WO2005013098A2 - Systeme et procede pour le controle continu en ligne de securite et de fiabilite - Google Patents

Systeme et procede pour le controle continu en ligne de securite et de fiabilite Download PDF

Info

Publication number
WO2005013098A2
WO2005013098A2 PCT/US2004/024936 US2004024936W WO2005013098A2 WO 2005013098 A2 WO2005013098 A2 WO 2005013098A2 US 2004024936 W US2004024936 W US 2004024936W WO 2005013098 A2 WO2005013098 A2 WO 2005013098A2
Authority
WO
WIPO (PCT)
Prior art keywords
failure
instrumented function
probability
demand
information
Prior art date
Application number
PCT/US2004/024936
Other languages
English (en)
Other versions
WO2005013098A3 (fr
Inventor
Paul P. Van Dyk
Robert S. Adamski
Leslie V. Powers
Robin Mccrea-Steele
David Barron
Original Assignee
Invensys Systems, Inc.
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Priority claimed from US10/684,329 external-priority patent/US7133727B2/en
Priority claimed from US10/716,193 external-priority patent/US7117119B2/en
Application filed by Invensys Systems, Inc. filed Critical Invensys Systems, Inc.
Publication of WO2005013098A2 publication Critical patent/WO2005013098A2/fr
Publication of WO2005013098A3 publication Critical patent/WO2005013098A3/fr

Links

Classifications

    • G—PHYSICS
    • G05—CONTROLLING; REGULATING
    • G05B—CONTROL OR REGULATING SYSTEMS IN GENERAL; FUNCTIONAL ELEMENTS OF SUCH SYSTEMS; MONITORING OR TESTING ARRANGEMENTS FOR SUCH SYSTEMS OR ELEMENTS
    • G05B23/00—Testing or monitoring of control systems or parts thereof
    • G05B23/02—Electric testing or monitoring
    • G05B23/0205—Electric testing or monitoring by means of a monitoring system capable of detecting and responding to faults
    • G05B23/0218—Electric testing or monitoring by means of a monitoring system capable of detecting and responding to faults characterised by the fault detection method dealing with either existing or incipient faults
    • G05B23/0243—Electric testing or monitoring by means of a monitoring system capable of detecting and responding to faults characterised by the fault detection method dealing with either existing or incipient faults model based detection method, e.g. first-principles knowledge model
    • G05B23/0245—Electric testing or monitoring by means of a monitoring system capable of detecting and responding to faults characterised by the fault detection method dealing with either existing or incipient faults model based detection method, e.g. first-principles knowledge model based on a qualitative model, e.g. rule based; if-then decisions
    • G05B23/0248—Causal models, e.g. fault tree; digraphs; qualitative physics

