Functional Safety and Cybersecurity Analysis and Management in Smart Manufacturing Systems

Power assist systems are expected to bring many benefits in various fields, and some of them have already been introduced in the welfare and manufacturing industries. As power assist systems demand manual contact with a human operator, it is important to prevent hazards that originate from system faults. The objectives of this paper are to introduce a strategy on safety function implementation by means of a case study for a power assist system and to propose an approach for safety function design. This paper describes details of the strategy for Skill-Assist — the power assist system adopted as the experimental platform. First, the safety integrity level (SIL) required for Skill-Assist was determined, following which top-down and bottom-up risk assessments were conducted. A safety-related system (SRS) with a fail-safe fault detection device and dual-channel voting architecture was then constructed based on the risk assessment result. A functional safety analysis was performed for the SRS and we found that the SRS satisfied the required SIL. An experiment on the functionality of the SRS was performed and we verified the safety function for Skill-Assist set by the proposed strategy.

Safety instrumented systems (SIS) are more and more used in industry to replace conventional protection systems and functional safety standards (e.g. IEC 61508 2010 or ISO/TR 12489 2013) have been developed to deal with them. This chapter presents a critical analysis of the main functional safety concepts (e.g. safety integrity levels) and principles (e.g. fault tolerance), highlights why relying on the safe failure fraction (SFF) is questionable and explains how to perform the related probabilistic calculations (e.g. PFDavg, PFH). The functioning design—loss of power versus power emission, low versus high demand modes of operation—and the impact of fault tolerance are analysed. The mathematics allowing to obtain the ready-made simplified results proposed in IEC 61508-6 are developed and the difficulties and limitations of this approach lead to the conclusion that it should be superseded by the various systemic models described in the book: fault trees, Markov graphs or Petri nets. Models for the various types of failures—dangerous/safe, detected/non-detected by diagnostic or proof tests, non-covered (i.e. never detected)—are proposed. Simple SIS structures as well as multiple SIS are considered. The impact of test staggering is analysed as well as the various ways to take input data uncertainties into account.

This study proposed the reliability analysis of a wellhead platform in Al Shaheen Block 5 Project. The reliability, optimal maintenance period, and appropriate redundancy policy were acquired by taking the failure rate of each component and methods from OREDA and PDS. The PDS is a method used to quantify the reliability of computer-based control and safety systems. The probability of failure on demand (PFD) was estimated for each safety function. The safety integrity level (SIL) of the overall system was evaluated to quantify failure risks. The SIL evaluation was applied to judging whether the reliability of process shutdown (PSD) functions of the present system was properly configured. In particular, the shutdown functions of the flare system and well isolation satisfied the minimum SIL requirement by IEC general recommendation. Introduction The Al Shaheen Oilfield is located in the Arabian Gulf, approximately 70km offshore northeast of the Qatar Peninsula. Hyundai Heavy Industries (HHI) has been awarded a contract for the Engineering, Procurement, Construction and Commissioning (EPCC) of a number of new platforms and additional facilities, by Maersk Oil Qatar (MOQ). This study gives a detailed risk assessment of the high liquid level shutdown to prevent liquid carryover to the flare stack in Block 5 Development Project. The overall system consists of two sub-systems equipped with safety instrumentation: one concerning the Production Wellheads with isolation valves, and the other concerning the Wellhead Platform with the Inlet Separator, Test Separator, and HP Flare K.O. Drum. Depending on the field development phase and operating philosophy, the number of working Production Wellhead varies up to 30. The HP Flare K.O. Drum is not designed to receive the total liquid flow from Inlet or Test Separators. This situation has raised a concern whether the safety instrumentation of the Wellhead Platform is of sufficient integrity. To analyze the reliability of the issued system, the functional boundaries are first defined in consideration of the design and operational philosophy. The reliability block diagram (RBD) is used to represent the system configuration. The failure rates of the overall instrumentation and equipment are obtained from the surrogated data such as OREDA and PDS. The SIL requirement by IEC is employed as the safety level determining the system integrity. Safety Integrity Level Assessment Safety functions and safety integrity level In the IEC standards, a safety function is considered as a function to be implemented in order to achieve a specified risk reduction related to a hazardous event. A safety function is thus specified in terms of the action to be taken and the required probability to successfully carry out this action. This probability is also referred to as the safety integrity, and in the context of IEC 61508 the safety integrity is classified to discrete levels as indicated in Table 1.

This paper describes a systematic way to apply the functional safety standards IEC 61508 and IEC 61511 on the safety management of a chemical process tank. After a short introduction of the basic principle of the functional safety philosophy the risk based determination of the safety integrity level (SIL) for a special liquid tank application is given. Then a safety instrumented system (SIS) suitable to the SIL-level 2 has been designed to fulfill the qualitative and quantitative requirements in the safety standards. The experience gained can be seen as a guidance for process and I&C engineers in industrial practice.

