Safety in the process industry

Transcription

1 Products Solutions Services Safety in the process industry Simply reliable

2 Table of contents Endress+Hauser: At home in the process safety Smart devices and concepts for hazardous areas Introduction to functional safety Safety by choice - not by chance Ensuring mechanical integrity Development according IEC61508: A view on electronics and software Safety and availability: The value of redundancy Manage the safety life cycle Conclusion

3 What is safety? Reducing risk to a tolerable level Basic: equipment should not cause any problem (Explosion safety) One step further: Instrumentation as the safety fundament of SIS to bring processes to a safe state Safety awareness, standards and recommendations driven by major incidents: Bhopal, Seveso, Buncefield, Deepwater Horizon,.

4 Buncefield, UK

5 Intelligent safety switch Diverse + separate technology Self monitoring Easy proof testing via push-button SIL3 with permanent self function control PFM Switching between differently designed electronics 2 nd line of defense

6 Most comprehensive SIL portfolio Complete range of SIL devices: pressure, temperature, level, ph, flow including system components

7 Products Solutions Services Functional safety Equipment safeguarding chemical reactions and storage of goods

8 Construction: Safety instrumented system Safety discussion Assessment of risk and classification (SIL) Risk reducing measures Elements safety instrumented systems PFD avg = 1 / 2 DU Ti Fieldcheck TM Heartbeat Technology TM Failure cause device Failure modes Failure rates Probability of failure Proof test inteval

9 Source: DIN EN Fig. 8 Safety Integrity Level (SIL) / Functional Safety Theory Overall Safety Life-Cycle acc. IEC Hazard and Risk Assessment Allocation of Safety Functions to Protection Layers (Quantification) Safety Requirements Specifications for the Safety Instrumented System Management of Functional Safety and Functional Safety Assessment and Auditing Safety Lifecycle Structure and Planning Design and Engineering of the Safety Instrumented System Design and Development of other Means of Risk Reduction Installation, Commissioning and Validation Verification Operation and Maintenance Modification Decommissioning Slide 27 Dept. GT / Thomas Fritz

10 What is functional safety? A safety instrumented system is 100% functionally safe if all random, common cause and systematic failures do not lead to malfunctioning of the safety system and do not result in Injury or death of humans Spills to the environment Loss of equipment or production 100% functional safety does not exist, but risk reduction SIL 1, 2, 3 or 4 does. Process industry Example: Petrochemical plant

11 Risk reduction to tolerable level Freedom of unacceptable risks (ISO/IEC guide 51) There is always a remaining minimum risk

12 Risk assessment is country/customer specific

13 Risk graph to determine SIL / Occupancy

14 Prevention Mitigation Safety in the process industry Layers of protection Plant emergency response Emergency response layer Embankment Passive protection layer Relief valve, rupture disk, F+G system Active protection layer Safety instrumented system Emergency Shutdown Isolated protection layer Trip level alarm Alarm & operator intervention Wild process Process control layer Basic process control system or DCS Normal process Process control layer Plant and process design Inherent safe plant design

15 Risk Reduction by Safety Instrumented Systems Sensor Safety Instrumented System (SIS) Communication e.g ma Logic unit Communication e.g ma Actuator Process interface Process interface Process Residual Risk = P D PFD

16 PFDavg - Integration of the complete loop SIL 1: 10-2 <10-1 Controller 15% SIL 2: 10-3 <10-2 Actuator 50% Sensor 35% SIL 3: 10-4 <10-3 SIL 4: 10-5 <10-4 Common values for the distribution of PFD avg to subsystems PFD avg = PFD Sensor + PFD Controller + PFD Actuator

17 Prevention Mitigation Safety in the process industry Layers of protection Plant emergency response Emergency response layer Embankment Passive protection layer Relief valve, rupture disk, F+G system Active protection layer Safety instrumented system Emergency Shutdown Isolated protection layer Trip level alarm Alarm & operator intervention Wild process Process control layer High level alarm Basic process control system or DCS Normal process Process control layer between high level and low level Plant and process design Inherent safe plant design

18 Mitigate the hazard with rupture disks Mechanical assemblies with predictable failure modes E.g. in E+H Promass design

19 Products Solutions Services Failures in electronics and software Failure mode and effect analysis

20 Failure Mode and Effect Analysis (FMEA) Example: Component failure modes Short circuit Interruption Drift Failure mode effect on safety function? Additionally: FMEA of mechanical Components (z. B. Sensor)

21 Failure Mode and Effect Analysis (FMEA) First step: determine safety path (e.g ma output) determine accuracy under fault condition ( e.g. ± 2 %) Different failure modes: Probability of failure modes Detected faults Undetected faults Safe faults l sd l su Dangerous faults l dd l du tot = su + sd + du + dd (+λ not relevant ) PFD MTBF = 1/ tot

22 Absolute number of failures are more important than SFF SFF 95 % Internal diagnostics improves SFF Safe Failure Fraction (SFF) (in %) SFF= sd + su + dd tot SFF 85 %

23 Products Solutions Services Safety and availability The value of redundant architectures in SIS

24 Single Channel System Example: single channel overfill prevention Sensor Logic Actuator SIL 2 PFDav= 0,35x10-2 SIL 3 PFDav=0,05x10-2 SIL 2 PFDav=0,4x10-2 Design rules SIL S, SIL L, SIL A SIL system PFD S +PFD L +PFD A < 10 -SIL system Sensor Logic Actor System SIL PFD av 0,3x10-2 0,05x10-2 0,4x10-2 0,71 x 10-2 System = SIL 2

