Presentation is loading. Please wait.

Presentation is loading. Please wait.

S o l u t i o n s f o r O i l & G a s 100.1 A.O.Sveen, NTNU 2011 Siemens Safety Systems. NTNU 14.03.2011, Arnt Olav Sveen Løsninger Applikasjoner »Kontroller.

Similar presentations


Presentation on theme: "S o l u t i o n s f o r O i l & G a s 100.1 A.O.Sveen, NTNU 2011 Siemens Safety Systems. NTNU 14.03.2011, Arnt Olav Sveen Løsninger Applikasjoner »Kontroller."— Presentation transcript:

1 S o l u t i o n s f o r O i l & G a s A.O.Sveen, NTNU 2011 Siemens Safety Systems. NTNU , Arnt Olav Sveen Løsninger Applikasjoner »Kontroller / sentralsystem »Kommunikasjon / nettverk »Human - Machine Interface »Inngangs og utgangs moduler »Programvare /programmering Historikk og bakgrunn »Basis for løsninger Krav i IEC61508 »Hjemmesikkerhetssystem

2 S o l u t i o n s f o r O i l & G a s A.O.Sveen, NTNU 2011 Siemens Safety Systems. The prevention of accidents should not be considered a question of legislation, but instead our responsibility to fellow beings and economic sense (Werner von Siemens in 1880)

3 S o l u t i o n s f o r O i l & G a s A.O.Sveen, NTNU 2011 History of Siemens Safety Systems SIMATIC S5- 110F (1980) SIMATIC S5- 115F (1988) SIMATIC S5- 95F (1994) QUADLOG (1995) Distributed Safety S7 151F/315F/317F/416F (2002/2003) S7 F Systems S7-400FH / PROFIsafe (1999) Safety Matrix (1999)

4 S o l u t i o n s f o r O i l & G a s A.O.Sveen, NTNU 2011 Siemens Safety Systems. n First large safety project 1985, Oseberg Feltsenter n To day nearly 30% of installed safety systems in Norwegian part of the North Sea, and numerous deliveries world wide. n First solutions, Simatic PLC's with additional hardware, 2 PLC's running independently. n To-day a full range of S7 F, TÜV verified systems n Work procedures according to IEC61508, SINTEF verified, and a full scope of function blocks and typicals

5 S o l u t i o n s f o r O i l & G a s A.O.Sveen, NTNU 2011 Stena Don 2000 Statfjord A2000 Snorre B 2000 Huldra 2000 Oseberg South 2000 Embla2000 Oseberg Gas1999 Troll C1999 Statfjord B1998 Visund 1998 Eldfisk WIP1999 Oseberg East1997 Petrojarl Foinhaven1996 Njord A & B1995 Statfjord C1995 Vigdis1995 Ekofisk1995 Eldfisk alpha1993 Brage1992 Embla1991 Snorre TLP1990 Oseberg A1988 Oseberg B1987 Siemens Safety Systems applications are based on long experience Siemens Safety Systems, traditional systems.

6 S o l u t i o n s f o r O i l & G a s A.O.Sveen, NTNU 2011 Siemens Safety Systems, S7, PCS7 HULDRA (Norway) 2000 MAERSK XL1 /XL2 (worlds largest jack up’s, built in Korea) 2002 EKOFISK 2/7A 2002 Visund Halfdan 5 platforms (Denmark/built in Singapore and Holland) Al Shaheen (28 platforms in Qatar) White Rose FPSO (Canada/ built in Canada/Korea/Abu Dhabi/USA) 2005 P50, Albacore Leste FPSO (Brazil), PRA FPSOcean 1 (China) Santa Fe (USA, 2 drilling Rigs) 2004 Oseberg Field-centre (Norway) (113 off S7 400/400FH, I/O) Statfjord A/B/C ESD and F&G Sevan SSP300-1, 2 and Deep Sea Driller 1and Blackford Dolphin Snorre TLP Tor2011 Yme (upgrade)2011

7 S o l u t i o n s f o r O i l & G a s A.O.Sveen, NTNU 2011 Safety Systems Applications Hva er et sikkerhetssystem (SIS)? Hvor griper det inn i en ulykkesutvikling, og forhåpentligvis stanser den? Plant personnel intervenes Safety system (automatic) Basic automation Overpressure valve, rupture disc Collection basin Active protection Passive protection Disaster protection Disaster protection Safety Instrumented System (SIS) Process value Process alarm Normal activity Process control system Safety shutdown

8 S o l u t i o n s f o r O i l & G a s A.O.Sveen, NTNU 2011 Safety Systems Applications Hva er et sikkerhetssystem (SIS)? Low level I / P Reactor PT 1A PT 1B FT Basic Process Control System (BPCS) InputsOutputs Safety Instrumented System (SIS) InputsOutputs

9 S o l u t i o n s f o r O i l & G a s A.O.Sveen, NTNU 2011 Safety Systems Applications Og hva er “Equipment Under Control”, EUC?

