The difference between the two selections is based on who is to bear the responsibilities for the burden of proof. This is clear from Fig. IX/1.0.2-1.

From the preceding figure, it is clear that in case of prior use, referenced in IEC 61511, it is the user who is responsible.

Nearly 90% of the causes for failure are due to field devices. Naturally, checking the health of the I/O, field devices, and valves are obvious. The system should also incorporate capabilities, such as sensor validation and environmental condition monitoring for conditions that can cause sensor degradation, and monitoring of impulse line blockage. All these are possible with the help of a safe fieldbus system. Safe fieldbus technology is a unified infrastructure to manage data, communication, plant assets, and plant events while providing highly distributed control functionality and interoperability between devices and subsystems. For safety protocol transmission, it is important how it is sent and received in a corruption-free way rather than the medium itself. So what is more important is the safe field bus technology. System integrity ensures that the running safely, with maximized reliability and a proactive maintenance strategy. In an emergency hazardous situation, the system shuts down in a logical and controlled manner with avoidance of the creation of waste, loss to the facility, and damage to personnel and the environment. At the same time, it is important to avoid spurious/nuisance trips, which has negative effect on production. To manage the show, it is at times important to have global access to the process data. At the same time, well-secured data should be presented in a manner that is easy to understand and act upon. Open, scalable integration addresses the need to drive out custom integration costs and the requirement for best of breed applications to work seamlessly together in an open environment. As an open automation infrastructure, safe fieldbus technology addresses all of these requirements in several different ways [4].

Normally, manufacturers notify the certifying authority regarding the issuance of the certificates. The certifying authority checks that all the requirements of the standard are met (see Clause 1.4 of Chapter VIII), and issues the certificates. As per IEC 61511, users can develop other criteria for certifying SIS loop components including requirements for the selection of components and subsystems based on prior use (Clause 11.5.3 of the standard). The main issue here is the “appropriate evidence” for subsystems and components that these are suitable for safety instrumentation. The standard also specifies the required documentation pertinent to the following issues mainly (see Clause 1.4 of Chapter VIII):

Suitable safety manuals shall be there to help utilizing the facilities. When there is any non-certified equipment, then the PFD calculations are necessarily performed to show the contribution of such logic solver is within acceptable limit. Whereas for certified item pre-calculated and verified data are made available. For software applications, V model of the standard needs to be followed; for this Fig. VIII/2.0.3-2 may be referenced. In case of non-certified systems, necessary precautions shall be taken to ensure safe communication, which is well-documented and verified in case of certified systems. For SILs above SIL1, certified relays, safety solid state, and safety programmable logic controllers (PLCs) would be necessary. Really to achieve SIL3, redundancy in safety PLC is necessary. For existing systems, it is not possible to replace the entire systems with a new certified logic solver. In that case, a few issues need to be addressed:

Many industries used to maintain separation between the process controls and safety systems; however the latest edition of the standard does not specify the same in black and white. So, some integrations and interconnections between the systems are seen. For such integration/interconnections, special measures shall be implemented to avoid adverse effects between SIS and non-SIS systems, or between various SIS and applications. If suitable special measures are implemented, a limited degree of interconnection can be allowed.

From the discussions, it transpires that each element of safety loop contributes to PFD for the safety loop. Naturally, PFD from the valve or final elements needs to be considered for SIL. This is very easy simple statement. One needs to look into the issue slightly in depth. From use point of view there can be mainly three pattern of usage of final elements, such as:

In the first two cases, failure of the final element places demand on SIF so it is needless to tell this calls for SIL rating. In the third case, final element under BPCS provides additional hardware fault tolerance for higher SIL application. To the end-user, here mean time to fail (MTTF) data is important to determine SIL level. Thus it is clear why SIL is important for final elements, which in fact is not restricted to valve damper, but could be anything such as circuit breaker, etc. also. So, for each application, suitability of the same is important for consideration. Major issues related to selection of final element selection shall include but are not limited to the following:

Now with these basic ideas in mind, it is time to go for little details into each system components and subsystems. Starting with safe fieldbus system, discussions will be presented on field instruments, alarm systems, logic solvers, and final elements also in sequence.