Safety Instrumented Systems Sis
Safety Instrumented Systems Sis
In high-risk industrial environments such as chemical processing, oil and gas refining, and wastewater treatment, the prevention of catastrophic failures is a primary engineering objective. Safety instrumented systems sis are specialized control systems designed to monitor the status of a process and, should a dangerous condition arise, automatically bring the process to a safe state. Unlike the Basic Process Control System (BPCS), which manages day-to-day operations, an SIS acts as a dedicated safeguard, operating only when the BPCS fails to maintain the process within safe boundaries.
Level measurement is a critical input for many safety loops. Whether preventing a tank overfill that could lead to an environmental disaster or ensuring a boiler does not run dry, the reliability of the level sensor is paramount. This guide explores the fundamental principles of level measurement within the context of safety instrumented systems sis, selection criteria for SIL-rated instruments, and best practices for installation and maintenance.
Measurement Principles in Safety Applications
Before selecting an instrument for a safety loop, it is essential to understand the physics behind the measurement. In an SIS environment, the choice of technology depends heavily on the media properties, tank geometry, and potential interference factors.
Radar Level Measurement
Radar level meters are frequently used in safety applications due to their non-contact nature and high accuracy. They operate on two primary principles:
1. Frequency Modulated Continuous Wave (FMCW): The sensor emits a continuous signal with a constantly changing frequency. The difference between the emitted and received frequency is proportional to the distance. This is highly accurate for long-range measurements up to 30 meters (approx. 100 feet) or more.
2. Guided Wave Radar (GWR): This uses Time Domain Reflectometry (TDR). A low-energy microwave pulse is sent down a probe (waveguide). When it hits the product surface, a portion of the energy is reflected back. GWR is excellent for low-dielectric liquids and applications with turbulence or foam.
Ultrasonic Level Measurement
Ultrasonic sensors use piezoelectric crystals to emit high-frequency sound pulses. The time taken for the pulse to travel to the surface and back (Time-of-Flight) determines the distance. These are cost-effective for water-based liquids but are limited by vacuum conditions, heavy foam, or high-pressure vapors which can attenuate the sound signal.
Hydrostatic Level Measurement
Hydrostatic transmitters measure the pressure exerted by a liquid column. The principle follows the formula $P = \rho gh$, where $P$ is pressure, $\rho$ is density, $g$ is gravity, and $h$ is the height of the liquid. In SIS applications, hydrostatic sensors are valued for their robustness, though they require compensation if the liquid density changes significantly with temperature.
Magnetic Level Gauges and Switches
Magnetic level gauges provide a visual indication and can be fitted with reed switches or transmitters for SIS integration. They rely on buoyancy and magnetic coupling. A float containing a magnet moves with the liquid level, actuating external flags or sensors. These are often used as secondary mechanical backups to electronic transmitters.
Components of a Safety Instrumented System (SIS)
A functional safety loop consists of three distinct elements, often referred to as the "Sense-Decide-Act" chain. For a safety instrumented systems sis to be effective, every component in this chain must meet specific reliability standards.
1. The Sensor: This is the field device, such as a Welk radar level meter or a pressure transmitter, that detects an out-of-limit condition (e.g., high-high level).
2. The Logic Solver: Typically a safety-rated PLC (Programmable Logic Controller), this component receives the signal from the sensor, compares it against a setpoint, and decides whether a safety action is required.
3. The Final Control Element: This is the hardware that performs the physical action to reach a safe state, such as an Emergency Shutdown Valve (ESV) that cuts off the feed to a tank or a pump that is automatically deactivated.
Understanding Safety Integrity Levels (SIL)
The performance of an SIS is categorized by its Safety Integrity Level (SIL), as defined by international standards IEC 61508 and IEC 61511. SIL is a measure of the risk reduction provided by a safety function. There are four levels, with SIL 4 representing the highest level of safety integrity.
| SIL Level | Probability of Failure on Demand (PFDavg) | Risk Reduction Factor (RRF) |
| :— | :— | :— |
| SIL 1 | $10^{-1}$ to $10^{-2}$ | 10 to 100 |
| SIL 2 | $10^{-2}$ to $10^{-3}$ | 100 to 1,000 |
| SIL 3 | $10^{-3}$ to $10^{-4}$ | 1,000 to 10,000 |
| SIL 4 | $10^{-4}$ to $10^{-5}$ | 10,000 to 100,000 |
Most industrial level measurement applications require SIL 2 or SIL 3. Achieving these levels involves not just using a high-quality instrument, but also considering the "Safe Failure Fraction" (SFF) and the hardware fault tolerance (HFT). For more detailed product specifications and SIL certifications, engineers should Review product options and application support on the Welk Main Page.
