ida Certification Services IEC Functional Safety Assessment Project: Masoneilan Smart Valve Interface, SVI II ESD Customer: GE Energy

Transcription

1 e ida Certification Services IEC Functional Safety Assessment Project: Masoneilan Smart Valve Interface, SVI II ESD Customer: GE Energy Avon, MA USA Contract Number: Q13/ Report No.: GEE Q R002 V1R1 Assessment Report Version V1, Revision R1, March 28, 2013 Chris O'Brien The document was prepared using best effort. The authors make no warranty of any kind and shall not be liable in any event for incidental or consequential damages in connection with the application of the document. All rights reserved.

2 Management summary This report summarizes the results of the functional safety assessment according to IEC carried out on the Masoneilan Smart Valve Interface, SVI II ESD The functional safety assessment performed by exida consisted of the following activities: - exida assessed the development process used by GE Energy by an on-site audit and creation of a safety case against the requirements of IEC exida performed a detailed Failure Modes, Effects, and Diagnostic Analysis (FMEDA) of the devices to document the hardware architecture and failure behavior. - exida reviewed field failure data to ensure that the FMEDA analysis was complete. - exida reviewed the manufacturing quality system in use at GE Energy. The functional safety assessment was performed to the requirements of IEC 61508: ed2, 2010, SIL 3 for mechanical components. A full IEC Safety Case was prepared, using the exida SafetyCaseDB tool, and used as the primary audit tool. Hardware process requirements and all associated documentation were reviewed. Environmental test reports were reviewed. Also the user documentation (safety manual) was reviewed. Some areas of improvement were identified in the design process and the design procedures were upgraded during the project. However because of the low complexity of the products and the proven in use design, GE Energy was able to demonstrate that the objectives of the standard have been met. The results of the Functional Safety Assessment can be summarized as: The GE Energy SVI II ESD was found to meet the requirements of IEC for up to SC3 (SIL 3 Capable). PFD AVG and Architecture Constraints must be verified for each application. The manufacturer will be entitled to use the Functional Safety Logo. The manufacturer may use the mark: T-023 V2R1, August, Page 2 of 17

3 Table of Contents Management summary Purpose and Scope Project management exida Roles of the parties involved Standards / Literature used Reference documents Documentation provided by GE Energy Documentation generated by exida Product Descriptions GE Energy Masoneilan Smart Valve Interface, SVI II ESD IEC Functional Safety Assessment Methodology Assessment level Product Modifications Results of the IEC Functional Safety Assessment Open Issues Lifecycle Activities and Fault Avoidance Measures Functional Safety Management Safety Requirements Specification and Architecture Design Hardware Design Validation Verification Modifications User documentation Hardware Assessment Terms and Definitions Status of the Document Liability Releases Future Enhancements Release Signatures T-023 V2R1, August, Page 3 of 17

4 1 Purpose and Scope This document shall describe the results of the IEC functional safety assessment of the GE Energy: Masoneilan Smart Valve Interface, SVI II ESD by exida according to the requirements of IEC 61508: ed2, The results of this provides the safety instrumentation engineer with the required failure data as per IEC / IEC and confidence that sufficient attention has been given to systematic failures during the development process of the device. T-023 V2R1, August, Page 4 of 17

5 2 Project management 2.1 exida exida is one of the world s leading accredited Certification Bodies and knowledge companies specializing in automation system safety and availability with over 300 years of cumulative experience in functional safety. Founded by several of the world s top reliability and safety experts from assessment organizations and manufacturers, exida is a global company with offices around the world. exida offers training, coaching, project oriented system consulting services, safety lifecycle engineering tools, detailed product assurance, cyber-security and functional safety certification, and a collection of on-line safety and reliability resources. exida maintains a comprehensive failure rate and failure mode database on process equipment. 2.2 Roles of the parties involved GE Energy exida exida Manufacturer of the SVI II ESD Performed the hardware assessment Performed the IEC Functional Safety Assessment according. GE Energy contracted exida in January 2013 for the IEC Functional Safety Assessment of the above mentioned devices. 2.3 Standards / Literature used The services delivered by exida were performed based on the following standards / literature. [N1] IEC (Parts 1-7): 2010 Functional Safety of Electrical/Electronic/Programmable Electronic Safety-Related Systems 2.4 Reference documents Documentation provided by GE Energy [D1] CES 270, 5/21/2007, R16 SVI II ESD Product Specification, Safety Requirements Specification, & Architecture Specification [D2] [D3] [D4] [D5] SVI II ESD Project Schedule, 5/25/2007 SVI II ESD Project Schedule CAP 020, 3/11/2013, Rev C New Instrument Process SVI II ESD (Validation) Test Specification Matrix, 5/31/07, V16 Calculations for Functional Safety, 4/26/2006, V1 SVI II ESD (Validation) Test Specification Matrix Calculations done on the hardware to ensure that various functional safety parameters, including de-rating, have been met. T-023 V2R1, August, Page 5 of 17

