IEC Functional Safety Assessment. ASCO Numatics Scherpenzeel, The Netherlands

Transcription

1 IEC Functional Safety Assessment Project: Series 327 Solenoid Valves Customer: ASCO Numatics Scherpenzeel, The Netherlands Contract No.: Q09/04-59 Report No.: ASC R003 V1 R Assessment Version V1, Revision R3, May 29, 2012 Chris O'Brien The document was prepared using best effort. The authors make no warranty of any kind and shall not be liable in any event for incidental or consequential damages in connection with the application of the document. All rights reserved.

2 Management summary This report summarizes the results of the functional safety assessment according to IEC carried out on the: Series 327 Solenoid Valves The functional safety assessment performed by exida consisted of the following activities: - exida Certification assessed the development process used by ASCO Numatics by an onsite audit and review of the safety case (technical file) created for the initial certification. The safety case provides detailed results showing how the product and processes meet the requirements of IEC exida Certification reviewed and assessed a detailed Failure Modes, Effects, and Diagnostic Analysis (FMEDA) of the devices to document the hardware architecture and failure behavior. The functional safety assessment was performed to the requirements of IEC 61508, SIL 3. A full IEC safety case was prepared, using the exida SafetyCaseDB tool, and used as the primary audit tool. Hardware process requirements and all associated documentation were reviewed. The manufacturing quality system was reviewed. Environmental test reports were reviewed. Also the user documentation was reviewed. The results of the Functional Safety Assessment can be summarized by the following statements: The Series 327 Solenoid Valves were found to meet the requirements of SIL 3. The manufacturer will be entitled to use the Functional Safety Logo. The manufacturer may use the mark: Chris O'Brien Page 2 of 17

3 Table of Contents Management summary Purpose and Scope Project management exida Roles of the parties involved Standards / Literature used Reference documents Documentation provided by ASCO Numatics Documentation generated by exida Product Description IEC Functional Safety Assessment Methodology Assessment level Results of the IEC Functional Safety Assessment Functional Safety Management Safety Requirements Specification and Architecture Design Hardware Design Manufacturing Validation Verification Modifications User documentation Hardware Assessment Terms and Definitions Status of the document Liability Releases Future Enhancements Release Signatures Chris O'Brien Page 3 of 17

4 1 Purpose and Scope Generally three options exist when doing an assessment of sensors, interfaces and/or final elements. Option 1: Hardware assessment according to IEC Option 1 is a hardware assessment by exida according to the relevant functional safety standard(s) like IEC or EN The hardware assessment consists of a FMEDA to determine the fault behavior and the failure rates of the device, which are then used to calculate the Safe Failure Fraction (SFF) and the average Probability of Failure on Demand (PFD AVG ). This option shall provide the safety instrumentation engineer with the required failure data as per IEC / IEC and does not include an assessment of the development process. Option 2: Hardware assessment with proven-in-use consideration according to IEC / IEC Option 2 is an assessment by exida according to the relevant functional safety standard(s) like IEC or EN The hardware assessment consists of a FMEDA to determine the fault behavior and the failure rates of the device, which are then used to calculate the Safe Failure Fraction (SFF) and the average Probability of Failure on Demand (PFD AVG ). In addition, this option includes an assessment of the proven-in-use demonstration of the device and its software including the modification process. This option is useful in combination with end user failure records for doing a prior use justification. Option 3: Full assessment according to IEC Option 3 is a full assessment by exida according to the relevant application standard(s) like IEC or EN 298 and the necessary functional safety standard(s) like IEC or EN The full assessment extends option 1 by an assessment of all fault avoidance and fault control measures during hardware and software development. This assessment shall be done according to option 3. This document shall describe the results of the IEC functional safety assessment of the ASCO Numatics Series 327 Solenoid Valves. The assessment has been carried out based on the quality procedures and scope definitions of exida Certification S.A. Chris O'Brien Page 4 of 17

