TÜV Rheinland Industrie Service GmbH Automation and Functional Safety (AFS)

Transcription

1 Programmable Systems 1. General 2. System Structures 3. Standards 4. Conditions and Restrictions 5. Product-independent Conditions and Restrictions 6. Recommended Features of safety-related Engineering Software General There are considerable restrictions on the use of the PES, especially for the timing restrictions after faults have been detected. These timing restrictions are depending on calculations or applications. Refer to the detailed test reports of the respective TÜV test institute. The reference list represents a common list of the working group "Safety Related PES" of IQSE (TÜV Product Service) and ASI (TÜV Rheinland). It has been compiled to give end users an overview of type certified PES. The list will be updated periodically. With this reference list both test authorities fulfil the requirement given by their European standard EN and EN accreditations to publish a list of tye approved systems. All of the above mentioned PES assume that the zero signal of binary inputs and outputs represents the defined safe state for the application. All of the above mentioned PESs with the system structures 1oo1 (1v1) and 1oo2 (2v2) and test reports dated 1989 or later, provide fault tolerance for the I/O-boards. If independent groups of I/O-boards have been defined during configuration or application programming, depending upon the product, a fault localisation on an I/O-board will lead to a shutdown of the associated safety related group only. Groups of I/O-boards can only be mutually independent, if the I/O-signals connected belong to independent parts of the application. Independent means that a part of the application has no safety relation with any other parts of the application. Beginning with the publication of DIN V and DIN V VDE 0801 in January 1990 the classification and certification have been performed according to the safety categories of DIN V and the safety requirements of DIN V VDE All executed certifications take into consideration requirements of a typical application standard, e.g. furnace control. As an alternative, typical application requirements (e.g. fault models, test methods, process reaction time, fault tolerance) are used. The specific application sectors covered by the certification are listed in the test report.

2 System Structures The nomenclature for system structures describes the possible degradation behaviour after fault detection and fault localisation for the central processing units. Variations are possible due to different implementation possibilities. This table shall give a first guideline. In the I/O area different degradation mechanisms are possible and implemented on the different systems. Fault-free system Degradation 1 Degradation 2 Degradation 3 System Structure 2oo4 1oo2 1oo1* shutdown safety-related and fault tolerant *with time restriction 2oo4 1oo2 shutdown safety-related and fault tolerant 1oo3 shutdown safety-related 2oo3 1oo2 1oo1* shutdown safety-related and fault tolerant *with time restriction 2oo3 1oo2 shutdown safety-related and fault tolerant 1oo2D 1oo1D shutdown safety-related and fault tolerant with time restriction 1oo2 shutdown safety-related 2oo2 1oo1 shutdown safety-related and fault tolerant 1oo1 shutdown safety-related Part 4 of the IEC gives the defintion of: MooN : M out of N channel architecture (for example 1oo2 is 1 out of 2 architecture, where either of the two channels can perform the safety function) MooND : M out of N channel architecture with diagnostic

3 Standards The set of standards used for certification and their publishing date is specified by the report of the certificate. The following list represents a compilation of the most generic standards only. [N1] DIN V "Fundamental safety aspects for measurements and control equipment" Safety requirements according to [N1] RC 8 - highest requirements [N3] abd [N4.n]:RC 1 - lowest requirements [N2] IEC "Functional safety of electrical / electronic / programmable electronic systems (PES)" part 1 to 7 (2000) Safety requirements according to [N2] SIL 4 - highest requirements SIL 1 - lowest requirements [N3]DIN "MC Protection Equipment" [N4.1] DIN V VDE 0801 "Principles for computers in safety-related systems" [N4.2] DIN V VDE 0801 Amendment A1 [N5] DIN VDE 0116 "Electrical Equipment for Furnaces" [N6.1] DIN VDE 0160 "Electronic Equipment used in Electrical Power Installations" (corresponds to pren 50178) DIN VDE 0110 "Insulation co-ordination for equipment within low-voltage systems; Fundamental requirements" part 1 [N6.2] EN "Programmable Controllers" Part 1; "General Information" Part 2; "Equipment requirements and tests" [N7.1] pren "Electromagnetic compatibility (EMC); Generic immunity standard Part 2: Industrial environment" [N7.2] EN "Electromanetic compatibility (EMC); Generic emission standard - Part 2: Industrial environment" EN "Limits and methods of measurement for radio disturbance characteristics of ISM radio frequency equipment", severity: limit class A [N8] DIN IEC 68 / DIN EN "Basic testing procedures", set of standards Part 2-1 / Cold Part 2-2-A / Dry heat Part 2-3 / Dump heat, steady state Part 2-6 / Vibration, sinusoidal Part 2-27 / Shock