6 [D6] CES 251, 11/14/2005, Rev SVI II-ESD Marketing Specification 4 [D7] IR07-004, 4/25/2007, V01 ESD Single Acting Mechanical Fault Injection Testing Procedure and Results [D8] CAP 011, 7/2/1999 Software Development Procedure [D9] [D10] [D11] [D12] CAP 005, 2/22/2012, Rev. H ESD Field Trial Approval Meeting Minutes, 2/23/2007 SVI II ESD Quick Start Guide and Safety Manual, 5/11/12, Rev D Monthly meeting minutes with team structure, 5/31/2007 [D13] Assembly Matrix, 7/8/11, Rev K [D14] [D15] [D16] [D17] CAP 026, 3/13/2013, Rev. B Code Review Checklist, 5/13, 2005 C Source Code Standard, 5/29/2007, V2.1 Firmware Development Tools Upgrade Policy, 5/30/2007 Controlled Product Development Process This document is an example of how approval to proceed in the next phase of the project is done. A meeting was held with management to review the project status, and signoff to proceed is included in the document. SVI II ESD Safety Manual This document is the minutes of the monthly status meeting with management for the SVI II ESD project. These minutes include a listing of all of the team members on the project along with their roles and as such it helps to serve the role of FSM Planning Document that shows all possible hardware configurations of SVI II ESD Valve Positioner Firmware Development Process Code Review Checklist C Source Code Standard This document lists the policies for upgrading tools and provides evidence of fitness of use for all tools on project. [D18] Firmware Design Document Document shows design specifications for all modules. Matrix, 5/29/2007 [D19] ESD Software Architecture, ESD Software Architecture 5/10/2006, V1.0 [D20] Unit Test Matrix, 5/29/2007 Unit Test Matrix [D21] Fault Bit Test Plan, Test plan for fault simulation testing. 5/29/2007 [D22] Design Review Minutes, Minutes of design/requirements review meeting. 3/28/2006 [D23] Fault Bit Test Results, Test Results for Fault Bit Simulation Testing 5/25/2007 [D24] Fault Matrix, 5/22/2007 Spreadsheet showing a list of all potential faults that are covered by diagnostics. T-023 V2R1, August, Page 6 of 17