10 S o l u t i o n s f o r O i l & G a s A.O.Sveen, NTNU 2011 Safety Systems Applications Purpose Risk reduction by safety systems, SIS Hensikten med å innføre et sikkerhetssystem, er å få risikoen ned til et akseptabelt nivå.

11 S o l u t i o n s f o r O i l & G a s A.O.Sveen, NTNU 2011 Safety Systems Applications What is Risk? Who decides what is acceptable risk? n Examples of fatality risk figures Road accident100cpm1.0x10-4/yr 1 av 100 (ved levetid 100 år) Car accident150cpm1.5x10-4/yr1,5 av 100 Accident at work10cpm1.0x10-5/yr1 av 1000 Falling Aircraft0.02 cpm2.0x10-8/yr2 av Lightning strike0.1cpm1.0x10-7/yr1 av Insect/Snake bite0.1cpm1.0x10-7/yr1 av Smoking 20 per day5000 cpm5.0x10-3/yr1 av 2 cpm = chances per million of the population (per year)

12 S o l u t i o n s f o r O i l & G a s A.O.Sveen, NTNU 2011 Safety Systems Applications Likelihood Consequence Tolerable Risk Region Unacceptable Risk Region Hazard #1 Containment Dike Control System Operator Intervention Safety Instrumented Function SIL1 SIL2 SIL3 Risk reduction by safety systems, SIS Risikoreduksjonen er større ved et høyere SIL

13 S o l u t i o n s f o r O i l & G a s A.O.Sveen, NTNU 2011 Safety Systems Applications What is Safe state? Can the Safety System bring the area or equipment to a safe state? How? What is required?

14 S o l u t i o n s f o r O i l & G a s A.O.Sveen, NTNU 2011 Safety Systems Applications Some of the Safety Systems Applications ESD, Emergency Shutdown F&G, Fire & Gas Detection, Fire-fighting Process Shutdown Fire-pump Logic Ballast Control Blow-down Riser release / Anchor Release Fire Dampers, Active Smoke Control HIPPS, High Integrity Pressure Protection System

15 S o l u t i o n s f o r O i l & G a s A.O.Sveen, NTNU 2011 Safety Systems Topology for total platform control system including safety

16 S o l u t i o n s f o r O i l & G a s A.O.Sveen, NTNU 2011 Fire & Gas Topology (sample)

17 S o l u t i o n s f o r O i l & G a s A.O.Sveen, NTNU 2011 F&G System Topology (the different modules) Fail Safe I/O Modules High Available & Fail Safe CPU’s Redundant Integrated Safety & Process Network Addressable Fire Detection Systems Redundant Communications Interface Redundant Fail Safe Communications – SIL3 (Profisafe) Redundant Safety Servers Redundant Operator Stations F&G Matrix

18 S o l u t i o n s f o r O i l & G a s A.O.Sveen, NTNU 2011 ESD Topology (sample)

19 S o l u t i o n s f o r O i l & G a s A.O.Sveen, NTNU 2011 PSD Topology (sample)

20 S o l u t i o n s f o r O i l & G a s A.O.Sveen, NTNU 2011 Marine Control System (SIL 3)

21 S o l u t i o n s f o r O i l & G a s A.O.Sveen, NTNU 2011 Subsea PSD solution and HIPPS, both SIL3

22 S o l u t i o n s f o r O i l & G a s A.O.Sveen, NTNU 2011 IEC n The safety level is applicable for : The total solution All the projects lifecycles n The system solution covers EUC, including HMI u HW engineering, construction and testing By use of standard hardware set-up With special modules approved by TÜV u Software Function blocks (basic blocks approved by TÜV) Protocols and drivers approved by TÜV Application program (according to procedure) u Maintenance procedures u Operation and Modification Procedures

23 S o l u t i o n s f o r O i l & G a s A.O.Sveen, NTNU 2011 IEC 61508, Quality Assurance and a few direct requirements

24 S o l u t i o n s f o r O i l & G a s A.O.Sveen, NTNU 2011 IEC 61508, Implementation according to proven procedures. n Safety requirements shall be specified, and the requirements shall be traceable through all engineering phases. u Internal procedures for development of software according to IEC61508 Procedures developed in co-operation with SINTEF Tele and Data. –specification –planning –implementation –verification –validation –modifications. u Internal procedures for hardware design and production according to IEC61508 Made on the same structure as the SINTEF verified SW procedure.

