Garcia-Cammack-Sanchez

Permissive sequencing
and the ISA 84

Standards
Certification
Education & Training
Publishing
Conferences & Exhibits

Co-Presenter/Author
Gene Cammack, P.E
Currently holds the position of Automation Consultant, Oil & Gas Americas,
for Siemens Energy and Automation. Responsible for development of
Automation Strategy for Oil & Gas industry in the Americas, including
development of relevant applications, project pursuit, industry strategies
and tailoring new product enhancements for the industry.
Previously; Gene held the positions of Technical service Manager, Office
Manager and Regional manager for Moore Products Company, in
Beaumont and Houston, Texas
With more than thirty years experience in automation and control, Gene has
worked in Power Plants and Refineries in Port Arthur, Amarillo and Houston
BS Nuclear Engineering, Texas A&M University in 1977 Gene is a
Licensed Professional Engineer , a Sr. Member Instrument, Systems and
Automation Society (ISA) and a member of Texas A&M Instrumentation
Symposium Advisory Committee
Gene resides with his wife in the Houston area

Co-Author
Francisco Sanchez
Currently holds the position of Project Leader in Automation,
Instrumentation and Process Safety in PDVSA. Responsible for
conceptualizing, design, directing and supervising the implementation of
projects for final investors in the area of automation, instrumentation and
safety processes which contribute to improve and optimize production while
increasing safety in order to protect personnel, facilities and the community
of the Puerto La Cruz Refinery in Venezuela.
BS - Electrical Engineering, Central University of Venezuela UCV, 1997;
Francisco is a Functional Safety Engineer for Safety Instruments Systems
with ID: 564/07 FS Engineer by TUV Rheinland

Francisco has been working extensively in the oil and gas, refinery sector
for 14 years in Venezuela. As charter engineer, Francisco has join his
company safety team in charge of design and development of
instrumentation, automation and safety project for PDVSA Venezuela.
Francisco was born in Venezuela is married to Rosa and has three
children, Daniela, Santiago y Diego they currently reside in Puerto La Cruz
Venezuela.

Co-Presenter/Author
Luis M. Garcia

Currently holds the position of Business Consultant for Latin America for
Siemens Energy and Automation as a Certified Functional Safety Expert by
the CFSE Governing Board and as member of the Global Process Safety
Group.
Has been working extensively in the Oil and Gas, Chemical and Petrochemical
sector for 27 years helping to develop standards, procedures and projects all
around Latin America and Europe.
Charter Engineer, Luis has participated in the design and development of
instruments for Safety Related applications, such as Solenoid Valves since
1989.
Honors graduated from Liverpool University (1981) as a Metallurgist and
Material Scientist, and holds a Mechanical degree from Saint Joseph
Technical College from Rosario, Argentina, obtained in 1972.
Has several white papers, seminars and workshops presented at ISA Mexico,
Venezuela, Brazil and other international events in Argentina, Chile, Colombia,
Peru, Spain and Great Britain.
Born in Venezuela, is married to Kathryn and has three Children. They
currently reside in the Houston area.

Agenda

1. Introduction and Justification

1. Assumptions for suspension of SIS
2. Assumptions Challenge
2. Permissive sequencing Cause and Effect Diagrams
1. Requirements
2. Tools for Static Logic
3. Requirements for Dynamic Logic
3. Example of Dynamic Documentation
4. Conclusions and Recommendations

Introduction and Justification

This is what happens

I see you comply with Osha

1910.119. You had successfully
applied IEC 61511 Mod. Or ANSI/ISA
84.00.01 2004. Im very impressed!

Then we can start the

UNIT up, cant we?
ABSOLUTELLY!
ACME

OSHA

Then I will order to

bypass the SIS
immediately

Of course! Just
follow the
guidance provided
by the Operation

Manual!
but is this safe?

Introduction and Justification

All that meant Replace the SIS by the operator Criteria

Start Up Manager

ALARMS
ALARMS
PRODUCTION

IO
AT
R
E
OP

ALARMS
AC
KN
OL
ED
GE
AB
OR
T

NS

VARIABLES

Is this what we would REALLY recommend?

Industry Sector

Quicksand

Introduction and Justification

What about the numbers?

