IEC Functional Safety Assessment

Transcription

1 IEC Functinal Safety Assessment Prject: 2052 Series Actuatrs Cmpany: Fisher Cntrls Internatinal LLC, Inc. (an Emersn Prcess Management cmpany) Marshalltwn, IA USA Cntract Number: Q13/ Reprt N.: EFC 13/ R003 Versin V1, Revisin R1, September 11, 2013 Ted Stewart The dcument was prepared using best effrt. The authrs make n warranty f any kind and shall nt be liable in any event fr incidental r cnsequential damages in cnnectin with the applicatin f the dcument. All rights reserved.

2 Management Summary This reprt summarizes the results f the functinal safety assessment accrding t IEC carried ut n the: 2052 Series Actuatrs The functinal safety assessment perfrmed by exida cnsisted f the fllwing activities: - exida assessed the develpment prcess used by Fisher Cntrls Internatinal LLC, Inc. by an n-site audit and creatin f a safety case against the requirements f IEC exida perfrmed a detailed Failure Mdes, Effects, and Diagnstic Analysis (FMEDA) f the devices t dcument the hardware architecture and failure behavir. - exida reviewed field failure data t ensure that the FMEDA analysis was cmplete. - exida reviewed the manufacturing quality system in use at Fisher Cntrls Internatinal LLC, Inc. The functinal safety assessment was perfrmed t the requirements f IEC 61508: ed2, 2010, SIL 3 fr mechanical cmpnents. A full IEC Safety Case was prepared, using the exida SafetyCaseDB tl, and used as the primary audit tl. Hardware prcess requirements and all assciated dcumentatin were reviewed. Envirnmental test reprts were reviewed. Als the user dcumentatin (safety manual) was reviewed. The results f the Functinal Safety Assessment can be summarized as: The Fisher Cntrls Internatinal LLC, Inc Series Actuatrs were fund t meet the Systematic Capability requirements f IEC fr up t SC 3 (SIL 3 Capable) The manufacturer will be entitled t use the fllwing Functinal Safety Lgs T-023 V2R3 Page 2 f 13

3 Table f Cntents Management Summary Purpse and Scpe Prject Management exida Rles f the parties invlved Standards and Literature used Reference dcuments Dcumentatin prvided by Fisher Cntrls Internatinal LLC, Inc Dcumentatin generated by exida Prduct Descriptin Fisher 2052 Actuatr Features IEC Functinal Safety Assessment Methdlgy Assessment level Results f the IEC Functinal Safety Assessment Lifecycle Activities and Fault Avidance Measures Functinal Safety Management Safety Requirements Specificatin and Architecture Design Hardware Design Validatin Verificatin Mdificatins User dcumentatin Hardware Assessment Terms and Definitins Status f the Dcument Liability Releases Future Enhancements Release Signatures T-023 V2R3 Page 3 f 13

4 1 Purpse and Scpe This dcument shall describe the results f the IEC functinal safety assessment f the Fisher Cntrls Internatinal LLC, Inc Series Actuatrs by exida accrding t the requirements f IEC 61508: ed2, The results f this prvides the safety instrumentatin engineer with the required failure data as per IEC / IEC and cnfidence that sufficient attentin has been given t systematic failures during the develpment prcess f the device. T-023 V2R3 Page 4 f 13

5 2 Prject Management 2.1 exida exida is ne f the wrld s leading accredited Certificatin Bdies and knwledge cmpanies specializing in autmatin system safety and availability with ver 300 years f cumulative experience in functinal safety. Funded by several f the wrld s tp reliability and safety experts frm assessment rganizatins and manufacturers, exida is a glbal cmpany with ffices arund the wrld. exida ffers training, caching, prject riented system cnsulting services, safety lifecycle engineering tls, detailed prduct assurance, cyber-security and functinal safety certificatin and a cllectin f n-line safety and reliability resurces. exida maintains the largest prcess equipment database f failure rates and failure mdes with ver 60 billin unit perating hurs. 2.2 Rles f the parties invlved Fisher Cntrls Internatinal LLC, Inc. exida Manufacturer f the 2052 Series Actuatrs Perfrmed the hardware assessment exida Perfrmed the IEC Functinal Safety Assessment Fisher Cntrls Internatinal LLC, Inc. cntracted exida in April 2008 fr the IEC Functinal Safety Assessment f the abve mentined devices. 2.3 Standards and Literature used The services delivered by exida were perfrmed based n the fllwing standards / literature. [N1] IEC (Parts 1-7): ed2, 2010 Functinal Safety f Electrical/Electrnic/Prgrammable Electrnic Safety-Related Systems 2.4 Reference dcuments Dcumentatin prvided by Fisher Cntrls Internatinal LLC, Inc. [D1] D103398X Safety Manual; May 2012; Rev C [D2] D103295X Prduct Bulletin; March 2013; Rev K [D3] Qmsm1 Quality Manual; Issue 2; Rev G; May 2013 [D4] D103295X012 Nv Diaphragm Rtary Actuatr Bulletin [D5] ECRN 2052.pdf 2052 Engineering Change Requests/Ntices [D6] 2052 Shipments.pdf 2052 Prduct Shipments [D7] 2052 field service reprt.pdf 2052 Field Service Reprt [D8] ES238 Technical Assessment Prcess; Rev K [D9] GE Actuatr Assembly; Rev C [D10] ES36 Making and Filing Calculatins; Rev N T-023 V2R3 Page 5 f 13