Selection Criteria for SIS Level Instruments
When designing a safety loop, the selection of the level transmitter must go beyond standard process requirements. The following table compares common technologies for use in safety instrumented systems sis:
| Technology | SIS Suitability | Primary Advantage | Main Limitation |
| :— | :— | :— | :— |
| Non-Contact Radar | High (SIL 2/3) | No moving parts; unaffected by density. | Sensitive to internal tank obstructions. |
| Guided Wave Radar | High (SIL 2/3) | Works well in foam and low dielectrics. | Probe can be subject to coating/buildup. |
| Hydrostatic | Medium/High | Extremely robust and simple. | Requires constant liquid density. |
| Ultrasonic | Medium (SIL 1/2)| Cost-effective for open sumps. | Ineffective in vacuum or high steam. |
| Vibrating Fork | High (Point Level) | Excellent for overfill prevention. | Only provides point detection, not continuous. |
Key Evaluation Factors:
* Diagnostics: Does the instrument have internal self-checking to detect a frozen signal or electronics failure?
* Redundancy: Is the system designed with a 1oo2 (one out of two) or 2oo3 (two out of three) voting architecture to increase reliability?
* Proof Test Interval: How often must the device be manually tested to ensure it will function on demand?
* Material Compatibility: Ensure the wetted parts (316L Stainless Steel, PTFE, etc.) are resistant to the process media to prevent premature failure.
Installation and Engineering Considerations
Even the most advanced SIL-rated level meter will fail if installed incorrectly. For safety instrumented systems sis, the installation must prioritize signal integrity and physical protection.
Separation from BPCS
One of the most critical rules in functional safety is the independence of the SIS from the BPCS. The safety level transmitter should be a separate physical device from the control level transmitter. This prevents a single point of failure (such as a blocked process tap) from disabling both the control and the safety functions.
Redundancy and Diversity
To achieve higher SIL ratings, engineers often use redundant sensors. However, if two identical sensors are used, they may both fail due to the same cause (e.g., both radar units failing because of heavy steam). Using "diverse" technologies—such as a guided wave radar paired with a hydrostatic pressure transmitter—mitigates the risk of Common Cause Failure (CCF).
Stilling Wells and Bypass Chambers
For turbulent liquids or tanks with heavy internal agitation, installing the level sensor inside a stilling well or an external bypass chamber is recommended. This provides a calm surface for radar or ultrasonic waves, reducing the "noise" in the safety signal and preventing false trips.
Environmental Protection
Level meters in an SIS often reside in harsh outdoor environments. Ensure that housing ratings (e.g., IP67 or NEMA 4X) are sufficient to prevent moisture ingress, which is a leading cause of electronics failure in safety loops.
Limitations and Common Risks
While safety instrumented systems sis significantly reduce industrial risk, they are not infallible. Engineers must be aware of several limitations:
* Proof Testing Constraints: A sensor might report a healthy 4-20mA signal but be physically stuck or coated in a way that prevents it from responding to a level change. Periodic manual proof testing is mandatory.
* System Complexity: Over-designing a safety system with too many interlocking parts can lead to "spurious trips" (nuisance shutdowns), which can be costly and may tempt operators to bypass the safety system entirely.
* Process Changes: If the chemical composition or temperature of the process changes, the original instrument selection may no longer be valid. For example, a change in fluid density will directly affect the accuracy of a hydrostatic level transmitter used in a safety loop.
Frequently Asked Questions (FAQs)
Q: Can any level meter be used in an SIS?
A: No. Only instruments that have been designed and certified according to IEC 61508, or those with sufficient "prior use" data proving their reliability in safety applications, should be used in an SIS.
Q: What is the difference between a safety trip and a control alarm?
A: A control alarm (BPCS) alerts an operator to take action. A safety trip (SIS) is an automated response that occurs independently of the operator to prevent an incident when the BPCS has failed.
Q: How does a 2oo3 voting system work for level measurement?
A: In a 2oo3 (two out of three) configuration, three separate level transmitters monitor the same point. The logic solver will only initiate a shutdown if at least two of the three sensors agree that a dangerous condition exists. This increases both safety and system availability by preventing a single faulty sensor from causing a false shutdown.
Q: Why is Guided Wave Radar (GWR) often preferred over Non-Contact Radar for SIS?
A: GWR is often preferred because the signal is concentrated along a probe, making it less susceptible to interference from tank walls, internal obstructions, or surface foam, which can sometimes "confuse" a non-contact radar signal.
Q: What is a Proof Test?
A: A proof test is a periodic manual check to find "unannounced" or "dangerous undetected" failures in a safety system. For a level meter, this usually involves physically raising the liquid level or using a simulator to ensure the sensor and logic solver respond correctly.
For engineers looking to implement or upgrade their safety instrumented systems sis, selecting the right hardware is the first step toward compliance and operational safety. By understanding the measurement principles and adhering to SIL guidelines, facilities can ensure long-term reliability and protection. For further technical data and instrument selection, visit the Welk Main Page.