Definitions

  • the present invention relates generally to control and monitoring systems, and more specifically to industrial safety and reliability control and monitoring systems.
  • a safety instrumented system is an instrumented system used to implement one or more safety instrumented functions (SIF), and is composed of sensors, logic solvers and final elements designed for the purposes of: taking an industrial process to a safe state when specified conditions are violated; permitting a process to move forward in a safe manner when specified conditions allow (permissive functions); and/or taking action to mitigate the consequences of an industrial hazard.
  • a safety instrumented function (SD?) is a function implemented by a SIS which is intended to achieve or maintain a safe state for a process with respect to a specific event, e.g., a hazardous event.
  • Hardware to carry out the SIF typically includes a logic solver and a collection of sensors and actuators for detecting and reacting to events, respectively.
  • a logic solver To direct appropriate design and planned maintenance of a SIF, safety standards bodies have established a system that defines several Safety Integrity Levels (STL) that are appropriate for a SIF depending upon the consequences of the SIF failing on demand.
  • STL Safety Integrity Levels
  • safety integrity level is a measure of the risk reduction provided by a SIF based on four discrete levels, each representing an order of magnitude of risk reduction. As shown in Table 1, each SIL level is associated with a designed average probability of failure on demand (PFD). For example, a SIL 1 means that the maximum probability of failure is 10% (i.e., the SIF is at least 90% available), and a SIL 4 means that the maximum probability of failure is .01% (i.e., the SIF is at least 99.99% available).
  • PFD probability of failure on demand
  • SIL safety integrity level
  • a SIF is typically comprised of a collection of instrumented function components (e.g., a logic solver, sensors, and actuators), and each of the instrumented function components have a respective average PFD, which affects the overall average PFD of the SIF
  • a designer has some flexibility in the way the overall average PFD is achieved. For example, by assuming a set of environmental conditions (e.g., humidity, temperature and pressure) that the instrumented function components will operate under, a designer is able to arrive at an overall average PFD by establishing regimented testing schedule for each of the instrumented function components.
  • a plant engineer is able to estimate the SIL level of a particular SIF as long as the actual maintenance and environmental conditions do not vary from the assumed design conditions.
  • a plant engineer is unable to determine what the average PFD or SIL levels are for a SIF once actual testing varies from the regimented test schedule.
  • the actual PFD and SIL levels will vary depending upon actual environment conditions, and as a consequence, a plant engineer will face further uncertainty as to what the actual PFD and SIL level is for the SIF.
  • FIG. 1 is a is a block diagram of an exemplary industrial system in which a safety and reliability monitoring system according to one embodiment of the present invention is implemented;
  • FIG. 2 is a flow chart illustrating steps carried out by the safety and reliability monitoring system of FIG. 1 according to several embodiments of the present invention;
  • FIG. 3 is a is a graph depicting the relationship between safety integrity level and probability of failure on demand;
  • FIG. 1 is a block diagram of an exemplary industrial system in which a safety and reliability monitoring system according to one embodiment of the present invention is implemented;
  • FIG. 2 is a flow chart illustrating steps carried out by the safety and reliability monitoring system of FIG. 1 according to several embodiments of the present invention;
  • FIG. 3 is a is a graph depicting the relationship between safety integrity level and probability of failure on demand;
  • FIG. 1 is a is a block diagram of an exemplary industrial system in which a safety and reliability monitoring system according to one embodiment of the present invention is implemented;
  • FIG. 2 is a flow chart illustrating steps carried out by
  • FIG. 4 is a is a graph, which depicts a range of values which an instantaneous probability of failure on demand traverses during a period of time for two different test intervals;
  • FIG. 5 depicts an industrial system in which another embodiment of the safety and reliability monitoring system is implemented;
  • FIG. 6 depicts one embodiment of the safety controller of FIG. 5 in accordance with one embodiment of the present invention;
  • FIG. 7 depicts an industrial system in which the safety and reliability monitoring system is centrally operated according to one embodiment of the present invention;
  • FIG. 7A depicts one embodiment of the COSILTM module of FIG. 7;
  • FIG. 8 is one embodiment of a system computer that may be implemented to carry out the functions of the system computers of FIGS. 5 and 7.
  • Corresponding reference characters indicate corresponding components throughout the several views of the drawings.
  • the invention may be characterized as a method for managing a safety instrumented function including a plurality of instrumented function components.
  • the method including the steps of obtaining, from an asset management application, operating information about at least one of the plurality of instrumented function components; determining a probability of failure on demand for the safety instrumented function based at least in part on the operating information; comparing the probability of failure on demand with a designed probability of failure on demand for the safety instrumented function to establish a variance; and managing the plurality of instrumented function components based on the variance.
  • the invention may be characterized as a system for managing a safety instrumented function including a plurality of instrumented function components.
  • the system includes an asset management application configured to maintain status information relating to the plurality of instrumented function components; and an online safety integrity level application in communication with the asset management application.
  • the online safety integrity level application is configured to receive the status information and calculate a probability of failure on demand for the safety instrumented function based at least in part on the status information.
  • the invention may be characterized as a processor readable medium including processor-executable code to generate safety availability information for an instrumented function including a plurality of instrumented function components.
  • the code includes instructions for: obtaining, from an asset management application, operating information about at least one of the plurality of instrumented function components; determining a probability of failure on demand for the instrumented function based at least in part on the operating information; and generating the safety availability information based on the probability of failure on demand
  • the invention may be characterized as a method (and means for accomplishing the method) for managing a plurality of instrumented function components.
  • the method including the steps of: receiving, from an online safety availability application, operating information about the plurality of instrumented function components; updating, within an asset management database, status information for the plurality of instrumented function components based upon the operating information; and managing the plurality of instrumented function components based on the status information.
  • the present invention is directed to a safety and reliability monitoring system, also referred to herein as a COSILTM system, which provides historical, real time and predictive probability failures for an online instrumented system, e.g., a safety instrumented system (SIS), based on events which occur during operation and maintenance of the instrumented system.
  • a safety instrumented system e.g., a safety instrumented system (SIS)
  • SIS safety instrumented system
