Oil and gas production handbook An introduction to oil ... - ABB Group

to-end safety integrity level. The SIS is typically divided into the following
subsystems:
• Emergency shutdown system (ESD) to handle emergency
conditions (high criticality shutdown levels)
• Process shutdown system (PSD) to handle non-normal but less
critical shutdown levels
• Fire and gas systems to detect fire, gas leakage and initiate
firefighting, shutdown and isolation of ignition sources
The purpose of an SIS is to reduce the risk that a process may become
hazardous to a tolerable level. The SIS does this by decreasing the
frequency of unwanted accidents:
• SIS senses hazardous conditions and takes action to move the
process to a safe state, preventing an accident from occurring.
• The amount of risk reduction that an SIS can provide is represented
by its SIL, which is a measure of the risk reduction factor provided
by a safety function. IEC 61508 defines four levels, SIL 1-4, and the
corresponding requirements for the risk reduction factor (RFF) and
probability of failure on demand (PFD):
SIL PFD RRF
1 0.1 – 0.01 10 – 100
2 0.01 – 0.001 100 – 1000
3 0.001 – 0.0001 1000 – 10.000
4 0.0001 – 0.00001 10.000 – 100.000
The SIL for a component is given by its PFD, safe failure fraction and design
to avoid influence of systematic errors.
8.1.2 Emergency shutdown and process shutdown
The emergency shutdown (ESD) and process shutdown (PSD) systems will
take action when the process goes into a malfunction or dangerous state.
For this purpose, the system maintains four sets of limits for a process value,
LowLow (LL), Low (L), High (H) and HighHigh (HH). L and H are process
warning limits which alert to process disturbances. LL and HH are alarm
conditions and detect that the process is operating out of range and there is
a chance of undesirable events and malfunction.
Separate transmitters are provided for safety systems. One example is the
LTLL (level transmitter LowLow) or LSLL (level switch LowLow) alarm for the
105