25 S o l u t i o n s f o r O i l & G a s A.O.Sveen, NTNU 2011 Basically three requirements 1.Quality assurance (98% of IEC61508) 2.Requirement to availability of safety function (PFD requirement, Probability of Failure on Demand) 3.Requirement to safe failure fraction (SFF requirment, Safe Failure Fraction) Basic principles to fulfil IEC61508 Answers to the requirements 1.Work methology, procedures, qualified workers 2.Equipment quality, redundancy, second resort, diagnostics 3.Fail to safe design, diagnostics

26 S o l u t i o n s f o r O i l & G a s A.O.Sveen, NTNU 2011 Diagnostics / feedback Diagnostics will give possibility to repair dangerius errors before an emergency situation, hence improving PFD and SFF. Increased diagnostics also give room for estension of test interval, hence saving cost. Feedback will give opportunity to use second shotdown possibility in case of first possibility failing, hence increasig PFD and SFF. Diagnostics, feedback and redundancy Redundancy / second shutdown fasility More than one shutown fasility, and all are activated at same time, or second fasilities are used as result of feedback when first is faling, will give improved SFF and PFD.

27 S o l u t i o n s f o r O i l & G a s A.O.Sveen, NTNU 2011 Risk Graph Risk Determination (one of several methods) : S1 F1 F2 F1 F2 A1 A2 A1 A2 S2 S3 S4 P P2P1 S: Severity of injury/damage 1:small injury, minor environmental damage 2:serious irreversible injury of many people involved or a death temporary serious environmental damage 3:death of many people long-term serious environmental damage 4:catastrophic results, many deaths F: Frequency and/or exposure time to hazard 1:seldom - quite often 2:frequent - continous A: Avoiding hazard 1:possible 2:not possible P: Probability of Occurrence 1:very low 2:low 3:relatively high How to find Required Safety Integrated Level (SIL) of the Safety System

28 S o l u t i o n s f o r O i l & G a s A.O.Sveen, NTNU 2011 S7-400F/FH by Siemens Safety Integrity Levels, direct requirement IEC61508 Requirement Class (AK) DIN V Safety Integrity Level (SIL) IEC Probability of failure on demand per h (constant operation) (IEC 61508) Probability of failure on demand (on demand operation) (IEC 61508) Control Category EN AK B AK 2 and 3 SIL to to and 2 AK 4 SIL to to AK 5 and 6 SIL to to AK 7 and 8 SIL to to 10 -x ---

29 S o l u t i o n s f o r O i l & G a s A.O.Sveen, NTNU 2011 Safety Integrity Levels, direct requirement IEC61508 IEC61508 requires higher “fail safe fraction” for “intelligent” components Safe failure fraction Hardware fault tolerance 012 < 60 %SIL1SIL2SIL3 60 % - 90 %SIL2SIL3SIL4 90 % - 99 %SIL3SIL4 > 99 %SIL3SIL4 Hardware safety integrity: architectural constraints on type B safety-related subsystems Safe failure fraction Hardware fault tolerance 012 < 60 %not allowedSIL1SIL2 60 % - 90 %SIL1SIL2SIL3 90 % - 99 %SIL2SIL3SIL4 > 99 % SIL3SIL4 Hardware safety integrity: architectural constraints on type A safety-related subsystems

30 S o l u t i o n s f o r O i l & G a s A.O.Sveen, NTNU 2011 Safety Integrity Levels, PFD calculation Safety reliability Block diagram :

31 S o l u t i o n s f o r O i l & G a s A.O.Sveen, NTNU 2011 Safety Control System, SIMATIC S7 – 300/400 F/FH Safety Controller S7 FH Certified up to SIL 3 Redundant systems S H *) 768kB 100 F-I/Os S H *) 2.8MB 600 F-I/Os S7-317F-2DP 1MB 500 F-I/Os S7-315F-2DP 192kB 300 F-I/Os S H *) 30MB 3000 F-I/Os S7-319F-2DP 1.4MB 1000 F-I/Os

