Prasad Goteti PROOF TESTING SAFETY INSTRUMENTED

May 10, 2018 SYSTEMS

 Honeywell

Aerospace Performance Materials Automation and

and Tech (PMT) Control Solutions

UOP Fluorine Resins and Speciality

products
HPS Chemicals products

Projects and Automation

Solutions (PAS)

Safety Engineering COE

Honeywell Confidential - © 2017 by Honeywell International Inc. All rights reserved.

RECAP – Safety Life Cycle SIL Verification

Conceptual Process SRS

Design Develop Safety
Establish Operation &
Requirements Specification Maintenance Procedures

Perform Process Hazard

LOPA Analysis & Risk Assessment Perform SIS Conceptual
Pre-startup Safety Review
Design, and verify it meets (Assessment)
the SRS
Apply non-SIS
protection layers to prevent SIS Startup Operation,
identified hazards or reduce Maintenance Periodic
risk Perform SIS Design Detail Functional testing

No Modify or
SIS Required SIS Installation Decommission SIS ?
? Commissioning and Pre-
Yes Startup Acceptance Test
Decommission
Define Target SIL
SIS Decommissioning

Analysis Implementation Operation phase SIS Validation

phase phase
Honeywell Confidential - © 2017 by Honeywell International Inc. All rights reserved.
RECAP –LOPA determined SIL2 SIF requirement

PSV SP = 4.0 BAR

PSHH-1 SP = 3.75 BAR

• High Pressure Trip PSHH-1 added (which is SIL2 rated, ie 99% Reliable as a minimum)
- Shuts off ESDV-1 when PT-2 detects Pressure in Vessel V-1 > 3.75 BAR
- ESDV-1 will be a De-energized To Trip (DTT) Fail Close valve, Open when Pressure is less than
3.75 BAR

Honeywell Confidential - © 2017 by Honeywell International Inc. All rights reserved.

RECAP - Reliability calculations – SIF design

PFDavg(SIF-1) = PFDavg(SE) + PFDavg(LS) + PFDavg(FE)

Make sure it is SIL2 (at least 99% Reliable)

Honeywell Confidential - © 2017 by Honeywell International Inc. All rights reserved.

RECAP - PFDavg value of a component

• PFDavg (approx.) = (lDU. PTI) / 2 + (lDD. DTI) / 2

- PFDavg is the Average Probability of Failure on Demand

- DTI is the Diagnostic Test Interval, normally in seconds for Smart transmitters and
Programmable Logic Solvers, within which some Dangerous failures will be detected online
depending on the Diagnostic coverage
- PTI is the Proof Test Interval, usually in months, when failures NOT detected by online
diagnostics will be detected (assuming a Proof Test Coverage of 100%)

Honeywell Confidential - © 2017 by Honeywell International Inc. All rights reserved.

PTI vs DTI, for Dangerous failures

Dangerous Undetected failures (lDU)

(PTI)

PFD(t) Average PFD

0
time t

Dangerous Detected failures (lDD)

(DTI)

Honeywell Confidential - © 2017 by Honeywell International Inc. All rights reserved.

Online Diagnostics

• Diagnostic Coverage (DC)

- Fraction of failures detected by automatic on-line diagnostic tests.
 lDD = DC. lD

• Diagnostic Test Interval (DTI)

- Interval between on-line tests to detect faults in a safety-related
system that has a specified diagnostic coverage

Honeywell Confidential - © 2017 by Honeywell International Inc. All rights reserved.

Types of Component failures

There are two types :

• Random Hardware failures are “failures, occurring at a random
time, which results from a variety of degradation mechanisms in the
hardware”.
• Systematic failures are “failures related in a deterministic way to a
certain cause, which can only be eliminated by a modification of the
design or of the manufacturing process, operational procedures,
documentation or other relevant factors.”

Honeywell Confidential - © 2017 by Honeywell International Inc. All rights reserved.

Random Hardware failures

• Random Hardware failures (ltotal) :

ltotal = lS (Safe failures) + lD (Dangerous failures)

Safe failures do NOT have the potential to put the safety related
system in a hazardous or fail to function state

Dangerous failures HAVE the potential to put the safety-related

system in a hazardous or fail-to-function state

Honeywell Confidential - © 2017 by Honeywell International Inc. All rights reserved.

Safe vs. Dangerous failure of a Sensing Element

• Analogue Pressure Transmitter

Measured pressure too high

The PT has failed safe,
and an action is taken before
the process is actually out of control
Pressure
level Actual process condition

High high pressure Measured pressure too low

The PT has failed dangerous,
and no action is taken at time (t.)
High pressure

At this time (t) the Time

process gets out of control,
pressure is high high.

Honeywell Confidential - © 2017 by Honeywell International Inc. All rights reserved.