6 [D11] d103296x012 [D12] ES121 [D13] ES119 [D14] ES192 [D15] ES Instructin Manual; Nv 2011; Rev G Cntrl and Maintenance Prcedure; Rev R Design Cntrl Requirements; Rev Z Engineering Change Request Prcedure; Rev AB Prject Dcumentatin Standard Dcumentatin generated by exida [R1] EFC_ _R001_V1R1_1052_2052 _FMEDA [R2] 2052_safetycase.xls [R3] EFC R003 V1R assessment.dc, 09/11/2013 Failure Mdes, Effects, and Diagnstic Analysis Fisher 1052 and 2052 Actuatrs. SafetyCase_2052 Assessment reprt, 2052 Series Actuatrs (this reprt) T-023 V2R3 Page 6 f 13

7 3 Prduct Descriptin The 2052 Actuatr is a spring and diaphragm actuatr fr use n rtary shaft valve bdies fr thrttling r n-ff applicatins. The 2052 Actuatr may be used fr n-ff service withut a psitiner r fr thrttling service with a psitiner. The 2052 Actuatr has an ISO 5211 munting mating interface that allws installatin t nn-fisher valves. 3.1 Fisher 2052 Actuatr Features Clamped lever t reduce lst mtin The clamping f the lever nt a splined valve shaft cupled with the single pivt linkage, reduces lst mtin between the actuatr and the valve. The typical cumulative deadband fr a Fisher rtary cntrl valve assembly results in 0.5% r less variability. ISO 5211 munting with ptinal insert - The actuatr can nw be munted directly nt nn-spline shafts, such as Square and Duble D. This allws the actuatr, with its enhanced cntrl, t munt n a wider range f valves cnfrming t ISO Adjustable travel stps standard with ptinal lckut feature - Prvides the ability t adjust r change the travel range withut remving the actuatr r the additin f extra parts. The ptinal lckut feature lcks the lever in the spring-fail psitin. Fail-safe mechanism cntains n aluminum - All parts (steel, cast irn, and ductile irn) in the fail-safe mechanism ensure the actuatr will maintain safety integrity in the event f a fire. Field reversible, right- r left-hand munting - The actuatr/valve assembly actin can be cnverted frm push-dwn-t-pen t push-dwn-t-clse, r vice-versa, withut additinal parts. T-023 V2R3 Page 7 f 13

8 4 IEC Functinal Safety Assessment The IEC Functinal Safety Assessment was perfrmed based n the infrmatin received frm Fisher Cntrls Internatinal LLC, Inc. and is dcumented in this reprt. 4.1 Methdlgy The full functinal safety assessment includes an assessment f all fault avidance and fault cntrl measures during hardware develpment and demnstrates full cmpliance with IEC t the end-user. The assessment cnsiders all requirements f IEC Any requirements that have been deemed nt applicable have been marked as such in the SafetyCase, e.g. sftware develpment requirements fr a prduct with n sftware. The assessment als includes a review f existing manufacturing quality prcedures t ensure cmpliance t the quality requirements f IEC Additinally, fr designs that have been in service fr several years and have demnstrated themselves in a variety f applicatins and cnditins, cnsideratin f a prven in use assessment may be used as a substitute if a prduct didn t fllw a fully cmpliant design prcess. As part f the IEC functinal safety assessment the fllwing aspects have been reviewed: Develpment prcess, including: Functinal Safety Management, including training and cmpetence recrding, FSM planning, and cnfiguratin management Design prcess, techniques and dcumentatin, including tls used Validatin activities, including prductin test prcedures and dcumentatin Verificatin activities and dcumentatin Mdificatin prcess and dcumentatin Installatin, peratin, and maintenance requirements, including user dcumentatin Prduct design Manufacturing Quality System Hardware architecture and failure behavir, dcumented in a FMEDA The review f the develpment prcedures is described in sectin 5.1. The review f the prduct design is described in sectin Assessment level The 2052 Series Actuatrs listed in Sectin 3 have been assessed per IEC t the fllwing levels: Systematic Capability SC3 (SIL 3 capability) The cntinuing develpment prcedures fr any design changes were assessed as suitable fr use in applicatins with a maximum Safety Integrity Level f 3 (SIL 3) accrding t IEC T-023 V2R3 Page 8 f 13