32 S o l u t i o n s f o r O i l & G a s A.O.Sveen, NTNU 2011 Components S7-400F/FH n High available System S7-417FH as a basis u CPU 417-4H with TÜV certified basis SW/HW (SIL3) u TÜV certified failsafe logic SW blocks (SIL3) n Engineering /Hardware Configuration/Programming u Configuration of the S7-400F-Hardware with Standard HW-Config. u Graphical Engineering (programming) with Standard CFC (Continuous Function Chart) u Coexistence of Standard- and F-Applications (SIL3) in one CPU n Connection to the Process Devices u Failsafe I/O modules (SIL1 - 3) u PROFIsafe (extra safety layer to Profibus) (SIL3) to ensure failsafe communication via Profibus-DP

33 S o l u t i o n s f o r O i l & G a s A.O.Sveen, NTNU 2011 Basic principle “Protected F-Islands” Safety-related user program CPU operating system Standard user programs CPU hardware Safety-related frame Any faults in other modules, environmental factors Failsafe I/O modules

34 S o l u t i o n s f o r O i l & G a s A.O.Sveen, NTNU 2011 S7 400F F/H system - modularity, PC Standard Engineering Software Standard-ProfibusDP F-Application Program F-Programming Tool F-I/O’s (ET200M) ProfiSafe Protocol RUN-P RUN STOP CMRES RUN-P RUN STOP CMRES Standard-CPU 417-4H Standard I/O’s (ET200M)

35 S o l u t i o n s f o r O i l & G a s A.O.Sveen, NTNU 2011 S7-400H Redundancy PrinciplePROCESS Synchronization, information and status exchange IMDEAEAADAIMFM

36 S o l u t i o n s f o r O i l & G a s A.O.Sveen, NTNU 2011 I/O Configuration Switching of master by use of redundant Profibus Profibus-DP IM Bus module Active backplane bus IO with active backplane bus performing the switchover L+ Redundant IM Target: Reduce common mode faults for the switch-over to a minimum Achieved by: Very simple component does the switchover

37 S o l u t i o n s f o r O i l & G a s A.O.Sveen, NTNU 2011 Redundant S7-400H A Synchronization Procedure is required Part. PLC A Part. PLC B Cycle synchronization Part.-PLC A Part. PLC B Time synchronization Command synchron. Part. PLC A Part. PLC B Part. PLC A Part. PLC B Without synchronization (Siemens Patent) Synchronization of all commands whose execution would trigger different states in both partial PLCs

38 S o l u t i o n s f o r O i l & G a s A.O.Sveen, NTNU 2011 Flexible Set-up‘s Together, the listed principles result in a flexible set-up nredundant S7-400FH nredundant PROFIBUS-DP nF-E/A Moduls nSIL3, AK6 nredundant S7-400FH nredundant PROFIBUS-DP nredundant F-E/A Moduls nSIL3, AK6 nS7-400F nPROFIBUS-DP nF-E/A Moduls nSIL 3, AK6 Fail SafeFail Safe and High Availability

39 S o l u t i o n s f o r O i l & G a s A.O.Sveen, NTNU 2011 AIDIDO Flexible Modular Redundancy ™ n Make any component redundant

40 S o l u t i o n s f o r O i l & G a s A.O.Sveen, NTNU 2011 AIDIDO Flexible Modular Redundancy ™

41 S o l u t i o n s f o r O i l & G a s A.O.Sveen, NTNU 2011 AIDIDO AIDI Flexible Modular Redundancy ™ n Physically separate redundant resources n Make any component redundant

42 S o l u t i o n s f o r O i l & G a s A.O.Sveen, NTNU 2011 AI Triple Simplex DIDO AIDIAIDOAI Dual Flexible Modular Redundancy ™ n Physically separate redundant resources n Mix and match redundancy n Make any component redundant

43 S o l u t i o n s f o r O i l & G a s A.O.Sveen, NTNU 2011 AI Triple Simplex DIDO AIDIAIDOAI Dual n Physically separate redundant resources n Mix and match redundancy n Tolerate multiple faults with no impact on safety n Safety is not dependant on redundancy; all components are SIL3-capable n Redundancy only for availability; No degraded mode        Flexible Modular Redundancy ™ n Make any component redundant