  • the present invention according to several embodiments is capable of providing dynamic, online calculations of average probability of failure on demand, instantaneous probability of failure on demand, and safety integrity level (SIL) using actual events (e.g.
  • the present invention also provides reliability information (e.g., mean time to fail (MTTF)) based on actual events.
  • MTTF mean time to fail
  • the inventive COSILTM system may be employed to provide accurate continuous online status information for an instrumented function, e.g., a safety instrumented function.
  • the term continuous as used herein should not necessarily be construed to mean that calculations are continually performed (i.e., without interruption).
  • the COSILTM system according to several embodiments, however, does allow a plant engineer to obtain substantially continuous values of PFD, SIL and/or MTTF, if so desired. It should be recognized that the COSILTM system also allows calculations to be performed at less frequent intervals, e.g., daily, weekly or monthly.
  • FIG. 1 shown is a block diagram of an exemplary industrial system 100 in which a COSILTM system according to one embodiment of the present invention is implemented.
  • the system 100 includes a programmable device 102 in communication, via a test input 104, with an actuator 108 and a sensor 110 which implement an instrumented function 112, e.g., a safety instrumented function (SIF).
  • an environmental input 106 which may be implemented to provide additional input to the COSILTM module 114.
  • the programmable device 102 may be realized using any one of a variety of devices, which have input/output (I/O) functionality and contain a CPU and memory and (not shown).
  • I/O input/output
  • the programmable device 102 may be, for example and without limitation, an intelligent field device, a safety controller, a programmable logic controller (PLC), a controller, a general purpose computer, a personal digital assistant (PDA) or potentially any other device that includes a processor, memory and input/output capability.
  • the instrumented function 112 represents a specific function executed by the 108 actuator and sensor 110 to achieve or maintain a safe state for a process with respect to a specific event, e.g., a hazardous event.
  • the sensor 110 and actuator 108 also referred to herein as instrumented function components, respectively monitor and react to process conditions in the industrial system 100 in order to help ensure that the instrumented function 112 is carried out on demand.
  • the sensor 110 is a pressure sensor and the actuator 108 controls a shut off valve.
  • the test input portion 104 in some embodiments is an automated test input unit, that provides test information, e.g., a most recent test time and date, for the actuator 108 and/or sensor 110 to the COSILTM module 114 without human intervention.
  • the actuator 108 and sensor 110 are coupled to the programmable device 102 via a communication link.
  • the test input portion 104 is a keypad or other user interface device, which allows a plant engineer, for example, to provide test information for the actuator 108 and/or sensor 110 to the programmable device 102.
  • the COSILTM module 114 Within the programmable device 102 are shown the COSILTM module 114 and an I/O module 116.
  • the COSILTM module 114 according to several embodiments is implemented by software that is read from a memory and processed by a CPU (not shown) of the programmable device 102.
  • the COSILTM module 114 generally comprises processor-executable code (a "COSILTM program") specifically designed to calculate, as a function of operating information for the instrumented function components 108, 110, a probability that the instrumented function 112 will fail on demand.
  • the COSILTM program may be created by one of several quantitative risk/reliability analysis (QRA) methodologies including, but not limited to, function block diagram analysis, fault tree analysis, structured text techniques, simple equation methodology, Markov modeling and reliability block diagram methodology.
  • QRA quantitative risk/reliability analysis
  • FIG. 2 is a flow chart 200 illustrating steps carried out by the COSILTM module 114 according to several embodiments of the present invention.
  • the COSILTM module 114 initially obtains operating information about at least one of the instrumented function components 108, 110 (Step 201). hi several embodiments the operating information includes test information that includes for example, a time and date when a test is successfully performed.
  • the operating information includes test information that includes for example, a time and date when a test is successfully performed.
  • the present embodiment the
  • COSILTM module 114 receives the operating information via the test information input portion 104.
  • this test information is saved in a memory of the programmable device 102, which allows the COSILTM program to calculate an elapsed time between the time of the test and a present (or future) time.
  • a timer is triggered that tracks the elapsed time between the time of the test and a present time.
  • the operating information received at Step 201 may include environmental information, which characterizes the operating environment for the instrumented function components 108, 110 (e.g., humidity, temperature and pressure). In this way, the COSILTM module 114 is provided with actual environmental conditions for the instrumented function components 108, 110 in the instrumented function 112.
  • COSILTM module 114 various modes of operation of the COSILTM module 114 are contemplated in which, for example, only test information is received, only environmental information is received, or both test and environmental information are received at the COSILTM module 114. It is also further contemplated that in one embodiment, both test and environmental information are received at the COSILTM module
  • the COSILTM module 114 only utilizes either the test or environmental information.
  • the COSILTM module 114 has been described as receiving test data for one of the instrumented function components 108, 110 in the instrumented function 112, it should be recognized that in several embodiments, the COSILTM module 114 receives test information on an ongoing (e.g., substantially continuous) basis for potentially hundreds of instrumented function components, and is able to establish an elapsed time since a last test for each of the hundreds of instrumented function components.
  • the COSILTM module 114 calculates a probability of failure on demand (PFD) for the instrumented function 112 based on the operating information (Step 202).
  • PFD probability of failure on demand
  • the failure rate ⁇ , and hence PFD m ⁇ will be typically be a function of environmental conditions such as temperature, pressure and humidity.
  • the COSILTM module 114 calculates both PFD INST and PFD ⁇ VG for the instrumented function 112.
  • the PFD for the instrumented function 112 is calculated as a function of the PFD of each of the instrumented function components 108, 110, it should be recognized that the PFD for each of the instrumented function components 108, 110 need not be calculated. For example, if one of the instrumented function components 108, 110 has failed (i.e., the instrumented function 112 is in a state of degraded operation), in one embodiment the PFD value for the failed instrumented function component is forced to a predefined value (e.g., 1.0). In this way, a PFD for the instrumented function 112 may be calculated even though one of the instrumented function components 108, 110 has failed.
  • a predefined value e.g. 1.0
  • an instrumented function includes two instrumented function components "a” and "b,” and the instrumented function fails on demand if both "a" and "b" fail on demand.
  • the probability of failure on demand is compared with a designed probability of failure on demand for the instrumented function to establish a variance (Step 204).
  • the variance is simply the difference (potentially positive or negative) between the designed probability of failure on demand and the calculated probability of failure on demand.
  • the designed probability of demand is a designed average probability of failure on demand.
