Reliability and Safety Assessment in Offshore and Process Industries PSAM 7 / ESREL 04 Berlin, Germany Lars Bodsberg SINTEF, Trondheim, Norway 1
2 All models are wrong! Some are useful. (G.E. Box)
3 Many Number of accidents contributing to total loss Safety Management Principles Control of conditions and causes from epidemiological analysis of past accidents Control of accident process itself from reaction to individual past accidents 1 Empirical Safety Control: Traffic and work safety 2 Evolutionary Safety Control: Air craft crashes, train collision 3 Analytical Safety Control: e.g., Major nuclear and chemical hazards (CEC Seveso directive) Control of accident process based on predicitive analysis of possible accidents Few Low Consequence of accident High Adapted from J. Rasmussen
Norsk Hydro 4
IEC 61508 and IEC 61511 The International standard IEC 61508: Functional safety of electrical/-electronic/programmable electronic (E/E/PE) safetyrelated systems (7 parts) Generic standard The International standard IEC 61511: Functional safety Safety instrumented systems for the process industry sector (3 parts) Sector specific standard 5
6 Widespread use of IEC 61508 and IEC 61511 in the Norwegian Petroleum Industry The Petroleum Safety Authority Norway recommends the use of IEC 61508 The Norwegian Oil Industry Association (OLF) provides financial support to a joint industry project between operators and the various suppliers of services and equipment to establish a guideline Guideline published at: www.itk.ntnu.no/sil
IEC 61508: Functional safety of electrical/- electronic/programmable electronic (E/E/PE) safety-related systems Generic standard, i.e.: Providing general framework, covering a wide range of complexity, hazards and risk potentials Conceived with a rapidly developing technology in mind - framework sufficiently robust and comprehensive Major objective: Facilitate development of sector specific standards Provide consistency within and across application sectors Provide a generic approach for all lifecycle activities Provide qualitative and quantitative safety requirements to safety systems 7
8 IEC 61508 Overall life cycle 1 2 3 4 5 Concept Overall Scope Definition Hazard & Risk Analysis Overall Safety Requirements Safety Requirements Allocation 6 Overall Operation& Maintenance Planning Overall Planning 7 Overall 8 Validation Planning OveralI Installation & Commissioning Planning 9 Safety-related systems: E/E/PES Realisation 10 Safety-related Systems: Other Technology Realisation 11 External Risk Reduction Facilities Realisation 12 Overall Installation & Commissioning 13 Overall Safety Validation Back to appropriate Overall Safety Lifecycle phase 14 Overall Operation & Maintenance 15 Overall Modification & Retrofit 16 Decommissioning
Development of Safety System Requirements 9 EUC Hazard EUC risk Safety requirements & Safety Integrity Level Allocation Design, etc Over pressure Risk E/E/PES Req. h/w s/w R Isolate and depressurize vessel 9999 out of 10000 times Other Safety-related systems Not part of IEC 61508 Tolerable risk External facilities
10 Risk reduction in IEC 61508 - General concept Residual risk Tolerable risk EUC risk Necessary risk reduction Increasing risk Actual risk reduction Partial risk covered by other technology safety-related systems Partial risk covered by E/E/PE safety-related systems Partial risk covered by external risk reduction facilities Risk reduction achieved by all safety-related systems and external risk reduction facilities Source: IEC 61508
11 Safety Integrity Level - SIL SAFETY INTEGRITY LEVEL -SIL 4 3 2 1 DEMAND MODE OF OPERATION (Probability of Failure on Demand - PFD) 10-5 to < 10-4 10-4 to < 10-3 10-3 to < 10-2 10-2 to < 10-1 CONTINUOUS/HIGH DEMAND MODE OF OPERATION (Probability of a dangerous failure per hour) 10-9 to < 10-8 10-8 to < 10-7 10-7 to < 10-6 10-6 to < 10-5
IEC 61508 implications on safety and reliability modelling The IEC 61508 standard sets out a risk-based approach for deciding the Safety Integrity Level (SIL) for systems performing safety functions On-going R&D to improve QRAs in Norway. The IEC 61508 standard requires evaluation of reliability performance of the safety instrumented systems The PDS method 12
13 Comparison PRA vs. QRA Topic PRA QRA Initiating events Fault tree/ event tree analysis (system modeling) Data and parameter estimation Human reliability Dependencies Uncertainty External events Results Root cause analysis of initiating events presented in fault trees. Identification of common cause initiators (CCIs). Predefined lists and handbooks. Detailed modeling Support systems explicitly modeled. Link between event trees and fault trees. (Time-dependent models for living PSA). Best estimates and confidence intervals. Classical and Bayesian framework. Weighted plant-specific data Thorough analysis of important human actions (e.g. by THERP, SHARP, etc.). Partly inherent in models Separate dependency analysis Regarded as crucial Always included, at least qualitatively. Regarded as important Covers some external events Linked to the internal event Best estimate and uncertainty in short and long term fatalities. Cumulative distribution functions. No root cause analysis No CCI assessment Predefined categories of leakage Frequencies based on counting leakage point, or platform data. Rough model Support systems not included Only partly use of fault trees No linking of event and fault trees. Best estimates Generic data and separate plant-specific data Almost non-existing Partly inherent in models No separate analysis Absent Covers many external events Separate analysis (Limited modeling effort) Single best estimate FAR-, and PLL-values