44 S o l u t i o n s f o r O i l & G a s A.O.Sveen, NTNU 2011 Flexible Set-up‘s n Multiple Fault Tolerant u Fieldbus architecture allows system to tolerate multiple faults without interruption u I/O redundancy independent of CPU redundancy n All components rated for SIL3 u No degraded mode u Safety not dependent on redundancy AIDIDO AI DIDO AI        2oo3 PT 1oo2 Valves 2oo3

45 S o l u t i o n s f o r O i l & G a s A.O.Sveen, NTNU 2011 Alternative setup by others Fail Safe and High Availability due to 2oo3 HW voting Sample from Triconex design

46 S o l u t i o n s f o r O i l & G a s A.O.Sveen, NTNU 2011 Input and output modules to SIL 3, 2 and 1 RUN-P RUN STOP CMRES F-SM´s Standard SM´s RUN-P RUN STOP CMRES u ET 200 M F-SM, Fail Safe Modules u ET200 iSP, zone 1 Small granularity modules for Zone 1, SIL3 u ET200 S Small granularity modules can cover SIL1 to SIL3 SIL3, 2 or 1dependant on configuration (TÜV) –SIL 3 also in single configuration for most modules –SIL 3 with single or redundant bus connection

47 S o l u t i o n s f o r O i l & G a s A.O.Sveen, NTNU 2011 Architecture S7-300 Fail Safe Modules (sample) Microcontroller Output driver Dual- port RAM Bus interface Second disconnection facility L+ F-Digital Output, with built in redundancy, self verification and degrading Microcontroller Output V Supply If ”Output driver” fails to bring output to safe state, ”0”, the microcontroller does, based on the read back, order the ”Second disconnection facility” to shut the card down Read back

48 S o l u t i o n s f o r O i l & G a s A.O.Sveen, NTNU 2011 S7-300 Fail Safe Modules n Redundant microcontroller in each IO module n Safety Integrated Level r 1oo1 evaluation, SIL 2, AK 4 r 1oo2 evaluation, SIL 3, AK 6, internal in module n Diagnose of internal and external errors r mutual function checking of the microcontrollers r input or output test r branching of the input signals to both microcontrollers r discrepancy analysis of the redundant input signals r readback of the output signals and discrepancy analysis n Second disconnection facility in the case of outputs n Communication with CPU via Profisafe

49 S o l u t i o n s f o r O i l & G a s A.O.Sveen, NTNU 2011 S7-300 Fail Safe I/O Modules Samples of modules available SM326F, DI DC24V 24 x SIL2, 12 x SIL3, with diagnostics interrupt SM326F, DI NAMUR [EEx ib] 8 x SIL2, 4 x SIL3 with diagnostics interrupt SM326F, DO DC24V/2A 10 x SIL3, current source, diagnostics interrupt SM336F, AI 4-20mA 6 x SIL2 or 3, with diagnostics interrupt

50 S o l u t i o n s f o r O i l & G a s A.O.Sveen, NTNU 2011 Fail Safe I/O Modules Library for interfaces to field devices Library with standard, pre-verified instrument interfaces

51 S o l u t i o n s f o r O i l & G a s A.O.Sveen, NTNU 2011 Man må ofte ting i sammenheng før en oppdager at det kan være spesielle feilsituasjoner Fail Safe I/O Modules Development of interfaces to field devices

52 S o l u t i o n s f o r O i l & G a s A.O.Sveen, NTNU 2011 Det er utrolig hvor lite komplisert det skal være før noe kan gå galt (eksempel på bruk av kretsen fra foregående slide) Fail Safe I/O Modules Development of interfaces to field devices

53 S o l u t i o n s f o r O i l & G a s A.O.Sveen, NTNU 2011 u Man - Machine interface for daily use are the Operator Stations (but Bill Gates deliver no SIL3 solutions) Operator interface to SIL3 u Operator Stations with commands to SIL3 High end servers and operator stations, with redundancy and extensive diagnosis Special TÜV approved procedure for safe commands from operator stations to F-area (safe island) for SIL3 commands to controller. u CAP solutions ensures HMI interface to SIL3 LED elements connected to SIL3 remote I/O Necessary information for an emergency situation Necessary input elements to put the process to safe state

54 S o l u t i o n s f o r O i l & G a s A.O.Sveen, NTNU 2011 CAP or Matrix / Mimic to SIL3, simple and hardwired Simple solutions Pushbuttons lamps and switches are lifting and maintaining the SIL for the total HMI