Combination of safety integrity levels (SILs): A study of IEC61508 merging rules

Safety PLCs (Programmable Logic Controller) are one of the appropriate tools for implementation of safety-related control system (SRCS). Their modular construction allows implementation not only control systems of defined safety integrity level (SIL), but even redundant control systems with defined availability. The contribution considers influence of redundant architectures on safety integrity of SRCS with safety PLC.

This paper illustrates the application of a Safe by Design approach developed by the process industries to determine the effectiveness of arc flash\blast risk control techniques using functional safety techniques used to determine the integrity of emergency shutdown systems. It is proposed that with the adoption of risk analysis practices detailed in NFPA70E-2015 Informative Annex F Risk Assessment Procedure, the risk assessment process lends itself to calibration with the process and machinery functional safety standards, (ISA84.01, IEC 61508, IEC 61511, IEC 62061), for electrical/electronic/programmable electronic safety systems. Using this approach, it is possible to determine the Safety Integrity Level (SIL) requirements of the Arc Flash\Blast risk control system and design it in the same manner as a process emergency shutdown system, and/or a machinery safety system. Using this approach in the design phase enables you to build a defendable and economical arc flash mitigation system and also demonstrate duty of care has been exercised. Worked examples are utilized to demonstrate the application and use of the technique.

Since inception, the Advanced Technology Solar Telescope (ATST) has planned to implement a facility-wide functional safety system to protect personnel from harm and prevent damage to the facility or environment. The ATST will deploy an integrated safety-related control system (SRCS) to achieve functional safety throughout the facility rather than relying on individual facility subsystems to provide safety functions on an ad hoc basis. The Global Interlock System (GIS) is an independent, distributed, facility-wide, safety-related control system, comprised of commercial off-the-shelf (COTS) programmable controllers that monitor, evaluate, and control hazardous energy and conditions throughout the facility that arise during operation and maintenance. The GIS has been designed to utilize recent advances in technology for functional safety plus revised national and international standards that allow for a distributed architecture using programmable controllers over a local area network instead of traditional hard-wired safety functions, while providing an equivalent or even greater level of safety. Programmable controllers provide an ideal platform for controlling the often complex interrelationships between subsystems in a modern astronomical facility, such as the ATST. A large, complex hard-wired relay control system is no longer needed. This type of system also offers greater flexibility during development and integration in addition to providing for expanded capability into the future. The GIS features fault detection, self-diagnostics, and redundant communications that will lead to decreased maintenance time and increased availability of the facility.

Off-site hydrogen refueling stations (HRS) handle large volumes of high-pressure hydrogen, requiring precise and systematic risk-reduction strategies. In this study, a Hazard and Operability (HAZOP) analysis was performed for an off-site HRS, and Layer of Protection Analysis (LOPA) was conducted for four risk-level-4 events using two different approaches. The Functional Safety only LOPA, based on IEC 61511, and the All Safeguards LOPA, developed according to the Center for Chemical Process Safety (CCPS) guideline, were both applied. The Functional Safety only approach, which considers only automated protection layers, required Safety Integrity Level (SIL) ratings of 1 and 2, whereas the All Safeguards approach, accounting for mechanical and procedural protection layers, achieved the Target Mitigated Event Likelihood (TMEL) in all scenarios without additional SIL requirements. Consequently, it was confirmed that the definition of protection layer scope significantly influences the required SIL, design cost, and system complexity. This study proposes a hybrid approach in which all safeguards are considered during the early design stage, while in the final design stage, protection measures are evaluated from a functional safety perspective in accordance with IEC 61511 to ensure both design efficiency and safety integrity.

Nowadays, systems such as motor vehicles, medical devices, or industrial machines are designed according to functional safety requirements. The main criterion is the safety integrity level (SIL), which is mainly based on failure probabilities. A development approach based on models, also called Model-Based Systems Engineering (MBSE), is increasingly coming into focus for a highly regulated development process. Probabilistic safety and reliability analyses for calculating failure probabilities and applying these in MBSE are currently only integrated to a limited extent. Merging partial development processes increases confidence and couples the design process with all stakeholders. This paper presents a general method that develops domain-specific extensions based on specifications from Object Management Group (OMG) regarding risk analysis and assessment modeling for more practical applicability of MBSE for functional safety.

