1. 6 July 2000CSAM Team1 CERN Safety Alarm Monitoring Invitation to Tender Strategy CERN Safety Alarm System Supervisory Board 3st meeting CSAM project team

2. 6 July 2000CSAM Team2Outline u IEC 61508 basics S. Grau ST/MO u CSAM Safety requirements F. Balda ST/AA, A. Chouvelon TIS/GS, S. Grau, ST/MO u Contract Strategy P. Ninin ST/MO

3. 6 July 2000CSAM Team3 IEC 61508 basics u Functional safety  Analysis of your system that provides you a justified confidence on the delivered service u Functional safety of electrical / electronic / programmable electronic safety-related systems structured via a Safety Lifecycle

4. 6 July 2000CSAM Team4 How should the system diagnose errors ? Which auto tests should be defined? What should be the maintenance politic ? Will the user know if some functions are not available ? How much time do we accept system down-time per year ? Can the system become dangerous in case of functional or transmission path failure ? Reliability study Maintainability study Security study Availability study IEC 61508 basics

5. 6 July 2000CSAM Team5 u Safety Integrity Level (SIL)  Associated to a function and to the risk that the function is dealing with SIL 1 SIL 2 SIL 3 SIL 4 Non redundant architectures with PLCs Integrated control system for subways Equipment of Electrical Substations Sub-system of boiler safeties for thermal power plants IEC 61508 basics

6. 6 July 2000CSAM Team6 Why should we use it ? u Objectives definition è Accessible, realistic è quantify + Domain of tolerance or variability u Specification of requirements è Functional, service quality, dysfunctional behavior u Anticipate degraded modes and control the risks u Justify confidence in the system è Based on: experience, expertise, forecast, methods and standards. IEC 61508 basics

7. 6 July 2000CSAM Team7 AIMS OF THE SPECIFICATION: u Define a safety strategy both for the team and CSAM developers u Trace a path for a RAMS-validated system u Prepare specific requirements u Be consistent with IEC - 61508 u Use validated risk analysis techniques CSAM Safety Requirements

8. 6 July 2000CSAM Team8 Contents Safety Requirements Based on IEC - 61508 Constraints Undesired Events Objectives Safety functions and SIL assignment Risk analysis strategy CSAM Safety Requirements

9. 6 July 2000CSAM Team9 u Basic safety conditions that the system must satisfy in order to be approved u Example: “The system must be in operation 24 hours a day, 365 days per year” 1.- Safety Constraints CSAM Safety Requirements

10. 6 July 2000CSAM Team10 u Any accident, simple or complex event that the system users or the community want to avoid u Example: “Total loss of the system” u ACTION:  Foresee consequences  Require a frequency to make the risk acceptable  ALARP model (As Low As Reasonably Practicable) 2.- Undesired Events CSAM Safety Requirements

11. 6 July 2000CSAM Team11 The consequence on the process can be "Catastrophic " 1: Assign a "Consequence Category" Total loss of the system 2.- Undesired Events: technique CSAM Safety Requirements

12. 6 July 2000CSAM Team12 The maximum allowed frequency is "Remote" 4: Individuate threshold for tolerable risk 3: Use the "Risk Matrix " 2: Define risk classes Risk is no more “Intolerable” 2.- Undesired Events: technique CSAM Safety Requirements

13. 6 July 2000CSAM Team13 The "Required frequency" for the UE is "Improbable" or "Negligible" 6: Individuate the "Required frequency" 5: Individuate the "Maximum frequency" meaning Common use: Decrease the “Maximum frequency” of 1 or 2 orders of magnitude 2.- Undesired Events: technique CSAM Safety Requirements

14. 6 July 2000CSAM Team14 > > u Risk = Frequency x Consequence u Individual risk and collective risk 2.- Undesired Events: Risk recall CSAM Safety Requirements

15. 6 July 2000CSAM Team15 Frequency of the recorded events (LEP period): u Fire / small system(minor) ~5/an u Fire / installation (severe)~1/an u Fire / building (major)~2/5ans u Fire / experience (catastrophic)? u Fatalities (catastrophic)6/15ans u Injured (major) ~10/an 2.- Undesired Events: Statistics at CERN CSAM Safety Requirements

16. 6 July 2000CSAM Team16 2.- Undesired Events: Consequences Categories CSAM Safety Requirements

17. 6 July 2000CSAM Team17 u Detailed conditions which the system is expected to cope with u Example: “Any Undesired Event or chain of events leading to a similar scenario should be characterised by a frequency of at least one or two orders of magnitude less than the one required for an acceptable risk” 3.- Safety Objectives CSAM Safety Requirements

