Your Safety, Our Future

is

SAFETY, CONTROL & AUTOMATION SYSTEMS

ISA Safety Seminar IEC61508-61511 Presentation April 2006 2

tech
04/04/2006

IEC 61508 / 61511

is

THE QUESTIONS TO ASK or What To Ask Your Vendors and You by Ian Parry - Hima Sella Ltd Colin Howard - Istech Consulting Ltd
ISA Safety Seminar IEC61508-61511 Presentation April 2006 3

tech
04/04/2006

Background
We assume for this presentation you are aware of and understand IEC61508/61511
International Standard Out for 6 years ( principles for Safety have been around for 30+) yrs.

Now being revised

Still having Problems Not with the Standard but with its application

is

Hardware requirements are well covered in 61508 but Software still leaves large questions to be answered

tech
04/04/2006 ISA Safety Seminar IEC61508-61511 Presentation April 2006 4

Responsibility

Everyone.
Owner / Operator / Designer / Constructor / Integration / System Supplier / Device Suppliers

Everyone has a requirement to supply documentation and figures supporting the system in use.

is

tech
04/04/2006 ISA Safety Seminar IEC61508-61511 Presentation April 2006 5

Questions
The Following questions need to be asked of everyone.
Only some of them will need to be answered by others!!!! I.e You have a response to all the first set of questions But how much information you need is dependent on your responsibility.

is

tech
04/04/2006 ISA Safety Seminar IEC61508-61511 Presentation April 2006 6

The First Set

a) What Overall SIL has been determined by the HAZOP for each Safety Integrity Function

b) What External risk reduction ( or other Technologies) is applicable for each Safety Integrity Function

is

c) What SIL level has been allocated to the E/E/PES system to provide the risk reduction to enable the required defined overall risk reduction to be met.

tech
04/04/2006 ISA Safety Seminar IEC61508-61511 Presentation April 2006 7

The Second Set

E/E/PES system responsibilities
a) b) Total system including the field devices i.e. from transmitter manifold to the final valve Logic Solver - terminal to terminal

c)
d)

Logic Solver - hardware only

Who provides the field devices

is

tech
04/04/2006 ISA Safety Seminar IEC61508-61511 Presentation April 2006 8

The Third Set

a) b) c) d) Who has the responsibility for the calculations for the system as required by IEC 61508 / 61511 Who has the responsibility for sourcing the information required for the calculations What has been determined from the HAZOP for the Demand Rate From the operator / owner, What is the preferred Test Interval E/E/PES

e)
f) g)

Field device suppliers to provide the required device figures - see later
Logic system suppliers / integrators to supply the required figures - see later If no information on a device is available from suppliers - from where is the information to be obtained or derived and who is to derive the information.

is

h)

How will the System components - Logic solver , field devices etc. be tested in service.

tech
04/04/2006 ISA Safety Seminar IEC61508-61511 Presentation April 2006 9

The Fourth Set

What information is required for each device or sub system or system a) Hardware Fault Tolerance - HFT - as per Tables 2 & 3 of 61508 Part 2

b)
c) d)

Safe Failure Fraction - SFF

Mean time to repair - MTTR What value has been used in each of the calculations Probability of Failure on Demand - PFD (or PFDAVG)

e)
f) g) h)

Probability of Failure to Danger per Hour - PFH

Fail Safe failure detected - sd Fail Safe failure undetected - su Fail to Danger Detected - dd
action needs to be taken to go to fail nsafe state

is

i)
j)

Fail to Danger undetected - du

Test Interval used for calculations

tech
04/04/2006

Note even if the SFF is advised then f), g) ,h) and i) will still be required
ISA Safety Seminar IEC61508-61511 Presentation April 2006 10

How to ease the load when starting. For the logic solvers and overall loops pick the worst case loop, i.e worst case Transmitter, barrier, logic solver path, output valve and do the loop calculation. If this value is used in the first pass of the calculations then you have a quick method of identifying the problems loops where you need to do more reviews to ensure you meet the requirements. Typically it is the field devices that cause the problem.

is

tech
04/04/2006 ISA Safety Seminar IEC61508-61511 Presentation April 2006 11

Performance Orders

Pfd = 0.1

Pfd = 0.01

Pfd = 0.001

Pfd = 0.0001

SIL1

SIL2

SIL3

Order of magnitude increases in performance requirement

Can your procedures and practices for: Design; Maintenance; Operations; Performance monitoring; Competence demonstrate equivalent increases in rigour?

is

Throughout the whole lifecycle of the system?