7 [D25] IR07-013, 8/7/2006, V1 EMC Test Report - Terminal Board [D26] IR07-014, 8/7/2006, V1 EMC Test Report - Terminal Board APDT [D27] IR07-105, 8/7/2006, V1 EMC Test Report Terminal Board DPT [D28] IR-1009, 10/23/2006, V1 ATP Terminal Board Environmental Testing Procedure and Report [D29] SVI II ESD SIL 3 recertification EMC, 3/6/2013 Memo documenting continued compliance [D30] PC LINT user's manual, 7/6/2001, V8.0 PC LINT is tool used for static analysis of software code. Manual has been included to support reading of the PC LINT configuration file. [D31] Project Makefile, 6/1/2007 Has been included to show call to PC LINT with exclusions to the OS code. [D32] [D33] [D34] PC LINT options file, 1/8/2007 SRS Review Meeting Minutes, 5/31/2007 PC LINT Configuration file, 12/21/2006 File that shows the options that PC LINT is called with. Safety Requirements Specification Review Meeting Minutes Configuration file for PC LINT which shows which checks have been suppressed and which have been added. [D35] SVI II ESD Firmware Test Software Validation Test Plan Plan, 5/25/2007, V0.1 [D36] Software Validation Test Software Validation Test Report Report, 5/25/07 [D37] Results of SW HAZOP for Software Criticality and HAZOP Report SVII ESD, 9/15/06, V0R2 [D38] System FMEA, 5/18/2007 System Failure Modes and Effects Analysis [D39] MicroCOS-II IEC61508 V&V Report, 7/10/2006 Verification and Validation Report for MicroCOS-II Operating System [D40] Unit Test Matrix, 5/29/2007 Lists all software modules along with a unit test reference for each module. [D41] [D42] Weekly meeting minutes with action item follow up, 5/15/2007 IEC Tables.doc, 6/1/2007 This document is the minutes of the weekly status meeting for the SVI II ESD Project. Note that in this document, all of the action items from the project are included and tracked. This is a good example of how action items are tracked to closure. Document that shows how the requirements of IEC Tables from Appendix A and B of parts 2 and 3 have been met. T-023 V2R1, August, Page 7 of 17

8 2.4.2 Documentation generated by exida [R1] DRE 07/02-47 R001, 9/1/2010, V2R1 [R2] FMEDA Spreadsheet - APDT Board, 5/22/2007 [R3] FMEDA Spreadsheet - APT Board, 5/22/2007 [R4] FMEDA Spreadsheet - DPT Board, 5/22/2007 [R5] FMEDA Spreadsheet - Hall Sensor, 10/5/2005 [R6] GEE Q R001 SafetyCase (Access Database), V1 R1, 03/28/2013 [R7] GEE Q R002 V1R1 Assessment Report, 03/28/2013 FMEDA Report for SVI II ESD Detailed FMEDA Spreadsheet for APDT Board Detailed FMEDA Spreadsheet for APT Board Detailed FMEDA Spreadsheet for DPT Board Detailed FMEDA Spreadsheet for Hall Sensor GE Energy IEC Compliance Assessment, SafetyCaseDB (Access Database) IEC Functional Safety Assessment, GE Energy Masoneilan Smart Valve Interface, SVI II ESD (this report) T-023 V2R1, August, Page 8 of 17

9 3 Product Descriptions 3.1 GE Energy Masoneilan Smart Valve Interface, SVI II ESD The Masoneilan Smart Valve Interface, SVI II ESD smart valve positioner is intended for use as part of a process automation system capable of SIL 3 rated safety system safety integrity functions. In addition to providing its core safety function (putting the Equipment Under Control (EUC) into a safe state upon demand, by opening / closing a final control element), the SVI II ESD is also capable of performing internal self-diagnostics and external partial valve-stroke testing used to detect possible failure modes of a final control element. The SVI II ESD is a 2-wire or 4-wire device depending on which safety function option is specified. It has two safety-rated input options: a 4 to 20 ma analog input, or a 24V DC discrete input. The two wire version uses either the AI_SP or the 24 VDC input to both power the unit and receive the safety function or trip signal. The four wire version uses the 4-20 ma signal to power the unit with a separate or discrete 24 VDC signal for the trip signal. The SIL 3 rated safety critical circuit is completely independent of the SIL 3 rated diagnostic circuit. The core safety function (ESD) is a Type A, Low Demand circuit while the diagnostics is considered to be categorized as a SIL 2 Type B system. The device will be certified for use in SIL 3 safety integrity functions in a 1oo1 safety architecture. This device can be configured for safety shutdown in a MooN configuration (M out of N devices must be successful for the safety function to be successful), but this is not relied upon for the SIL 3 certification. If an internal fault is detected, the software may attempt to transition the final element to a Fail- State and will annunciate the fault to the logic solver. Table 1 lists the versions of the Masoneilan Smart Valve Interface, SVI II ESD that have been considered for the assessment. Table 1 Version Overview SA-ASD SA-DSD SA-A/DSD DA-ASD DA-DSD DA-A/DSD SVI II ESD, Single Acting, 2-wire AI Mode (ASD) SVI II ESD, Single Acting, 2-wire DI Mode (DSD) SVI II ESD, Single Acting, 4-wire DI Mode (A/DSD) SVI II ESD, Double Acting, 2-wire AI Mode (ASD) SVI II ESD, Double Acting, 2-wire DI Mode (DSD) SVI II ESD, Double Acting 4-wire DI Mode (A/DSD) The SVI II ESD is classified as a Type A 1 device according to IEC61508 when using the dedicated shutdown circuit, and has a hardware fault tolerance of 0. 1 Type A component: Safety function has limited components and well defined failure modes. For details see of IEC T-023 V2R1, August, Page 9 of 17