Types of Failures in a Pressure Transmitter
• Safety Function example - On High Pressure (> 3.75 BAR), the PT
should sense and send a signal to the Logic Solver which takes a
specific executive action

Safe Detected, lSD

SAFE By online Diagnostics
Senses Pressure Safe Undetected, lSU
as > 3.75 BAR when
it is < 3.75 BAR
Dangerous Detected, lDD
By online Diagnostics
DANGEROUS
Senses Pressure Undetected, lDU
as < 3.75 BAR when (PROOF TEST should
it is > 3.75 BAR detect these failures)

11
Honeywell Confidential - © 2017 by Honeywell International Inc. All rights reserved.
Types of failures in a Valve
• Safety valve, normally open & normally energized
• In case of an out of control process, the valve has to close

Safe Undetected
SAFE
Closes Safe Detected
spontaneously
due to loss
of energy
Dangerous Detected
DANGEROUS By valve stroke test
Stuck at Dangerous Undetected
open (PROOF TEST should detect these failures)

Honeywell Confidential - © 2017 by Honeywell International Inc. All rights reserved.

Logic Solver failures

Safe Detected
99% plus detected by online diagnostics
SAFE
(Eg - IO module Safe Undetected
acts when Less than 1% of failures during PROOF
NOT needed) TEST

Dangerous Detected
DANGEROUS 99% plus detected by online diagnostics
(Eg - IO module
Dangerous Undetected
Does NOT respond Less than 1% of failures
when needed) detected during PROOF TEST

Honeywell Confidential - © 2017 by Honeywell International Inc. All rights reserved.

PTI vs DTI, for Dangerous failures

Dangerous Undetected failures (lDU)

(PTI)

PFD(t) Average PFD

0
time t

Dangerous Detected failures (lDD)

(DTI)

Honeywell Confidential - © 2017 by Honeywell International Inc. All rights reserved.

Systematic failures

• Presently there is NO mathematical way to quantify Systematic

failure rate
• Ways to reduce Systematic failures :
- A “Proven in use” process while designing and manufacturing
components with good Quality checks will help reduce Hardware and
Software Systematic failures
- Well tested application software written in a low level language (like
ladder logic or FLDs) to reduce the possibility of introducing
Systematic errors

Honeywell Confidential - © 2017 by Honeywell International Inc. All rights reserved.

Validation, Proof Test and Revalidation

• Validation – per IEC 61511 - Activity of demonstrating that the safety instrumented
function(s) and safety instrumented system(s) under consideration after installation meets
in all respects the safety requirements specification

• Proof Test – per IEC 61511 - Test performed to reveal undetected faults (both Random
and Systematic) in a safety instrumented system so that, if necessary, the system can be
restored to its designed functionality

• Re-validation – Activity of demonstrating that a modified safety instrumented function(s)

and safety instrumented system(s) under consideration after modification meets in all
respects the modified safety requirements specification

Honeywell Confidential - © 2017 by Honeywell International Inc. All rights reserved.

“When” in a Safety Life Cycle

Honeywell Confidential - © 2017 by Honeywell International Inc. All rights reserved.

SIF, PSHH-1

PSV SP = 4.0 BAR

PSHH-1 SP = 3.75 BAR

Validation / Re-validation refers to the WHOLE SIF, not just

some components of a SIF which are installed / modified

Honeywell Confidential - © 2017 by Honeywell International Inc. All rights reserved.

How do I validate my SIS Logic Solver ?

PSHH-1 ESDV-1
PT-2
(SIL3) (1oo1)
(1oo1)

Pressure Transmitter Shut down valve

(SE) Logic Solver (LS) (FE)

• Validation of the SIS logic solver could be done independently at a Factory Acceptance
Test (FAT) and / or when installed, wired up with field instruments and powered up at site.
• Usually a FAT is conducted so that before the complete SIS validation at site, there is
enough time to fix both random and systematic errors, if found.

Honeywell Confidential - © 2017 by Honeywell International Inc. All rights reserved.

How do I validate my SIS ?

PSHH-1 ESDV-1
PT-2
(SIL3) (1oo1)
(1oo1)

Pressure Transmitter Shut down valve

(SE) Logic Solver (LS) (FE)

• After site installation, Functional testing of every SIF per the SRS
requirements would include the following (and more) :
- Input Trip condition
- Reset after trip
- Input Bypassed
- Input Bad signal
- etc

Honeywell Confidential - © 2017 by Honeywell International Inc. All rights reserved.

When do I Proof test my SIS Logic Solver ?

PSHH-1 ESDV-1
PT-2
(SIL3) (1oo1)
(1oo1)

Pressure Transmitter Shut down valve

(SE) Logic Solver (LS) (FE)

• Most SIS Logic Solver suppliers will provide a recommended

maintenance checklist and a suggested time period for
maintenance.
• If the supplier suggested time period is less than the PTI used to
calculate PFDavg of the SIS logic solver, then the end user should
follow the time period suggested by the SIS logic solver supplier for
Proof Testing the SIS logic solver

Honeywell Confidential - © 2017 by Honeywell International Inc. All rights reserved.

SIS Logic Solver Proof Test

• PFDavg SIL3 Logic Solver = (λDU. PTI) / 2 + (λDD. DTI) / 2

- Usually the DC for SIL3 rated Logic Solvers is very High (> 99%), so
λDU >> λDD

- Therefore (λDU. PTI) / 2 >> (λDD. DTI) / 2

- DD failures are detected by online diagnostics

- DU failures are detected during Proof test and are very small in quantity

Honeywell Confidential - © 2017 by Honeywell International Inc. All rights reserved.