4 Conditions and Restrictions General When planning a safety instrumented function with a safety-related programmable controller, the safety section of the manufacturer s handbook is to be used. The tested and certified components are listed in the test reports fo the TÜV test institutes. Requirements related to other components of installation will be specified by the application and have to be determined and assessed during the local inspection. Planning / Protecting The configuration and the operation of the safety-related programmable controller should be based on a hazard analysis. The protective targets of the realised application shall be defined. Care is to be given to the possibility of a safety shutdown whilst the control process is starting up or closing down. The behaviour of the programmable controller in all different operating conditions, error conditions and restarting should to be defined. The conditions for use specified by the manufacturer are to be observed. Particular attention is to be paid to: o Protection from excessive voltage and EMC; o Environmental conditions; o Ex-protection - if required. Care is to be taken that system parameters which may have an affect upon safety are set correctly in safetycritical applications, particularly: o Requirement class / Safety integrity level o Maximum cycle time o System configuration o Process safety time, interval for foreground tests and background tests o Time limit for monitoring of the communication o Access limitations for external communicators (e.g. programming equipment and process control systems) o I/O configuration and connections o Reaction to I/O errors o Reaction to system errors Equipment and components which are used must be certified. Only safety-related components may be used in safety-critical operation. Either the equipment in the shutdown path must be made of type approved fail safe components, or the application must have two separate, independent shutdown paths. The safe state of an ESD must be the de-energised state or low (0) state. In general, the closed loop principle is to be maintained for all external safety circuits which are connected to the system. Signals should be dynamic where possible. Care must be taken when projecting, that non-safety related functions can never interfer with safety-related functions / components in any operating situation. The conditions and restrictions for operation in degraded mode shall observed. Typically a timing restriction should be planned for the degraded mode of operation. The low state of the output components (current and voltage) is to be considered for the appropriate application. In systems with components which are to be serviced cyclically (e.g. backup batteries) administrative measures shall ensure that the required work is carried out. Regarding cabling the local respectively national installation and equipping requirements are to be adhered to. Programming Application programming is to be carried out in accordance with the information in the safety section of the manufacturer s handbook. Safety orientated configuration and application programming must be carried out with safety tools and checked by a competent person who is independent of the application developer. Care is to be taken that the details of the planning and engineering (system parameters which may have an affect

5 upon safety) are set correctly in safety critical application. Programs and data which are relevant to safety must be separated from programs and data which are not relevant to safety. Safety paths are to be marked in logic plans and parameter lists. Proof of freedom of interaction (interference-free) of non-safety-related program parts must be shown for every modification. System reaction times to external requirements are to be tested. System reaction times to internal errors are to be taken into account. Discrepancy times are to be specified application-specific, as far as is necessary. Conformity of the programs that are loaded in the safety-related programmable controller with the programs theoretically checked previously must be proved. This especially includes proof that the compiled version of the programs, which are to be jointly used, provide the specified safety functions. The correct operation of the safety related program should to be shown by means of a complete functional test. The usage a certified revision comparator during the test of modifications is strongly recommended. Operation Safety relevant error reactions which only lead to signalling alarms are only permitted under supervised operation. On-line modification reduces the safety by its nature and are not supported by TÜV. On-line modifications are under the sole responsibility of the operator. Modification of the system software (operating system, I/O-drives, diagnostics, libraries e.g.) are subject to the type certi fication. In addition to the printed documentation of the application program, copies of the program must be stored on write-protected data carrier. PID and other control algorithms must not be used for safety relevant functions. If it is intended to take safety-related functions temporarily out of operation for maintenance (so-called "maintenance ovrride) then: o This factor is to be taken into account at the planning stage. o It is to be ensured that the plant operator is clearly informed about this operating condition. o It is to be ensured that the plant operator still receives sufficient information about the safety status of the plant. o A detailed instruction is to be produced for switching this special condition on or off. It is recommended, to consider the actual version of the document "Maintenance Override" of TÜV Süddeutschland (TÜV Product Service) and TÜV Rheinland.