5 2 Project management 2.1 exida exida is one of the world s leading knowledge companies specializing in automation system safety and availability with over 300 years of cumulative experience in functional safety. Founded by several of the world s top reliability and safety experts from assessment organizations and manufacturers, exida is a partnership with offices around the world. exida offers training, coaching, project oriented consulting services, internet based safety engineering tools, detail product assurance and certification analysis and a collection of on-line safety and reliability resources. exida maintains a comprehensive failure rate and failure mode database on process equipment. 2.2 Roles of the parties involved ASCO Numatics exida Consulting exida Certification Manufacturer of the Series 327 Solenoid Valves Provided services to support ASCO Numatics and performed the original functional safety assessment of the Series 327 Solenoid Valves. Performed the IEC Functional Safety Assessment according to option 3 (see section 1) as an independent organization. The assessment was performed by Chris O Brien, assessor, who was not involved in the execution of the audited activities. ASCO Numatics contracted exida in October 2009 with the IEC Functional Safety Assessment of the above mentioned devices. 2.3 Standards / Literature used The services delivered by exida were performed based on the following standards / literature. [N1] IEC (Parts 1-7): 2000 Functional Safety of Electrical/Electronic/Programmable Electronic Safety-Related Systems Chris O'Brien Page 5 of 17

6 2.4 Reference documents Documentation provided by ASCO Numatics [D1] Initial Marketing Data Marketing Data Sheet Template Sheet, Rev A; 1/01 [D2] Marketing Data Sheet Marketing Data Sheet for 327 and NF Low Temperature [D3] Technical Specification Sheet (TSS), Rev A; 11/3/2009 Product Technical Specification Sheet, 327 Artic Conditions [D4] MP-I-121, 10/24/2003 Procedure for handling of ASCO Valve, Inc. Stop Orders [D5] EDP-013, Rev AF; 6/2/2009 Request for Engineering Investigation or Change [D6] EDP-145, Rev G; 8/12/08 Valve Engineering Design Review Process [D7] [D8] EDP-148, Rev A; 5/16/2002 Qualification Test Plan procedure NPD2-001, Rev B; 11/10/09 New Product Development for Platform Products [D9] GBP-07, Rev B; 11/8/2009 ECN User Guide [D10] ELP-161, Rev E; 11/8/82 [D11] VSP-14, 9/1/05 [D12] QTP template, Version 19; 10/5/05 [D13] QTR Conducting valve engineering laboratory life tests Procedure for handling valve returns Qualification Test Plan Matrix - template Qualification Test Report - Cover Sheets [D14] QTP: QTP BF Qualification Test Plan, 327 Arctic Conditions; 5/18/2009 [D15] Catalog 34, online; 1/31/2010 [D16] Safety Manual, Rev 0; 5/09 [D17] P202, Rev C; 8/8/2007 [D18] QTP No.: 262B03 QTP BF Solenoid Valves, Air Operated Valves, Combustion Products, Accessories Catalog Safety Manual for Solenoid Pilot Valves Behandeling Customer Troubles (Handling Customer Complaints) Qualification Test Plan Matrix, 327B3(WS)IS modifications Chris O'Brien Page 6 of 17

7 2.4.2 Documentation generated by exida [R1] [R2] [R3] ASC R001 V1 R4 Series 327 Solenoid Valves FMEDA Report, 05/17/2012 ASC R002 SafetyCase Review, V1 R2, 05/29/2012 ASC R003 V1 R3 IEC Assessment.doc, 5/29/2012 FMEDA report ASCO Series 327 Solenoid Valves ASCO IEC Compliance Assessment, SafetyCaseDB Review IEC Functional Safety Assessment, ASCO Numatics Series 327 Solenoid Valves (this report) Chris O'Brien Page 7 of 17

