Luis Duran – ABB Safety Product Group ABB in Safety Systems 800xA High Integrity – February 2014 © ABB 06 February 2014 | Slide 1 ABB in Safety Systems Agenda § ABB in Safety § 800xA High Integrity Overview § Integrated System Engineering and Operations § Independent High Integrity § Application Examples § Reference Projects § Summary © ABB 30+ Years Of Experience With Safety Systems Pioneering Installations & Long-Term Support § First safety system delivered offshore to the North Sea in 1979 § Pioneering engineering efforts § Close collaboration between ABB and end-users § Long customer relationships with close technical support and system evolution § Installed base continuously evolved and migrated to maximize customer value and minimize risk “ For an ocean of safety § Support throughout system life-cycle experience you can from installation to de- trust...” commissioning © ABB ABB Safety Execution Centers 30 Years Of Experience With Safety Systems Safety Execution Center (SEC) TUV Certified SEC © ABB Control Systems February 6, 2014 | Slide 4 Over The Years…Innovation and leadership And our experience continues to grow 1975 1980 1985 1990 1995 2000 2005 2010+ s t c 1979 - Statfjord 1984 – First integrated 1993 – First integrated 2005 – First 2007 – Largest HI e j o B safety MP200 based safety Safeguard 3000 safety installations with system to date (13 r P system goes systems goes online at system goes online at Safeguard and 000 IOs) goes y e online Gulfaks A platform Sleipner A platform HI in parallel online K 2005 – 800xA 2008 – 800xA High Integrity High Integrity s t c (SIL2) (SIL3) u d o r 1979– Triguard 2002 – Plantguard P 1983 – Safeguard 9000 1993 – Safeguard 3000 1997 – Safeguard 400 © ABB Group © ABBFebruary 6, 2014 | Slide 5 Product Group Safety Business Results – Controllers and IO © ABB Safety Automation Market ARC Figures – Safety Market - 2012 © ABB ABB Total Safety Offering Field Instrumentation SIL rated Instrumentation Actuators SIS Systems Proof Testing Support TUV Certified TRAMs Flexible and Scalable Proof test period System 800xA Maintenance Lifecycle Support Alarm Management Installed Systems Benchmarking Review EEMUA 191 SIL assessment Training Benchmarking Support SIL Determination IEC61508/IEC61511 Analysis Compliance TRAC Compliance Management Training Mentoring © ABB © ABB Group February 6, 2014 | Slide 8 ABB in Safety Systems Agenda § ABB in Safety § 800xA High Integrity Overview § Integrated System Engineering and Operations § Independent High Integrity § Application Examples § Reference Projects § Summary © ABB Safety StandardsTimeline 06 February 2014 February 06 © ABB © | Slide 10 USA UK Germany International API RP14C PRESCRIPTIVE STANDARDS 1974, Flixborough 1974 1976, Seveso HSE PES 1984, Bhopal VDE 19250 VDE 1986, Chernoble DIN DIN VDE 0801 DIN VDE 1987 1988, Piper Alpha OHSA CFR 1 1989, Pasadena 1910.119 1989 st ISO 10418 Generation Systems Generation 1991 ISA dS84.01 IEC SC65 1992 1993 Draft 1995 Draft 1995 1995 PERFORMANCE STANDARDS PERFORMANCE IEC 61508 ANSI/ISA S84.01 S84.00.01 (IECS84.00.01 61511Mod 1996 1999 IEC 61511 ANSI/ISA 2004 2003 2005 ) SIS Hardware Fault Tolerant Architectures 1st Generation Safety Systems • Duplex • Triplex • Quad (Bi-Duplex) • 1oo2D • 2oo3 • 2oo4D © ABB © ABB Group February 6, 2014 | Slide 11 2nd Generation Safety Systems …better but not perfect § 2nd generation systems.. § Were developed and certified in accordance to standards (i.e. IEC 61508) § Provide additional software diagnostics to help identify latent faults § However, they still … § Rely on redundancy for safety as well as availability § Focus on identical paths and voting for Safety (hardware fault tolerance) § Do not use diversity to eliminate common cause issues § A few are certified to IEC61508 Edition 2, but not all © ABB 06 February 2014 | Slide 12 SIL 3 Certification by TÜV 800xA High Integrity – ABB Safety Certificates § © ABB Group § February 6, 2014 | Slide 13 Product Safety Development Department Safety Manual Certificate Safety Certificate § TÜV Product Service, has certified all product components on the 800xA Safety offering © ABB 800xA High Integrity – SIL3 Certified Certificate § © ABB Group § February 6, 2014 | Slide 14 Also NFPA certified for F&G and BMS SIL3 Certified © ABB 3rd Generation Safety Systems Diverse Architecture and Implementation, Certified § Newer systems (i.e. SIL 3 800xA High CB PM AC800M HI SIL3 SIL3 Integrity controller) has parallel processing paths based on diverse technology § Integrity voting between paths SM Safety I/O SIL3 § Built in active software diagnostics § Controller and Safety Module developed HFT SFF (%) 0 1 by diverse (different) teams (Vasteras and < 60 SIL 1 Malmo, Sweden) and tested by a third 60 - 90 SIL 1 SIL 2 team (Oslo, Norway) by people with 90 - 99 SIL 2 SIL 3 different backgrounds > 99 SIL 3 SIL 4 § The two channel architecture meets SIL3 requirements for hardware fault detection 1oo1D 1oo2D and reaction IEC61508-2 Table 3 © ABB 06 February 2014 | Slide 15 System 800xA High Integrity Application Execution Diversity Parallel diverse execution allows a hardware fault CEX Bus ModuleBus tolerance of 1 for SIL3 I/O-Data+CRC I/O-Data+CRC applications I/O-Data I/O-Data I/O-Data HFT = 1 (SIL 3 Execution) . 