25 Architecture of Multi-Channel Systems Safety 1oo4 1oo3 Fundamental Safety Parameters PFDav HFT SFF for the complete system must be evaluated (e.g. Markov Model) 1oo2 2oo3 1oo1 2oo2 3oo3 4oo4 Availability

26 Approximation formula (Source: VDI/VDE 2180, Sheet 4) Options of Circuit Approximation formula for PFD av 1oo1 1oo2 1oo3 1oo4 PFD 1oo2 2 1 PFD DUT 1oo1 DUT 3 3 This is simplified. T 1 2 DUT 2 DU 1 DUT1 PFD1 oo3 Use MARKOV method 4to calculate 2 4 DUT1 DUT1 the PFD more PFD1 oo4 accurate oo2 PFD 2oo2 DUT1 2oo3 2oo4 PFD PFD 2oo3 2oo4 DU = dangerous undetected, = Common cause Factor, T 1 = Time interval for proof testing [h] (1 Jahr = h) DU DU T T DUT 2 1 DUT 2 1

27 Complex calculation example(1) Target: SIL 2 Subsystem Sensor Subsystem Logic Unit Subsystem Actuator Sensor 1 Interface 1 Sensor 2 Interface 2 Sensor 3 Interface 3 2oo3 Control Module 1 Control Module 2 1oo2 2oo2 Interface 4 Interface 5 Actu. 1 Actu. 2 l DU = 500 FIT (per line) b=10%, T 1 =1 year, SFF= l DU = 50 FIT (per Module) b=2%, T 1 =1 year, SFF= l DU = 1200 FIT (per line) b=10%, T 1 =1 year, SFF= Formula for für 2oo3 Formula for für 1oo2 Formula for für 2oo2 PFD av (S) = 2, PFD av (LE) = 4, PFD av (A) = 1, Result: PFD av (System) = PFD av (S) + PFD av (LE) + PFD av (A) = 1, SIL 1 FIT = Failures In Time, 1 FIT = /h Target not achieved! What to do?

28 Complex calculation example(2) Action 1: Reduce Proof-Test Intervall from 1 year to ½ year Additional Cost! Subsystem Sensor Subsystem Logic Unit Subsystem Actuator Sensor 1 Interface 1 Sensor 2 Interface 2 Sensor 3 Interface 3 2oo3 Control Module 1 Control Module 2 1oo2 2oo2 Interface 4 Interface 5 Actu. 1 Actu. 2 l DU = 500 FIT (per line) b=10%, T 1 =½ year, SFF= l DU = 50 FIT (per Module) b=2%, T 1 =½ year, SFF= l DU = 1200 FIT (per line) b=10%, T 1 =½ year, SFF= Formula for 2oo3 Formula for 1oo2 Formula for 2oo2 PFD av (S) = 1, PFD av (LE) = 2, PFD av (A) = 5, Result: PFD av (System) = PFD av (S) + PFD av (LE) + PFD av (A) = 5, SIL 2

29 Safety data sheet on

30 Redundancy: Homogeneous or diverse? Homogeneous Redundancy (same instruments) SIL 2 SIL 2 + z.b. 1oo2 SIL 33? Advantage of homogeneous system Control of random faults Endress + Hauser offers multiple instruments which are SIL2/3 capable. Simple stock management, commissioning, maintenance Note: Systematic Integrity (e.g. Software) can not be enhanced! You reach SIL 3 even in homogeneous redundancy. Diverse Redundancy (different instruments) SIL 2 SIL 2 + z.b. 1oo2 SIL 3 Advantage of diverse system Control of random and systematic faults (device + process) systematic integrity can be enhanced

31 Products Solutions Services The safety life cycle Maintain your safety at the highest level

32 Probability of a failure on demand - PFD Example: Safety component with low demand frequency (~1/a) PFD du t ( t << 1) SIL 0,1 du Ti PFD SIL 1 0,01 PFDav ½ du Ti 0,001 0,0001 Ti = Proof test interval PTC= Proof test coverage = λ du* / λ du (λ du* =failures revealed by the proof test) Ti PTC=100 % Ti Operation time Ti SIL 2 SIL 3 SIL 4

33 Total Proof test coverage according to IEC Max Total coverage (DC+PTC) FTL80/81/85+ FTL825 Wet test 99% (Procedure IA MAX/MIN) Simulation (in situ testing!) 97 % (Procedure IB) Via test button Smart proof testing procedures reduce effort, increase safety and minimize shut down times. Min

34 Proof testing without dismounting the device Not necessary to interrupt or manipulate the production process for partial proof test. Recommended proof test interval 12 years 3 years 2 years

35 Products Solutions Services Conclusion Endress + Hauser: State of the art technology and solutions for your process safety

36 Improve safety with state of art technology - Liquiphant Explosion and fire at Buncefield Oil Storage Depot - Five companies to face prosecution gov.uk/press/b08002.htm Failed!!!

37 Separation of process monitoring and safety function Buncefield report, Volume 2, Annex 4, Recommendation 3, page 11

38 Need of record on site and a different location

39 Summary Endress + Hauser offers an instrumentation portfolio for hazardous areas and safety applications which is second to none. Robust measuring principles and material ensure reliability in harshest processes Smart concepts to improve mechanical integrity are simulated, implemented and tested in order keep your process safe under any circumstances Hard- and software developed according IEC61508 and high diagnostic coverage reduce dangerous, undetected failures to a minimum and help to extent proof test interval Redundancy improves safety and availability Smart proof test procedures significantly safe cost Document your safety life cycle with W@M

40 And never forget Liquiphant FailSafe: THE safety switch for highest demands. A unique device: SIL 3 and 12 years proof test interval. Highest safety at minimum effort!