White Paper Deltav Sis Standalone en 57874
White Paper Deltav Sis Standalone en 57874
June 2020
www.emerson.com/deltavsis
White Paper
DeltaV SIS Standalone June 2020
Table of Contents
Introduction ............................................................................................................................................................................... 3
www.emerson.com/deltavsis 2
White Paper
DeltaV SIS Standalone June 2020
Introduction
This whitepaper provides an overview of Emerson’s modern process safety system when deployed as a standalone or
interfaced Safety Instrumented System (SIS). This whitepaper is not intended to provide training material on DeltaV SIS,
but rather provide an overview of how DeltaV SIS can be utilized as a standalone safety system with or without a 3rd party
Basic Process Control System (BPCS).
DeltaV SIS with Electronic Marshalling offers many compelling benefits including modular architecture, increased configuration
flexibility, higher availability, extended system life, cybersecurity features, native embedded HART for both Asset Management
and diagnostic handling for all signals throughout the system. As a modern safety solution, it expands the visibility throughout
the entire Safety Instrumented Function (SIF) by taking advantage of smart instruments and valves, DeltaV SIS continuously
monitors the ability of sensors, logic solvers, and final elements to perform on demand. DeltaV SIS assists in stream lining the
proof test procedures creating a more efficient process. During modernization projects, DeltaV SIS with Electronic Marshalling
allows the most efficient use of available space thanks to the elimination of entire marshalling cabinets.
Emerson’s vision for process safety is the same regardless of the Basic Process Control System (BPCS).
Interfaced:
The SIS is interfaced to the BPCS using standard protocols such as Modbus TCP, OPC Data Access
(OPC DA), or OPC Unified Architecture (OPC UA).
Integrated: The SIS shares the same engineering tools and operator environment with the BPCS.
DeltaV SIS can be deployed in any of the above architectures. This whitepaper will focus on the first two options and uses the
term standalone to generically refer to these two architectures.
Separate SIS
In this architecture, the SIS does not share data with the BPCS and it is either completely isolated from the BPCS or deployed
without a BPCS. It can have either a permanent engineering station or configured and maintained through the use of a laptop
computer. It can have a local Human-Machine Interface (HMI) or not.
as needed
BPCS SIS
www.emerson.com/deltavsis 3
White Paper
DeltaV SIS Standalone June 2020
Interfaced SIS
In the interfaced architecture, there’s some integration between the SIS and the BPCS, and the most common protocols used
are Modbus (RTU or TCP) and OPC (DA or UA). This communication in restricted to monitoring and in same cases operations.
2) Local Safety Network (LSN) to communicate safety data between multiple CSLSs
3) SZ Controller to isolate the safety system while maintaining connectivity to the third-party BPCS
5) Local Safety Network Bridge (LSNB) to transfer safety rated data between multiple LSNs
With a safe failure fraction (SFF) greater than 99.8%, the DeltaV SIS CSLS meets the SIL 3
requirements of IEC 61508 even when in a simplex mode. The redundant CSLS is for
increased availability and not required for safety.
SIF-based Approach
DeltaV SIS design was based on the IEC 61511 concept where a SIS is used to implement
one or more SIFs. Unlike other architectures, the DeltaV SIS modular logic solving architecture
means the logic solver is no longer a single point of failure of the entire process.
The DeltaV SIS SIF-based approach does not mean that all of the safety logic and I/O have to Figure 3 – CHARMs Smart
fit into one logic solver. All input data is made available to every logic solver on the LSN every Logic Solver
50ms the same as the local inputs on every CSLS.
www.emerson.com/deltavsis 4
White Paper
DeltaV SIS Standalone June 2020
With the DeltaV SIS logic solver, neither the scan rate nor the execution of a SIF is altered by changes or additions to another
SIF or an increase in I/O. DeltaV SIS logic solvers always execute deterministically.
Diagnostics
The DeltaV SIS logic solvers execute extensive automatic self-testing on a continuous basis to detect potential faults.
Faults detected by logic solver diagnostics can be associated with the logic solver itself or associated with field devices,
field wiring, or other conditions not related to hardware.
Integrated HART
HART diagnostics provide much more information on the health of a field device that can be determined from a
standard 4-20 mA signal. DeltaV SIS has not only the capability to pass on the field device diagnostics information to an
Asset Management System (AMS) or the BPCS via Modbus or OPC but to bring field diagnostics into the logic solver. For
example, DeltaV SIS can use the HART diagnostics to determine if a field device is unhealthy and remove the device from
voting if desired. It is up to the end user to determine if these status signals should be used for voting degradation or not.
