Funkční bezpečnost elektrických přístrojů souvisejících s bezpečností

1. Funkční bezpečnost elektrických přístrojů souvisejících s bezpečností

2. Část celkové bezpečnosti týkající se EUC a systému řízení EUC závislá na správném fungování E/E/EP systémů souvisejících s bezpečností, systémech souvisejících s bezpečností založených na jiných technických principech a vnějších prostředcích pro snížení rizika Funkční bezpečnost ČSN EN 61508-4

4. Process. Mechanical Safety Action (if available) Plant Shut-down Wild Process parameter If Operator takes action High Alarm level DCS Functionality High Control level Normal behavior Certain Process parameter value Low Control level Time

5. Safety System. Mechanical Safety Action (if available) Plant Shut-down Safety Instrumented System Functionality ESD controlled Trip level Wild Process parameter If Operator takes action High Alarm level DCS Functionality High Control level Normal behavior Certain Process parameter value Low Control level Time

6. Have You Been Asked This? ‘Regulator’ “How can you demonstrate that you are safe?”

7. How do you demonstrate that your operations are ‘safe’? How do you demonstrate that your equipment is ‘safe’? How do you demonstrate that your safety and protective systems protect against your hazards? You can answer these questions by demonstrating compliance with Industry Safety StandardsIEC61508 - Functional safety of electrical/electronic/programmable electronic safety-related systems Safety Issues for End User / Operators

8. An international standard relating to the Functional Safety of electrical / electronic / programmable electronic safety related systems Mainly concerned with E/E/PE safety-related systems whose failure could have an impact on the safety of persons and/or the environment Could also be used to specify any E/E/PE system used for the protection of equipment or product It is an industry best practice standard to enable you to reduce the risk of a hazardous event to a tolerable level What is IEC61508?

9. E Electrical electro-mechanical / relays / interlocks EElectronic solid state electronics PESProgrammable Electronic Systems Programmable Logic Controllers (PLC’s); Microprocessor based systems Distributed Control Systems Other computer based devices (“smart” sensors / transmitters / actuators) Technologies Concerned

10. Generic Standard Guidance on the use of E/E/PES Comprehensive approach involving concepts of Safety Lifecycle and includes all elements of the protective system Risk-based approach leading to determination of Safety Integrity Levels (S.I.Ls) Considers the entire Safety Critical Loop Features

11. IEC61513 : Nuclear Sector Medical Sector IEC62061 : Machinery Sector IEC61511 : Process Sector Generic and Application Sector Standards IEC61508

12. IEC61511 Functional Safety Safety instrumented systems for the Process industry sector

13. “FUNCTIONAL SAFETY: SAFETY INSTRUMENTED SYSTEMS FOR THE PROCESS INDUSTRY SECTOR” IEC 61511

14. Industries • Applies to a wide variety of industries across the process sector • Including: • Chemicals • Oil refining • Oil and gas production • Pulp and paper • Non-nuclear power generation • Pharmaceuticals / Fine Chemicals

15. Process (chemicals, oil & gas, paper, non-nuclear power generation) End-to-end safety instrumented system (SIS) - h/w, s/w, mgt. and human factors Full safety lifecycle - specification, design, integration, operation, maintenance Intended for integrators / users not for equipment designers / vendors Scope

16. Structure • IEC 61511 – Structure • Part 1 – “Framework, definitions, system, hardware and software requirements”. • Part 2 – “Guidelines for the application of IEC 61511-1”. • Part 3 – “Guidance for the determination of safety integrity levels”. Normative Informative

17. IEC 61511 TITLE - “Functional Safety – Safety Instrumented Systems for the Process Industry sector” • This international Standard gives requirements for the specification, design, installation, operation and maintenance of a safety instrumented system, so that it can be confidently entrusted to place and/or maintain the process in a safe state. • This standard has been developed as a process sector implementation of IEC 61508.

18. Relationship IEC 61511 & IEC 61508

19. Relationship IEC 61511 & IEC 61508

20. Whole safety lifecycle Concept, Hazard & Risk Analysis and Design through operation & maintenance to eventual decommissioning Safety requirements specification Safety integrity levels (SIL 1 to 4) End-to-end system (Sensor via Logic to Actuator) Hardware reliability analysis (PFD) Management of functional safety Architectural constraints (fault tolerance) Similarities (IEC 61508 - IEC 61511)

21. Terminology Process (EUC) Basic Process Control System (EUC Control system) Safety Instrumented System (E/E/PE S-R-S) Safety Instrumented Function (Safety function) Presentation less rigorous than IEC 61508 more guidance (especially in Parts 2 & 3) Key Differences IEC 61511 (IEC 61508)

22. 1 Concept 2 Overall Scope Definition 3 Hazard Risk Analysis 4 Overall Safety Requirements 5 Safety Requirements Allocation External Risk Reduction Facilities Safety Related Systems: Other Technology 11 9 Safety Related Systems: E / E / PES 10 Overall Planning 6 Overall Operation & Maintenance Planning 7 Overall Validation Planning 8 Overall Installation & Commissioning Planning Realisation Realisation Realisation Overall Installation & Commissioning 12 Back to appropriate Overall Safety Lifecycle Phase 13 Overall Safety Validation 15 Overall Modification & Retrofit 14 Overall Operation & Maintenance 16 Decommissioning Overall Safety Lifecycle in IEC 61508

23. IEC 61508 - ownership of phases PRE-DESIGN (Phases 1 to 5) DESIGN AND INSTALLATION (Phases 6 to 13) OPERATION (Phases 14 to 16) End user / operator Engineering Contractors / Equipment Supplier End user / operator

24. 1 : Concept 2 : Overall Scope Definition 3 : Hazard Risk Analysis 4 : Overall Safety Requirements 5 : Safety Requirements Allocation Can you demonstrate that you are using adequate and correct methods of hazard protection? Pre-Design : Phases 1 - 5 Can you demonstrate that you have identified all your hazards?

