NISHIDA Jun1 MATSUDA Toshihiko1
We have developed the ProSafe-RS, a safety system compatible with the SIL3 level of the IEC 61508 international standard. This product alone fulfills the requirements for safe instrumentation. In addition, it is highly compatible with our CENTUM CS 3000 process control system and offers a platform for flexible, comprehensive solutions to users who implement overall process plant designs. This paper outlines the aims and features of the ProSafe-RS.
There is growing recognition of the importance of preventing serious accidents in the process control field in view of the potential scale of impact on society. The IEC 61508 and IEC 61511 international standards call for the reduction of risk using safety instrumented systems (SIS) as well as the configuration of multiple protective layers in a process control system in order to prevent major accidents. Safety systems included in SIS are required to be both safe and highly reliable. Generally, safety and high reliability appear to be similar in meaning. However, the term "safety" as applied to safety systems, means the level of accuracy at which plant shutdown is performed when a problem occurs, and includes the characteristic that safety systems will behave toward the fail-safe side, i.e., plant shutdown, even if they themselves fail. In contrast, reliability refers to the low probability at which a plant is shut down due to failure in a safety system (error trip rate is low). From the user's point of view, both process control and safety instrumentation are conducted for the same plant, requiring solutions that consider both process control and safety instrumentation comprehensively. Our safety system, the ProSafe-RS, has been developed with the following features to meet these requirements.
Figure 1 Example of ProSafe-RS/CS 3000 Integrated System Configuration
Figure 1 shows an example of an integrated configuration of the ProSafe-RS safety system and the CENTUM CS 3000 production control system. In the ProSafe-RS, the safety engineering PC (SENG) and safety control station (SCS) are connected directly using a V net control bus.
The SENG is a PC on which software having engineering functions and maintenance functions runs.
The SCS is a safety controller that performs logical operations such as shutdown by downloading application(s) created on the SENG. The architecture of the SCS is based on the flexibility of the CS 3000 FCS, and its I/O modules and CPU modules allow the user to select a dual-redundant configuration (Figure 1- 1) or single configuration (Figure 1- 2 3) in a single station according to the user's objective. Moreover, SCS supports inter-SCS safety communication, allowing a safety loop to be built (Figure 1- 4) extending over SCSs via the V net control bus shared by the CS 3000.
Performing CS 3000 tag engineering on the SENG and then downloading these tags to the SCS allows integrated operations handling SCS (Figure 1- 6) to be performed from the CS 3000 HIS in the same way as the CS 3000 FCS.
Architecture Integration The basic architecture of the ProSafe-RS is the same as that of the CS 3000. This makes the ProSafe-RS easy to use, based on the many years of DCS development and the proven field reliability of the CS 3000.
Users also benefit, as the concept of hardware installation, maintenance methods, etc., is the same between DCS and SIS by applying the CS 3000 and ProSafe-RS in the same plant.
Moreover, architecture integration allows the SIS and DCS to be connected using the V net common control bus. This simplifies system building and mutual interface design, thus significantly improving total engineering efficiency including the design and installation costs of system building and interface design.
In addition, the design concept of providing the same interface with the HIS operator station and MES domain for the DCS and SIS provides a platform offering a total solution using the DCS and SIS with virtually no distinction, as well as sophisticated functional enhancement (such as equipment management) in the future.
The SIS is a system that immediately shuts down a plant safely if a problem occurs in the plant and neither the DCS nor humans can handle it. In other words, cases where SIS operation or monitoring is required are very rare, and it is inconvenient to always monitor both SIS-specific HMI and DCS-specific HMI for that purpose alone. If the SIS and DCS can be operated and monitored using the same HMI, the operators do not have to remember the operations of both HMIs, and when needed, the operator can take accurate action using the HMI of the DCS he/she usually uses. Therefore, routine SIS monitoring should ideally be performed using the same DCS HMI.
To meet these user requirements, the ProSafe-RS provides an integrated operating environment having the following features:
Integration of DCS and SIS, and Segregation Thereof
Integration of DCS and SIS has the advantages described above. However, the international safety standards require DCS and SIS to be segregated in order to protect the function of safety protective layers even if control functionality is lost, as is apparent in risk assessment analysis (Layer of Protection Analysis, LOPA) using multiple protective layers.
The system configuration of the ProSafe-RS integrates the DCS and SIS using the V net control bus, while keeping DCS and SIS functions securely separated. When considering the segregation between the DCS and SIS, the key points are how to prevent interference from the DCS to SIS and how to prevent a failure affecting both systems. The following describes how the ProSafe-RS protects itself against interference from DCS and common cause failures.
Figure 2 Common Cause Failures and Safety in Reuse
The ProSafe-RS incorporates the redundant matching mechanism and self-diagnostic mechanism in one I/O module and CPU module to comply with the SIL3 level defined in IEC 61508 by a single component. That is, both the CPU module and I/O module can realize a safety loop meeting SIL3 in a single configuration. This provides the following additional engineering options:
The ProSafe-RS engineering functions support languages compliant with the IEC 61131-3 international standard. This allows applications having a hierarchical structure to be created and so users can benefit from the advantages of IEC 61131-3, such as reusability and conversion to parts. The ProSafe-RS supports the following functions for efficient engineering and maintenance.
This paper has outlined the features of the ProSafe-RS and their objectives. The ProSafe-RS provides a powerful platform for achieving safety instrumentation and total DCS solutions. In the future, we will study the following functional enhancements to meet various user needs:
Released in 1998, CENTUM CS 3000 R3 was Yokogawa's first integrated production control system to feature an HMI running on the Windows OS. Thousands of these systems are in use around the world, in a wide variety of industries. CENTUM CS 3000 R3 is interoperable with both CENTUM VP and CENTUM CS systems, which makes it possible for users to upgrade to a newer system with minimum investment
The ProSafe-RS is a Safety Instrumented System that is certified by the German certification organization (TÜV) to meet Safety Integrity Level (SIL) 3 specified in IEC 61508. It has been used in over 2,100 projects, ranging from large scale integrated process automation projects to stand-alone solutions. Yokogawa's ProSafe-RS safety systems are built with competence, life cycle support and long term sustainability.