Engineering Safety Functions using Cause and Effect Charts

Transcription

1 Whitepaper Engineering Safety Functions using Cause and Effect Charts

2 Engineering Safety Functions using Cause and Effect Charts Manually created Cause and Effect (C&E) charts are used in process and process control technology such as for ESD systems (Emergency Shut Down) for a long time. In addition to that, there is a growing demand from companies in the oil and gas sector as well as those in the chemical and pharmaceutical industries for tools that support the usage of C&E charts. The objective in this case is always the reduction of engineering costs and in the same time the improvement of safety and quality. With its C&E editor, infoteam provides a tool that significantly streamlines the process of developing and verifying safety functions. AutHor Frank Poignée Summary Application development using Cause and Effect charts Procedure according to NAMUR, recommendation NE 31 Specification instead of programming Simple and clear safety verification Integration of the C&E editor in IEC programming systems Keywords Safety, Cause and Effect charts, safety functions, IEC 61131, process technology, process control technology, safety verification Version 1 1 Creating C&E Charts Safety functions implemented at application level in general tend not to be that complex. A critical machine or system status is recorded with the aid of sensors and just a few connections are mainly all that is necessary to calculate a reaction that will cause corresponding actuators to achieve a safe status. Especially these types of functions can be described very well using C&E charts. A C&E chart is a tabular display of logical connections between causes and effects. The causes are listed in rows and the effects in columns (see figure1). The assignment of causes to effects is defined at the intersections. The processing sequence within a Programable Logic Control (PLC) cycle is: Cause Intersection Effect. To generate PLC programs from C&E charts, a suitable syntax need to be defined first. In doing so, the charts should not be overloaded with information, but no information should be hidden either. The available expressions and operators must therefore be limited compared to other standard PLC languages (such as ST). To make C&E charts more understandable to PLC programmers, the time and logic functions from the IEC standard are used. One C&E chart is implemented in a Program Organisation Unit (POE), so that processing of the charts complies with the standard. # WP , 2

3 2 Example The example of a fill level limiter is used to illustrate the development of safety functions using the infoteam C&E chart Editor. safety related periphery actuators 2.1 Process Flow Diagram quadrant II C&E matrix quadrant III quadrant I effects quadrant IV A process flow diagram or a Piping and Instrumentation Diagram P&ID) forms the basis of the safety examination (see figure 2). In a pressure container, an exothermal reaction takes place that can be controlled using the inflow of material 1. If the inflow of material 1 is stopped, the reaction comes to a halt. Burst protection for the pressure container is to be achieved using a safety PLC as safety device (see Figure 3). sensors causes intersections Figure 1: The principle of a C&E matrix V1 V2 Material 1 H1 2.2 Safety Requirements Material 2 V3 TI S1 PI S2 Material 3 is toxic, and therefore relevant to safety. An overflow can severely damage the health of operating personnel; the risk analysis has yielded SIL3 for the burst protection function. Overflow basins or other measures are not provided. V4 Material 3 Figure 2: P&ID fill level limiter 2.3 Designing the Safety Function The safety device is designed with two channels. Monitoring is to be performed using one pressure sensor (S2) and one temperature sensor (S1). Since pressure and temperature are proportional, a diverse capture of process data values can be realised. Valves V1 and V2 are provided to interrupt the material feed. Both valves are closed if there is no current supplied. The safe state is reached when feed of Material 1 is interrupted. Valve V1 is used in 3

