Siemens Process Automation End-user Summit- 2011

Transcription

1 Siemens Process Automation End-user Summit Experience. Technology. Community

2 SIMATIC PCS 7 Process Safety Jean-Luc Gummersbach I IA AS PA PRM1

3 Global market trend in Process Safety Process Safety Market is growing with an annual rate of 5.8% Market will exceed $2 billion in 2014 From 2013 onwards accretion rates of >7% are expected Biggest share of sales volume is in hardware, including bundled software Source : ARC - Process Safety System Worldwide Outlook 2009 through 2014

4 Global market trend in Process Safety Development of Market Shares ( ) Total Shipments of Process Safety Systems by World Region EMEA market share will decrease from 47.4 % to 43.7 % (775 -> 946 ) Asia market share will increase from 27.1 % to 32.2 % (443 -> 697 ) Latin America market share is stable at 8.7 % (142 -> 188 ) North America market share will decrease from 16.8 % to 15.4 % (275 -> 334 ) Source : ARC - Process Safety System Worldwide Outlook 2009 through 2014

5 Global market trend in Process Safety Trends in Process Safety Products Integration between BPCS & SIS Scalability Use of common components Better diagnostics Comprehensive lifecycle support SIMATIC PCS 7 ES & OS BPCS = Basic Process Control System SIS = Safety Instrumented System SIMATIC S7-400FH

6 Market Expectation / Customer Requirements Product related requirements continue integration of standard and safety system improve use and access control better system support for upgrades and application changes improve On-Line-Change Capability consider Cyber Security for SIS especially in the asian market : F-AO

7 Market Expectation / Customer Requirements Services Process Safety Consultancy: E.g. how to develop safety conform concepts in accordance to existing regulations and standards Functional Safety Workshops & Trainings Engineering Services by supplier or partner Implementation Guidelines Engineering and Planning Guidelines Functional Safety Management (FSM) following IEC61511 (Documentation, project management, validation, )

8 QMR and TMR technology in the market TMR ICS Triplex Trusted (Rockwell Automation) Single or Redundant Controller each with 3 CPUs SIL fault tolerant control system Fault behavior (e.g. CPU fault) Faulty CPU will stop others still run Complete controller has to be exchanged by a new one Faults which are on a common part causes a stop of the controller Same behavior as the Siemens System Siemens controller goes directly into the safe state Siemens controller does not run with internal faults

9 QMR and TMR technology in the market TMR Triconex Tricon (Invensys) 3 Controller each with 1 CPU Degradation Fault behavior Faulty controller goes to safe state Faulty controller has to be exchanged Degraded mode with time restriction No continuous operation in Dual Mode or Single Mode for SIL 3 No continous operation in Single Mode for SIL 2 3 Controller are required for SIL 3

10 QMR and TMR technology in the market QMR - HIMA HIQUAD Single or redundant controller each with 2 CPUs Fault behavior CPU Fault Faulty Controller goes to safe state Faulty Controller has to be exchanged Other Controller faults Faulty Controller goes to safe state Faulty Controller has to be exchanged Same behavior as the Siemens System

11 QMR and TMR technology in the market Strength Robust High Availabilty Concept Comprehensive IO module range Well established Safety Systems Large installed base Weakness Controllers have to be installed in one chassis System is not integrated into a DCS system no integrated solution Additional engineering tool is required Additional bus system for the safety communication is required Redundant or Hot Swap IO has to be placed besides the first I/O module in the same rack or chassis (Tricon) High Common-Cause failure

12 Flexible Modular Redundancy (FMR) DI Simplex Dual 1oo1 LS DI Triple 1oo2 Valves 2oo3 PT

13 Flexible Modular Redundancy DI Make any component redundant

14 Software Execution Time redundancy and software diversity instead of using two CPUs (hardware redundancy) Time redundancy and instruction diverse processing Logical program execution and data flow monitoring Bool and Word operations processed in different parts of the CPU 2 independent hardware timer Operands A, B (Bool) Operation = C Result Diversity Operands Encoding AND OR Comparison Stop At D /C Diversity /A, /B (Word) Operation = D = /C Diversity Result Time redundancy Time

15 Flexible Modular Redundancy DI Make any component redundant Physically separate redundant resources DI

16 Flexible Modular Redundancy DI Make any component redundant Physically separate redundant resources DI Mix and match redundancy

