PDS safety and SIS reliability in chemical processing equipment
In chemical and process plants, PDS safety normally means using PDS reliability methods and data to evaluate safety instrumented systems. It is not a separate legal requirement. Its value is practical: it helps engineers judge whether sensors, logic solvers and final elements can perform a defined safety instrumented function with enough reliability under stated assumptions.
PDS should not be used as a shortcut around hazard analysis, process safety management or the IEC 61511 safety lifecycle. It is most useful as a supporting method for SIL verification, proof-test planning, failure-data assumptions and maintenance decisions. For owners of reactors, pressure vessels, dosing skids, storage systems and utility packages, the useful question is not whether a document says “PDS compliant.” It is whether the credited safety function is clearly defined, independent where required, tested properly and maintained throughout operation.
What PDS safety means in a process plant
PDS is commonly associated with reliability data and calculation methods for safety instrumented systems. In industry references from DNV and SINTEF, the PDS method is used to support reliability prediction and safety integrity level calculations for safety equipment. The method has strong roots in petroleum applications, but the same engineering questions are relevant to chemical plants, specialty chemical units, pharmaceutical processes and other facilities where hazardous energy or hazardous materials must be controlled.
For a chemical equipment owner, PDS safety is therefore not a product label by itself. It is a disciplined way to ask practical engineering questions:
- What hazardous event is the safety function intended to prevent or mitigate?
- Which sensor detects the unsafe condition?
- Which logic solver decides that action is required?
- Which final element moves the process to a safer state?
- What dangerous failures could prevent the function from working?
- How often must the function be tested to maintain the claimed integrity?
This focus matters because many serious process incidents do not start with one dramatic failure. They develop when several barriers are weak, bypassed, poorly maintained or misunderstood. A safety instrumented function is only one barrier. PDS-style reliability work helps determine whether that barrier is credible enough for the role assigned to it.
For more articles on protective systems, interlocks and process safeguards, see the Safety Systems category.
Where PDS fits in the SIS lifecycle
The main international framework for safety instrumented systems in the process industries is IEC 61511. The 2016 edition of IEC 61511-1 describes requirements for specification, design, installation, operation and maintenance of SIS so that a process can be achieved or maintained in a safe state. PDS can support part of that lifecycle, but it does not replace the lifecycle.
Hazard identification and target SIL selection
Before reliability can be calculated, the safety function must be justified. A process hazard analysis, layer of protection analysis or similar risk study identifies scenarios such as overpressure, high temperature, runaway reaction, loss of cooling, flammable vapor release or toxic exposure. If existing safeguards do not reduce the risk enough, a safety instrumented function may be specified.
At this stage, PDS data is not the starting point. The starting point is the hazardous scenario and the required risk reduction. Engineers must define the safe state, process demand, trip set point, response time and independence from other protection layers. Only after those basics are clear does a reliability calculation become meaningful.
Reliability calculation and SIL verification
PDS is most useful during SIL verification. A typical safety instrumented function includes input devices, a logic solver and final elements. Each part can fail dangerously. The architecture may also include voting arrangements such as one-out-of-two or two-out-of-three sensors. The calculation must consider diagnostic coverage, proof-test interval, common-cause failure and repair assumptions.
The goal is not simply to produce a low probability of failure number. The goal is to test whether the proposed design can realistically meet the target safety integrity level under the plant’s expected operating and maintenance conditions. If the calculation depends on very frequent proof testing, optimistic failure rates or perfect maintenance execution, the design may be fragile even if the spreadsheet appears acceptable.
Operation, maintenance and change control
A verified SIS can lose integrity after startup. Bypassed trips, changed process conditions, undocumented set-point changes, fouled impulse lines, sticky valves and poor proof-test coverage can all erode protection. That is why OSHA process safety management, IEC 61511 and CCPS guidance all emphasize management systems, documentation, training, mechanical integrity and change control.
PDS safety should therefore be connected to maintenance practice. If proof testing is assumed every 12 months, the site needs a realistic procedure, trained personnel, test records and a system for overdue actions. If the calculation assumes that a valve stroke test detects dangerous failures, the test procedure must actually reveal the relevant failure modes. A test that only confirms a signal change on a screen may not prove that the final element can isolate, vent or shut down the process.