For the benefit of this argument, lets

consider the unproven fact that only 1% of
the total number of accidents occurred were
due to startup operations, transition
operations or controlled shut down
operations (a very conservative figure)

In other words. lets accept that only 1 out of 100 accidents

occurred during startup operations, transition operations or
controlled shut down .

Introduction and Justification

What about the numbers?

On average, it is safe to say that on average, a unit operates
uninterrupted or without a major overhaul for at least five years
That is; 5 x 8760 Hours = 43.800 Hours steady state
On the other hand a unit takes an average of two days to startup
That is; 2 x 24 Hours = 48 Hours unstable state
Then, 99 units had an accident rate of;
99 accidents / 43.800 hours = 0,00023 accidents per hour
While the accidents rate during startup was;
1 accident / 48 hours = 0,021 accidents per hour

A difference of two orders of Magnitude!

Introduction and Justification

What about the numbers?

While the accident rate in steady state operation has been
dramatically decreased, thanks to standards From 10-3 to 10-5
Accidents/Year

/IS
SI

AN
A
84

C
IE

11
5
1

Little has been done with accident rates while

in unstable state, whether startup, shutdown
or process transitions!

Introduction and Justification

What are the assumptions for suspension of an SIS during

Startups?
There are several justifications:
1. Processes transitions (i.e. start-ups), are not
frequent and are of short duration compared to
steady state operation.
2. There is a lack of similarity between different
processes. This makes prescriptive standards
impossible and best practices difficult.
3. There is a lack of similarity between the Process
Transition operation and Steady State operation.
SIS designers would have to create an entirely
new and conflicting SIS to manage process
transitions.

Introduction and Justification

What are the assumptions for suspension of an SIS during

Startups?
There are several justifications:
4. The process transition operation is more affected
by operational subjectivity and procedures than
steady state operation, i.e. How long an interlock
should be bypassed? Therefore automating
process transitions require strong operations
input in the development process.
5. Because the transition is sequential and dynamic,
timing of process steps and interlock changes are
critical. These are difficult to validate and verify
without both detailed operational knowledge and
adequate (proper) simulation routines.

Introduction and Justification

Assumptions Challenge
Lets analyze one at the time:
1. Processes transitions (i.e. start-ups), are not
frequent and are of short duration compared to
steady state operation.

st
o
m
e
th in operations
?
Transitions are the most volatile and unstabletphases
t
A
n
e
?
The BPCS generally is not capable torreact
fast enough
or to changing conditions
m
a
o
e
The operators are under lotsy
of pressure because
m of unstable variables
b
s
t
u
Usage (in this case) isi not a layerrof
protection
because of high demand rate
o
y
e
Human intervention
notg
be considered a LOP for high demand (see later)
Pla canan
d and auditable after the fact)
(It is not dependable
Note: Human Error (action or inaction) as defined by ANSI/ISA 84.00.01 (part 1) or IEC
61511-1 Mod. Definitions - 3.2.32 page 26 Note: ANSI/ISA 84.00.01 Part 2 or IEC
61511-2 Mod Offers guidance on how to include operators availability and reliability
calculations.

A Human IS NOT the same as a Safety PES. So,

Introduction
and
Justification
should we allow
humans
to substitute PES in SIF?
In High demand mode?
REMEMBER!
A PES
SIL 1 in high demand mode
Assumptions
Challenge
requires PFD = 10-5 to 10-6

e
h
t
r
o
2. There is a lack of similarity between different
f
sy
processes. This makes prescriptiveestandards
a
t
e
impossible and best practicesydifficult.
,
S
I
S

Introducing

e
?
r
h
t
o
t
r
a
o
r
f
e
t
l
p
u
o
c
i
f
if
d
Too
Lets analyze one at the time:

Sure! This characteristic makes it difficult for a SIS during Startup.