8 3 Product Description The Series 327 Solenoid Valves are 3/2 solenoid valves that are direct operated with a balanced poppet. The Models 327B are basic flow models with ¼ inch pipe connections. The Models 327A are high flow models with ¼ and ½ inch pipe connections. The Models 327B are available in a redundant configuration. The Series 327 Solenoid Valves are offered in four coil power levels. The Series 327 Solenoid Valves are available with manual operators that are used to reset the solenoid to the energized position after a trip. The manual operators do not serve a safety function. Table 1 lists the model numbers and coil versions of the Series 327 Solenoid Valves covered by this FMEDA. Table 1 Coil Options Basic Model Number Coil Power 327B0/8327G Basic Power (10.0 to 14 W) 327B1 Medium Power ( W) 327B2 Reduced Power ( W) 327B3 Low Power (1.8 W) 327A6 Basic Power (10.0 to 14 W) Figure 1 shows a direct operated, basic flow, balanced poppet Series 327 Solenoid Valves. Figure 1: Series 327 Solenoid Valve Chris O'Brien Page 8 of 17

9 Table 2 gives an overview of the different versions that were considered in the FMEDA of the Series 327 Solenoid Valves. Table 2 Version Overview Model 327B0/8327G 327B1 327B2 327B3 327B3(WS)IS 327A6 Redundant 327B0 Redundant 327B1 Redundant 327B2 Redundant 327B3 MO 1 (Manual Operator) NVR 2 (Manual Operator) Configuration De-Energize to trip / Energize to trip, Normally Closed / Normally Open De-Energize to trip / Energize to trip, Normally Closed / Normally Open De-Energize to trip / Energize to trip, Normally Closed / Normally Open De-Energize to trip / Energize to trip, Normally Closed / Normally Open De-Energize to trip / Energize to trip, Normally Closed / Normally Open De-Energize to trip / Energize to trip, Normally Closed / Normally Open De-Energize to trip / Energize to trip, Normally Closed De-Energize to trip / Energize to trip, Normally Closed De-Energize to trip / Energize to trip, Normally Closed De-Energize to trip / Energize to trip, Normally Closed De-Energize to trip De-Energize to trip Energize to trip applications failure rates do not take into account the loss of power to the solenoid. The Series 327 Solenoid Valves are classified as a Type A 3 devices according to IEC 61508, having a hardware fault tolerance of 0. 1 The MO manual operator option is used to reset the solenoid manually. It is not part of the safety function of the solenoid valve but does contribute to the failure rates of the solenoid valve. 2 The NVR manual operator option is used to reset the solenoid manually. It is not part of the safety function of the solenoid valve but does contribute to the failure rates of the solenoid valve. 3 Type A component: Non-Complex component with well-defined failure modes, for details see of IEC Chris O'Brien Page 9 of 17

10 4 IEC Functional Safety Assessment The IEC Functional Safety Assessment was performed based on the information received from the ASCO Numatics and is documented in [R2]. 4.1 Methodology The full functional safety assessment includes an assessment of all fault avoidance and fault control measures during hardware and software development (if applicable) and demonstrates full compliance with IEC to the end-user. The assessment considers all requirements of IEC Any requirements that have been deemed not applicable have been marked as such in the full SafetyCase report, e.g. software development requirements for a product with no software. As part of the IEC functional safety assessment the following aspects have been reviewed: Development process, including: o Functional Safety Management, including training and competence recording, FSM planning, and configuration management o Specification process, techniques and documentation o Design process, techniques and documentation, including tools used o Validation activities, including development test procedures, test plans and reports, production test procedures and documentation o Verification activities and documentation o Modification process and documentation o Installation, operation, and maintenance requirements, including user documentation Product design o Hardware architecture and failure behavior, documented in an FMEDA Manufacturing process o Manufacturing quality system The review of the development procedures is described in sections 5.1 through 5.8. The review of the product design is described in section Assessment level The Series 327 Solenoid Valves have been assessed per IEC to the following levels: SIL 3 capable The development procedures will be assessed as suitable for use in applications with a maximum Safety Integrity Level of 3 (SIL3) according to IEC Chris O'Brien Page 10 of 17