9 5 Results f the IEC Functinal Safety Assessment exida assessed the develpment prcess used by Fisher Cntrls Internatinal LLC, Inc. fr this develpment against the bjectives f IEC parts 1 and 2. The assessment was dcumented in the SafetyCase [R2]. 5.1 Lifecycle Activities and Fault Avidance Measures Fisher Cntrls Internatinal LLC, Inc. has a defined prduct lifecycle prcess in place. This is dcumented in the Quality Manual [D3] and varius Quality Prcedures [D2-D7]. The same prcess is used fr mdificatins. N sftware is part f the design and therefre any requirements specific frm IEC t sftware and sftware develpment d nt apply. The assessment investigated the cmpliance with IEC f the prcesses, prcedures and techniques as implemented fr prduct design and develpment. The investigatin was executed using subsets f the IEC requirements tailred t the SIL 3 wrk scpe f the develpment team. The defined prduct lifecycle prcess was mdified as a result f a previus audit which shwed sme areas fr imprvement. Hwever, given the simple nature f the safety functin and the extensive prven field experience fr existing prducts Fisher Cntrls Internatinal LLC, Inc. was able t demnstrate that the bjectives f the standard have been met. The result f the assessment can be summarized by the fllwing bservatins: The audited Fisher Cntrls Internatinal LLC, Inc. design and develpment prcess cmplies with the relevant managerial requirements f IEC SIL Functinal Safety Management FSM Planning Fisher Cntrls Internatinal LLC, Inc. has a defined prcess in place fr prduct design and develpment. Required activities are specified alng with review and apprval requirements. This is primarily dcumented in sectin 7.3 f their Quality Manual [D3]. Templates, frms and sample dcuments are prvided. The same prcess is used fr mdificatins. This prcess and prcedures referenced herein fulfill the requirements f IEC with respect t functinal safety management fr a prduct with simple cmplexity and well defined safety functinality. Versin Cntrl All dcuments in the design file are under versin cntrl. This includes design drawings and specificatin and test dcuments. Training, Cmpetency recrding Human Resurces maintain apprpriate recrds f educatin, experience, training and qualificatins fr all persnnel. Department managers are respnsible fr identifying and prviding the training needs fr their department and fr maintaining recrds f in-prcess training. The prcedures and recrds were examined and fund up-t-date and sufficient. Fisher Cntrls Internatinal LLC, Inc. hired exida Cnsulting t be the independent assessr per IEC and t prvide specific IEC knwledge. T-023 V2R3 Page 9 f 13

10 5.1.2 Safety Requirements Specificatin and Architecture Design Fr the 2052 Series Actuatrs, Safety Requirements Specificatin was reviewed. The listed requirements were sufficient t cver a mechanical device with a simple Safety Functin. As the prduct designs are simple and are based upn standard designs with extensive field histry, n semi-frmal methds are needed. General Design and testing methdlgy is dcumented and required as part f the design prcess. This meets SIL Hardware Design The design prcess is dcumented in Sectin 7.3 f [D3]. Items frm IEC , Table B.2 include bservance f guidelines and standards, (PED, ATEX, NACE) prject management, dcumentatin (design utputs are dcumented per quality prcedures), structured design, mdularizatin, use f well-tried cmpnents / materials, and cmputer-aided design tls. This meets SIL Validatin Validatin Testing is dne via a dcumented plan created with the prducts specificatins and includes cmpliance testing per applicatin and agency standards. There is n separate integratin testing necessary because the 2052 Series Actuatrs deals with nly simple safety functins. The 2052 Series Actuatrs perfrm nly 1 Safety Functin, which is extensively tested under varius cnditins during validatin testing. Items frm IEC , Table B.3 include functinal testing, prject management, dcumentatin, and black-bx testing (fr the cnsidered devices this is similar t functinal testing). Field experience and statistical testing via regressin testing are nt applicable. This meets SIL 3. Items frm IEC , Table B.5 included functinal testing and functinal testing under envirnmental cnditins, prject management, dcumentatin, failure analysis (analysis n prducts that failed), expanded functinal testing, black-bx testing, and fault insertin testing. This meets SIL Verificatin The develpment and verificatin activities are defined in Sectin 7.3 f [D3]. Fr each design phase the bjectives are stated, required input and utput dcuments and review activities. This meets SIL Mdificatins Mdificatins are dcumented in ES192 [D14]. All changes are first reviewed and if apprved, the wrk fllws the nrmal design prcess. This meets SIL User dcumentatin Fisher Cntrls Internatinal LLC, Inc. creates the fllwing user dcumentatin: prduct catalgs and a Safety Manual. The Safety Manual was fund t cntain all f the required infrmatin given the simplicity f the prducts. The FMEDA reprts are referenced, available and they cntain required failure rates, failure mdes, useful life, and suggested prf test infrmatin. T-023 V2R3 Page 10 f 13