55 S o l u t i o n s f o r O i l & G a s A.O.Sveen, NTNU 2011 CPU-Software Architecture F-User Program F-Control Blocks F-User Blocks Standard- User Program Standard- Operating System F-Standard- blocks F-System- blocks CommunicationsSelf tests Program execution Safety-relevant sections of the operating system Safety-relevant System Func. Calls Safety-relevant Self tests F-Access protection Program execution

56 S o l u t i o n s f o r O i l & G a s A.O.Sveen, NTNU 2011 S7-F Concept, Double processing in diverse environments Multi-channel storage of safety-critical data in instance DBs in the CPU, e.g. as word-oriented complement COMP Multi-channel processing of the safety function in F-FBs by SP7-ASIC of the CPU Standard operation on DATA Multi-channel operation on COMP CPU-internal comparison in the output driver to improve error locating Error handling: disable outputs and stop CPU CPU-external comparison in receiver (F-output modules and processing F- CPUs) Error handling: safe substitute values and error message DATA 0 1 COMP FFFF H COMP 0H0H CRC DATACOMP Comparison Data Safety-related message     Bit-AND in bit arithmetic logic unit Word-OR in ALU ConvertCopy Instead of redundancy of HW, Siemens Safety System runs redundant SW on same HW.

57 S o l u t i o n s f o r O i l & G a s A.O.Sveen, NTNU 2011 Time redundancy and instruction diverse processing Operands Encoding Diversity Operands Operation Diversity Operation Result Diversity Result Comparison Stop Time Time redundancy A, B (Bool) /A, /B (Word) C D = /C At D  /C AND OR Time redundancy and Diversity instead of hardware redundancy S7-F Program Concept Extensive comparision and monitoring Logical program execution and data flow monitoring Bool and Word Operations processed in different parts of the CPU 2 independent hardware timer

58 S o l u t i o n s f o r O i l & G a s A.O.Sveen, NTNU 2011 Programming Graphical programming CFC acc. to IEC 1131 CFC F-Library Certified (TÜV) function blocks Links are structs

59 S o l u t i o n s f o r O i l & G a s A.O.Sveen, NTNU 2011 Simplified ESD Program Overview, s ample CFC HMI OS skjerm Normal program Safe program

60 S o l u t i o n s f o r O i l & G a s A.O.Sveen, NTNU 2011 Engineering tool Program Protection CFC Enabling of the Failsafe function of the CPU 417-4H or 414-4H Read/Write protection with password

61 S o l u t i o n s f o r O i l & G a s A.O.Sveen, NTNU 2011 Program protection Program Signature CFC Signature of F-Program for TÜV Certification. Program taken out of CPU cannot be downloaded unless carrying the correct signature The signature is generated by the programming tool, and is changed after every change of the program

62 S o l u t i o n s f o r O i l & G a s A.O.Sveen, NTNU 2011 Programming Comparison of existing and changed program CFC Comparison of different F-program versions Deviations shall be checked before download of change

63 S o l u t i o n s f o r O i l & G a s A.O.Sveen, NTNU 2011 Hardware Configuration CPU Parameters n Safety-relevant parameters Set up protection level Activate safety operation

64 S o l u t i o n s f o r O i l & G a s A.O.Sveen, NTNU 2011 Hardware Configuration F-DO Parameters n Safety-relevant parameters

65 S o l u t i o n s f o r O i l & G a s A.O.Sveen, NTNU 2011 Enabling of the failsafe function Signal evaluation: 1oo1 (SIL 2) 1oo2 (SIL 3) Engineering Failsafe I/O Modules, diagnostics is set due to SIL

66 S o l u t i o n s f o r O i l & G a s A.O.Sveen, NTNU 2011 Communication concepts to SIL3 /2/1 u PROFIBUS DP / ProfiSafe for communication to approved ProfiSafe equipment, SIL3 / 2. F-SM remote I/O modules Other S7 400F or S7 300F nodes u Drivers for Ethernet communication to S7 F nodes, SIL3. Drivers for communication on Ethernet between safety programs in S7 nodes. u Communication from OS to safety program to SIL3 Special routine and function blocks for verified command from OS to F-area (safe island). u Combination of PROFIBUS DP /PROFIBUS PA to SIL 2/3

67 S o l u t i o n s f o r O i l & G a s A.O.Sveen, NTNU 2011 High Available Communication (not required to achieve SIL) Redundant optical ringbus S7-400H Single controller PS CPU CP CPU PS Bus Redundancy replacement diagram:

68 S o l u t i o n s f o r O i l & G a s A.O.Sveen, NTNU 2011 SIMATIC ET 200M B+B Redundant system with SIMATIC S7- 400FH AIDIDO AI DIDO AO AI B+B Redundant Ring Safety Communications

69 S o l u t i o n s f o r O i l & G a s A.O.Sveen, NTNU 2011 enabling failsafe fieldbus applications.... Basic concepts for communication to SIL3 and SIL2

70 S o l u t i o n s f o r O i l & G a s A.O.Sveen, NTNU 2011 Standard- I /O Standard Control „Black/Gray Channel": ASICs, Links, Cables, etc. are not safety relevant "ProfiSafe": Parts of the safety critical communications systems: Adressing, Watch Dog Timers, Sequenzing, Signatur, etc. Safety relevant, but not part of the ProfiSafe-Profils: Safety I/O and the Safety Control Systems Safety Input Safety Control Safety Output Safety-Layer e.g.. Diagnostics Program Non safety critical functions, like e.g. diagnosis Basic concepts for communication to SIL3 and SIL2 Add required safety layer to a standard protocol

71 S o l u t i o n s f o r O i l & G a s A.O.Sveen, NTNU 2011 The measures must be executed and monitored inside one failsafe unit Failure type: Remedy:Sequence Number Time Out with Receipt Codename for Sender and Receiver Data Consistency Check Repetition Deletion Insertion Resequencing Data Corruption Delay Masquerade (standard message mimics failsafe) X X X X XX X XX X X XX Failure Types and remedial Measures... X FIFO failure within Router Basic concepts for communication to SIL3 and SIL2 Content of required safety layer must cover possible failures

72 S o l u t i o n s f o r O i l & G a s A.O.Sveen, NTNU 2011 SSSSSS Standard-Message SDLELErSDDASAFCFCSED 68H... 68H H Sync time 33 TBit Data Unit = Standard- or Failsafe-Data Bytes TBit= Clock-Bit = 1 / Baudrate SD= Start Delimiter (here SD2, var. Data Length) LE= Length of Data LEr= Repeated LoD, not in FCS DA= Destination Address SA= Source Address FC= Function Code (Type of Message) LE Data Unit= Failsafe-Data max. 244 Bytes FCS= Frame Checking Sequence (across data within LE) ED= End Delimiter SB= Start-Bit ZB0...7= Character-Bit PB= (even) Parity Bit EB= Stop-Bit SBZB 0 ZB 1 ZB 2 ZB 3 ZB 4 ZB 5 ZB 6 ZB 7 PBEB 1 Cell = 11 Bit Standard Profibus DP Message...

73 S o l u t i o n s f o r O i l & G a s A.O.Sveen, NTNU 2011 S SSSSS Standard-Message-Frame (user telegram) Max. 244 Bytes DP-Data F-I/O-Data Status / Controlbyte CRCSequence Number across F-Data and F-Parameter Sender based Counter Max. 12 / 122 Bytes 1 Byte 2/4 Bytes *)1 Byte Standard- I/O-Data (240/238 - F-Data) *) 2 Byte for a max. of 12 Byte F I/O data 4 Byte for a max. of 122 Byte F I/O data... and a ProfiSafe Message... (the extra layer included in the user telegram)

74 S o l u t i o n s f o r O i l & G a s A.O.Sveen, NTNU 2011 PROFIBUS PA Fieldbus solution to SIL 1/2/3. u ProfiSafe PA, TÜV certified SIL 2/ 3 (2007) u SINTEF Study "Evaluation of PROFIBUS PA against SIL1 / 2 requirements (2000).

75 S o l u t i o n s f o r O i l & G a s A.O.Sveen, NTNU 2011 PROFIBUS PA with PROFISafe Redundancy n Ring architecture with Active Field Distributor PROFIBUS DP M AFD Active Field Distributor AFD PROFIBUS PA IM 157, redundant DP/PA coupler, redundant (M = master)

76 S o l u t i o n s f o r O i l & G a s A.O.Sveen, NTNU 2011 PROFIBUS PA with PROFISafe Voting PROFIBUS DP 2oo3 1oo2 S7-400FH DP/PA Coupler, redundant IM 157, redundant

