Honeywell Safety Manager SIL 3 Safety System (QMR 2oo4D)

Safety Manager SIL 3 safety system from Honeywell

The Honeywell Safety Manager is a safety instrumented system (SIS) logic solver that runs emergency shutdown, fire and gas and burner management functions up to SIL 3. It is a second-generation platform that uses the same Quadruple Modular Redundant (QMR) 2oo4D architecture as its FSC predecessor, and it forms part of the Experion Process Knowledge System. Seven Star LLC supplies Safety Manager hardware and spares in Oman and the GCC as an independent supplier in Muscat, and this page describes the system so that a spare or expansion request can be specified accurately.

Safety Manager is a system name, not one part number. A real installation is a set of modules in racks, with a quad processor module, I/O modules, communication modules and power and battery hardware, and the exact module list is fixed by the project. Because this is a safety system, any replacement part must match the installed hardware and software revision, which is why the checklist further down is longer than for general industrial controls.

Safety Manager technical overview

How Safety Manager 2oo4D QMR architecture works

In a quadruple modular redundant design, the safety function is processed on four redundant channels with diagnostic-based fault detection. The 2oo4D voting scheme means two of the four channels, with diagnostic coverage, must agree on a result for the safety action to proceed. If a channel fails its diagnostics it is taken out of the vote and the system keeps running, so a single fault does not cause a spurious trip and does not remove safety protection.

The result is a controller that is both safe and available. The manufacturer states that uninterrupted operation continues during any system degradation or online modification without leaving SIL 3, and that a failed module can be replaced while the plant is running: the replacement copies its data and program automatically from the running processor, with no manual loading. The optional A.R.T. (Advanced Redundancy Technique) adds extra benefit where timely maintenance is not available, such as remote sites.

Safety Manager Universal Safety I/O and distributed safeguarding

Traditional safety systems demand a separate card type for each signal, plus marshalling cabinets and home-run cables to the control room. With Universal Safety I/O, each of the 32 channels of a module can be configured individually as the I/O type you need, using soft marshalling in the engineering tool. The module can be mounted close to the process unit, which removes marshalling panels and reduces cable and field auxiliary room scope. The module can also execute the safety application locally, so protection continues if communication to the main Safety Manager is lost. Remote cabinets are rated for −40 to +70°C, which suits upstream oil and gas sites and hazardous locations.

HART devices on safety I/O are integrated with Honeywell’s Field Device Manager to provide asset data. To protect the safety loop, the system does not allow device parameter changes from the field device manager unless the device safety lock is disabled from Safety Builder.

Safety Manager integration with Experion and the process control system

Safety and control are deliberately separate in the Safety Manager design: separate databases, separate engineering tools (Safety Builder and Control Builder) and dedicated hardware and firmware, so a fault or an unauthorised change in one cannot affect the other. At the same time, Safety Manager connects to Experion through peer-to-peer communication with the control execution environment controllers, which allows transmitter data sharing, alarm suppression, automatic bypassing, interlocks and soft landing during a process upset. Operators see safety information at the same Experion station as control data, including sequence-of-events records.

Safety Manager is compatible with SIL-rated field devices. The manufacturer mentions SIL 1 to 3 safety transmitters such as the ST3000 and STT250 and safety valve positioners, which supports full safety-loop integration from field to logic solver.

Safety Manager selection and ordering checklist

• Safety function type: emergency shutdown, fire and gas, burner management, or a combination.
• Required SIL level for each safety instrumented function and the proof-test strategy.
• Installed hardware and software release, and the module identifiers shown on the existing racks.
• I/O count and types, central or remote Universal Safety I/O, and the environmental conditions of remote cabinets.
• Communication needs: Experion peer-to-peer, SafeNet, Modbus or other interfaces.
• Power supply, battery and diagnostic modules, and spare policy.
• Whether the request is for a new system, an expansion, or like-for-like spares from the FSC or Safety Manager generation.

Installation, commissioning and maintenance of Safety Manager

Safety systems demand disciplined handling. Install the racks and modules in accordance with the hardware reference supplied with the system, protect modules from electrostatic discharge, and keep the cabinet within the stated temperature and humidity limits. All field wiring is tested end to end before power-up. Commissioning follows the project’s safety requirement specification: load the application using Safety Builder, run the application verification, test each safety function, and record the results. The simulation mode lets an application be tested on a minimum-size system, and an offline UniSim environment is available for early design work.

Operation and maintenance rely on diagnostics. Faults are detected and isolated per channel and reported immediately, so repairs can be planned quickly. Because modules can be replaced online and the replacement self-learns from the running processor, spares are a core part of the maintenance plan. Keep spare modules of each type on site, record serial numbers and revisions, and run function tests at the intervals set in your safety manual. Use the audit trail in Safety Builder to record every application change, which supports IEC 61511 compliance.

Typical Safety Manager applications in Oman and the GCC

Safety Manager systems protect oil and gas upstream facilities, gas processing, refineries, LNG and petrochemical plants and power generation. Typical duties are emergency shutdown of wells, compressors and process units, fire and gas detection and mitigation, and burner management on furnaces and boilers. The ability to place remote Universal Safety I/O in hazardous or distributed locations suits sprawling sites and offshore or desert installations, while the high ambient limits of the remote cabinets are useful in Gulf summer conditions. Many plants in the region have older FSC-generation hardware, and the catalogue lists FSC-related items such as the quad processor module, Safety Manager module, enhanced communication modules and diagnostic and battery modules, so spare parts requests are common.

Safety Manager standards compliance summary

Information to send with your Safety Manager RFQ

• Part numbers, descriptions and revisions printed on the modules to be replaced or added.
• System software release and rack or cabinet type.
• Quantity of spares or additional I/O and the safety function served.
• Project name and delivery location in Oman or the GCC.
• Any documentation or traceability you need with the shipment.

Documents and quotation

A datasheet is attached on this page: the manufacturer’s Product Information Note for Safety Manager. For module-level hardware references, send us the module part number and we will confirm which further documents are available.

Seven Star LLC is an independent supplier in Muscat and quotes Safety Manager hardware and spares against the information above. Please send the part number or the module description for availability and lead time.