  • the designed probability of failure on demand is a designed instantaneous probability of failure on demand, and the actual instantaneous probability of failure on demand calculated in Step 202 is compared with the designed instantaneous probability of failure on demand.
  • the instrumented function components 108, 110 are managed based upon the variance.
  • an alarm is provided when the calculated probability of failure on demand for an instrumented function exceeds a designed probability of failure on demand.
  • the COSILTM module 114 provides historical, on-line and predictive reporting of probability of failure on demand values for several instrumented functions. Again, it should be recognized that the COSILTM system according to several embodiments tracks test information (and in some embodiments environmental conditions) for several instrumented function components within each of the instrumented functions to arrive at a calculated probability of failure on demand for each respective instrumented function.
  • a plant engineer is provided with many more management options than prior plant management methodologies. For example, it is often advantageous to perform tests, albeit outside of the prescheduled test regimen, on instrumented function components while a portion of a plant process is shut down for repairs. Testing one or more instrumented function components 108, 110 in the instrumented function 112 before their respective scheduled test dates, however, decreases the probability of failure on demand (PFD) and increases the risk reduction factor (RRF) for the associated instrumented function.
  • PFD failure on demand
  • RRF risk reduction factor
  • the present invention provides feedback indicating a resulting probability of failure on demand due to the unscheduled testing
  • a plant engineer is able to manage both the tested instrumented function components in the instrumented function and other instrumented function components that were not tested based upon the unscheduled testing. For example, if the calculated PFD AVG after the unscheduled testing is reduced substantially below a designed average probability of failure on demand, instead of shutting a process down (and losing productivity) to test other instrumented function components according to their designed schedule, a plant engineer may wait, e.g., until a planned shutdown, with the knowledge that the PFD AVG for the instrumented function is still below the designed probability of failure on demand.
  • the present embodiment allows a plant engineer to take credit for testing in advance of a scheduled test date, and potentially save a substantial amount of money by keeping a process running longer than would otherwise be possible using prior methodologies.
  • the present invention allows a plant engineer to establish a risk if testing of an instrumented function component was not performed as scheduled. This is a significant advantage over prior management methodologies, which leave a plant engineer unsure of whether the actual PFD AVG or PFD m ⁇ level exceeds a designed PFD level.
  • the present invention allows a plant engineer to take credit for replacement of instrumented function components.
  • Prior methodologies which merely establish a fixed test schedule to maintain an acceptable PFD and risk reduction factor (RRF), simply do not provide the means for a plant engineer to take into consideration the effects of replacing several instrumented function components at different times.
  • the present invention according to these several embodiments, however, is able to track both replacement of instrumented function components and variances between actual testing and a designed test schedule to allow a plant engineer to take credit for any increased risk reduction factor (RRF).
  • Yet another advantage of some embodiments of the present invention is the ability to establish PFD AVG or PFD m ⁇ as a function of environmental conditions including, e.g., temperature, pressure and/or humidity.
  • a plant engineer may adjust the test interval or environmental conditions to maintain a PFD AVG or PFD ms ⁇ in response to varying environmental conditions.
  • a plant engineer operating under prior management methodologies cannot tell what effect changes in environmental conditions have on the actual average PFD for any instrumented function.
  • prior plant management methodologies included a predetermined testing schedule that assumed a set of environmental conditions.
  • the calculated probability of failure on demand values i.e., PFD m ⁇ and/or PFD AYG
  • the calculated probability of failure on demand values are converted to safety integrity levels. Referring to FIG. 3 for example, shown is a graph depicting the relationship between safety integrity level and probability of failure on demand.
  • SIL -Log(PFD) Eq. (3) Consequently, based on the on-line calculation of the PFD AVG and/or PFD m ⁇ , a corresponding PFD AYG and/or SIL m ⁇ may be calculated as a real number.
  • a plant engineer is able to monitor calculated SIL values over time and deduce trends based upon the changes in the SIL level over time. For example, if continuous online SIL levels of 3.3,
  • the present invention in several embodiments is applicable to both PFD/SIL calculations based on continuous (high demand) mode of operation and low demand operation.
  • online calculation of average probability of failure on demand PFD AVG for an instrumented function provides a wealth of information heretofore unavailable to a plant engineer, the ability to calculate an instantaneous probability of failure on demand PFD m ⁇ provides even more information to a plant engineer.
  • An average probability of failure on demand does not provide information about the range of probability of failure on demand values that an instrumented function may render during a period that the PFD AVG is determined.
  • FIG. 4 shown is a graph depicting the probability of failure on demand for an instrumented function with respect to time for two different test intervals. Shown is a first graph 402 of an instantaneous probability of failure on demand for an instrumented function tested with an interval TIi . Also shown is a second graph 404 of an instantaneous probability of failure on demand for the same instrumented function, which is tested at an interval TI 2 .
  • the test interval TIi produces an average probability of failure on demand (PFD avg TIi) which is below a designed average probability of failure on demand (Designed
  • FIG. 5 shown is an industrial system or plant 500 in which another embodiment of the COSILTM system is implemented.
  • a network 502 coupled to a network 502 are several programmable devices 102A through 102G including a DCS system 102A, a safety controller 102B, two intelligent field devices 102C, 102D coupled by a field bus 520, a programmable logic controller (PLC) 102E, a controller 102F and a control computer 102G.
  • PLC programmable logic controller
  • each of the progr--mmable devices is a respective COSILTM module 114A through 114G. Also shown coupled to the network 502 are a system computer 510 and a personal digital assistant 512. In the present embodiment, each of the programmable devices 102A-102G are coupled to instrumented function components (not shown) that implement one or more instrumented functions, e.g., safety instrumented functions. The programmable devices 102A-102G are also coupled via the network 502 to a system computer 510 and a personal digital assistant 512.
  • the programmable devices 102A-102G are able to communicate with the system computer 510 and the personal digital assistant (PDA) 512 via the network 502, it should be recognized that the programmable devices 102A-102G do not necessarily communicate with each other.
  • PDA personal digital assistant
  • One of ordinary skill in the art will recognize that a variety of network systems may be implemented to provide a communication path between each of the programmable devices 102A-102G and the system computer 510 and/or the personal digital assistant (PDA) 512.
  • a wireless network for example, may be utilized as part or all of the network 502.