4 +U B S1 T S2 P V Inputs Safety PLC Outputs Q0.1 Q0.2 Q1.2 V1 V2 H1 V3 Figure 3: Example I/O assignment for fill level limiter regular operation and therefore is also continuously monitored. Valve V2 is only for safety functions. Diagnosis of valve V2 can be taken over by the safety device. To do this, the operator has to close the valve and open it again, if the process allows that. The inspection interval is monitored by the safety device via a contact on valve V2 (I0.1). 2.4 Implementing the Safety Function Figure 4 shows the design of the safety function as a C&E chart. The cause break_protection and the associated effect stop_flow1 represent the safety function. The input variables R_T_I1 (temperature sensor S1) and R_P_I2 (pressure sensor S2) are assigned to the cause break_protection. Through the OR connection (Fct.) it is enough for one of the two sensors to reach its limit value for the cause to be activated. The limit values are defined as activation conditions (AC) for REAL type variables. In this case, these are high limit values (HL) with corresponding hysteresis. When assigning causes to effects, it is specified how the effects should behave if the cause is de/activated. An N stands for not stored, that is, if the cause is deactivated, the effect is also deactivated. Figure 4: Example C&E matrix for fill level limiter For the effect stop_flow1 a time function TP is defined. It keeps the effect active for at least five minutes after activation. If the cause break_protection is then no longer active, the effect stop_flow1 is also deactivated. If an effect is active, the associated output variables corresponding to its activation conditions are activated. The output variables here are SB_Q0.1 (Valve 1) and SB_Q0.2 (Valve 2). They are of the SAFEBOOL type. For SAFEBOOL and BOOL variables, ETT (Energize-To-Trip) or DTT (Deenergize-To-Trip) as activation condition has to be chosen. In the example, both valves are closed if there is no current. This means that if the effect stop_flow1 is active, current supply to the valves is shut off (DTT) which causes them to close. 4

5 The causes V2_closed and operator _check as well as the effects V2_check_intervall and V2_op_check are used to diagnose valve V2. The cause V2_closed is activated if the input variable SB_I0.1 is activated. This means that both, the valve and the monitoring contact (ETT) close. This activates the associated effect V2_check_intervall (N) and the output variable SB_V2_check is set. Activation stays on for a defined period due to the time function TP. This period is defined as the inspection interval. After the expiry of the inspection interval (36 h), the output variable SB_V2_check is reset. SB_V2_check is also declared as an input variable for the cause operator_check, which results in the activation of this cause (activation condition DTT). This leads to the stored activation (S) of the associated effect V2_op_ check. Stored activation means that even if all causes of an effect are deactivated, the effect remains active until a reset (R) is triggered by another cause. The output variable SB_V2_op_check is assigned to the effect V2_op_check. This variable is associated with an alarm in the SCADA system. It can only be acknowledged by closing valve V2 (input variable SB_I0.1). This use of the output variables of an effect as the input variables of a cause may be used for specifying shut-down sequences, among other things. Naturally, this example cannot show the full syntax definition, but it illustrates the principle of designing safety functions using C&E charts. 5

6 3 The C&E Editor Control The infoteam C&E editor is a.net control. Based on its interfaces, the C&E editor from infoteam is designed to be integrated into programming systems. It features simple syntax and semantics that do not contain any hidden logic. The most relevant adaptation needed is related to adapt to the target language C, ST, IL or any other into which the C&E diagrams are to be translated by the post-processor, which is part of the C&E editor control. Integration variants range from a simple flat integration based on a loose coupling, monitoring online values of C&E state variables via OPC, all the way to deep integration in the programming system, its variable administration, online and debugging functions. 6

7 4 Glossary AC IL C&E DTT ESD ETT HL P&ID POE SIL PLC ST Activation Conditions Instruction List (IEC programming language) Cause and Effect Deenergize-To-Trip Emergency Shut Down Energize-To-Trip High Limit Values Piping and Instrumentation Diagram Program Organisation Unit Safety Integrity Level Programmable Logic Control Structured Text (IEC programming language) 7

8 Contact Am Bauhof 9 D Bubenreuth Phone: +49 (0) 9131 / Fax: +49 (0) 9131 / info@infoteam.de Emil-Figge-Straße 80 D Dortmund Phone: +49 (0) 231 / Fax: +49 (0) 231 / dortmund@infoteam.de Laubisrütistrasse 44 CH-8712 Stäfa Phone: +44 (0) Fax: +44 (0) info@infoteam-software.ch infoteam Software (Beijing) Co., Ltd. Zhongguancun North Street 151 Yan Yuan Resource Tower, Room , Haidian District Beijing China Phone: +86 (0) Fax: +86 (0) info@infoteam.com.cn