77 S o l u t i o n s f o r O i l & G a s A.O.Sveen, NTNU 2011 Fail-safe CPU – CPU Communication n The safety-oriented CPU-CPU communication via S7 connections with the send/receive blocks: u F_SENDBO/F_RCVBOTransfer of 20 F_BOOL u F_SENDR/F_RCVBRTransfer of 20 F_REAL

78 S o l u t i o n s f o r O i l & G a s A.O.Sveen, NTNU 2011 logic operations Bin. OActuatorSensor Bin. I Anal. I 15 % 1 % 100 %, total figure for allowed PFD (Probability of Failure on Demand) Safety Control Loops and Residual Error (PFD) Probability.... e.g. Safety Integrity Level (SIL) 3 : / h (Share of ProfiSafe: 1% = / h) logic operations Bin. OActuatorSensor Bin. I Anal. I within one PLC 1 % (Profisafe share of total for SIL3)

79 S o l u t i o n s f o r O i l & G a s A.O.Sveen, NTNU 2011 Andre SAS krav for et typisk nettverk, Safety / Security Typisk SAS nettverks arkitektur

80 S o l u t i o n s f o r O i l & G a s A.O.Sveen, NTNU 2011 Standarder, anbefalinger  ISO / ISO / ISO  ISA S99  OLF-104  OLF-110  OLF-123  ISA Security Compliance Institue: ISA Secure  INL Security Lab (Idaho National Lab)  LOGIIC (Linking the Oil and Gas Industry to Improve Cyber Security ) Andre SAS krav for et typisk nettverk, Safety / Security Mange standarder, forsvar i dybden

81 S o l u t i o n s f o r O i l & G a s A.O.Sveen, NTNU 2011 Ganske mye utstyr / SW for security i et komplett anlegg

82 S o l u t i o n s f o r O i l & G a s A.O.Sveen, NTNU 2011 Vil du ha SIL3 på din egen PC Vi starter med en standard PC og en programpakke + litt safe I/O Standard PROFIBUS DP or PROFINET IO Standard Programming- Software STEP 7 Standard Remote I/O Failsafe Programming- Tool Distributed Safety Failsafe I/O Modules PROFIsafe Failsafe Application Program F Soft PLC

83 S o l u t i o n s f o r O i l & G a s A.O.Sveen, NTNU 2011 Først må du sjekke om din PC er egnet for formålet Så kan du laste nødvendig SW, og sette inn snitt for PROFIbus n Tar min n Har den en timer, RTC på n Interupt 8? (normalt ok) n Last SW n Win AC RTX F er installert på Windows XP Prof / eller er ”embedded” n Koden løper på en ekstra ”realtime kernel, IntervalZero RTX”

84 S o l u t i o n s f o r O i l & G a s A.O.Sveen, NTNU 2011 n Coded Processing n Time redundancy and diversity instead of structural redundancy Divers Operation Operation CodingComparison Divers Operators Operators Divers Output Output Stop by D ≠ /C D = /C C A, B /A, /B OR AND Time redundancy Time Baserer seg på tidligere omtalte prinsipper

85 S o l u t i o n s f o r O i l & G a s A.O.Sveen, NTNU 2011 z c = x c + y c + 1 z f = x f + y f Data x f Coded x c F-DI F-CPU F-DO Plus Minus uP LeftuP Right PSF Input Driver F-CTRL 1 F- CTRL2 F FBs STEP 7 F-Coded FBs PSF Output Driver uP Left uP Right PROFIsafe telegram CRCData PROFIsafe telegram CRCData Wrong CRC -> PROFIsafe Stop or -> CPU Stop Bad Baserer seg på tidligere omtalte prinsipper

86 S o l u t i o n s f o r O i l & G a s A.O.Sveen, NTNU 2011 WinAC RTX F Ditt eget Moholt SIL3 anlegg

87 S o l u t i o n s f o r O i l & G a s A.O.Sveen, NTNU 2011 Tusen Takk for at Dere gadd høre på! Arnt Olav Sveen For mer info se: u First with Integrated Control & Safety u First with Flexible, Scalable, Distributed Architecture u First Safety Lifecycle Management Tool - Safety Matrix u First and Only Fully Integrated Safety Fieldbus u First and Only SIL3, zone 1 I/O u First and Only SIL3 on your own PC


Download ppt "S o l u t i o n s f o r O i l & G a s 100.1 A.O.Sveen, NTNU 2011 Siemens Safety Systems. NTNU 14.03.2011, Arnt Olav Sveen Løsninger Applikasjoner »Kontroller."

Similar presentations


Ads by Google