  • each of the programmable devices 102A-102G includes a respective COSILTM module 114A-114G for calculating aPFD ms ⁇ and/or aPFD AVG for each of their respective instrumented functions. It should be recognized that some of the programmable devices 102A-102G may receive operating information from more than one instrumented function. For example, each of the programmable devices 102A-102G may be associated with more than one instrumented function, and each instrumented function may include more than one instrumented function component.
  • each programmable device 102A-102G receives operating information, e.g., test and/or environmental information, about its associated instrumented function components, and calculates a probability of failure on demand for the instrumented function associated with the instrumented function components.
  • the calculated probability of failure on demand for one or more instrumented functions is forwarded via the network 502 to the system computer 510 where it is provided by a reporting application 516 to the display 514.
  • information including a designed SIL level, an on-line SIL level and instantaneous PFD as well as deviation lights/alarms may be displayed on the display 514.
  • the probability of failure on demand may be converted to a SIL level for convenient reporting to a user at the system computer 510 and/or the personal digital assistant 512.
  • conversion from a probability of failure on demand to a SIL level may be calculated either in the programmable devices 102A-102G (e.g., in the respective COSILTM modules 114A-114G) or the system computer 510.
  • calculated probability of failure on demand values for each instrumented function are forwarded to the personal digital assistant (PDA) 512 (e.g., via a wireless link).
  • the personal digital assistant 512 may be any portable computing device with programming and reporting capability including, but not limited to, cellular telephones and notebook computers.
  • the portable aspect of the PDA allows a plant manager to receive alarms and/or generate reports without being "tied" to a desktop-type computer. Referring next to FIG. 6, shown is one embodiment of the safety controller 102B of
  • the safety controller 602 includes a COSILTM module 604 located within a control programs portion 606 of the safety controller 602 and is in communication with a tester 608 to receive information about testing of instrumented function components in a plant 600. Also shown is an environmental input, which may be utilized along with the information about testing to calculate an average probability of failure and/or an instantaneous probability of failure on demand for an instrumented function based upon the test and environmental information.
  • the tester 608 is an operator that inputs test information manually into the safety controller 602, and in other embodiments, the tester 608 is an automated test feedback device that updates the COSILTM module 604 automatically with any test information. As depicted in FIG.
  • the safety controller 602 provides an alarm 609 to an operator 610 without communicating via the network 502.
  • the safety controller 602 does not communicate any PFD or SIL information to other devices and simply provides an alarm if any instrumented functions have a PFD level that rises above a designed PFD level.
  • FIG. 7 shown is an industrial system 700 in which the COSILTM system is centrally operated according to one embodiment of the present invention.
  • the present embodiment includes a collection of programmable devices 702, 704, 706, 708, 710, 712, 714, which include the same type of programmable devices described with reference to FIG.
  • a system computer 716 calculates PFD information for each of the safety instrumented functions and provides, via a display 718, PFD and/or SLL information for each of the instrumented functions.
  • each of the programmable devices is associated with an instrumented function (e.g., the instrumented function 112), and each instrumented function includes instrumented function components (e.g., the instrumented function components 108, 110). For clarity, however, the associated instrumented functions and instrumented function components are not shown. Referring briefly to FIG. 7A, shown is the COSILTM module 720 of FIG. 7 according to one embodiment.
  • the COSILTM module 720 includes N separate COSILTM programs 122 ⁇ -122N that correspond to N respective instrumented functions in the plant 700.
  • each of the programmable devices 702, 704, 706, 708, 710, 712, 714 forwards operating information (e.g., test information) to the system computer 716 and/or the PDA 724 about each of the instrumented function components that the programmable device is associated with.
  • operating information e.g., test information
  • operating information about instrumented function components is provided to the system computer 716 by manual entry of a user (e.g., as tests are performed).
  • Each of the COSILTM programs 122 ⁇ -122 N in the COSILTM module 720 is associated with a corresponding one of N instrumented functions and tracks operating information for each instrumented function component (e.g., each of the instrumented function components 108, 110) in the corresponding instrumented function (e.g., the instrumented function 112). Based on the operating information, each of the COSILTM programs 122 ⁇ -122 ⁇ calculates, on an ongoing basis, the probability of failure on demand for the corresponding one of the N instrumented functions. In this way, the system computer 716 is able to provide alarms responsive to actual plant events and/or conditions. As discussed herein, the COSILTM module 720 in some embodiments also includes historical and predictive reporting capabilities in addition to on-line reporting.
  • the COSILTM module 722 in an exemplary embodiment is implemented in a personal digital assistant (PDA) 724.
  • PDA personal digital assistant
  • the COSILTM module 722 operates in much the same way as the COSILTM module 720 in the system computer 716, i.e., the COSILTM module 722 tracks operating information for each instrumented function component in each instrumented function and calculates, on an ongoing basis, the probability of failure on demand for each monitored instrumented function.
  • the COSILTM module 722 may generate alarms and reports for a user, but this is not required.
  • FIG. 8 shown is one embodiment of a system computer 800 that may be implemented to carry out the functions of the system computers 510, 716 of FIGS. 5 and 7.
  • the system computer 800 includes a quantitative risk/reliability analysis (QRA) portion 802, which converts information about each instrumented function into one corresponding COSILTM program.
  • QRA quantitative risk/reliability analysis
  • each COSILTM program (which may be stored in the memory 804, the COSILTM module 720 of the system computer 716, the COSILTM module 722 the PDA 724 and/or in the COSILTM modules 114A-114G of the programmable devices 102A-102G) provides a PFD value for an associated instrumented function (e.g., the instrumented function 112) based on operating information about instrumented function components (e.g., the instrumented function components 108, 110) included in the instrumented function.
  • an associated instrumented function e.g., the instrumented function 112
  • instrumented function components e.g., the instrumented function components 108, 110
  • the QRA portion 802 utilizes function block diagram analysis that allows a user to convert an instrumented function fault tree into a function block diagram.
  • the QRA portion 802 then converts the function block diagram into a COSILTM program for the instrumented function.
  • the QRA portion 802 is implemented with a Triconex® TS1131 application, but this is certainly not required.
  • the user is provided with one or more electronic files which include a library of function blocks, e.g. AND and OR logic function blocks, along with Eq. (1) and Eq. (2) set forth above.
  • Such function blocks and equations may be tailored to be read and utilized by various QRA software applications including the Triconex® TS1131 application.
  • exemplary function block diagrams are provided to the user to further guide the user.
  • other QRA methodologies are utilized to create COSILTM programs for each instrumented function including, but not limited to, structured text techniques, simple equation methodology, Markov modeling and reliability block diagram methodology.
