Why a Certified SIL 1 Rated RTU Was Not Enough
An Apparently Suitable RTU
An Oil and Gas project in the Middle East was developing new production wells in the Arabian Desert.
Each well required remote monitoring of field instrumentation together with local control of the Wellhead Control Panel (WHCP, including the hydraulic power unit) and wellhead tree. An RTU was required to provide the remote monitoring and command functions.
From a functional perspective, several commercially available RTUs could satisfy these operational requirements. However, the project also required implementation of safety logic achieving at least SIL 1, with a proof test every year.
One supplier presented a convenient offer for an RTU rated SIL 1, with two(2) different sets of failure rates data depending on whether the RTU is operated above or below 30.0 °C.
The proposed RTU was supplied as a sealed enclosure for outdoor installation, without an instrument shelter, with external cable connections only and no forced cooling system. Heat dissipation therefore depended entirely on natural convection through the enclosure surfaces.
The Decision Before Procurement
Before proceeding with preparation of the purchase order, the project manager requested an independent engineering review of the offered SIL 1 rated RTU.
Based on the environmental data available for the project location, the typical temperature ranges in the Arabian Desert were as follows:
Consequently, the RTU would be expected to operate above 30 °C during a significant portion of its service life.
The temperature condition was therefore directly relevant to the failure-rate data provided for the proposed RTU.
The Individual Rating Was Not the Complete Answer
Manufacturers commonly classify individual devices according to their SIL capability.
However, the SIL rating of an individual component does not establish the SIL performance of a complete Safety Instrumented Function (SIF). The complete SIF must be evaluated considering the integrated performance of all SIF components, the applicable proof-test interval, and architectural requirements.
No details were provided about the safety logic design to be implemented in the RTU.
The independent engineering review therefore proposed a preliminary verification of a simple SIF without redundant components.
The preliminary SIF consisted of:
- One pressure transmitter (initiator).
- The offered RTU SIL 1 (logic solver).
- The safety valve (final safety element: choke valve, surface or sub-surface safety valve).
- De-Energize to trip was selected as trip philosophy.
- Verification using the procedure for a low-demand safety system.
- Common Cause Failure (CCF) not considered in this preliminary verification.
If the offered RTU failed this preliminary verification, no further evaluation would be necessary.
Only if the simple SIF satisfied the required SIL 1 would additional engineering scenarios be evaluated.
Failure Data Used for the Verification
The preliminary SIF verification was based on the failure data provided for the offered SIL 1 rated RTU.
For the other SIF components, public data was used for the pressure transmitter.
Normally, the failure data for safety valves is confidential information, so representative failure-rate data for the safety valve was used for the preliminary calculation, based on data available from comparable projects.
For simplicity, no additional components or safety-design refinements were included in the preliminary verification, including:
- signal splitter,
- input/output barriers/isolators,
- SOV at the WHCP is not considered. Also named: Pilot valve, Dump valve or Directional control valve.
- type of RTU input and output cards,
- Only full proof test is considered (not partial proof test).
The Independent Review
The independent engineering review consisted of two activities:
- Failure-data consistency check:
The available failure data for each SIF component was reviewed for consistency with the preliminary SIL 1 verification, considering a one-year proof-test interval and the applicable environmental temperature range. - Preliminary SIL verification:
The simple SIF was evaluated as an integrated function, with a one-year proof-test interval.
From activity (A), the available component failure data, for each individual component, was found to be consistent with the preliminary SIL 1 rating, working in environment temperatures below and above 30.0 °C.
From activity (B), it was found:
- The simple SIF satisfied the required SIL 1 rating when environment temperatures were below 30.0 °C.
- But, the simple SIF did not satisfy the required SIL 1 rating when environment temperatures were above 30.0 °C.
Engineering Conclusion
The independent engineering review demonstrated that evaluating only the SIL capability of an individual component would have led to an incorrect engineering decision.
Although the proposed RTU satisfied its individual SIL 1 classification, the complete Safety Instrumented Function (SIF) failed to achieve the required SIL 1 rating under the environmental conditions expected during normal plant operation.
The review therefore identified a significant technical risk before equipment procurement.
This allowed the project team to reconsider the equipment selection and evaluate an alternative RTU supplier before committing to final design and implementation.
The independent review therefore provided additional technical confidence for an informed engineering decision.
Engineering Lesson
An individual component SIL rating does not establish the adequacy of the complete engineering function.
A technically acceptable component may still contribute to a complete function that does not satisfy the required performance under the conditions in which the plant is expected to operate.
Independent technical review can therefore provide value before procurement or implementation by evaluating the proposed solution as an integrated engineering function rather than relying only on individual equipment classifications.