Reliability Assessment of Safety Instrumented Systems the PDS Method 14
15
16 Balance between production and protection Protection Production Reason (1998)
17 High Integrity Pressure Protection System (HIPPS) PT Redundant Logic PT 3 PT 2 1 V 1 V 2
18 Safety performance voting logic Probability of failure on demand 0.006 2oo2 voting Primary Investment 0.005 0.004 0.003 1oo1 voting 0.002 0.001 2oo3 voting 1oo2 voting
19 Safety vs. LCC Low Unavailability Cost pr Trip Probability of failure on demand 0.006 0.005 0.004 0.003 2oo2 voting Acceptance criteria 1oo1 voting Primary Investment Operation and maintenance cost Unavailability cost pr trip 0.002 0.001 2oo3 voting 1oo2 voting 100 200 300 400 500 LCC in 1 000 Norwegian kroner
20 Safety vs. LCC High Unavailability Cost pr Trip Probability of failure on demand 0.006 0.005 2oo2 voting Acceptance criteria Primary Investment Operation and maintenance cost Unavailability cost pr trip 0.004 0.003 1oo1 voting 0.002 0.001 2oo3 voting 1oo2 voting 100 200 300 400 500 LCC in 1 000 Norwegian kroner
Gareth Morgan 21
22 Failure Mode Classification in PDS and IEC Failure IEC Dangerous (D) Safe (S) PDS Spurious Trip (ST) Non-critical (NONC)
23 Main Failure Modes in PDS Dangerous (D) Safety system/module does not operate on demand (e.g. sensor stuck upon demand) Spurious Trip (ST) Safety system/module operates without demand (e.g. sensor provides signal without demand) Non-Critical (NONC) Main functions not affected (e.g. sensor imperfection which has no direct effect on control path) The IEC standard does not distinguish between ST and NONC failures; both are referred to as Safe failures
24 Failure Cause Classification in PDS and IEC IEC Failure PDS Random Hardware (Physical) Systematic (Non-physical) Ageing Stress Interaction Design Examples Natural Sandblasting Random Test/periodic ageing Humidity Scaffolding Leave in (within design Overheating cover up by-pass envelope) sensor Cover up sensor Software error Sensor does not distinguish true and false demand Wrong location of sensor
25 Loss of Safety Quantification in PDS and IEC Failure Random Hardware (Physical) Systematic (Non-physical) Ageing Stress Interaction Design IEC PDS
Reliability Performance Measures Loss of safety. Critical Safety Unavailability (CSU): The probability that the safety system will fail to automatically carry out a successful safety action on the occurrence of a hazardous/- accidental event Probability of Failure on Demand (PFD): That part of CSU which is caused by random hardware failures Loss of production regularity. Spurious Trip Rate (STR): The mean number of spurious activations of the safety system per unit time Maintenance activity. Mean Corrective Maintenance (MCM): The mean number of man-hours spent on CM per year Mean Preventive Maintenance (MPM): The mean number of man-hours spent on PM per year IEC 26
27 Loss of Safety Calculations - Example Component PFD Random hardware PSF Systematic CSU Total PT (1oo2) 1.1 10-5 3.6 10-5 4.7 10-5 Logic (1oo2) 0.2 10-5 2.5 10-5 2.7 10-5 V (1oo2) 11.8 10-5 0.03 10-5 11.8 10-5 Total 13.1 10-5 6.1 10-5 19.2 10-5
28 5 Safety requirements allocation RAMS targets and tradeoff values 15 Overall modification and retrofit Generic Reliability parameters Updated Reliability parameters 6 Overall operation and maintenance planning Follow up plan Maintenance plan Inprovement measures 14 Overall operation, mainteance and repair Failures Work Order system Trends, Pareto, CCF, FCA etc Extended reliability databases Manufactures and vendors Infrom regulator (NPD) Data Analysis Database Reporting Op. restrict. Budget allocation Resource allocation Infrom regulator (NPD) Actual PM & CM Follow up actions Backlog PM & CM
29 Summary Risk-based approach adopted in Norwegian offshore production Widespread application of the IEC 61508 standard Requirements to safety functions can normally not be obtained directly from the Quantitative Risk Analysis (QRA) as it is performed today. Cooperation between regulatory authorites, industry and R&D to establish guideline document for IEC 61508 Ongoing research to improve QRA Reliability analysis should support the balance between production and protection
IEC 61508 and 61511 Lessons learned Provides good framework for design, implementation and operation of safety-related systems Sensible risk-based approach, however in an area, and at a level of detail, which is not yet very mature Difficult to apply for systems involving several vendors global functions 30
31 All models are wrong! Some are useful. (G.E. Box)
32 References Reliability Prediction Method for Safety Instrumented Systems; PDS Method Handbook, 2003 Edition Published by SINTEF (www.sintef.no/pds) and distributed by Sydvest (www.sydvest.com) Reliability Data for Safety Instrumented Systems; PDS Data Handbook, 2003 Edition Published by SINTEF (www.sintef.no/pds) and distributed by Sydvest (www.sydvest.com) Application of IEC 61508 and IEC 61511 in the Norwegian Petroleum Industry Published at www.itk.ntnu.no/sil
33 Lars Bodsberg Ph.D --Research Director SINTEF, Safety and Reliability N-7465 Trondheim Telephone: +47 73 7359 5927 2758 Telefax: +47 73 7359 5928 2896 http://www.sintef.no