So because it is hard for the SIS, we leave it in the hands of an operator?
Thanks to modern software, there are programming strategies that take care
of this issue

Introduction and Justification

Assumptions Challenge
Lets analyze one at the time:

it
,
l
a S!
3. There is a lack of similarity between the Process
u
n
I
a
S
Transition operation and Steady State
operation.
SIS
M
n and
a
designers would have to createin
anaentirely
new
in
d
d
conflicting SIS to managete
process transitions.
e
n
m
e
m
m
a
r
u
As before, modern software
makes
g this a fallacy
c
o
o
r
dBPCS ecanpnot be tuned for changes and require continue
e
In any event,
the
bdemanding
battention from already busy operators
n
adjustments
y
l
a
e
c
t
i
t
i
Instead of
nwasting time writing procedures in a manual that may or may not
i
If be
f
e
followed,
same input could be used to write startup subroutines in the SIS.
d
n
caThat is; automate the process

Startup subroutines could be verified and validate like the rest of the Safety
Instrumented Functions (SIF) in a SIS as required by current standards

Introduction and Justification

Assumptions Challenge
Lets analyze one at the time:

e
g
d
4. The process transition operation is more affected
le
?
l
w
a
by operational subjectivity and procedures
than
o
u
n
n
k
a
r an interlock
steady state operation, i.e. How long
e
m
f
s
a
should be bypassed? Therefore
automating
n
p
a
r
u
t
process transitions require
y strong
te operations
l
i
r
n
w
o toprocess.
input in the development
n
a
r
c
o
s
r
e to have priority over Safety
r
o
Here again
we allow difficulty
t
u
a
s
r
s
e
e
Same
level
of
participation
is required from an experienced operator to write
p
r
p
O
up a startup
procedure as to write up a program subroutine.
r
e
d
u
An
proof of the above are BMS applications as per NFPA 85 and NFPA 86. In
such cases Startups are automatic for exactly the same reasons presented
here

Introduction and Justification

Assumptions Challenge

it
,
l
a
!
u
S
n
5. Because the transition is sequential and
dynamic,Itiming
a
M are acritical.
nS
of process steps and interlock changes
a
n
in verify
iwithout
These are difficult to validatedand
both
d
e
e
detailed operational knowledge
nt mand
m adequate (proper)
e
m
a
simulation routines.
r
u
g
c
o
o
r
d
p
Lu
This is exactly
Startups and process transitions
e thebpoint.
e
b
is And/or
should
be Verified
and Validated following IEC61511 Mod.
n
y
Pr
l
a
e
c
inc
ANSI/ISA
84.00.01

2004
in
the
same
way
any
as
any
SIF.
t
i
t
i
n
ipl
i
f
I
f
e
e
d
can
Lets analyze one at the time:

Introduction and Justification

Summarizing
ANSI/ISA-84.00.01-2004 Part 3 (IEC 61511-3 Mod) Page 60

Do we have a Psychologist
in the committee?
Do we use Psychologists
during start-up operations?

Permissive sequencing Cause and Effect Diagrams

How much really can we expect to avoid the human uncertainty?
Easy answer: DO NOT rely on human intervention if you can help it!

Ia

SI

C
3
L

ed
i
f
i
ert

If it can be documented in
a Manual, it can definitely
be programmed in an SIS!

Permissive sequencing Cause and Effect Diagrams

Requirements

?!?
In order to define automatic permissive
sequencing, there are two basic
requirements:
1. Deep knowledge of the process
2. A set of tools that would allow dynamic
programming and documenting of the
logic.
Because of these requirements, a constant
flow of communication between all
members of the team is needed, Process
Experts, Programmers and System
Engineers should communicate in a
common language.

Permissive sequencing Cause and Effect Diagrams

Requirements

?!?
There are several methods to assign SIF to
Safety Requirement Specifications (SRS)
1. Narrative
2. Ladder Logic
3. Function Blocks
4. Cause and Effect Diagrams, etc.
We will select Cause and Effect Diagrams,
because it was precisely created to simplify
communications amongst safety Team
Members:
Users, Engineers, Operators etc.

Permissive sequencing Cause and Effect Diagrams

A tool for Steady State Logic

Created in the environment
of the American Petroleum
Institute (API) to facilitate
the understanding of
interlocks logic

EFECT

Cause

Recommended Practices API

14C, for SIS in Offshore
applications
Widely utilize today for
safety analysis as an
evaluation diagram and
documentation tool
Originally a central panel
indicates with LEDs, which
causes and effect (which
interlocks) are active

Permissive sequencing Cause and Effect Diagrams

A tool for Steady State Logic

How does it work?

Ahhh!