10 4 IEC Functional Safety Assessment The IEC Functional Safety Assessment was performed based on the information received from GE Energy and is documented in this report. 4.1 Methodology The full functional safety assessment includes an assessment of all fault avoidance and fault control measures during hardware development and demonstrates full compliance with IEC to the end-user. The assessment considers all requirements of IEC Any requirements that have been deemed not applicable have been marked as such in the full Safety Case report e.g. software development requirements for a product with no software. The assessment also includes a review of existing manufacturing quality procedures to ensure compliance to the quality requirements of IEC As part of the IEC functional safety assessment the following aspects have been reviewed: Development process, including: o Functional Safety Management, including training and competence recording, FSM planning, and configuration management o Specification process, techniques and documentation o Design process, techniques and documentation, including tools used o Validation activities, including development test procedures, test plans and reports, production test procedures and documentation o Verification activities and documentation o Modification process and documentation o Installation, operation, and maintenance requirements, including user documentation o Manufacturing Quality System Product design o Hardware architecture and failure behavior, documented in a FMEDA The review of the development procedures is described in section 5. The review of the product design is described in section Assessment level The Masoneilan Smart Valve Interface, SVI II ESD has been assessed per IEC to the following levels: SC 3 (SIL 3 Capability) The development procedures have been assessed as suitable for use in applications with a maximum Safety Integrity Level of 3 (SIL 3) according to IEC T-023 V2R1, August, Page 10 of 17

11 4.3 Product Modifications GE Energy may make modifications to this product as needed. Modifications shall be classified into two types: Type 1 Modification: Changes requiring re-certification, which includes the re-design of safety functions or safety integrity functions. Type 2 Modification: Changes allowed to be made by GE Energy provided that: A competent person from GE Energy, appointed and agreed with exida, judges and approves the modifications. The modification documentation listed below is submitted prior to a renewal of the certification to exida for review of the decisions made by the competent person in respect to the modifications made. o o o o o List of all anomalies reported List of all modifications completed Safety impact analysis which shall indicate with respect to the modification: The initiating problem (e.g. results of root cause analysis) The effect on the product / system The elements/components that are subject to the modification The extent of any re-testing List of modified documentation Validation test plans T-023 V2R1, August, Page 11 of 17

12 5 Results of the IEC Functional Safety Assessment exida assessed the development process used by GE Energy for these products against the objectives of IEC parts 1-7. The assessment was done on-site at the Avon, MA facility on January 22, and 239, 2013 and documented in the SafetyCase [R6]. 5.1 Open Issues The overall process is strong and the designs have extensive proven field experience, sufficient for SIL 3 capability. Some areas of improvement were identified in the design process and some of the design procedures and forms were upgraded during the project. All of the improvements were evaluated and included in the final version of the SafetyCase. 5.2 Lifecycle Activities and Fault Avoidance Measures GE Energy has an IEC compliant development process as assessed during the IEC certification. This compliant development process is documented in [R6]. This functional safety assessment investigated the compliance with IEC of the processes, procedures and techniques as implemented for the valve positioner development. The investigation was executed using subsets of the IEC requirements tailored to the SIL 3 work scope of the development team. The result of the assessment can be summarized by the following observations: The audited GE Energy design and development process complies with the relevant managerial requirements of IEC SIL Functional Safety Management FSM Planning The functional safety management of any instrument development is governed by Controlled Administrative Procedure (CAP) 020 [D3]. For each development GE Energy creates a project schedule [D2] which defines all of the tasks that must be done to ensure functional safety as well as the person responsible for each task. The team structure is documented in the minutes of the monthly status meeting with management (see [D12] for an example). Action items that arise during the project are tracked to completion in minutes of the weekly status meeting with the development team (see [D41] for an example). A meeting is held with management at the end of each phase to determine if the team should proceed to the next phase (see [D10] for an example). These processes and the procedures referenced herein fulfill the requirements of IEC with respect to functional safety management. Version Control All documents are under version control as documented in [R6]. Design drawings and documents are also under version control. GE Energy uses Visual Source Safe for its version control. Training, Competency recording Personnel training records are kept in accordance with IEC requirements as documented in [R6]. GE Energy hired exida to be the independent assessor per IEC T-023 V2R1, August, Page 12 of 17