PDS, PSM, SIS and P&ID are related but different
Confusion around acronyms is common in process safety. The table below separates several terms that are often mixed together when teams discuss PDS safety.
| Term | Main meaning in process safety work | What it does not do by itself |
|---|---|---|
| PDS | A reliability method and data basis used to support SIS reliability prediction and SIL calculation. | It does not decide which hazards exist or whether a plant complies with all regulations. |
| PSM | Process safety management, including management systems for highly hazardous chemical processes. OSHA 29 CFR 1910.119 is the U.S. regulatory reference for covered processes. | It does not provide a single calculation method for every instrumented function. |
| SIS | Safety instrumented system made of sensors, logic solvers and final elements that implement safety instrumented functions. | It is not the same as the basic process control system, although both may interact with the same process. |
| P&ID | Piping and instrumentation diagram showing process equipment, lines, instruments, valves and control relationships. | It does not prove that a protective function has the required reliability. |
A strong safety review connects all four. The P&ID shows where the instruments and final elements are installed. The hazard study explains why the function is needed. The SIS specification defines what the function must do. PDS-style reliability work helps verify that the selected components and testing strategy can meet the required integrity.
Practical design checks for chemical equipment
PDS safety becomes more valuable when it is tied to real equipment decisions. The following checks are especially relevant for chemical processing equipment because materials, fouling, corrosion, temperature and pressure can strongly affect reliability.
Check that the sensor can detect the real hazard
A pressure transmitter may be suitable for overpressure protection only if it sees the pressure that matters. Long impulse lines, plugging, condensation, crystallization or isolation valve position can compromise detection. For level, temperature, gas detection and flow-based trips, the same principle applies: the sensor location and measuring principle must match the hazard scenario, not merely the drawing symbol.
Separate protection from routine control where required
A safety instrumented function should not be credited as an independent layer if it relies on the same failure path as the basic process control system. For example, if the same transmitter is used for normal control and the trip without appropriate independence, one instrument fault may defeat both control and protection. Independence is not only a hardware issue; it can also involve software, power, air supply, maintenance practices and human actions.
Pay attention to final elements
Final elements often dominate real-world SIS reliability. A shutdown valve, vent valve, isolation damper or motor starter must move when demanded. Chemical service can introduce sticking, polymer buildup, corrosion, erosion, seal swelling or solids accumulation. Reliability data is useful, but it must be paired with service-specific judgement and inspection evidence. See also: Storage Systems.
Verify proof-test quality, not just frequency
A proof-test interval in a calculation is valid only if the test can find the dangerous failures assumed by the model. Partial-stroke testing may provide useful information for some valve failures, but it may not prove full closure under process conditions. A complete proof test may require bypass planning, production coordination and a safe method to confirm final element action. The written procedure should state what is tested, what is not tested and how deficiencies are resolved.
Common mistakes when using PDS safety data
The most common misuse of PDS safety data is treating generic failure rates as if they automatically represent the installed equipment. Generic data can be a reasonable starting point, especially during design, but it should be reviewed against actual process service, manufacturer information, environmental conditions and site history.
A second mistake is using reliability calculation to justify weak independence. If the same utilities, cabinets, impulse lines, software changes or maintenance crew errors can defeat multiple protection layers, the calculated risk reduction may be overstated. Common-cause failure is difficult to model perfectly, so conservative engineering judgement is essential.
A third mistake is ignoring demand mode. Many process safety instrumented functions operate in low-demand mode, meaning they are expected to act only when a hazardous demand occurs. Others may have more frequent demands or continuous operation. The calculation approach and performance measures must match how the function is actually used.
A fourth mistake is allowing temporary bypasses to become normal operation. A trip bypass may be necessary during startup, maintenance or proof testing, but it should have authorization, compensating measures, time limits and records. If bypass management is weak, the reliability calculated on paper no longer describes the protection available in the plant.