  • the QRA portion 802 need not be implemented in the system computer 800, and in other embodiments, the COSILTM programs are created by the user on other machines, or simply provided to the user (e.g., from a third party). In some embodiments (e.g., when the system computer 800 is implemented within the system 700 described with reference to FIG.
  • each COSILTM program is stored in a memory 804 of the system computer and a CPU carries out the instructions in the COSILTM program to calculate a PFD for each instrumented function.
  • an input/output (I O) portion 806 receives (e.g., from the network 726) operating information for instrumented function components in each instrumented function.
  • I O input/output
  • a COSILTM program is created for an instrumented function, it is provided (e.g., uploaded via the network 502), to a programmable device (e.g., one of the programmable devices 102A-102G) where it is stored and carried out by a CPU on the programmable device.
  • the I/O portion 806 receives PFD and/or SIL information from programmable devices (e.g., the programmable devices 102A-102G) for instrumented functions that are associated with each programmable device.
  • Foundation Fieldbus function blocks may be uploaded along with the COSILTM programs to the COSILTM modules 114C, 114D of the intelligent filed devices 102C, 102D (which are compatible with the Foundation Fieldbus protocol).
  • COSILTM programs are stored in one or more programmable devices in addition to the system computer 800.
  • COSILTM safety availability application 808 referred to herein as a COSILTM application 808.
  • COSILTM application 808 includes code to produce a graphical user interface on the display 810, which provides user feedback and user controls (e.g., icons) that allow a user to request several variations of reports for the instrumented functions. For example, information including design SIL levels, continuous PFD and/or SIL levels and instantaneous PFD levels may be displayed for each instrumented function on an ongoing basis. Moreover, alarm information is provided via the display for each instrumented function.
  • the COSILTM application 808 allows a user to analyze historical and future probabilities of failure for each instrumented function in addition to online PFD information. Historical operating information for historical analysis may be stored in the memory 804, or may gathered based on retained records (e.g., test records).
  • Such historical analysis may be used to reconstruct what the PFD levels were at the time of a prior event. For example, if a plant experienced a boiler explosion, a historical analysis may be performed to determine PFD levels for instrumented functions associated with the boiler. Such historical analysis may provide probative information during an accident investigation of such an event.
  • the COSILTM application 808 also allows a user to predict future PFD and or SIL levels. For example, a user is able to enter a hypothetical scenario, which includes a future date and a set of assumed conditions (e.g., assumed test intervals and/or environmental conditions). Based upon the information provided by the user, the COSILTM application 808 calculates PFD and/or SIL values for the instrumented function for the future date based upon the assumed conditions.
  • assumed conditions e.g., assumed test intervals and/or environmental conditions
  • the COSILTM application 808 allows future PFD and/or SIL levels to be predicted based upon historical PFD information.
  • the COSILTM application tracks and reports PFD and/or SIL level changes for each instrumented function over a period of time. Based upon the tracked information, trends may be established allowing a user to predict when an instrumented function is about to drop below a designed SIL level. As discussed, SIL levels may be reported as real numbers to allow small changes in SIL levels to be perceived by the user.
  • an asset management application 812 which according to an exemplary embodiment both receives information from the COSILTM application 808 and provides information to the COSILTM application 808.
  • the asset management application 812 which according to an exemplary embodiment both receives information from the COSILTM application 808 and provides information to the COSILTM application 808.
  • the asset management application 812 which according to an exemplary embodiment both receives information from the COSILTM application 808 and provides information to the COSILTM application 808.
  • the asset management application 812 may be realized by adapting one of many presently available asset management applications so that it communicates with the COSIL application 808 as described herein.
  • the AvantisTM asset management applications from Invensys® are examples of presently available asset management programs.
  • the asset management application 812 tracks replacement of instrumented function components. Specifically, when an instrumented function component is replaced, the asset management application 812 informs the COSILTM application 808. In this way the COSILTM application 808 is able to update the
  • COSILTM program that is associated with the replaced instrumented function component.
  • the COSILTM program resets the elapsed time associated with the instrumented function component as though a test were just performed on the replaced instrumented function component. Conversely, when a test is performed on an instrumented function component, the
  • COSILTM application 808 receives operating information (e.g., test information indicating whether the test was successful or not) and provides the asset management application 812 with the operating information.
  • the asset management application 812 updates status information for the instrumented function component in an asset management database 814.
  • the asset management application 812 is provided up to date status information for instrumented function components.
  • instrumented function components can be managed based upon information received from the COSILTM safety availability application 808. For example, procurement of inventory to replace instrumented function components or their constituent parts may be initiated by the asset management application 812 based upon the status information (e.g., based upon status information indicating the instrumented function component has failed).
  • each application 808, 812 may be configured to communicate according to the other application's specific application program interface (API).
  • API application program interface
  • the applications 808, 812 may exchange information according to well- known communication formats (e.g., using extensible markup language (XML)).
  • asset management application 812 may be located remotely from the system computer 800 and communicate with the COSILTM application 808 via a network comiection.
  • asset management application 812 and the COSILTM application 808 may be bundled, distributed and installed on the system computer 800 as a single application instead of operating as separate discrete (albeit communicatively coupled) applications.
  • the present invention is readily adaptable to providing online mean time to failure (MTTF) information for an instrumented function.
  • MTTF mean time to failure
  • QRA quantitative risk/reliability
  • the quantitative risk/reliability (QRA) methodologies utilized to provide a COSILTM program may be modified so that the COSILTM program calculates MTTF values instead of probability of failure on demand (PFD) values.
  • PFD probability of failure on demand
  • testing intervals are typically not part of an MTTF calculation, it is contemplated that operating information including notice of a failure of an instrumented function component will be utilized in such a calculation.
  • instrumented function components are typically replaced quickly upon failure, knowledge of the MTTF value while an instrumented function component is nonfunctional provides a plant engineer with information to make a more informed decision about operating the instrumented function until the instrumented function component is replaced.