11 5 Results of the IEC Functional Safety Assessment exida assessed the development process used by ASCO Numatics for this development against the objectives of IEC parts 1 and 2. A detailed SafetyCase was completed, see [R2]. This functional safety assessment has shown that the process sufficiently meets the requirements of IEC 61508, SIL 3. The assessment investigated the compliance with IEC of the processes, procedures and techniques as implemented for the ASCO Numatics development. The investigation was executed using subsets of the IEC requirements tailored to the SIL 3 work scope of the development team. The result of the assessment can be summarized by the following observations: The audited ASCO Numatics development process complies with the relevant managerial requirements of IEC SIL Functional Safety Management FSM Planning ASCO Numatics has a 7-phase staged-gate process in place for product development with specific deliverables, reviews and approvals at each gate. This is documented in NPD2-001 [D8]. The same process is used for modifications. This process and procedures referenced herein fulfill the requirements of IEC with respect to functional safety management. Version Control All documents as called out for in NPD2-001 are under version control. Design drawings and documents are also under version control. Training, Competency recording Personnel training records are kept per standard quality procedures. Engineering personnel involved in the project have received IEC training. ASCO Numatics hired exida to be the independent assessor per IEC and to provide specific IEC knowledge. 5.2 Safety Requirements Specification and Architecture Design The first step for any new development is the creation of a Marketing Data Sheet (MDS) [D2] by the Marketing Department. Once this has been reviewed and the project accepted, engineering will develop the project Technical Specification Sheet (TSS) [D3]. This captures in detail all the requirements for the devices, such as critical functions, performance targets etc. exida reviewed the content of the specification for completeness per the requirements of IEC As the valves are simple electro-mechanical devices, there is no need for a separate architecture design phase. The MDS and TSS will indicate if the design is new or based on an existing design. Requirements as specified in the Technical Specification Sheet (TSS) are tracked through all development phases. Items from IEC , Table B.1 include project management, documentation, separation of safety requirements from non-safety requirements, structured specification, and inspection of the specification. As the function of the valve is simple and clearly defined there is no need for semiformal methods such as functional block diagrams. The application is considered when specifying the requirements; the devices may be required to meet specific applications standards. This meets SIL 3. Chris O'Brien Page 11 of 17

12 5.3 Hardware Design The hardware design process consists of two distinct phases: concept verification, and design and development. During concept verification all possible solutions are reviewed and the most promising is detailed. During this phase also the Qualification Test Plan and Agency Approval Plan is developed (equal to validation plan per IEC 61508). In the design and development phase, the design is further detailed and Qualification testing is performed on beta units. Per EDP-145 [D6], a preliminary design review, an intermediate and final design review is conducted. ASCO Numatics has standards for documentation with specified output documents. ASCO Numatics uses ProE and AutoCad as development tools. Version numbers should be listed and re-qualification should be done when the tool vendor makes revisions. Re-qualification test results should be documented and reviewed. ASCO Numatics confirmed that tool re-qualification is performed. Items from IEC , Table B.2 include observance of guidelines and standards, project management, documentation (design outputs are documented per NPD2-001 and other quality guidelines), structured design, modularization, use of well-tried components, and computer-aided design tools. This meets SIL Manufacturing The Series 327 Solenoid Valves are manufactured in an ISO certified facility. All units are functionally tested. Field returns are tracked and reviewed monthly to identify quality issues and performance issues. Customer feedback is solicited and reviewed to identify performance issues and opportunities for product improvements. This meets SIL Validation Validation Testing is done via a documented plan, the Qualification Test Plan, written per the Technical Specification Sheet and includes compliance testing per application standards, through the Agency Approval Plan which is part of the QTP. The QTP is traceable to the TSS. As the Series 327 Solenoid Valves are purely electro-mechanical devices with a simple safety function, there is no separate integration testing necessary. However, the solenoids do undergo several separate tests before valve body and solenoid are integrated; this is part of the Qualification Test Plan. The Series 327 Solenoid Valves perform only 1 safety function, which is extensively tested under various conditions during validation testing. Procedures are in place for corrective actions to be taken when tests fail. Every run of the Qualification Test Plan is documented in a Qualification Test Report and reviewed. Items from IEC , Table B.3 include functional testing, project management, documentation, and black-box testing (for the considered devices this is similar to functional testing). Field experience and statistical testing via regression testing are not applicable. This meets SIL 3. Items from IEC , Table B.5 included functional testing and functional testing under environmental conditions, project management, documentation, failure analysis (analysis on products that failed), and expanded functional testing and black-box testing. Interference surge immunity testing is not applicable and fault insertion testing is not feasible for these devices. Instead a detailed FMEDA was performed. This meets SIL 3. Chris O'Brien Page 12 of 17

