PLCs in diving systems: a life cycle Presented by Ed Gardyne of Safewell. Managing Lifecycle Safety & Performance of PLC s Used on Dive Systems

Transcription

1 PLCs in diving systems: a life cycle Presented by Ed Gardyne of Safewell

2 Some Background Founder of Safewell specialists in the safety of compressed air and gas used for respiratory protection and critical processes 30 Years Experience in the Application of PLC s in Various Sectors Member of Institute of Measurement and Control Working as part of the Shell Diving Safety Assurance Team since 2009 carrying out audits on various DSV s Helping to develop the Shell Dive System Assurance Process DSAP Assisted Several Operators and Contractors in UK & Norway carry out audits on automated DSV s and Incident Investigations e.g Skandi Arctic Bell Drop

3 Original Patent for a PLC System

4 Early PLC Development History In 1968 General Motors in the US wrote a specification for a programmable controller to replace large unwieldy relay logic panels Contract was won by Bedford Associates who created the Modicon 084 and sold 1000 units Dick Morley Allen Bradley began R&D in 1969 and filed a patent in 1974 for a programmable logic controller PLC becoming market leader In intervening years many suppliers developed PLC technology Current market leaders are Siemens, Allen Bradley (Rockwell Automation) & Schneider

5 What Does a Modern PLC Look Like? Modern PLC uses modular building blocks to integrate a system Processor with App Software Communication Network Input / Output Modules to Sensors, Instruments, Actuators Power Supply PLC Programmable Logic Controller Chassis in Enclosure With Ethernet switches built automation systems can now be easily networked with business IT systems!

6 And Modern PLC Architectures?

7 Programming Languages?

8 Programming Languages?

9 Current PLCTrends? Market Research Demands More Safety Integration in PLC s Siemens SIMATIC Safety CPUs +17% in FY 2013/14 (Standard CPUs + 2,8%)

10 PLC Safety - Current Trends? Standard PLC s now with safety integrated Implement process and safety control in a single PLC Fail safe IO modules with Enhanced Hardware Diagnostics Implement Safety Logic in PLC using Software instead of external safety relays Use of proven certified library safety code and firmware with 3 rd party approvals e.g. TUV Auto Generated Standards compliant documentation Reduced safety hardware and wiring Improved Development Tools with PLC Simulation Reduced debug time and more rapid commissioning There is No excuse to build an unsafe automated dive system using PLC s

11 PLC Safety - Certification? Functional safety certified to EN Certified according to EN nd Edition and EN ISO PL e

12 Our Objectives Today Education and Awareness Understand the Pervasive Impact of PLC s on Dive Systems and the Benefits! Appreciate & Focus on the Invisible? Risks when Using PLC s Generate a Clear Mind set for Effective Life Cycle Management of PLC s Tune all this into the existing DSV assurance and audit cycles Stimulate Open Discussion of the Issues Remove the Fear Factor - The people in the industry already have the technical capability to deal with this After All It s Not.. Hard to Manage This When You Become Aware

13 The Invisible Risks ENSURE VISIBILITY OF SAFETY RISKS PREVENT COMPLACENCY

14 Why is This Important? PLC AUTOMATION UBIQUITOUS,PERVASIVE, DISRUPTIVE e.g. Drilling Industry When Automation changed things in the 80 s and 90 s The Way It Was The Way It is Now & Getting More Automated!

15 And In The Diving Industry? Modern DSV s designs are highly automated 7 Atlantic, Scandi Arctic,7 Havila, are good examples Automation is applied to many processes and machinery Systems are complex and more difficult to audit unless you have the necessary knowledge and experience The control software may be invisible & only understood by a few

16 Extent of Automation on DSV s Bell launch and recovery systems Bell Utilities Compression / Decompression Controlling gas pressure Oxygen Concentration Control CO2 Monitoring / Scrubbing Humidity & Temperature Monitoring Environmental Monitoring Data Logging Warnings / Alarms HPU Control ROV, DP Cranes, Pipe Lay Intelligent Drives, Instruments DSV 7 Havila (image courtesy SS7) Experience Shows PLC s Turn Up When Least Expected!

17 Extent of Automation on DSV s What does an automated DSV look like from an auditors perspective? Like This Example - DSV 7 Havila Dive Control Room (images courtesy SS7)

18 Extent of Automation on DSV s What does an automated DSV look like from an auditors perspective? And This - DSV 7 SAT Control Room (images courtesy SS7)

19 Extent of Automation on DSV s And From a PLC Engineers Perspective?

20 Benefits of Automation on DSV s? Safer Diving Operations using high integrity (certified) safety hardware and software to implement risk mitigation and bring systems to a safe state Providing advanced tools to manage complex risks e.g. running several chamber profiles simultaneously Providing sophisticated instantaneous oversight over complex operations Capturing data for analysis and improvement Eliminating human error during repetitive work tasks which may arise from tiredness or temporary lack of focus Thought: These days commercial air flights are highly automated but we don t think twice about boarding?

