Supersedes: 9/01/11 (Rev.5) Preparer: Owner: Approver: Team Member, North America Process Safety Center of Expertise

Transcription

1 Procedure No.: BC Page: 1 of 12 Preparer: Owner: Approver: Team Member, North America Process Safety Center of Expertise Manager, North America Process Safety Center of Expertise Sr. Vice President, Ecology and Safety 1. PURPOSE To establish the minimum requirements for the design, installation, testing, and operation of Safety Instrumented Systems within BASF Corporation ("BC"). 2. DEFINITIONS 2.1. Basic Process Control System (BPCS) The system that responds to inputs from the process and/or the operator that generates outputs which act directly on the process, causing it to operate in the desired manner. The BPCS does not perform any Safety Instrumented Function (SIF) Certified Safety Programmable Logic Controller Components and instrumentation systems that are certified for their intended use by expert organizations (e.g. Underwriters Laboratory and Technischer Überwachungsverein ("TÜV")). If used, digital systems and associated software must be certified by TÜV for the intended application Failure Modes of Safety Instrumented Systems Safety Instrumented Systems may fail due to a variety of faults, e.g. hardware faults, software faults, electrical faults, design faults etc. These faults are further classified as random or systematic or random faults Safe Failure A failure that does not have the potential to put the Safety Instrumented System in a hazardous or fail-to-function state. These are failures that cause the Safety Instrumented System to take action for reasons not associated with a problem in the process that the Safety Instrumented System is designed to protect. These failures are also referred to as nuisance or spurious trips. The failure affects plant availability. Safe failures can occur as safe detected failures and safe undetected failures. An example of a safe detected failure : In a 1oo2 high-level-trip system, a high level switch fails and triggers a pump shutdown. An example of safe undetected fault : In a 1oo2 high-pressure-trip system, one of the transmitters has a baseline ( zero ) drift upward. The reading will be higher than actual, and therefore the Safety Instrumented system will trip at a lower pressure than necessary. The failure is undetected until a proof test if the drift is not large enough to be caught by any online diagnostics or it is a system with no such diagnostics.

2 Procedure No.: BC Page: 2 of DEFINITIONS cont d 2.3 Failure Modes of Safety Instrumented Systems cont d Dangerous Failure A failure that has the potential to put the Safety Instrumented System in a hazardous or fail-to-function state. These are failures that prevent the Safety Instrumented System from responding to a potentially unsafe or unallowable situation. Dangerous failures can occur as dangerous detected failures and dangerous undetected failures. An example of a dangerous detected failure : In a 1oo2 high-pressure-trip system, the impulse line to one of the transmitters clogs, causing it to read a constant value regardless of what the process is doing. The failure is detected by online diagnostics that continuously compare the reading of the two transmitters and detects when one transmitter moves relative to the other and causes a high deviation between the two. An example for dangerous undetected failure : In a 1oo2 high-level-trip system, where one transmitter is a switch and the other delivers analog values, a continuous comparison of analog values cannot be done. Therefore, the failure of one transmitter, e.g. due to instrument failure or process pluggage, will remain undetected until a proof test Random hardware failure Failure, occurring at a random time, which results from a variety of degradation mechanisms in the hardware. Failure rates arising from random hardware failures are predictable and can be statistically quantified Systematic failure Failure whose cause can only be eliminated by a modification of the design or of the manufacturing process, operational procedures, maintenance procedures, documentation or other relevant factors (training). Example causes of systematic failures include human error in: the safety requirements specification; the design, manufacture, installation and operation of the hardware; the design, implementation, etc. of the software I & E Device ( Device ) Instrumentation and electric circuits that include control, monitoring and Protective Devices more fully described in Section 4.1 of this procedure M out of N ( MooN ) Configuration A system design parameter such that N number of independent channels exist and M number of channels need to be triggered to cause the safety intent to be executed.