Documents owners should request before relying on a PDS-based claim
Equipment purchasers and plant owners do not need to become reliability mathematicians to ask better questions. Before relying on a PDS-based or SIL-related claim, request documents that connect the calculation to the actual safety function.
- Safety requirements specification: Defines the function, safe state, trip point, response time, demand assumptions, proof-test interval and required SIL.
- SIL verification calculation: Shows architecture, failure rates, diagnostics, common-cause assumptions, test intervals and repair assumptions.
- Proof-test procedure: Explains how the site will reveal dangerous failures and what acceptance criteria apply.
- Cause-and-effect matrix: Shows how detected abnormal conditions lead to alarms, trips, valve actions, shutdowns or permissives.
- Bypass and override procedure: Controls when protection can be disabled and what compensating measures are required.
- Mechanical integrity records: Demonstrate inspection, testing, calibration, repair and replacement history.
- Management of change record: Confirms that process, equipment, software and procedure changes are reviewed before implementation.
These documents also help during audits, incident investigations and pre-startup safety reviews. OSHA guidance for process safety information and mechanical integrity emphasizes that safety devices and instrumentation associated with covered processes need to be documented, inspected, tested and maintained according to recognized and generally accepted good engineering practices.
How to interpret PDS safety for equipment procurement
When purchasing a reactor package, dosing module, filtration skid, thermal system or storage unit, avoid asking only whether the package “has PDS safety.” A better procurement question is: which safety instrumented functions are included, what hazards do they address, and what evidence supports their reliability?
For example, a solvent heating package may need high-temperature shutdown, low-flow protection, high-pressure isolation and ventilation interlocks. Each function has different sensors, trip logic, final elements and failure modes. One generic safety statement cannot cover all of them. The supplier may provide component certificates, but the owner still needs an integrated view of the process hazard and installed configuration.
Package equipment also creates interface risks. A skid may be designed correctly as a standalone unit, but its protection can be weakened when connected to plant utilities, upstream feed systems, downstream storage or distributed control systems. During commissioning, the site should verify signals, trip actions, reset behavior, alarm priorities, emergency shutdown interfaces and proof-test access.
Frequently asked questions
Is PDS safety the same as SIL?
No. SIL is a safety integrity level assigned to a safety instrumented function based on required risk reduction. PDS provides reliability data and methods that can help verify whether a design can meet a target SIL. A PDS-based calculation supports the SIL argument, but it is not the same as the hazard analysis, safety requirements specification or lifecycle management required by IEC 61511.
Can PDS data be used outside the petroleum industry?
Yes, with caution. PDS data has been widely associated with petroleum applications, but the reliability principles can support other process sectors. Chemical plants should still evaluate whether the component type, service conditions, operating environment and maintenance strategy are comparable to the assumptions behind the data.
Does a PDS calculation prove that equipment is safe?
No single calculation proves that equipment is safe. A PDS calculation addresses reliability of defined safety functions under stated assumptions. Overall equipment safety also depends on process design, relief systems, materials of construction, operating procedures, training, maintenance, emergency planning and management of change.
What is the most important PDS safety question for plant owners?
The most important question is whether the claimed safety function will work when demanded in the installed process. That requires a clear function definition, suitable components, independent architecture where required, realistic proof testing, controlled bypasses and maintenance records that match the assumptions used in the reliability calculation.
How often should proof testing be performed?
The interval depends on the target SIL, equipment architecture, failure-rate assumptions, diagnostics, operating conditions and risk tolerance defined in the safety requirements specification. A fixed interval should not be copied from another plant without verification. If proof tests are delayed or incomplete, the real risk reduction may be lower than the calculated value.
Conclusion
PDS safety is most useful when it is treated as a reliability discipline within a broader process safety system. It helps engineers challenge assumptions about sensors, logic solvers, final elements, proof testing and dangerous failures. Its weakness appears when teams use it as a label without connecting the calculation to real hazards, real equipment and real maintenance behavior. For chemical equipment owners, the practical path is straightforward: define the safety function, verify the design against recognized functional safety practice, test what can actually fail, control changes and keep records that show the protection remains available over the life of the plant.