1131 1131 c c e e SIL3 SIL3 x x SFF Hardware fault tolerance E E e e s s r r 0 1 2 e e v v i i < 60 % Not allowed SIL 1 SIL 2 Superv. Logic Superv. Logic D D Safety Module Processing Module 60 % - < 90 % SIL 1 SIL 2 SIL 3 SM PM Safety I/O 90 % - < 99 % SIL 2 SIL 3 SIL 4 ≥ 99 % SIL 3 SIL 4 SIL 4 IEC 61508-2, Table 3 © ABB 06 February 2014 | Slide 16 Safety System Engineering SIL Compliant Application Environment § Engineering tool automatically limits user configuration choices to ensure integrity § Safety functions protect and control download to the process and runtime environment § Download is prevented unless all SIL requirements are met § Embedded firewall mechanisms include: § CRC protection on different levels § Double code generation with comparison § Compiler with revalidation © ABB 06 February 2014 | Slide 17 Systematic Capabilities § Concept developed for systematic safety integrity compliance for elements and sub-systems § Replaces the term: “effectiveness against systematic failure” § Measure on a scale 1-4 that the systematic safety integrity of an element fulfills the given safety function § Considering the instructions stated in the safety manual Source: IEC 61508 © ABB 06 February 2014 | Slide 18 Aspect Server and Safety Application relationship Difference Report – Avoid Unauthorized Changes Reports the differences between the project running in the controller and the project in the Control Builder M Presented before download to the controller Changes may be rejected (in which case the download is cancelled) Each difference report is saved and stored automatically and can be reviewed at any time This, together with audit trail functionality and more, provides a well documented and traceable history © ABB Safety and Network Security § Safety: Freedom from unacceptable risk of physical injury or of damage to the health of people, either directly or indirectly as a result of damage to property or to the environment. IEC 61508 § Security: Preventing intentional or unintentional interference with the proper and intended operation, or inappropriate access to confidential information in industrial automation and control systems ANSI/ISA–99.00.01–2007 © ABB 06 February 2014 | Slide 20 Safety Engineering on common Client/Server Network Physical Access Control on SM811 § Reset All Forces – Enable a quick reset of all forces in the controller § Access Enable – Activates the access enable function § Hot insert – Initiates hot insertion of SM811 (in redundant configuration) § Force Indicator – Active if one or more signals are in force § System Alarm Indicator – Active if there are one or more system alarms C C P P “Reset all forces” Hot Insert Force System Indicator Alarm © ABB Safety Engineering on common Client/Server Network System Security And Embedded Firewalls § Provides functions for protection of SIL classified applications in AC800M HI § © ABB Group Controllers § February 6, 2014 | Slide 22 § SIL Access Control and Authorization § Force Control / Override Control / Bypass Management § Confirmed Online Write / Confirmed Operation § Embedded firewalls and confirmation procedures protect the SIL application from inadvertent / accidental control actions © ABB User Roles&Responsibilities Network Client/Server Engineering oncommon Safety © ABB © § § § § High flexibility (operation andengineering) Restriction of access tothe SIS specific stations Users can be assigned access from responsibilities permissionsaccording to their Users can beassigned with different Engineer SSS Engineer PCS Operate SSS Operate PCS X X Process Operator X Safety Operator X Process Engineer X Safety Engineer Aspect Server and Safety Application relationship Impact in term of segregation § Safety Application runs on the Safety Controller and functionally independent of the Aspect Server § Aspect Server in Oil & Gas application are redundant § Engineering data is stored on a protected section of the Aspect Server § Safety engineering data is protected § Access is limited to those users with the appropriate access permission § Backup is handled on a regular basis § Malware protection § Audit Trail capabilities © ABB Group February 6, 2014 | Slide 24 Secure by Default, Defense in Depth Certified SIL3 Communication § SIL3 certified (IEC 61508) Communication