3 Procedure No.: BC Page: 3 of 12 DEFINITIONS cont d 2.6. Protective System / Protective Device Mechanical or I & E system intended to prevent severe personal injury. Protective Devices shall have a minimum two orders of magnitude of risk reduction. An I & E Protective Device includes: field input instruments (hardware and software) logic or control elements final control elements (hardware and software), and all signal pathways. An I & E Protective System includes: the I &E Protective Device (hardware) as well as the software all hardware and software testing strategies the process design basis for the system, and all related documentation Safety Instrumented Function (SIF) A highly reliable I&E Protective Device(s) that operates independently of the Basic Process Control System and is intended to perform specific shutdown action(s) to prevent a process from operating in a impermissible manner Safety Instrumented System (SIS) Specially configured instrumented system, consisting of one or more SIFs that protect personnel against an unacceptable risk of severe injuries and/or fatality (See BASF Global Procedure G-P-EI 201 M) Safety Integrity Level (SIL) A discrete level (1 4) describing the reliability of a SIF, in terms of the likelihood of failure, when a demand for activating the SIF occurs. This value is expressed as a Probability of Failure on Demand (PFD). A SIL is assigned to every SIF, based on the results of a suitable risk assessment. Only SIL 2 or SIL 3 will be used for Safety Instrumented Functions (SIF) in BASF. 3. SCOPE This procedure establishes minimum requirements for BASF Corporation ( BC ) and its North American Region subsidiaries.

4 Procedure No.: BC Page: 4 of PROCEDURE 4.1. GENERAL INFORMATION This procedure is based on the mandatory Global Standard for Safety Instrumented Systems, G-S-EI M. BASF mandatory Global Procedure G-P-EI 201 M shall be consulted for further information regarding I & E Protective Devices, including their design and testing Grandfathering For existing SIS designed and constructed in accordance with codes, standards, or practices prior to the issuance of BASF Global Procedure G-P-EI 201 M (e.g. RPI 10, ISA S84, TS ), there is no need to reevaluate these SIFs or change the SIS according to G-P-EI 201 M. Owner of grandfathered SIS should acknowledge that this status does not provide an indefinite shield against implementing the full requirements of G-P-EI 201 M. The grandfather section does not protect the owner from the requirement to provide a safe working environment. The triggers for proceeding according to G-P-EI 201 M are found in BASF Global Procedure G-P-EI 201 M, section 2.2 and Annex 3.1, and serve as the reference expectation for the determination Overview of I & E Devices The following table describes the types of I & E devices and their functions: Type of I & E Device Function Operational Provides routine measurement and control needed to keep the plant within its normal operating range. Monitoring Alerts or takes action at the border between the normal operating range and the safe operating limits (acceptable consequences). Protective Serves to prevent process parameters from exceeding safe operating limits (unacceptable consequences). Should be considered only if mechanical devices cannot be applied or alternate processing strategy is not feasible. Note: When selecting alternatives for risk reduction measures, it is BASF s philosophy to use principles of inherently safer processes or design first. If those principles are exhausted at reasonable cost mechanical (non-i & E) Protective Devices such as safety relief valves and rupture discs that vent to a safe location are to be selected next. If no suitable mechanical protective device is available or feasible I & E protective devices should be used.

5 Procedure No.: BC Page: 5 of General Information cont d Determination of Safety Integrity Level The BASF Risk Matrix shall be used for the classification of instrumented systems to assign a target Safety integrity Level (SIL) early in the engineering phase. Only SIL 2 or SIL 3 will be used for Safety Instrumented Functions (SIF) in BASF. SIL 2 is used when raw risk assessment results in a risk ranking of C, and a SIL 3 is used when raw risk assessment results in a risk ranking of B. Functions with SIL less than 2 will be considered to be monitoring functions and part of the Basic Process Control System. SIL functions greater than 3 will not be implemented using a Safety Instrumented System alone. In order to provide physical independence of SIFs, monitoring devices are normally implemented in the BPCS General Requirements All field devices and logic solvers used in I & E Protective Systems must be in compliance with the BASF Global or Regional Standard Device List (see 6. Related Documents). For details and exceptions, refer to BASF Global Procedure G-P-EI 201 M, section and The design and testing of an SIF must be adequate to meet the SIL assigned to the SIF by the associated risk assessment Key Considerations for Design and Operation of Safety Instrumented Systems SIF Design Considerations The combination of selected devices, architecture (level of redundancy, type of redundancy), proof test interval / proof test method (e.g. including bypass or on-line test methods), diagnostic coverage and common cause failure modes impact the resulting safety integrity and the design of a SIF. The design should be established and verified to meet the target SIL before design implementation (= before appropriation). Compliance of implementation with design will be verified during Safety Review Step 4 (Pre-Startup Safety Review (PSSR)) before startup.

