I discussed the use of RTDs and thermocouples for temperature measurement last week in a post, Temperature Measurement and Installation Practices. Emerson’s Len Laskowski, a certified functional safety expert (CFSE), was recently asked about the use of thermocouples in safety instrumented systems. Len has shared his thoughts in a number of process safety-related posts.
The question was raised because of the number of temperature sensors required and the difference in price between thermocouples and temperature transmitters from a capital purchase point of view. The temperature measurements were in a SIL 2 reactor train application.
In some applications, a risk reduction factor (RRF) greater than 100 (SIL 2 range) can be achieved assuming low demand for one-out-of-two (1oo2) voting architecture of duplex thermocouples wired directly to a safety logic solver. This could be done, if and only if, external comparison is done (preferably in the SIS) to validate the temperature signal. However, in an Intech article, Handle with care: Temperature sensors need know-how, author Bud Alder noted:
For a thermocouple, a short becomes a second measurement junction in parallel with the original thermocouple. This type of fault is termed a nondiagnosed dangerous failure. In safety-instrumented functions, a dangerous failure is a measurement error in excess of 2% and is undetectable by diagnostics. Thermocouple extension wire degrades over time, with an unpredictable contribution to measurement drift. Yearly drift of 10°F (5.5°C) or more is common.
Although use of thermocouples in safety instrumented systems are possible, Len raised several points why this approach should not be taken. For his initial point, he cited William Gobles and Harry Cheddie’s book, Safety Instrumented Systems Verification, and their “well-designed system” concept:
A simplistic definition of such a system would be one where all techniques and measurements presented in our functional safety standards to prevent systematic failures are followed.
SIL-rated temperature transmitters suitable for SIL 2 applications are available where a raw thermocouple is not SIL rated. Hence, there is a systematic capability of SIL 0 assigned to this design. Len notes that good engineering practices for a basic process control system (BPCS) temperature control loop would require a temperature transmitter on the loop if it were to be used for DCS control. A process safety system should also follow this same logic. Reasons for this include accuracy, signal robustness, diagnostics and reduction of induced noise on the signal.
The duplex thermocouple in a 1oo2 voting arrangement also has the issue of a spurious trip rate on the order of once every three years. Typical spurious trip rate targets are on the order of 50 years or greater. The high number of thermocouples required in the train of reactors makes the aggregate spurious trip rate worse. The cost of even one spurious trip can dwarf the difference in capital costs between thermocouple and temperature transmitter. The longer the extension wiring and the more terminals involved the greater the potential for inhomogeneous wires, terminals, terminal corrosion and stray pickup of electromagnetic field (EMF) interference that are difficult to detect (Instrument Engineers Handbook Vol 1, Liptak).
Also from a lifecycle standpoint, the useful life of thermocouples needs to be carefully examined and temperature elements need to be replaced routinely to insure calibration, based on the established useful life span. For validation or proof testing, testing these devices, pipe to pipe is recommended by the standards. While a portable temperature bath can be used for short sensors, it is not practical for thermocouple bundles. The verification process includes the remote duplex sensors, connected cabling, and the I/O subsystem channels.
Len noted the diagnostics available in temperature transmitters. These diagnostics can be used to degrade the voting schemes to increase overall reactor availability in logic solvers that can access the HART temperature transmitter values.
With these points, Len presents a strong case for the use of temperature transmitters in safety instrumented systems.