How do I Proof test my SIS Logic Solver ?
• Will be suggested by Logic Solver manufacturer
• Typical Proof testing activities for Logic Solver Hardware are checking
and replacing / fixing the following :

- Cable damage between SIS Logic Solver modules

- Voltages to the Control Processor if within the tolerable limits
- Temperature in the Control Processor if within the tolerable limits
- Airflow obstruction to various modules
- Presence of any earth faults
- Availability of spare parts and usage per requirement

Honeywell Confidential - © 2017 by Honeywell International Inc. All rights reserved.

 How do I Proof test my SIS Logic Solver ?

• Typical Proof testing activities for Logic Solver Software to primarily

reduce systematic errors are:

- Making sure the latest running application software has been backed up.
- If there has been a change in the firmware of the Logic Solver, it is
recommended to upload the new firmware at this time.
- If the new firmware was already uploaded online earlier or now, or if there
were some modifications done to a SIF or SIFs, it is recommended to do
a complete functional test of all the SIFs as done during validation. The
reason is to make sure that a firmware change or modification to a
validated application software has not in any way affected the functioning
of all SIFs

Honeywell Confidential - © 2017 by Honeywell International Inc. All rights reserved.

How do I Proof test my SIS ?

PSHH-1 ESDV-1
PT-2
(SIL3) (1oo1)
(1oo1)

Pressure Transmitter Shut down valve

(SE) Logic Solver (LS) (FE)

• Check Transmitter mechanical and electrical installation, calibration

etc
• Check valve assembly for mechanical faults if any, if TSO is
important, check valve “passing” on closure etc
• Functionally check all SIFs in the SIS

Honeywell Confidential - © 2017 by Honeywell International Inc. All rights reserved.

When do I Re-validate my SIS ?

• Revalidation of a SIS is done during the Operation and

Maintenance phase of the Safety Life cycle usually when:

- Additional SIFs may get added, or existing SIFs may get modified or
deleted, during the next cycle of a Process Hazard Analysis (usually
every 5 years in the USA as per OSHA regulation – 29 CFR 1910.119)
or during a system audit or assessment.
- Modification of an existing SIF based on Operational feedback, for
example – too many spurious trips, too many demands etc
- Change of SIS logic Solver or other SIF components due to excessive
Random and / or Systematic failures

Honeywell Confidential - © 2017 by Honeywell International Inc. All rights reserved.

Modification to a SIS
A modification plan usually follows end user’s Management Of
Change (MOC) process which generally details the following:

• Personnel in the company who will authorize the modification

• Reason for the modification to the SIS
• Impact analysis to make sure that this modification :
- does not lead to any new potential hazardous events , either during
implementation or after the modification.
- does not effect other SIFs in the same SIS
• Implementation of the modification
• Revalidation before “startup” of the modified SIS
• Update of all documentation to reflect the changes done during the
modification

Honeywell Confidential - © 2017 by Honeywell International Inc. All rights reserved.

Extent of Revalidation of SIS Logic Solver

• Based on IEC61508, Part 3, Table A.8, meant for Programmable

Logic Solvers
• Recommended to be used for all types of Logic Solvers

Honeywell Confidential - © 2017 by Honeywell International Inc. All rights reserved.

How do I Re-validate my SIS Logic Solver ?

• What to test will depend on the table on the previous slide

• Process is similar to Validation of the SIS Logic Solver to test for
Random hardware and Systematic failures

Honeywell Confidential - © 2017 by Honeywell International Inc. All rights reserved.

Conclusion
Activity When ? Why ? How ?

SIS Logic Just before taking SIS Hardware test to detect Test logic solver Hardware
logic solver online for Random failures and and Application Software
Solver the first time software to reduce
Validation Systematic failures
During the regular Hardware test to detect Test logic solver Hardware
maintenance of the Random failures by looking and Application Software if
SIS Logic SIS Logic Solver for potential errors not change in firmware or any
Solver Proof dictated by SIL detected by online modifications have been
calculations or SIS diagnostics and software to done
test vendor reduce Systematic failures

SIS Logic When modifications Hardware test to detect Test logic solver Hardware
have been made to a Random failures and and Application Software.
Solver validated SIS logic software to reduce Extent of test will be based
ReValidation solver and before Systematic failures on Table 2, which is based
taking it online on SIL ratings of SIFs in the
SIS

Honeywell Confidential - © 2017 by Honeywell International Inc. All rights reserved.

References

• ANSI/ISA 84.00.01- 2004 (IEC-61511). “Functional safety – Safety

instrumented systems for the process industry sector”.
• IEC-61508, “Functional safety of electrical/ electronic/
programmable electronic safety related systems”.
• “SIS Design Basis Revalidation”, white paper by Kenexis

Honeywell Confidential - © 2017 by Honeywell International Inc. All rights reserved.

Honeywell Confidential - © 2017 by Honeywell International Inc. All rights reserved.