11 Items frm IEC , Table B.4 include peratin and maintenance instructins, user friendliness, maintenance friendliness, prject management, dcumentatin, limited peratin pssibilities (2052 Series Actuatrs perfrm well-defined actins) and peratin nly by skilled peratrs (peratrs familiar with type f valve, althugh this is partly the respnsibility f the enduser). This meets SIL Hardware Assessment T evaluate the hardware design f the 2052 Series Actuatrs, a Failure Mdes, Effects, and Diagnstic Analysis was perfrmed by exida. This is dcumented in [R1]. A Failure Mdes and Effects Analysis (FMEA) is a systematic way t identify and evaluate the effects f different cmpnent failure mdes, t determine what culd eliminate r reduce the chance f failure, and t dcument the system in cnsideratin. An FMEDA (Failure Mde Effect and Diagnstic Analysis) is an FMEA extensin. It cmbines standard FMEA techniques with extensin t identify nline diagnstics techniques and the failure mdes relevant t safety instrumented system design. Frm the FMEDA, failure rates are derived fr each imprtant failure categry. All failure rate analysis results and useful life limitatins are listed in the FMEDA reprt [R1]. Nte, as the 2052 Series Actuatrs are nly cmpnents f a final element, the SFF must be calculated fr the entire final element cmbinatin if fllwing the Rute 1 H hardware architectural cnstraints. It is the end users respnsibility t cnfirm this fr each particular applicatin and t include all cmpnents f the final element in the calculatins. The analysis shws that the design f the 2052 Series Actuatrs can meet the hardware requirements f IEC 61508, SIL 3 depending n the cmplete final element design. T-023 V2R3 Page 11 f 13

12 6 Terms and Definitins ATEX Atmsphere Explsives; ATEX directive fr equipment, safety / cntrl and regulatin devices, cmpnents, and prtective systems, intended fr use in ptentially explsive atmspheres. Autmatic Diagnstics Tests perfrmed n line internally by the device r, if specified, externally by anther device withut manual interventin. ES Fault tlerance FIT FMEDA HFT Lw demand mde NACE PED PFD AVG PVST Randm Capability SFF SIF SIL SIS Type A element Engineering Standard Ability f a functinal unit t cntinue t perfrm a required functin in the presence f faults r errrs (IEC , 3.6.3) Failure In Time (1x10-9 failures per hur) Failure Mde Effect and Diagnstic Analysis Hardware Fault Tlerance Mde, where the demand interval fr peratin made n a safety-related system is greater than twice the prf test interval. Natinal Assciatin f Crrsin Engineers Pressure Equipment Directive Average Prbability f Failure n Demand Partial Valve Strke Test It is assumed that the Partial Strke Testing, when perfrmed, is autmatically perfrmed at least an rder f magnitude mre frequent than the prf test, therefre the test can be assumed an autmatic diagnstic. Because f the autmatic diagnstic assumptin the Partial Valve Strke Testing als has an impact n the Safe Failure Fractin. The SIL limit impsed by the Architectural Cnstraints fr each element. Safe Failure Fractin summarizes the fractin f failures, which lead t a safe state and the fractin f failures which will be detected by diagnstic measures and lead t a defined safety actin. Safety Instrumented Functin Safety Integrity Level Safety Instrumented System Implementatin f ne r mre Safety Instrumented Functins. A SIS is cmpsed f any cmbinatin f sensr(s), lgic slver(s), and final element(s). Nn-Cmplex element (using discrete cmpnents); fr details see f IEC T-023 V2R3 Page 12 f 13

13 7 Status f the Dcument 7.1 Liability exida prepares reprts based n methds advcated in Internatinal standards. exida accepts n liability whatsever fr the use f this reprt r fr the crrectness f the standards n which the general calculatin methds are based. 7.2 Releases Versin: V1 Revisin: R1 Versin Histry: V1, R1: Updated t 2010 versin; re-certified 2051 actuatr nly; TES 9/11/13 V0, R1: Draft; August, 2013 Authrs: Ted Stewart Review: Release status: DRAFT 7.3 Future Enhancements At request f client. 7.4 Release Signatures Ted Stewart, Safety Engineer Dr. William M. Gble, Principal Partner T-023 V2R3 Page 13 f 13