21 This Raises Some Lifecycle Questions How engaged and aware are senior management? How well are automated PLC based dive systems safety assessed? How good are the technical specifications? Competency and quality assurance of designers, manufacturers, engineers, operators, class bodies, auditors Hardware and Software testing and life cycle software configuration control Competence of Maintenance Technicians / Availability of Spares / Tools System Security Management of Change during system life cycle

22 IMCA: Industry Response to PLC s To Date Issued Draft Addendum to IMCA D 024 And an Information Note in August 2012

23 Industry Response to PLC s To Date - OGP OGP working group developing dive vessel safety assurance audit tool DSAP for use by all operators and dive vessel owners document in draft Objective is to develop a consistent and systematic audit approach Shell currently piloting the tool during DSV audits

24 Overall Objectives The objective was / is to create awareness and drive change in the management of risk in automated PLC based diving operations by embedding a life cycle approach to management of PLC based dive systems The functional safety standard IEC61508 was chosen as a basic reference standard for the life cycle model This does not mean every system will have a SIS with a SIL greater than 0 more later on this. May just have redundancy with higher availability to eliminate SP failures IEC61508 has already been adopted by some companies in the diving sector and embedded in their ISO9000 system

25 What is IEC61508?

26 Relationship Between Safety Standards IEC61508 underpins other standards SAFETY RELATED PARTS OF A CONTROL SYSTEM SAFETY INSTRUMENTED SYSTEM SAFETY RELATED ELECTRICAL CONTROL SYSTEM With its life cycle map it has a foot in either camp i.e. machinery and process

27 Benefits of IEC61508? Guidance on the use of Electrical, Electronic and Programmable Electronic Systems which perform safety functions Comprehensive approach involving concepts of safety life-cycle and all elements of a protective system Risk based approach leading to determination of Safety Integrity Levels (SILs). Safety measures adopted are proportionate to the calculated risk Covers the Safety Related Loop end to end International standard allowing end users worldwide to operate in accordance with common standard providing confidence to system owners, users and regulators Systematic and technically sound approach Coherent based on commonly accepted underlying principles based on sound engineering logic and practise

28 What does SIL mean? SIL = Safety Integrity Level SIF = Safety Instrumented Function

29 To Determine an Overall SIL? Safety Function Design 1 Safety Function Design 2 Safety Function Design 3

30 Safety Requirements Specification Typical Index of the SRS Identify protection layers Identify each SIF; provide a functional description Describe Methodology Used to Determine SIL SIL Target Allocation Assessment Describe Each Safety Related Function Actions on Detection of Faults (C&E) Definition of Safe State / Response Time How to Reset SIS after shutdown Interfaces with operators / other systems Modes of Operation SIS Inhibits/ Overrides/ Maintenance By Passes Environmental Conditions Impact on SIS

31 Do You Need a SIS? Possibly Not if you have layers of protection. Consider a PLC used for Bell LARS It is programmed with sequential logic to launch and recover the bell If a single PLC fails, there may be redundancy in the design to allow the LARS operation to continue If both PLC s fail there may be a back up independent system allowing emergency recovery If the back up system fails there may be an option to directly control the bell winch or use the guide wire winch for recovery or a crane or a second bell to recover the divers

32 Do You Need a SIS? Possibly Not but let s say on a PLC used for Bell LARS It is programmed to monitor the bell winch load cell as a back up to prevent a bell drop incident by applying braking over X tonnes (in addition to E- Stop functions) If this was the only mitigation then a SIS would be required The PLC used would have to have a higher safety integrity and fail safe attributes and be suitable for a SIL along with all other components of the SIF This really need to be analysed during the development of the safety requirements specification i.e. at the outset of the system design

33 PLC Software? The PLC software is the most invisible component of an automated dive system but there are safe standard techniques to assure safety

34 Why Life Cycle?

35 IEC61508 Life Cycle Process DSAP Tool Uses Checklists for Each Process Module to Validate Compliance This is cradle to grave process which must be applied consistently to assure safety

36 DSAP Checklist 1 Extent of Awareness? Do You Have PLC s on Your Dive Vessel? Is there a High Level List of PLC Systems? How Extensive is the Automation? Is there High Level Management Awareness? Are the Certifying Authorities Aware? Note! -Previous Find Searches of FMEA and O&M Documents relating to automated dive systems have yielded no results for the term PLC

37 DSAP Checklist 2 The Supply Chain? Who is designing and implementing the automation system on your vessel? Convoluted Supply Chain? Dive System Knowledge? Do they Have a Good Safety Culture? Any Functional Safety Experience / Certification? Who will Provide Life Cycle Support? External Audit Results? Note! On Some New DSV builds Automation Specialists are becoming embedded in the dive equipment manufacturer s organisation to assist

38 DSAP Checklist 3 Safety Management Studies have found that the most important factor in the occurrence of accidents is the management commitment to safety and the basic safety culture (human factors) in the organisation or industry.