The DeltaV SIS logic solver can also generate HART commands to initiate a partial stroke test in a digital valve controller.
The operators can initiate partial stroke tests manually from a third-party HMI by writing to the PST_START parameter via
Modbus or OPC. Partial stroke tests can also occur automatically based on a specified test interval. The results from these
tests are captured and integrated with the system event history. An alarm can be generated if a partial stroke test fails,
alerting maintenance that there is a potential problem with a valve. HART can also retrieve other useful information
from digital valve controllers such as the stroke time calculated at the device.
Engineering Station
www.emerson.com/deltavsis 5
White Paper
DeltaV SIS Standalone June 2020
Connection to an engineering station and/or HMI is through the SZ controller. The SZ Controller does not interfere on the
secure communication between logic solvers, if for some reason the SZ is disconnected, the safety-rated communication
between logic solvers is not affected. For larger systems, multiple Local Safety Networks (LSN) can be integrated using
the Local Safety Network Bridge (LSNB) where safety communication is required across LSN's.
A Local Safety Network Bridge (LSNB) can be installed on two or more LSNs to communicate safety rated data over the GSN.
For more information about the GSN and LSNB, see the DeltaV SIS with Local Safety Network Components
product data sheet.
Redundant
GSN Ethernet
Redundant
connectivity
LSN Ethernet
connectivity
Redundant
LSNB
SZ
Controller LSNB
CSLS
www.emerson.com/deltavsis 6
White Paper
DeltaV SIS Standalone June 2020
SZ Controller
The SZ controller is the proxy (or gateway) between the LSN and the BPCS, and it is certified per Achilles Level 2.
The SZ controller isolates the safety-critical components (logic solvers and field devices) from non safety-critical components
such as the engineering stations or BPCS nodes. The SZ controller carrier provides 4 Ethernet ports. The top two ports
connect to the configuration station and BPCS while the bottom two ports connect to the LSN. It does not execute safety logic,
its main function is to isolate the LSN from the BPCS and communicate configuration, parameter changes, and module
data to the CSLSs from the engineering station and BPCS. The SZ controller provides the interface to multiple CSLSs
on the same LSN. All CSLSs under one SZ controller share the same LSN.
Figure 7 – SZ controller
In Standalone applications, the top Ethernet ports provide native Modbus TCP protocol communication to interface to a
third party BPCS. In this case, the SZ controller is a Modbus slave device.
Engineering Station
DeltaV SIS is configured via an engineering station that comes with a complete set of tools including user management,
engineering, diagnostic, sequence of events (SOE) and process safety historian for up to 250 process variables.
A comprehensive Management of Change package can also be added. From IEC 61131-3 graphical control strategy
configuration to alarms and events collection, the enginering station has it all. For larger stanalone applications, the SOE,
Historian and Manage of Change database can reside on different workstations.
Control Studio Configuration software suite. Makes it easy to create safety logic and system graphics.
Control Studio on-line. Graphically monitor and troubleshoot running safety logic.
DeltaV Live. HTML5 based HMI to create high performance operator graphics, hierarchical navigation, trends and alarms
offered in standard operating layout.
Operate. HMI to create high performance operator graphics, trends and alarms offered in standard operating layout.
Event chronicle. Captures process, system and user alarms and events and stores them in a
Microsoft SQL Server database.
Continuous Historian. Captures up to 250 parameters with their status and stores them for future analysis. For larger
historian needs an separate application station can be added.
www.emerson.com/deltavsis 7
White Paper
DeltaV SIS Standalone June 2020
Historical View suite. Monitor your plants continuous and even data – historical and in real time.
This powerful Management Of Change tool has Check-in/Check-out, Electronic Signature, both Graphical and Text
configuration version comparison, and many other capabilities that helps keeping track on changes and help the compliance
with the standards. Refer to the DeltaV SIS Configuration Audit Trail product data sheet for more information.
Provides the engineering interface to device calibration and configuration software for HART field devices.
AMS SNAP-ON Product Options. Choose from a variety of AMS configuration options. Refer to www.assetweb.com for the
list of SNAP-ON product options.
For standalone applications not requiring a permanent engineering station, it is common that customers require laptops.
The preferred option is Dell Latitude 14' Rugged 5420 (consult the DeltaV Workstation Hardware PDS for details).