13 5.6 Verification The development and verification activities are defined in the New Product Development Process for Platform Products, NPD For each phase the objectives are stated, as well as required input and output documents and review activities. Checklists are used for e.g. the review of the Marketing Data Sheet. Design reviews are governed by EDP-145, Valve Engineering Design Review Process. Per NPD2-001, the following verification steps are defined: product idea review, concept definition review, feasibility review, design and development review, pilot run review, and introduction review. All verification activities are documented. This meets SIL Modifications Modifications are done per the Engineering Change Notice procedure [D9]. A web-based system is in place to track ECNs. The ECN system allows to user to identify if a certified device is affected. Affected documents and/or drawings are also listed. If design changes are identified as a result of an ECN, they are usually treated as a derived product and therefore the same general procedure is used for both new development and modifications. All design change requests are reviewed to determine if there is any negative impact on product safety. This review is done by both the assigned engineer and the appropriate engineering manager. This meets SIL User documentation ASCO Numatics creates the following user documentation: product catalog [D15] and safety manual [D16]. Items from IEC , Table B.4 include operation and maintenance instructions, user friendliness, maintenance friendliness, project management, documentation, limited operation possibilities (valve performs well-defined action) and operation only by skilled operators (operators familiar with type of valve, although this is partly the responsibility of the end-user). This meets SIL Hardware Assessment To evaluate the hardware design of the Series 327 Solenoid Valves a Failure Modes, Effects, and Diagnostic Analysis was performed by exida. This is documented in [R1]. A Failure Modes and Effects Analysis (FMEA) is a systematic way to identify and evaluate the effects of different component failure modes, to determine what could eliminate or reduce the chance of failure, and to document the system in consideration. An FMEDA (Failure Mode Effect and Diagnostic Analysis) is an FMEA extension. It combines standard FMEA techniques with extension to identify online diagnostics techniques and the failure modes relevant to safety instrumented system design. From the FMEDA failure rates are derived for each important failure category. Table 3 lists these failure rates as reported in the FMEDA reports. The failure rates are valid for the useful life of the devices. Based on ASCO Numatics endurance test data and general field failure data a useful life period of approximately 10 years is expected for the Series 327 Solenoid Valves. This is listed in the FMEDA reports. Chris O'Brien Page 13 of 17

14 Table 3 Failure Rates According to IEC (in FITs) Model Failure Category sd su 4 327B0/8327G 327B1&2 327B3 327B3(WS)IS 327B0 Redundant 327B1&2 Redundant 327B3 Redundant 327A6 MO NRV dd du SFF 5 De-Energize to Trip % Energize To Trip % De-Energize to Trip W/PVST % Energize To Trip W/PVST % De-Energize to Trip % Energize To Trip % De-Energize to Trip W/PVST % Energize To Trip W/PVST % De-Energize to Trip % Energize To Trip % De-Energize to Trip W/PVST % Energize To Trip W/PVST % De-Energize to Trip % Energize To Trip % De-Energize to Trip W/PVST % Energize To Trip W/PVST % De-Energize to Trip % Energize To Trip % De-Energize to Trip W/PVST % Energize To Trip W/PVST % De-Energize to Trip % Energize To Trip % De-Energize to Trip W/PVST % Energize To Trip W/PVST % De-Energize to Trip % Energize To Trip % De-Energize to Trip W/PVST % Energize To Trip W/PVST % De-Energize to Trip % Energize To Trip % De-Energize to Trip W/PVST % Energize To Trip W/PVST % De-Energize to Trip % De-Energize to Trip W/PVST % De-Energize to Trip % De-Energize to Trip W/PVST % 4 It is important to realize that the Residual failures are included in the safe undetected failure category according to IEC Note that these failures on their own will not affect system reliability or safety, and should not be included in spurious trip calculations 5 The SFF must be calculated for the complete final element. These values are only valid when the solenoid valve constitutes the entire final element. Chris O'Brien Page 14 of 17