6 Procedure No.: BC Page: 6 of General Information cont d Key Considerations for Design and Operation of Safety Instrumented Systems cont d Safety Availability Determination If Probability of Failure on Demand (PFD) calculations or other calculations (e.g. Safe Failure Fraction (SFF)) are used for the design of SIS, these calculations and the underlying data for the calculations shall be approved by the BASF SIS responsible engineer assigned to the project who may be supported by the BASF Corporation SIS Team (CoE). The use of BASF standard designs (also known as typicals ; See G-P-EI 201 M, section 6.1) shall be reviewed with the SIS Team. There is no need for a quantification of the availability of this function. These designs will address the combination of standard architecture with allowable test frequencies, standard field devices and maintenance requirements I & E Protective Devices Safety Instrumented Functions shall not be carried out in the Basic Process Control System (BPCS). Safety Instrumented Functions should be as simple as possible. Safety Instrumented Functions often require multi-channel design. Typical architectures for BASF-devices: 1oo1 for SIL 2 1oo2 for SIL 3 2oo3 designs may be required for higher plant availability. Analog values instead of switches shall be used whenever possible. A. Data Links The communication between the Safety Instrumented System and the BPCS shall have no impact on the safe function of the SIF. In general, the BPCS shall not jeopardize the safe operation of the SIF. B. Shutdown Logic All SIF logic must be implemented within the certified safety system.

7 Procedure No.: BC Page: 7 of General Information cont d Key Considerations for Design and Operation of Safety Instrumented Systems cont d I & E Protective Devices cont d C. Mechanical Relays The use of mechanical relays in the design of a SIS is acceptable but shall be employed only in SIS designs of low loop count. D. Reducing the Likelihood of Failures The effects of multiple or common-cause failures are to be limited as far as practicable by suitable failure suppression barriers. As a part of SIF design, a formal review of each SIF is required to ensure adequate consideration and mitigation of the potential failure modes. This review should be accomplished by the methodology described in Detailed Explanation for the BASF-Specification and Review Form for Safety Instrumented Functions, and documented using the form contained therein. Harmful influences to be considered include, but are not limited to: those caused by the environment such as vibration, impact, temperature, corrosion, dirt, wear and electromagnetic influence, as well as common cause failures including, but not limited to, loss of power or loss of instrument air. See BASF Global Procedure G-P-EI 201 M, section 6.1.8, for additional details Sharing of SIS-components between SIS and BPCS A device used to perform part of a Safety Instrumented Function shall not be used for basic process control purposes, where a failure of that device results in a failure of the basic process control function which causes a demand for the Safety Instrumented Function. See BASF Global Procedure G-P-EI 201 M, section 6.2.1, for additional details.

8 Procedure No.: BC Page: 8 of General Information cont d Key Considerations for Design and Operation of Safety Instrumented Systems cont d Automatic Restart Any automatic restart after activation of the I & E Protective Device must be specifically prevented Determination/Documentation of Trip/Failure Causes The cause(s) of the activation of a SIF and/or the failure of a SIF to activate upon demand should be determined and documented in order to aid in optimizing the overall plant safety concept. Activation of a SIF and the failure of a SIF to activate on demand are considered process safety incidents (see BASF Corporate Procedure BC Incident Notification and Reporting), and as such shall be reported in the BASF Accident / Incident Management (AIM) database, with the investigation findings and identified corrective actions. In addition, technical reporting of SIF failures (both random and systematic) is required in the BASF "SIS Malfunction and Reporting Tool" (SMART database). This reporting is typically coordinated with and by the engineer responsible for the plant's SIS. This BASF global database assists in overall optimization of I & E safety concepts Maintenance and Startup Considerations Maintenance and start-up considerations should be extensively evaluated during the conceptual design of SIF / SIS to ensure that testing capability is included in the design and to eliminate, if at all possible, any anticipated need for SIF by-passing. Bypassing parts or components of Safety Instrumented Functions may jeopardize safety. Therefore the need for bypasses should be discussed very carefully during the safety review and additional measures have to be defined. Bypassing of a whole SIF for the purposes of maintenance shall not be acceptable. If bypasses are needed for maintenance or operational purposes see BASF Global Procedure G-P-EI 201 M, section and 7.3 for details.