39 DSAP Checklist 3 Safety Management Key Initial Questions to Ask when designing automated dive systems using PLC s: Is the PLC / programmable system programmed to mitigate a known machinery or process risk to a tolerable level? Is the PLC / programmable system the primary safety barrier? Does the PLC / programmable system provide process information or data on which operational safety judgements are based? Ideally the answer is NO. If the answer is YES then a SIL assessment will be required and a Safety Requirements Specification must be produced. This will require functional safety verification by a certified FS specialist

40 Further Questions to Ask if your organisation is involved in designing automated dive systems using PLC s: Do you have the competence to manage and formally document a functional safety process? Are key members of the operational team involved in the development of the safety requirements specification? Can you challenge any assumptions made when deciding the SIL? To what extent have you the system owner delegated the safety assessment and verification of the PLC systems? Do you review and revise the safety specification during the management of change process?

41 DSAP Checklist 4 Competent Resources? Do You Have Staff Assigned to Life Cycle Management of PLC s? Are there written procedures and work instructions for PLC related work? Do staff have the necessary training & competence to manage PLC issues? Are sub suppliers audited to check their training competence and resource levels? Do Safety Cultures Align?

42 DSAP Checklist 5 Design Specifications? Who Defines the Automated Dive System User Requirements Specification - URS? Is the Functional Design Specification FDS based on the approved Functional Safety Assessment? Are these documents subject to formal document revision control during the development

43 DSAP Checklist 6 Verification & Testing? Were simulation tools used during development of the PLC systems? How Thorough was the Factory Acceptance Testing of the PLC systems? Did the FAT test both functional and safety design features e.g. PLC redundancy, diagnostics, SIL testing and validation Was the FAT documented and signed off by competent personnel Following successful FAT was PLC software version control in place & recorded? Is the PLC code open or proprietary?

44 DSAP Checklist 7 System Validation? How good are the vessel site acceptance test procedure records in relation to PLC s? Did the SAT validate both the functional and the failure modes of the automation system If a SIL is applicable were safety loops validated to assure risk mitigation Were the e-stop functions and safety relays validated and recorded? If a SIL is applicable has proof testing frequency been determined. Is there awareness that failure to proof test many invalidate the SIL

45 DSAP Checklist 8 Training, Ops, Security Do Management understand the limitations of the automated systems on their dive system? Do staff have the training and competence to understand and use the PLC systems Are PLC failure modes and back up systems fully understood? Do regular drills simulate PLC failure modes and emergency response procedures? Has system security been defined with appropriate user levels and passwords? Is there vendor remote access and if so how is this controlled & how secure is this?

46 DSAP Checklist 8 Training, Ops, Security The FAA s Flight Deck Automation Working Group warned in September 2013 of a perceived erosion in basic knowledge required to manage the flight path and called for pilots to practice flying manual during normal passenger operations. Use of automated systems has not replaced the need for basic knowledge and skills, including hand flying, instrument cross-check, system knowledge and maintaining situation awareness and aircraft state awareness. The report said that long-term over-reliance on technology may atrophy the skills needed to anticipate, monitor and react.

47 DSAP Checklist 9 Life Cycle Maintenance Do the PLC s register on the PMS with part numbers and firmware versions? Are the necessary PLC spares held on board? Do the technicians have the training and competence to carry out the tasks Do they have the tools e.g. programming software, cables etc Does the system track PLC hardware / software compatibility & obsolescence? Is the frequency of sensor failure logged and reported?

48 DSAP Checklist 10 Management of Change Is there a formal documented management of change procedure? Does it specify MOC competence & approval levels? Does it apply to all PLC hardware, software, sensor, communications & actuator changes? Does the MOC specify testing requirements following the change? Is the original safety case reviewed and updated during the MOC Is the software version control and change history log updated?

49 Conclusions The risk of using PLC s in automated dive systems is manageable The diving industry already has a strong safety culture and a mind set of continuous improvement. It just needs to apply this to PLC s The industry is now focussing its mind on this issue and can take control Operators like Shell are piloting new audit approaches and tools The trend among manufacturers and integrators is to provide safer PLC hardware with certified levels of safety reliability and diagnostics This trend extends to the use of standard certified PLC software modules again with higher reliability Integration Tools provide standards based documentation for traceability

50 LETS GET PLC RELATED RISK UNDER CONTROL YOUR SAFETY IS OUR PASSION THANK YOU Q&A