As alternative Emerson has approved the Panasonic Toughbook® CF-31 for configuration management, diagnostics
and retrieval of event records. The Panasonic CF-31 is a rugged full-size laptop with a 13.1” color touchscreen, QWERTY
keyboard and comes optionally equipped with Wi-Fi, cellular, and Bluetooth® radios, GPS, integrated webcam, fingerprint
scanner, and is available with a Class 1 Div 2 certification. Since the laptop is not intended to be connected all the time,
only one network adapter is needed for communication to the primary network (non-safety ACN). The minimum requirements
for the laptop are: Windows 7 64-bit, 4 GB RAM, and 452 GB hard drive.
A standard set of events are automatically generated without special configuration or programming required. For example,
I/O failures, trip limits, first outs, and other similar events are automatically time stamped and recorded in Event Chronicle.
When a process variable exceeds a trip limit, DeltaV SIS records the event along with the analog value and the trip condition.
Run time values can be transferred via either Modbus TCP or OPC interfaces in order to create alarms at the BPCS.
Events are time stamped with a resolution of 1 ms, and they are recorded in the Event Chronicle in the sequence that they
occur. In general, when there is a plant event that triggers an emergency shutdown from the SIS, one input will exceed a trip
limit on one scan and this will cause outputs to trip and more inputs will then change state. Sequence of Events Recording has
been used to find that first input that caused the trip by looking at all of the inputs in the plant. With the DeltaV SIS system,
the operator simply filters the Event Chronicle for first out trips, and the first-out is clearly visible.
Determining the sequence of events requires tight time synchronization among the DeltaV SIS nodes. The SZ controller
supports Network Time Protocol (NTP) which is a standard communication protocol that allows computers to synchronize
with a timeserver across a network. DeltaV SIS supports master and backup timeservers as a standard feature. By default,
the master timeserver is the engineering station. An external NTP server that receives its time directly from some standardize
reference time source (GPS for example) can also be used.
www.emerson.com/deltavsis 8
White Paper
DeltaV SIS Standalone June 2020
All DeltaV SIS devices are synchronized with the master timeserver, by default the engineering station.
The CSLS’s ability to capture events does not depend on the communication to the engineering station.
Engineering Station
SZ Controller
3 384 Non-Safety IO
Non-Safety Logic 3 1536 Safety IO
LSN
Safety Logic
Licensing Options
There are two main options for DeltaV SIS as standalone system. One option is using DeltaV base licenses and the other
options is using PK controller standalone licenses.
www.emerson.com/deltavsis 9
White Paper
DeltaV SIS Standalone June 2020
Base Licenses
Before you can download your safety logic configuration to the DeltaV SIS system, you must attach the system identifier to
the engineering workstation, load your licenses on the engineering workstation from a license disk, and assign licenses to the
workstations and SZ controllers. The system identifier, shipped in the License Pack, is a connector that plugs into a USB port
on the engineering workstation. A DeltaV SIS configuration license is required on each system.
PK Controller Licenses
The Emerson PK Controller provides a control and safety solution designed to operate in a standalone fashion.
The PK controller and associated logic solvers are configured using the PK Controller Engineering Software but it does
not require a connection to the PK Controller Engineering Software to run in a standalone fashion. The on-board SD-card
in the PK controller stores and backup all configuration and HMI files, enabling a laptop to retrieve those files. A standalone
PK Controller can be deployed with one operator station (Panel HMI or workstation PC) to serve local HMI needs.
The PK controller integrates with DeltaV SIS with Electronic Marshalling as described in figure 9.
Engineering Station
The PK controller can be used for applications in a wide variety of sizes, from 100 to 1500 DSTs. The PK size will define
the overall size of the PK standalone system. For example, a PK100 will limit the DST count for this PK Standalone
system to 100 DST, and this considers DSTs consumed by the PK itself and the DST associated with the SZ and LSN.
The PK controller support multiple communication protocols such as OPC UA server, EtherNet/IP, and Modbus TCP master
and slave. For more information about the PK controller consult the DeltaV PK controller PDS.
www.emerson.com/deltavsis 10
White Paper
DeltaV SIS Standalone June 2020
Support Services
All DeltaV SIS products are fully supported under the Emerson Guardian and Foundation Support programs. DeltaV SIS is
supported for both integrated and standalone architectures. Emerson can provide consulting services to help on the integration
of DeltaV SIS with a 3rd party BPCS.
Emerson provides limited support for the Panasonic laptop. Emerson will provide implementation guidelines, but the customer
is responsible for configuration and implementation of DeltaV SIS in the Panasonic laptop. We will provide a reasonable effort
to support DeltaV SIS running in this laptop; however, should we suspect that laptop implementation is causing an incident;
the customer will need to either purchase Emerson support services to help troubleshoot and resolve the incident,
or contact the appropriate Panasonic support provider.