A CAUSE is a process aberration (deviation)

An EFFECT is the process response

VALVE 5

1
N

2N
2N
2N

Master Trip

VALVE 4

1
2
3
4
5

A
B
C
D
E

VALVE 3

Condition
Condition
Condition
Condition
Condition

VALVE 2

Safety Analysis
Function Evaluation Chart
Plant ID
Sheet 1 of 20
Effect No

Cause No

Company ABC

VALVE 1

Intersections define Cause-Effect relationship

6
S
S
S
S
S

Permissive sequencing Cause and Effect Diagrams

A tool for Steady State Logic

How does it work?
In order to document appropriately, we need to expand little further:
There are intersections type N or Normal
There are intersection Type S or with Memory (Latched)

VALVE 4

VALVE 5

Master Trip

1
2
3
4
5

A
B
C
D
E

VALVE 3

Condition
Condition
Condition
Condition
Condition

VALVE 2

Safety Analysis
Function Evaluation Chart
Plant ID
Sheet 1 of 20
Effect No

Cause No

Company ABC

VALVE 1

Voting of causes (or/and) are indicated by Intersections type XN or

XS (Example below: 2oo3)

1
N

2N
2N
2N

Reset

Permissive sequencing Cause and Effect Diagrams

A tool for Steady State Logic

This Diagram or Matrix documents how each
SRS is satisfied by a SIF.

Master Trip

1
2
3
3
4
4
5
5

5
VVALVE
501 Open

Condition
A > 120 F
Temperature
Condition
Pressure >B200 Psi
Condition
C
Flow < 56 Gal/m
Condition
D
Flow < 56 Gal/m
Condition
E
Flow < 56 Gal/m

4
VVALVE
401 Open

3
V VALVE
301 Close

Safety Analysis
Function Evaluation Chart
Plant ID
Sheet 1 of 20
Effect No

2
VVALVE
201 Open

Company ABC

VVALVE
101 Open
1

If triggering points and final control elements

actions are indicated, there is no much more
needed in the form of documentation to
explain the logic of the SIF

Cause No

Easy!

1
N

2N
2N
2N
2N
2N
2N

Permissive sequencing Cause and Effect Diagrams

Requirements for Dynamic Logic

In order to make a Cause & Effect Diagram

dynamic, that is, a diagram that allows for
startup sequencing, we must have:
1. The possibility of forcing effects with
overrides, even in causes are triggered.
1. With time limits
2. With the appropriated intersections
2. Timers to govern the action and duration
of causes
3. Causes supervision of effects or
feedbacks

Permissive sequencing Cause and Effect Diagrams

Requirements for Dynamic Logic

Overrides to force effects
Overrides must act when switching from de-energized to energized
state, similarly to resets.
Overrides must have a time limit as a function of risk assessments studies.
Their action must be allowed to be delayed if necessary
They must have special intersections :
1.

Type Norma (V effect overridden even if cause is present)

2.

Type Latched (R latched effect can be overridden)

3.

Type XV or XR for voting as before

Override
Pushbutton

Permissive sequencing Cause and Effect Diagrams

Requirements for Dynamic Logic

Cause Timers
Causes must have timers to delay their action. There are three basic
ways in which such timers could function:
Active Cause
Normal Cause

Normal Cause

Normal Cause

Delay

Normal Cause

Normal Cause

Delay

Cause without delay

Pre-Trip Delay (PTD)

Delay

Post Trip Delay (PTD)

Normal Cause

Time Caused Delay (TCD)

Example of Dynamic Documentation

Lets consider the following example:

In this petrochemical process, an hydrocarbon needs to
be dried. For such purposes the fluid passes through a
reactor packed with absorbent granules.
An exothermic reaction takes place in the drier
allowing to use temperature to evaluate its performance
If the temperature goes below certain level, (110 oF), it is
an indication that the granules are saturated and lost
their capacity of drying the gas. But because of thermal
inertia, a 20 seconds delay must be allowed before the
temperature is recognized as being too low.
On the other hand, humidity is extremely harmful for the
process downstream, and the SIF that protects the
process has been ruled to be SIL 3 in a LOPA followed
by a GAP analysis.