17 Flexible Modular Redundancy Dual DI Make any component redundant Physically separate redundant resources DI Mix and match redundancy Simplex Triple

18 Flexible Modular Redundancy DI Dual Make any component redundant DI Physically separate redundant resources Mix and match redundancy Tolerate multiple faults with no impact on safety Simplex Triple

19 Flexible Modular Redundancy (FMR) Safety Integrity Level up to SIL 3 with one controller Highest Safety Integrity Level Highest Flexibility Separate or combine safety and standard application in one CPU Use redundancy for safety only where it is needed Parallel use of PROFIsafe on PROFIBUS Highest Availability through Multiple Fault Tolerance Architecture allows system to tolerate multiple faults IO redundancy independent of CPU redundancy IO and device redundancy can be matched to maximize availability Cost reduction Use redundancy only where you need it for safety or availability

20 SIL Verification acc. IEC and IEC IEC61508 IEC serves as the basic standard and basis for safety standardization. It covers all areas where electrical, electronic or PLC systems are used to realize safety-related protection functions. IEC61511 There are sector-specific standards based on IEC 61508, such as IEC for the process industry or IEC for the nuclear industry These sector standards are important for planners and operators of corresponding plants.

21 SIL Verification acc. IEC and IEC Determination of the maximum SIL for E/E/PE safety related subsystem Example in IEC (Clause ) Both element 1 and element 3 restrict the maximum SIL that can be claimed to just SIL 1 E/E/PE = electrical and/or electronic and/or programmable electronic

22 SIL Verification acc. IEC and IEC Verification of the Safety Integrity Level (SIL) of the hardware for the safety instrumented system (SIS) Structural suitability demands on hardware fault tolerance (HFT) Safety related probability of failure on demand (PFD)

23 SIL Verification acc. IEC and IEC Sensor Power Communication CPU Communication Relay MCC Architecture and Hardware Fault Tolerance Sensor Part Transmitter HFT = 0, Proven in use => SIL 2 Power Supply HFT = 0 => SIL 1 Sensor Part SIL 1 SPAES Hardware 2011 failure Goa, tolerance India / requirements Siemens according AG to All IEC Rights Reserved. clause 11.4

24 SIL Verification acc. IEC and IEC Sensor Power Communication CPU Communication Relay MCC Architecture and Hardware Fault Tolerance Logic System (Controller and IO) IO SIL 3 certified according to IEC => SIL 3 Controller SIL 3 certified according to IEC => SIL 3 Communication SIL 3 certified according to IEC => SIL 3 Logic System SIL 3

25 SIL Verification acc. IEC and IEC Sensor Power Communication CPU Communication Relay MCC Architecture and Hardware Fault Tolerance Final element Relay HFT = 0, Proven in use => SIL 2 MCC HFT = 0, Proven in use => SIL 2 Final element SIL 2 Hardware failure tolerance requirements according to IEC clause 11.4

26 SIL Verification acc. IEC and IEC Sensor Power Communication CPU Communication Relay MCC Architecture and Hardware Fault Tolerance Total system Sensor part = SIL 1 Logic system = SIL 3 Final element = SIL 2 Total system = SIL 1

27 SIL Verification acc. IEC and IEC Sensor Power Communication CPU Communication Relay MCC Probability of Failure on Demand PFD Total PFD S = 5.68E-4 PFD = 4.10E-4 L PFD FE = 1.77E-3 PFD Total = 5.68E E E-3 PFD Total = 2.75E-3 Total system = SIL 2

28 SIL Verification acc. IEC and IEC Sensor Power Communication CPU Communication Relay MCC Architecture and Hardware Fault Tolerance Result SIL 1 Probability of Failure on Demand Result SIL 2 Overall Result SIL 1 Architecture must be changed to claim higher SIL

29 SIL Verification acc. IEC and IEC oo2 Sensor Sensor Power Power Logic system and IO Relay MCC Architecture and Hardware Fault Tolerance Result SIL 2 Probability of Failure on Demand Result SIL 2 Result All Over SIL 2 Hardware failure tolerance requirements according to IEC clause 11.4

30 We wish you a successful meeting! Questions? Jean-Luc Gummersbach PCS 7 Product Management I IA AS PA PRM1 gummersbach.jean-luc@siemens.com