ISA Safety Seminar IEC61508-61511 Presentation April 2006 12

tech
04/04/2006

is

tech
04/04/2006 ISA Safety Seminar IEC61508-61511 Presentation April 2006 13

Not IEC 61508 IEC 61508

is

tech
04/04/2006 ISA Safety Seminar IEC61508-61511 Presentation April 2006 14

HOW NOT TO DO IT
Some pointers of the wrong way to confirm compliance.

is

tech
04/04/2006 ISA Safety Seminar IEC61508-61511 Presentation April 2006 15

1) From a specification
The plant will be shutdown on 23 days in the year . The demand rate is 0.00435 years per demand . A SIL3 system is required Would you accept the specification?

Comments please

is

tech
04/04/2006 ISA Safety Seminar IEC61508-61511 Presentation April 2006 16

2) A proposed design..

Gas Turbine

1oo2 trips on: Bearing temperature,Vibration; 1oo1 trip on displacement

Compressor
LSZ

Suction Drum

2oo3 trips on: Bearing temperature Vibration Displacement

1oo1 Trip On Level

Process plant

is

tech
04/04/2006

Would you accept this design proposal?

ISA Safety Seminar IEC61508-61511 Presentation April 2006 17

3)
Take the MTFB / MTTF figure, convert it to a rate per hour and then allocated a %, say 20% to be the Fail to Danger Rate - If no information then you should use 50% but also what about HFT, SFF is also questionable, as you have decided what the figure is.

is

tech
04/04/2006 ISA Safety Seminar IEC61508-61511 Presentation April 2006 18

4) Use of 3 standard non SIL transmitters in a SIL3 application as it has a HFT of 2. What is the SFF of the devices. Are they SMART transmitters raising the question on the integrity of the software. IEC61508 clearly shows that if you have 2 off SIL2 sub systems in a 1oo2 to trip configuration then the best they can achieve is SIL3, even 2oo3 only gives SIL3 ( HFT and SFF Table 2/3) What about common cause effects, this can cause 2oo3 SIL2 Txs may not meet SIL2.

is

tech

Most certified devices reports detail what different configurations will meet with respect to SIL levels.

04/04/2006

ISA Safety Seminar IEC61508-61511 Presentation April 2006

19

5) Devices provided with FMEA reports which provide PFD / PFH figures but the report specifically excludes any software coverage and thus it is difficult to use the devices.

Or the report makes assumptions, i.e. a trip amplifier with relay outputs which the Logic Solver is required to monitor for failure of the relay.

is

tech
04/04/2006 ISA Safety Seminar IEC61508-61511 Presentation April 2006 20

6) Concentration on the Logic Solver details when placing orders, but do not consider the field devices associated with the logic solver. This causes problems as the configurations of the field devices may need to be upgraded, if it is in fact possible to use the devices ordered, from 1oo1 to 1oo2 or even 2oo3 usually late in the project ( at FAT) delaying the project and costs overruns.

is

tech
04/04/2006 ISA Safety Seminar IEC61508-61511 Presentation April 2006 21

7) Attention needs to be taken during the design stage to refer to maintenance regime and training requirements for the systems and also spares holdings. Calculations for the PFD and PFH requires the use of the MTTR, normally assumed to be 8 hrs i.e. a normal shift.

It is possible to use 1 Hour in the calculations to give the answer you wish to show, so the MTTR figure used should be declared.

is

tech
04/04/2006 ISA Safety Seminar IEC61508-61511 Presentation April 2006 22

8) Test intervals.

Again short test intervals will improve the calculated figures but does not reflect the time and costs incurred by the maintenance teams.
Also to be considered is the amount of time each device is not available to provide the protection when it is in test,calibration or maintenance. This can affect the SIL level applicable if you have to apply overrides for long periods per year just to maintain the field devices.

is

tech
04/04/2006 ISA Safety Seminar IEC61508-61511 Presentation April 2006 23

9) Common Mode Failure. When using voting configurations it is important to validate and quantify the Common Mode Beta value applicable.

If the Beta value is high say 10% then this can be the defining limit on the SIL level achievable. Indeed if you have a high BETA value then even a 2oo3 voting configuration may only meet SIL1 or 2 !!!

is

tech
04/04/2006 ISA Safety Seminar IEC61508-61511 Presentation April 2006 24

10) My supplier says the kit is good for SIL3 so why not design to SIL3? SIL 3 systems are very difficult to achieve in practice. If SIL 3 is specified, too much of the risk reduction is being taken by the instrumented system and not enough by other layers of protection. This indicates a need to review the risk assessment. Avoid the need for a SIL 3 or 4 system by introducing further layers of protection (other non-instrument measures)

is

These will then take their share of the overall risk reduction.

tech
04/04/2006 ISA Safety Seminar IEC61508-61511 Presentation April 2006 25

Thank you for your attention If you have any questions? Please wait until the question time at the end of the presentations

is

tech
04/04/2006 ISA Safety Seminar IEC61508-61511 Presentation April 2006 26