The subject of research is to determine the functional safety indicators of a fault-tolerant safety-critical system, namely, the minimal cut sets’ probability for a given duration of the system’s operation, using the state transition diagram (STD). The aim is to create a new method for analyzing the functional safety of a fault-tolerant safety-critical system. This method is based on the methodology of developing models of operational reliability behavior in the form of STD. This methodology provides a detailed representation of inoperable states and their relation with pre-failure (inoperable critical) states. The task is to propose a new classification for inoperable states of the STD to obtain all possible emergencies in the same space of inoperable states. This approach allows consideration the correlations between the failures, that it is impossible to use the fault trees. Since the space of inoperable states can reach hundreds and thousands of states, a method is proposed for their automated determination according to the classification. The state space method was used to conduct the validation of the method of functional safety analysis. The following results were obtained: the system of Chapman-Kolmogorov differential equations is formed in accordance with the STD and it provides the dependence of the functional safety indicator – the minimal cut sets’ probability as a function of the operational duration of the fault-tolerant safety-critical system. This dependence is called the emergency function. The method for determining the emergency function is based on the usage of the emergency mask. Note that the proposed model of operational reliability behavior in the form of STD provides the possibility to conduct both the functional safety and the reliability indicators. The value of the minimal cut sets’ probability for a given duration of operation is determined using the fault tree for the validation of the proposed method of functional safety analysis. The fault tree was built by Reliasoft BlockSim software. The obtained value coincides with the value of the minimal cut sets’ probability, which was defined by the emergency function for the same operational duration. Thus, the designer can comprehensively analyze the feasibility of introducing redundancy (structural, temporal, functional). Conclusions: the scientific novelty of the obtained results is the following: the new method for determining safe, critical and catastrophic states in the set of inoperable states is used in the methodology of the STD developing to obtain the stochastic model of operational reliability behavior of fault-tolerant safety-critical system. This technique ensures an automated defining of emergency function by using an improved structural-automatic model.

Safety programmable logic controllers (S-PLCs) provide broad application options and are being used to perform control but primarily safety functions (SFs) on the process control level. An essential part of control systems based on S-PLC is the sensors and actuators. In order to ensure the SF with high safety integrity level (SIL), the control system performing this SF has to dispose of a suitable failure detection mechanism and a mechanism providing its safe reaction in case of a failure detection. The diagnostics provided by S-PLC is mainly focused on its own components, and the diagnostics of sensors and actuators has to be resolved on the application program level while respecting some specific properties of S-PLC. This paper addresses the analysis of the influence of S-PLC parameters and diagnostic parameters on the safety function SIL, which is performed by a safety relevant electronic system. In the practical part is described the implementation of application diagnostics in S-PLC and the results of diagnostic parameters influence on safety integrity of SF for a selected example connected to a practical application.

The implementation of safety functions, in contrast to ordinary control functions, requires a different approach to the design of the hardware and software of the control system. The reason for the different approaches is that each safety function must meet the required Safety Integrity Level (SIL). This has two aspects: safety integrity against random failures and safety integrity against systematic failures. Hardware is primarily related to random failure safety integrity, and software primarily to systematic failure safety integrity. The focus of this contribution lies in the design of a method that will allow the software of a safety function for industrial applications to be designed using a model of the functional behavior of this function. Since commercially available programmable logic controllers (PLCs) with a defined SIL level (so-called safety PLC) do not support such solutions, a dual architecture based on standard PLCs, including their software control, is proposed in the paper. Such an approach will make it possible to significantly limit the occurrence of systematic errors in the creation of application software, as well as to test the created application software and reveal deficiencies that arose in previous phases of the life cycle (e.g., when specifying safety functions). To implement the method proposed in this paper, a dual architecture created from the safety PLC Simatic series S7-1500 is used. With the help of this architecture, the safety function “Muting” is implemented.

Increasing requirements in automation and production make control systems more complex and vulnerable to failure. Breakdowns can cause delays in production, material damage, and above all, work-related accidents. For this reason, directives and legislation have been created at the country, European Union, and global levels that define the essential safety and requirements of industrial equipment. Guidelines must be observed by those involved in the design, supply, purchase, or use of industrial equipment in the European Union and several countries outside the European Union. Some guidelines (CAT, SIL) are created to ensure their safe operation in case of failure of both the hardware and the software. For a reliable operation of a fail safety system together with a system operating at SIL2 or SIL3, it must have Safety hardware and software. Industrial equipment manufacturers are incorporating security features into a variety of devices. Depending on the Safety Integrity Level (SIL) requirements, these features can be used during the design phase to increase safety in the event of failures or malfunctions. With proper design, the process as well as its environment (including people) can be protected by entering a controlled safe state. Manufacturers have approached this problem in a number of ways, including adding redundant Central Processing Units (CPUs), using special hardware to interface input and output signals, and developing secure network protocols for communication. Unfortunately, these features cannot be added to existing machines, at least without upgrading some hardware. As the associated costs lead to slower adoption, manufacturers rely on previous work to support certain security features, notably CPU debugging. This is implemented in the form of software libraries that operate at a low level (logic gate), designed to run on older hardware (PLC) so that they can offer an increased level of security. This study analyzes the required guidelines and legislation that must be followed for the safe operation of a production unit. It describes the mechanisms that basic and specialized PLC systems utilize to ensure the safety of an automation system. The authors have developed algorithms to record behavior measurements of electronic equipment. By further analyzing the results, it is concluded that basic equipment can be reused in these systems to provide safety functions, at the same time conserving both cost and time.

Communication channels in safety analysis: An industrial exploratory case study