13 5.2.2 Safety Requirements Specification and Architecture Design As defined in [D3], a safety requirements specification (SRS) is created for all products that must be certified to meet IEC The requirements specification contains three major sections: Product Specific Safety Requirements, Product Specific Architecture, and Derived Safety requirements. For the SVI II ESD Valve Positioner, the SRS [D1], has been reviewed by exida for completeness per the requirements of IEC Requirements are tracked throughout the development process by the creation of derived requirements, which map the requirements to the design, and by mapping requirements to appropriate validation tests in the validation test plan [D4]. Requirements from IEC , Table B.1 that have been met by GE Energy include project management, documentation, separation of safety requirements from non-safety requirements, structured specification, inspection of the specification, semi-formal methods and checklists. [D38] documents more details on how each of these requirements has been met. This meets the requirements of IEC SIL Hardware Design Hardware design, including both electrical and mechanical design, is done according to [D3]. The hardware design process includes component selection, detailed drawings and schematics, 3D Solid Models, safety case documents for agency justification, a failure modes and effect analysis (FMEA), a failure modes, effects, and diagnostic analysis (FMEDA), a concept design review, the creating of prototypes, and hardware verification tests. Requirements from IEC , Table B.2 that have been met by GE Energy include observance of guidelines and standards, project management, documentation, structured design, modularization, use of well-tried components, checklists, semi-formal methods, computer aided design tools, simulation, and inspection of the specification. This meets the requirements of IEC SIL Validation Validation Testing is done via a set of documented tests (see [D4]). The validation tests are traceable to the Safety Requirements Specification [D1] in the validation test plan [D4]. In addition to standard Test Specification Documents, third party testing may be included as part of agency approvals. As the SVI II ESD consists of simple electrical devices with a straightforward safety function, integration testing has been limited to verifying that all diagnostics take the appropriate action when a problem is detected (See [D21] and [D23] for more details on this testing). Procedures are in place for corrective actions to be taken when tests fail as documented in [R6]. Requirements from IEC , Table B.3 that have been met by GE Energy include functional testing, project management, documentation, and black-box testing. Field experience and statistical testing via regression testing are not applicable. [D38] documents more details on how each of these requirements has been met. This meets the requirements of IEC SIL 3. Requirements from IEC , Table B.5 that have been met by GE Energy include functional testing and functional testing under environmental conditions, Interference surge immunity testing, fault insertion testing, project management, documentation, static analysis, dynamic analysis, and failure analysis, expanded functional testing and black-box testing. [D38] documents more details on how each of these requirements has been met. This meets IEC SIL 3. T-023 V2R1, August, Page 13 of 17