Interfacing to a BPCS
DeltaV SIS with Electronic Marshalling can be interfaced with any BPCS in different ways using common standards
such as Modbus TCP or OPC. For systems with one SZ controller, the preferred method is the Modbus TCP interface on the
SZ controller. An alternative method for systems with one SZ controller is the use of PK controller. The PK controller enables
more connectivity options such as OPC UA server and EtherNet/IP. For systems with multiple SZ controller, it is preferable to
use the Ethernet I/O card (EIOC) or OPC interfaces on application stations. The following subsections explain the different
methods to interface DeltaV SIS.
Engineering Station
Native Redundant
Modbus TCP
Optional Firewall Any DCS Any HMI Any PLC Any F&G
www.emerson.com/deltavsis 11
White Paper
DeltaV SIS Standalone June 2020
Data from DeltaV SIS must be mapped to Modbus port registers. Only function block and module parameters can be mapped.
You can map parameters to Modbus port registers from the Register mapping and Map Register dialogs. However, because
of the possible large number of parameters to map, using Bulk Edit and Excel is easier for initial configuration. There is one
mapping table for each SZ controller.
Mapping of SIF_ALERTS parameters makes it very easy to send information to the BPCS about a particular SIF such as
active bypasses, active startup overrides, trip consensus, pre-trip consensus, forces, and output blocks in an off state. All this
information is available in a single parameter which makes connecting DeltaV SIS to a 3rd party BPCS easy. In a similar way,
the SIF_ERROR parameter allows the user to send error information such as bad status on input block, bad status on output
block or last partial stroke test failed.
HART diagnostics information can be transferred by creating a non-SIS module in the SZ Controller to read the HART device
information and then mapping the non-SIS module parameters to Modbus registers.
Direct writes into the CSLS are not allowed. Modbus registers are passed from the SZ Controller to the CSLS via a non-secure
parameter. The main usages for writes into a safety system from a third-party BPCS are for resets and input bypasses.
The following function codes are supported from the Modbus Interface on the SZ controller.
Interfaces on PK Controller
The PK controller supports both Modbus master and slave interfaces as well as EtherNet/IP.
The OPC UA server in the PK controller provides native server implementation of a Data Access profile compliant
with OPC UA version 1.02.
www.emerson.com/deltavsis 12
White Paper
DeltaV SIS Standalone June 2020
LSN
The redundant OPC server prevents a single point of failure in the communications with the third-party BPCS. When the active
OPC server fails, the standby OPC server automatically takes over, providing reliable data transfer without user intervention.
For more information about Application Stations, see the Application Station Software Suite and OPC Data Access Server
Redundancy product data sheets.
In the case of interfacing with another OPC server, OPC Mirror is an OPC Data Access compliant software application that
enables two or more OPC Data Access servers to communicate with each other. The OPC standard is based on client-server
architecture; OPC clients send and receive data from OPC servers. OPC clients send and receive data from OPC servers.
OPC Mirror enables OPC server to server communication, acting as bi-directional client to OPC servers. For increased
availability of your OPC data, OPC Mirror has an option for redundant operation. Two instances of OPC mirror work together
on two Application Stations in active and standby roles. Failure of the active OPC mirror or any connected OPC server
causes automatic failover to the standby OPC Mirror, ensuring seamless data transfer. For more information about
OPC Mirror, see the OPC Mirror and OPC Mirror Redundancy product data sheets.
www.emerson.com/deltavsis 13
White Paper
DeltaV SIS Standalone June 2020
CTO Cabinet
www.emerson.com/deltavsis 14
White Paper
DeltaV SIS Standalone June 2020
Network segmentation to isolate safety critical components from components not required for execution of the safety function
Multiple layers of protection against unauthorized access, including enforcing of physical presence to prevent remote attacks
Automatic removal of maintenance bypasses to prevent both inadvertent or intentional defeat of safety logic.
For more information about the DeltaV security features, consult the DeltaV SIS and Cybersecurity whitepaper.
Summary
In summary, when choosing DeltaV SIS as your Safety Instrumented System platform, you can take advantage of a
modern safety system with a modular architecture, increased configuration flexibility, higher availability, extended system life,
and optimal use of HART communication.
Emerson is committed to providing a safety instrumented solution which is easy to use and provides the same safety
performance and reliability that our customers have come to expect.