9 Procedure No.: BC Page: 9 of General Information cont d Key Considerations for Design and Operation of Safety Instrumented Systems cont d Modifications to SIFs Modifications to any Safety Instrumented System (also changing of trip set points) shall be properly planned, reviewed and approved prior to making the change. In addition, all modifications to a Safety Instrumented Function shall be managed using the unit Management of Change (MOC) process. All MOCs involving a SIF must be approved by the appropriate responsible SIS Engineer. A hazard analysis with participation of the PS CoE and/or PS Hub shall be carried out to determine the impact on functional safety as a result of the proposed modification. For additional details see BASF Global Procedure G-P-EI 201 M, section Tagging and Testing of I & E Protective Devices Tagging In order to draw attention to this special circuitry all principle components of a SIF shall be clearly identified on documents such as P&IDs, logical diagrams, function plans, specification sheets and wiring diagrams, and must be tagged in locations such as the rack room the control room on field instruments, and on related wiring panels. See BASF Global Procedure G-P-EI 201 M, section 6.2.2, for additional details. The use of Z in tag numbers (in the second position of the tag number) shall be avoided for Non-Protective Devices to prevent confusion between Protective and Non-Protective Systems.

10 Procedure No.: BC Page: 10 of Tagging and Testing of I & E Protective Devices cont d Instrument Tag Numbers The letter Z shall be used as an add-on modifier when assigning instrument tag numbers, e.g., FZSL-101, TZSH-200. The older terms for instruments and instrument systems designed for use as Protective Devices, e.g. Category II, Class A, will not be used in the future and should be replaced when the P&IDs will be updated. See BASF Global Procedure G-P-EI 201 M, section for additional details Testing Testing must be performed to determine if design and function are in accordance with the original requirements from the safety reviews and risk assessment. Testing should be done prior to initial implementation after any changes to the SIF, and at regular intervals, consistent with the assigned SIL, as determined with the engineering design. A written testing procedure for each specific SIF shall be established describing the nature and extent of the regular testing. The testing procedure should be reviewed and approved by the Operations Manager. All testing results must be documented and retained for the life of the SIF. For multi-channel SIF designs, testing should determine that each individual channel is fully functional and operates as expected on demand. Any failures discovered during the course of testing or during normal plant operations shall be investigated and documented. The failure of a SIF to activate on demand, even during testing, is considered a process safety incident (see BASF Corporation Corporate Procedure BC Incident Notification and Reporting), and as such shall be reported in the AIM database, with the investigation findings and identified corrective actions. In case of a failure, SIFs shall be repaired as soon as possible, at least within a specified mean time to repair (MTTR) specified in the Safety Requirements Specification. See BASF Global Procedure G-P-EI 201 M, section 7.5 and 7.6 as well as N-P-EI 500 for additional details.

11 Procedure No.: BC Page: 11 of Employee Training Training Operators shall be trained on the function and operation of the SIS in their area. This training shall ensure the following: They understand how the SIS functions (trip points and the resulting action that is taken by the SIS); The hazard the SIS is protecting against; The operation of all bypass switches and under what circumstances these bypasses are to be used; The operation of any manual shutdown switches and manual start-up activity and when these manual switches are to be activated (This may include system rest and system restart ); Expectation on activation of any diagnostic alarms (e.g., what action shall be taken when any SIS alarm is activated indicating there is a problem with the SIS). 5. RESPONSIBILITIES 5.1. Site/Operations Manager The appropriate manager at the site or unit has the primary responsibility for implementing this procedure Manager, Process Safety Center of Excellence The manager, Process Safety CoE, has the primary responsibility for initiating, revising and interpreting this procedure.

12 Procedure No.: BC Page: 12 of RELATED DOCUMENTS BASF Global Standard G-S-EI M: Minimum Safety and Health Requirements Plant Safety by Means of Safety Instrumented Systems BASF Global Procedure G-P-EI 201 M: Electrical & Instrumentation Quality Control and Plant Safety E& I Safety Concept Detailed Explanation for the BASF Specification and Review Form for Safety instrumentation Functions Specification & Review Form for Safety Instrumented Functions BASF Global Standard G-S-EI 790: Electrical & Instrumentation Instrument Devices Standard Device List Instrumentation BASF Corporation Standard N-S-EI 790: Electrical & Instrumentation Instrument Devices Standard Device List E&I North America BASF Global Standard G-S-EI 890: Electrical & Instrumentation Digital Systems - Standardlist BASF Standard Device Lists North America BASF Corporation Procedure N-P-EI-500: Electrical and Instrument Design Safety Instrumented System (SIS) Preventive Maintenance Guidelines Including Periodic Testing