25. Overall Planning 6 : Overall Operations and Maintenance Planning 7: Overall Validation Planning 8: Overall Installation & Commissioning Planning 9 : Safety Related Systems : E/E/PES 12 : Overall Installation & Commissioning 13 : Overall Safety Validation 10 : Safety Related Systems : Other Technology 11 : External Risk Reduction Facilities Design & Implementation : Phases 6 - 13 Can you demonstrate that you pass the necessary information into these activities? How do you ensure competencies for all these activities? Can you demonstrate that all necessary information has been passed to you from these activities?

26. 14 : Overall Operations and Maintenance 15 : Overall Modification and Retrofit 16 : Decommissioning Operation : Phases 14 - 16 Can you demonstrate that you maintain / test / analyse your protective systems correctly? Can you demonstrate that you are in control of your modification process?

27. Supply Chain Requirement Specification Commissioning and Use End User IEC 61511 System Designer – Integrator Sub-system Designer IEC 61508 Component Manufacturer

28. Risk

29. The probable rate of occurrence of a hazard causing harm AND the degree of severity of the harm Qualitatively - Words Quantitatively - Figures What is Risk?

30. Levels of Risk and ALARP (As Low As Reasonably Practicable) Risk cannot be justified except in extraordinary circumstances Unacceptable region Tolerable only if risk reduction is impracticable or if its cost is grossly disproportionate to the improvement gained TheALARPor Tolerability region As the risk is reduced the less, proportionately, it is necessary to spend to reduce it further. The concept of diminishing proportion is shown by the triangle. (Risk is undertaken only if a benefit is desired) Necessary to maintain assurance that risk remains at this level Broadly acceptable region (No need for detailed working to demonstrate ALARP) Negligible risk

32. Risk to meet Level of Safety Actual risk remaining Plant Under Control risk Necessary minimum risk reduction Actual risk reduction Partial risk covered by E/E/PES protective systems Partial risk covered by Other Technology safety-related systems Partial risk covered by External Risk Reduction Facilities Risk reduction achieved by all protective systems & External Risk Reduction Facilities Risk reduction: General concepts Increasing risk

33. Extent of Safety Related System Equipment(plant) Under Control (EUC) PE SRS SENSOR PROGRAMMABLE ELECTRONICS ACTUATOR

34. Any system that implements safety functions necessary to achieve a safe state for the “Equipment Under Control”, or to maintain it in a safe state. What is a Safety Related System (SRS) ? Examples

35. A typical Methodology for Hazard Identification and Risk Analysis (by the end user) Hazard studies and HAZOPs Evaluate possible consequences Establish tolerable frequencies vs ALARP Build event chain Estimate demand rates Define protection required Specify required SIL Hazard Identification and Risk Analysis

36. A = Random HardwareFailures OR B = Systematic Failures specification; systematic hardware; software; maintenance; all failures that are not random “ Failure categories” in IEC 61508 A B

37. Safety Integrity Level SIL

38. Basic Design Unacceptable SIL 4 Increasing Severity SIL 3 SIL 2 SIL 1 No Protection Increasing Likelihood Risk and Determination of Safety Integrity Levels

39. Risk Reduction Requirements

40. SIL 1 SIL 2 SIL 3 SIL 4 Reliability, Failure Rate and Availability at each level

41. Protective System Technology Standard components, single channel or twin non-diverse channels SIL 1 Standard components, 1 out of 2 or 2 out of 3, possible need for some diversity. Allowance for common-cause failures needed SIL 2 Multiple channel with diversity on sensing and actuation. Common-cause failures a major consideration. Should rarely be required in Process Industry SIL 3 Specialist design. Should never be required in the Process Industry SIL 4

42. Determined to achieve the correct SIL level...

43. Various methods available: Qualitative risk graph Calibrated risk graph (methodology only – not definitive) Layer Of Protection Analysis (LOPA) Hazardous event severity Matrix Quantified Risk Analysis (QRA) Which one to use? Develop your own? SIL assessment

44. Calculation of PFDAVG 35% of PFD 15% of PFD 50% of PFD Avg SE Avg FE Avg LS Distribution of the Failure Measures 35 % Sensors + 15 % Logic solver + 50 %Final elements

45. PFD-figures for a HIMA system, example 35 % 15% 50%

46. probability of theunwanted occurrence consequenceriskparameter frequency& exposuretime possibilityof avoidinghazardousevents relativelyhigh slight very slight minor injuryno influenceto the environment possible rare notpossible dead of 1 person periodic influenceto the environment possible frequent notpossible dead toseveral people rare permanent influenceto the environment frequent disaster requirement classes RC or AK Safety IntegrityLevels (SIL)IEC 61508 Risk Graph acc. DIN V VDE 19250 RC/AK according DIN V VDE 19250SIL according IEC 61508

47. Concept of layers of protection acc. IEC 61511 LOPA

48. Hazardous event severity Matrix

49. Část celkové bezpečnosti týkající se EUC a systému řízení EUC závislá na správném fungování E/E/EP systémů souvisejících s bezpečností, systémech souvisejících s bezpečností založených na jiných technických principech a vnějších prostředcích pro snížení rizika Funkční bezpečnost