15 When using the MO or NRV options the failure rates for these options must be added to the failure rates of the Solenoid Models they are used with. For SIL 2 applications, the PFD AVG value needs to be 10-3 and < This means that for a SIL 2 application without partial valve stroke testing, the PFD AVG for a 1-year Proof Test Interval of the Series 327 Solenoid Valves is approximately equal to 10% of the range for the 327A6. When performing partial valve stroke testing at regular intervals, the Series 327 Solenoid Valve minimally contributes to the overall PFD AVG of the Safety Instrumented Function. These results must be considered in combination with PFD AVG values of other devices of a Safety Instrumented Function (SIF) in order to determine suitability for a specific Safety Integrity Level (SIL). It is the responsibility of the Safety Instrumented Function designer to do calculations for the entire SIF. For redundant use, common cause failure between the solenoid valves has to be considered. The Safety Manual should include estimation of the common cause factor β; β is estimated to be 5% for all options. exida recommends the accurate Markov based exsilentia software tool for this purpose. The analysis shows that design of the Series 327 Solenoid Valves can meet the hardware requirements of IEC 61508, SIL 2 when used as a single final element (HFT = 0) and IEC 61508, SIL 3 for redundant use (HFT > 0). Chris O'Brien Page 15 of 17

16 6 Terms and Definitions Fault tolerance FIT FMEDA HFT Low demand mode PFD AVG SFF SIF SIL SIS Type A (sub)system Type B (sub)system Ability of a functional unit to continue to perform a required function in the presence of faults or errors (IEC , 3.6.3) Failure In Time (1x10-9 failures per hour) Failure Mode Effect and Diagnostic Analysis Hardware Fault Tolerance Mode, where the frequency of demands for operation made on a safetyrelated system is no greater than twice the proof test frequency. Average Probability of Failure on Demand Safe Failure Fraction summarizes the fraction of failures, which lead to a safe state and the fraction of failures which will be detected by diagnostic measures and lead to a defined safety action. Safety Instrumented Function Safety Integrity Level Safety Instrumented System Implementation of one or more Safety Instrumented Functions. A SIS is composed of any combination of sensor(s), logic solver(s), and final element(s). Non-Complex (sub)system (using discrete elements); for details see of IEC Complex (sub)system (using micro controllers or programmable logic); for details see of IEC Chris O'Brien Page 16 of 17

17 7 Status of the document 7.1 Liability exida prepares reports based on methods advocated in International standards. Failure rates are obtained from a collection of industrial databases. exida accepts no liability whatsoever for the use of these numbers or for the correctness of the standards on which the general calculation methods are based. 7.2 Releases Version: V1 Revision: R3 Version History: V1, R3: Added 327B3(WS)IS to report, C. O Brien, May 29, 2012 V1, R2: Added 8327G to report, S. Close, Sep 15, 2010 V1, R1: Released; January 31, 2010 V0, R1: Draft; January 31, 2010 Authors: Chris O'Brien Review: V0, R1 Rachel Amkreutz; January 31, 2010 Release status: Released 7.3 Future Enhancements At request of client. 7.4 Release Signatures Rachel Amkreutz Chris O Brien, Partner Chris O'Brien Page 17 of 17