Landscapes

  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Engineering & Computer Science (AREA)
  • Automation & Control Theory (AREA)
  • Testing And Monitoring For Control Systems (AREA)
  • Management, Administration, Business Operations System, And Electronic Commerce (AREA)

Abstract

L'invention concerne un système et un procédé pour le contrôle continu en ligne de la sécurité et de la fiabilité. Le procédé consiste à recueillir l'information d'exploitation concernant au moins une des composantes fonctionnelles instrumentées de fonction instrumentée et à déterminer une probabilité de panne sur demande pour ladite fonction, selon l'information considérée. Aux fins de différentes variantes, l'information comprend des données d'état pouvant être reçues de la part d'une application de gestion d'installations et/ou fournies à cette application, et on peut aussi déterminer pour une fonction instrumentée la probabilité instantanée de défaillance sur demande, la durée moyenne de fonctionnement avant défaillance (MTTF) en ligne et le niveau d'intégrité de sécurité en ligne, et enfin il est possible de prévoir des valeurs de probabilité de défaillance sur demande à partir de temps d'essai hypothétiques et/ou prévus.
PCT/US2004/024936 2003-08-01 2004-07-29 Systeme et procede pour le controle continu en ligne de securite et de fiabilite WO2005013098A2 (fr)

Applications Claiming Priority (6)

Application Number Priority Date Filing Date Title
US49199903P 2003-08-01 2003-08-01
US60/491,999 2003-08-01
US10/684,329 US7133727B2 (en) 2003-08-01 2003-10-10 System and method for continuous online safety and reliability monitoring
US10/684,329 2003-10-10
US10/716,193 2003-11-17
US10/716,193 US7117119B2 (en) 2003-08-01 2003-11-17 System and method for continuous online safety and reliability monitoring

Publications (2)

Publication Number Publication Date
WO2005013098A2 true WO2005013098A2 (fr) 2005-02-10
WO2005013098A3 WO2005013098A3 (fr) 2007-11-15

Family

ID=34119819

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/US2004/024936 WO2005013098A2 (fr) 2003-08-01 2004-07-29 Systeme et procede pour le controle continu en ligne de securite et de fiabilite

Country Status (1)

Country Link
WO (1) WO2005013098A2 (fr)

Cited By (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP1760558A1 (fr) 2005-08-29 2007-03-07 DLR Deutsches Zentrum für Luft- und Raumfahrt e.V. Dispositif et procédé destinés à examiner la sécurité d'un dispositif technique
FR2991066A1 (fr) * 2012-05-28 2013-11-29 Snecma Systeme de traitement d'informations pour la surveillance d'un systeme complexe
WO2014063889A1 (fr) * 2012-10-26 2014-05-01 Schneider Electric Industries Sas Detecteur sil2 polyvalent dote de deux sorties et d'une entree de test
EP2728429A3 (fr) * 2012-11-06 2017-06-14 General Electric Company Systèmes et procédés pour améliorer la fiabilité des opérations
EP2645195A3 (fr) * 2012-03-27 2017-08-02 General Electric Company Systèmes et procédés pour améliorer la fiabilité des opérations
CN110007648A (zh) * 2018-01-05 2019-07-12 中国石油天然气股份有限公司 Sil的确定方法、装置及存储介质

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5293943A (en) * 1991-07-05 1994-03-15 Halliburton Company Safety valve, sealing ring and seal assembly
US5663713A (en) * 1994-09-08 1997-09-02 Lucas Industries Public Limited Company Control system
US5710723A (en) * 1995-04-05 1998-01-20 Dayton T. Brown Method and apparatus for performing pre-emptive maintenance on operating equipment