18. 6 July 2000CSAM Team18 4.- Safety Functions CSAM Safety Requirements

19. 6 July 2000CSAM Team19 4.- SIL Assignment CSAM Safety Requirements

20. 6 July 2000CSAM Team20 4.- SIL Assignment CSAM Safety Requirements

21. 6 July 2000CSAM Team21 Example Function 1: > Related Undesired Events (UE): UE-8: Safety actions failure UE Consequences category: Catastrophic Event likelihood: Frequent SIL assignment: SIL 3 4.- SIL Assignment CSAM Safety Requirements

22. 6 July 2000CSAM Team22 Preliminary Risk Assessment (PRA) Risk Analysis Keep into account the Maintenance politics Objectives: Identify and locate the hazards Individuate the weak points Point out causes and consequences of hazards Find corrective measures if necessary Set special protection systems if necessary Methods: HazOp, FMECA, Qualitative Fault Trees Objectives: Quantify the probability of foreseen accidents Quantify the consequences Estimate the risk Quantify reliability and availability Validate the good working of the system Verify that constraints are respected Iterate the process if corrective actions have to be undertaken Methods: Fault Trees, Event Trees, Markov graphs, Petri nets 5.- Risk analysis strategy for CSAM developers CSAM Safety Requirements

23. 6 July 2000CSAM Team23 u A series of precise requirements have been defined u Requirements are based on IEC - 61508 and on widely used safety techniques u A risk analysis strategy has been outlined for CSAM developers u Worst foreseen accidents have been identified u Safety Integrity Levels have been assigned Summary CSAM Safety Requirements

24. 6 July 2000CSAM Team24  Product satisfying functional safety criteria of Availability, Reliability, Maintainability, Security  Upgrade of existing safety alarm systems Modularity, Standardisation, Integration  Operational and Maintenance service on a “per-alarm” driven and controlled by system performance indicators  INB compliant The Strategic Objectives Contract Strategy

25. 6 July 2000CSAM Team25 1 contract -> 3 Work Packages (WP) Contract Strategy

26. 6 July 2000CSAM Team26 WP Breakdown based on IEC 61508 Work Packages Breakdown Contract Strategy

27. 6 July 2000CSAM Team27 u ds The CSAM commercial strategy Contract Strategy

28. 6 July 2000CSAM Team28 u WP1: Concept validated -> payment u WP2: Migration of all Safety Zones u Bonus/Malus according to quality & deadlines u WP3: u Bonus/Malus according to system performance Results Oriented Contract Contract Strategy

29. 6 July 2000CSAM Team29 Cost based on the level of integration Alarm Integration Cost Contract Strategy

30. 6 July 2000CSAM Team30 u How the application of functional safety and the Operational and maintenance service will guarantee optimal contract performance? u The functional safety fixes clear measurable results for the functioning of the system u The O&M service has to satisfy the same functional requirements u Therefore there is an optimum when System is well functioning and Minimum O&M effort is required The CSAM commercial strategy Contract Strategy

31. 6 July 2000CSAM Team31 System is not functioning System is well functioning Two Losers: CERN and the Contractor Two Winners: CERN and the Contractor Decrease the performance Increase the O&M effort to make it functioning LOWER THE GAINImprove the performance Maintain the minimum O&M effort to keep it functioning INCREASE THE GAIN The CSAM commercial strategy Contract Strategy

32. 6 July 2000CSAM Team32 u Ds u ds The Safety Alarm Monitoring Center The Local Safety Alarms Controller The CERN Safety Alarm Network The CSAM commercial strategy

33. 6 July 2000CSAM Team33 u Documentation structure u Detailed description of the safety alarm requirements The Technical Specification structure Contract Strategy

34. 6 July 2000CSAM Team34 u Final version sent for approval to all the concerned parties u Replies expected by the end of June u Last Revision Mid-July The CSAM User Requirements Contract Strategy

35. 6 July 2000CSAM Team35 u 18 Firms replied to the MS u 10 Fully qualified u 8 visit planned to take place June/July u Three types of companies: u Nuclear u Petrol-chemical u Security (intrusion and access control, fire detection, etc.) Status of the Market Survey Contract Strategy

36. 6 July 2000CSAM Team36 u Real Outsourcing u Safety Objectives -> Contract (System, O&M) -> Result Oriented Payment u IEC 61508 as a safeguard (design, operation, benchmark) u The contractor needs to control its environment ! u Others u Open question on the Safety networks ( added in the IT2694) u IT under ST revision process, out of CERN end of September Conclusions Contract Strategy