6 Product-independent Conditions and Restrictions Specification of Safety Instrumented Loops Specification based on the hazard analysis Safety functions, immediate safety states, process safety time (PST) Structure of each safety instrumented loop Independent control and protective structure of the plant automation Interacting of plant subsystems Consider a safety shutdown while the process is in start up or controlled shutdown down. Specification of organisational measures (operation, inspection) Hazards to be covered by full / major responsibility of the plant operator. Suitable Ex-protection Overvoltage, surge and other EMC protection Observe the conditions of use specified by the manufacturer Example: Monitored threshold limits and leakage current of the digital I/O modules Electrical insulation provided by the I/O moduls Specified environmental stress conditions Current loop principle (de-energized to trip, 4-20mA) Signals should be dynamic, to the extend possible Configuration of Safety Instrumented System Follow the system documentation incl. safety manual Follow the conditions and restrictions stated in the TÜV report to the certificate Configuration based on the specification of the safety functions Check by a competent and independent person (four eye principle) Separate safety-related and non-safety-related programs and data Highlight the safety-related paths and data in the logic diagrams and parameter lists Configuration with the delivered safety engineering tools only Specify the safety-related configuration I/O configuration, process safety time (PST), SIL, max. cycle time, System reaction to internal failures and failures of the periphery Application-specific processing of the discrepancy of inputs Select system structure suitable for the required availability, SIL and PST (Certified systems provide increased availability but rare software and hardware failures can lead to a complete shutdown) Time limitation of degraded operation Only certified safety-related modules for safety functions Interference-free modules ("Rückwirkunsfrei") for non-safety-related functions Communication Safety-related communication is currently only supported between systems of the same family- vendor-independent safety bus specifications are currently under certification Communication with other non-safety-related systems can be made safe only by additional measures in the application program Access control for external communication partners (Examples: Engineering work station and DCS) Communication adds to the safety-related reaction time Specify and configure time limit for the monitoring of the communication Unfavourable communication structures and parameters may reduce the plant availability

7 Application Programming Program based on logic diagrams or cause + effect matrices only Program with the delivered safety engineering tools only (if no safety engineering tools exist, each path must be fully tested) Avoid instruction lists / mnemonics Use function block diagrams, cause + effect matrix or sequential function charts Use proven-in-use or pre-tested function blocks Maintain a library of such blocks Keep the reaction time of the application program constant Test of the maximum system reaction time to all external events Test the re-start after power failure in all operating modes Check modifications always with the certified revision comparator Check during commissioning that the compiled configuration loaded in the safety instrumented system and the configuration theoretically checked previously are equal Operation and Modifications Safety relevant fault reactions which only lead to signalling are only permitted under supervised operation. (Operator must have enough information and time to react) Maintenance Override requires (operator-specified) guidelines Plant operator must nevertheless receive sufficient information about the safety status of the plant see the Document "Maintenance Override" Hazards associated with on-line modifications On-line modifications reduce safety by its nature. Full functional testing should be done at simulators or at a similar plant. Timing restriction after degradation The generic standards ( IEC and DIN in companion with DIN 0801) don't give exact figures or guidelines for a system, when a fault has been detected in the system, and the system strucure has been degraded as a result of that fault. For ESD applications, where the AK system according to the DIN is used, only supervised operation should be possible after reaching a single channel mode of operation. Online repair is possible. If not repaired, single channel operation is possible with the following maximum timing : - in AK 5 : shutdown after a maximum of 72 hours of supervised operation in single channel mode - in AK 6 : shutdown after a maximum of 1 hour of supervised operation in single channel mode

8 Recommended Features of safety-related Engineering Software Features to facilitate configuration, programming and tests Encapsulation of program units Libraries of pre-tested, application-specific function blocks Standardised programming languages, e.g. as a subset of IEC (Function blocks, sequential function charts, strong data type checking) Cause + effect matrix programming Use of Simulator Features to support modifications Encapsulation of program units Function blocks without global variables Safety-related and non-safety-related program and parameter are secrued by individual CRC-checksums Revision comparator Version-Control System with individual access rights Configuration checker (Example: is the proposed online-modification allowed?)