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5293943A (en) * 1991-07-05 1994-03-15 Halliburton Company Safety valve, sealing ring and seal assembly
US5663713A (en) * 1994-09-08 1997-09-02 Lucas Industries Public Limited Company Control system
US5710723A (en) * 1995-04-05 1998-01-20 Dayton T. Brown Method and apparatus for performing pre-emptive maintenance on operating equipment

Cited By (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP1760558A1 (fr) 2005-08-29 2007-03-07 DLR Deutsches Zentrum für Luft- und Raumfahrt e.V. Dispositif et procédé destinés à examiner la sécurité d'un dispositif technique
EP2645195A3 (fr) * 2012-03-27 2017-08-02 General Electric Company Systèmes et procédés pour améliorer la fiabilité des opérations
FR2991066A1 (fr) * 2012-05-28 2013-11-29 Snecma Systeme de traitement d'informations pour la surveillance d'un systeme complexe
WO2013178913A1 (fr) * 2012-05-28 2013-12-05 Snecma Systeme de traitement d'informations pour la surveillance d'un systeme complexe.
US10393624B2 (en) 2012-05-28 2019-08-27 Safran Aircraft Engines Information processor system for monitoring a complex system
WO2014063889A1 (fr) * 2012-10-26 2014-05-01 Schneider Electric Industries Sas Detecteur sil2 polyvalent dote de deux sorties et d'une entree de test
FR2997537A1 (fr) * 2012-10-26 2014-05-02 Schneider Electric Ind Sas Detecteur sil2 polyvalent dote de deux sorties et d'une entree de test
EP2728429A3 (fr) * 2012-11-06 2017-06-14 General Electric Company Systèmes et procédés pour améliorer la fiabilité des opérations
CN110007648A (zh) * 2018-01-05 2019-07-12 中国石油天然气股份有限公司 Sil的确定方法、装置及存储介质
CN110007648B (zh) * 2018-01-05 2021-08-27 中国石油天然气股份有限公司 Sil的确定方法、装置及存储介质

Also Published As

Publication number Publication date
WO2005013098A3 (fr) 2007-11-15

Similar Documents

Publication Publication Date Title
US8019570B2 (en) System and method for continuous online safety and reliability monitoring
US8099672B2 (en) System and method for continuous online safety and reliability monitoring
RU2398260C2 (ru) Оценка надежности технологического оборудования
JP6159059B2 (ja) プラント運転最適化システムおよび方法
JP4904155B2 (ja) 診断システム、プロセス制御システムの性能を監視する方法、及びフィールド装置
EP3296830B1 (fr) Appareil d'affichage d'état d'installation, système d'affichage d'état d'installation et procédé d'affichage d'état d'installation
JP6781594B2 (ja) プラント監視装置及びプラント監視方法
CN103809585A (zh) 用于验证控制系统中的现场设备的方法和装置
EP3553044A1 (fr) Procédé et système de contrôle d'objets à distance
JP2015522895A (ja) 制御の信頼性動作ためのシステムおよび方法
AU2021329227B2 (en) Systems and methods for HVAC equipment predictive maintenance using machine learning
CN113093670A (zh) 一种仪控状态监控方法、系统及监控平台
EP3217241A2 (fr) Technique d'étalonnage de normes utilisée avec la surveillance des biens dans des systèmes de commande et d'automatisation de processus industriel
WO2005013098A2 (fr) Systeme et procede pour le controle continu en ligne de securite et de fiabilite
EP1918869A1 (fr) Méthode dynamique pour balance de securité
CN115427767A (zh) 用于过程工厂内数据驱动的故障检测的改进模式识别技术
US10614702B2 (en) Alarm tuning using alarm and process data for condition monitoring
US11809175B2 (en) Alarm management apparatus, alarm management method, and computer-readable recording medium
CN111837082B (zh) 利用近实时条件的超声流量计预诊
CN116414086A (zh) 基于fmeda失效预测技术集成安全控制系统的装置
JPH04366742A (ja) プラント監視装置および方法
CN118068820B (zh) 一种液压支架控制器智能故障诊断方法
Generowicz et al. Reassessing failure rates
KR20240032413A (ko) 시뮬레이터를 이용한 인공지능 기반 플랜트 진단 시스템 및 그 동작 방법
KR20240062307A (ko) 사물인터넷을 활용한 산업용 보일러 관리시스템

Legal Events

Date Code Title Description
AK Designated states

Kind code of ref document: A2

Designated state(s): AE AG AL AM AT AU AZ BA BB BG BR BW BY BZ CA CH CN CO CR CU CZ DE DK DM DZ EC EE EG ES FI GB GD GE GH GM HR HU ID IL IN IS JP KE KG KP KR KZ LC LK LR LS LT LU LV MA MD MG MK MN MW MX MZ NA NI NO NZ OM PG PH PL PT RO RU SC SD SE SG SK SL SY TJ TM TN TR TT TZ UA UG US UZ VC VN YU ZA ZM ZW

AL Designated countries for regional patents

Kind code of ref document: A2

Designated state(s): BW GH GM KE LS MW MZ NA SD SL SZ TZ UG ZM ZW AM AZ BY KG KZ MD RU TJ TM AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HU IE IT LU MC NL PL PT RO SE SI SK TR BF BJ CF CG CI CM GA GN GQ GW ML MR NE SN TD TG

121 Ep: the epo has been informed by wipo that ep was designated in this application
122 Ep: pct application non-entry in european phase