Example of Dynamic Documentation

Lets consider the following example:

V 110

TT101
V 130

V 120

TT102
TT103
TT104

V 220

TT105
V 230
V 210

TT106

Example of Dynamic Documentation

Lets consider the following example:

Valve 210 - Close

Valve 220 - Open

Valve 230 - Close

Effect No

Valve 130 - Close

Sheet 1 of 20

Valve 120 - Open

Safety Analysis
Function Evaluation Chart
Plant ID

Cause No

Company ABC

Valve 110 - Close

If 4oo6 measurements are below 110 oF, the process is aborted and
the blocking valves would close while the bleeding ones would open

4S 4S 4S 4S 4S 4S

4S 4S 4S 4S 4S 4S

4S 4S 4S 4S 4S 4S

4S 4S 4S 4S 4S 4S

4S 4S 4S 4S 4S 4S

4S 4S 4S 4S 4S 4S

Temperature TT 101 < 110 F

Temperature TT 102 < 110 F
Temperature TT 103 < 110 F
Temperature TT 104 < 110 oF
o

Temperature TT 105 < 110 F

Temperature TT 106 < 110 oF

A traditional Steady State Cause & Effect diagram would be:

Example of Dynamic Documentation

Lets consider the following example:

Unit Startup Procedure as per operation Manual:
1. Bypass all temperature sensors
2. Manually, open Valves V110, V130, 230 and V220, and
keep Valves V210 and V120 closed.
3. From the BPCS, increase flow at a rate of 5 Gallons per
minute every two minutes until reaching a stable flow of
30 Gallons per minute.
4. Remove bypasses on sensors, one at a time, once each
have been at a stable temperature above 110 oF for at
leats 20 seconds. This should happens within the first
10 minutes of operation.
5. Ten seconds later, Open Valve V210 and Close Valve
V220.

Example of Dynamic Documentation

Lets consider the following example:

Manually:
1.

O
C

C
O

2.

C
O

3.

B
C
O

4.

OPERATOR

NOT STRESSED!

C
O

O
C

To Process

Accidents may occur. Too many manual operations

Example of Dynamic Documentation

Pb_START

Delay Output
10 seconds

Delay Output
10 seconds

PB_START
Valve 230 Close

Valve 220 Open

Valve 210 Close

Plant ID
Sheet 13 of 13

DELAY 10 S

Effect No
o

Temperature TT 101 > 110 F

o
Temperature TT 102 > 110 F
o
Temperature TT 103 > 110 F
o
Temperature TT 104 > 110 F
o
Temperature TT 105 > 110 F
Temperature TT 106 > 110 oF
Effect No 1

3
4R
4R
4R
4R
4R
4R
R

4
4R
4R
4R
4R
4R
4R
R

5
4N
4N
4N
4N
4N
4N
N

6
4N
4N
4N
4N
4N
4N
N

Timers
PTD 20 s
PTD 20 s
PTD 20 s
PTD 20 s
PTD 20 s
PTD 20 s

Max Override
10 Minutes

PB_START
Valve 130 Close

2
4R
4R
4R
4R
4R
4R
R

Function Evaluation Chart

MAX 10 M

Max Override
10 Minutes

PB_START
Valve 120 Open

Safety Analysis

Max Override
10 Minutes

PB_START
Valve 110 Close

1
2
3
4
5
6
7

1
4R
4R
4R
4R
4R
4R
R

Timers
Override Reset Tag

Company ABC

How does it work?

Cause No

nte
a
t
w
p
o
S
yrDtu
t
a
d
t
hSau
SSte

Max Override
10 Minutes

Lets consider the following example:

Dynamic Matrix would avoid this danger

Conclusions and Recommendations

1. Planning Startup Sequences is as complex and

complicated to do in an operation manual as it is
in a logic tool.

ed
b
n
a
c
If it

IS!
S
n
2. In fact, more prescriptive standards such as in a
ed
NFPA 85 and 86 already contemplate mandatory
m
amBMS in
:
automation of startuplesequencing
for
r
g
ip
ro
c
P
Boilers and Furnaces.
n
ri
be
P

n
ca of tools to automate
3. ModernLSIS
set
uis include
l
a
nu In such way, the processes
startup sequences.
a
M
a
are protected
at all times. Furthermore generate
n
i
d
enecessary
the
documentation to verify and
t
n
e
m validate the sequences as any steady state logic.
oc u
4. Performance based standards (like ANSI/ISA
84.00.01 or IEC 61511 Mod.) should consider
addressing the issue of permissive sequencing
for Startup, shutdowns and process transitions in
a more prescriptive way.

End of the presentation

Any Question?

Thank you for your

time