14 5.2.5 Verification The development and verification activities are defined in [D3] and [D8]. Verification activities include the following: Fault Injection Testing [D7], Calculations for Functional Safety [D5], Code Review [D15], Unit Testing [D20] and [D40], Integration Testing [D21] and [D23], Requirements Review [D22] Design Review [D22], FMEDA [R1], Static Analysis using PC LINT [D30], [D31], [D32], and [D34], Software Criticality Analysis and HAZOP [D37], and System FMEA [D38]. This meets the requirements of IEC SIL Modifications Modifications are done per the GE Energy s IEC SIL 3 compliant development process as documented in [D3]. Consequently this meets the requirements of IEC SIL User documentation GE Energy created a Safety Manual for the SVI II ESD, see [D11]. This safety manual was assessed by exida. The final version is considered to be in compliance with the requirements of IEC The document includes all required reliability data and operations, maintenance, and proof test procedures. Requirements from IEC , Table B.4 that have been met by GE Energy include operation and maintenance instructions, user friendliness, maintenance friendliness, project management, documentation, limited operation possibilities, protection against operator mistakes, and operation only by skilled operators. [D38] documents more details on how each of these requirements has been met. This meets the requirements of IEC SIL Hardware Assessment To evaluate the hardware design of the SVI II ESD, a Failure Modes, Effects, and Diagnostic Analysis was performed by exida consulting for each component in the system. This is documented in [R1]. The FMEDA was verified using Fault Injection Testing as part of the development, see [D7], and as part of the IEC assessment. A Failure Modes and Effects Analysis (FMEA) is a systematic way to identify and evaluate the effects of different component failure modes, to determine what could eliminate or reduce the chance of failure, and to document the system in consideration. An FMEDA (Failure Modes, Effects, and Diagnostic Analysis) is an FMEA extension. It combines standard FMEA techniques with extension to identify online diagnostics techniques and the failure modes relevant to safety instrumented system design. From the FMEDA, failure rates are derived for each important failure category. All failure rate analysis results and useful life limitations are listed in the FMEDA report [R1]. The failure rates listed are valid for the useful life of the devices. T-023 V2R1, August, Page 14 of 17

15 Note, as the Masoneilan Smart Valve Interface, SVI II ESD are only one part of a (sub)system, the SFF should be calculated for the entire final element combination. These results must be considered in combination with PFD AVG values of other devices of a Safety Instrumented Function (SIF) in order to determine suitability for a specific Safety Integrity Level (SIL). The architectural constraints requirements of IEC , Table 2 also need to be evaluated for each final element application. It is the end users responsibility to confirm this for each particular application and to include all components of the final element in the calculations. The analysis shows that the design of the Masoneilan Smart Valve Interface, SVI II ESD can meet the hardware requirements of IEC 61508, SIL 3 and SIL 2 depending on the complete final element design. PFD AVG and Architecture Constraints must be verified for each application. T-023 V2R1, August, Page 15 of 17

16 6 Terms and Definitions Fault tolerance FIT FMEDA HFT Low demand mode PFD AVG PVST SFF SIF SIL SIS Type A element Type B element Ability of a functional unit to continue to perform a required function in the presence of faults or errors (IEC , 3.6.3) Failure In Time (1x10-9 failures per hour) Failure Mode Effect and Diagnostic Analysis Hardware Fault Tolerance Mode, where the frequency of demands for operation made on a safetyrelated system is no greater than twice the proof test frequency. Average Probability of Failure on Demand Partial Valve Stroke Test It is assumed that the Partial Stroke Testing, when performed, is automatically performed at least an order of magnitude more frequent than the proof test, therefore the test can be assumed an automatic diagnostic. Because of the automatic diagnostic assumption the Partial Valve Stroke Testing also has an impact on the Safe Failure Fraction. Safe Failure Fraction summarizes the fraction of failures, which lead to a safe state and the fraction of failures which will be detected by diagnostic measures and lead to a defined safety action. Safety Instrumented Function Safety Integrity Level Safety Instrumented System Implementation of one or more Safety Instrumented Functions. A SIS is composed of any combination of sensor(s), logic solver(s), and final element(s). Non-Complex element (using discrete components); for details see of IEC Complex element (using complex components such as micro controllers or programmable logic); for details see of IEC T-023 V2R1, August, Page 16 of 17

17 7 Status of the Document 7.1 Liability exida prepares reports based on methods advocated in International standards. exida accepts no liability whatsoever for the use of this report or for the correctness of the standards on which the general calculation methods are based. 7.2 Releases Version: V1 Revision: R1 Version History: V1, R1: Released, March 28, 2013 Authors: Chris O'Brien Review: V0, R1: Steven Close; March 28, 2013 Release status: Released 7.3 Future Enhancements At request of client. 7.4 Release Signatures Steven F. Close, Safety Engineer Chris O Brien, CFSE, Partner T-023 V2R1, August, Page 17 of 17