" bus, but with extra checks and balances to meet additional protections and features required of a safety system. These enhancements make the bus a "safety bus" and, in many cases, allow sharing infrastructure between that safety bus and conventional control communications. Despite being able to do so, few if any users will mix their control and safety systems at the physical layer.
When fieldbus organizations say their fieldbus safety devices comply with their appropriate safety standard, it means the device is compliant and consistent with IEC 61508 and verified by TÜV or some other safety organization. Devices and hosts/logic solvers therefore require two sets of safety approvals now — one for the safety fieldbus or communications and a second for the associated safety integrity level (SIL) rating. After obtaining approval for the communications/fieldbus part of its device, a manufacturer must obtain SIL certification from an appropriate organization. Most safety fieldbus specifications are designed so devices can achieve a minimum SIL-2 rating, although many buses are certified to SIL 3.
Figure 1 shows how a combination of changes to both the function blocks (circles in the devices) and communications layer (rectangles) are needed to meet the requirements of IEC 61508 to obtain the SIL rating necessary for a safety bus implementation. The function block changes add the necessary safeguards to the traditional function blocks used for control while the communication layer changes perform additional checks on the messages themselves.
The two international standards applicable to the process industries are IEC 61508 and IEC 61511. The IEC 61508 standard is most relevant to safety device manufacturers as it defines the requirements and criteria upon which a device's reliability and, hence, SIL rating are based. IEC 61511 is the more important standard for end users as it defines how systems are to be designed, installed and operated. ANSI/ISA-84.00.01-2004 is the ANSI-approved and OSHA-referenced version of this document and the one to which systems in the United States must comply. The most recent release includes statements permitting use of fieldbus communications as part of safety systems and removes the requirement that SIS and process control systems must be separate. As a result of this change, ISA has issued a technical report, ISA–TR84.00.06 "Safety Fieldbus Design Considerations for Process Industry Sector Applications," that describes the requirements for using fieldbus in safety applications.