The presentation covers the high-level (and brief) description of principles to use when declaring functional safety and an overview of some techniques.. The paper looks at a system of systems level and how this complexity can be related to safety functions (Goals) and how further derivation can be achieved to ensure a meaning Safety Role at a system level. These principles can be applied to any Process plant that utilises Profibus or Profinet.

1. Functional Safety
Safety Engineering
Practical Aspects of PROFIBUS and PROFINET in Process Seminar
29th June 2015 / Not Protectively Marked 1
29th June 2016, Manchester E&H
Presenters: M Carter MSc CEng FIET
© BAE Systems 2016

2. 29th June 2015 / Not Protectively Marked 2
Terminology
• Functional – ‘To preform a specific Action
or Activity’
• Safe – ‘Freedom from the occurrence of
Risk’ (Harm)
• Risk – ‘The product of a Consequence
(severity) in relation to Probability
(frequency)’.
• Safety – ‘Performance’ or acceptable interval of
Integrity exposure to risk!
Level (SIL) expressed in hours or years
© BAE Systems 2016

3. 29th June 2015 / Not Protectively Marked 3
What is Functional Safety
Function
SIL - Performance Risk
Functional
Safety
© BAE Systems 2016

4. A
B
29th June 2015 / Not Protectively Marked 4
An Example
Customer
To sell my goods
for profit I need to
get from A to B
© BAE Systems 2016

5. 29th June 2015 / Not Protectively Marked 5
An Example
Customer
To sell my goods
for profit I need to
get from A to B
A
B
© BAE Systems 2016

6. 29th June 2015 / Not Protectively Marked 6
An Example
Customer
To sell my goods
for profit I need to
get from A to B
2hr journey
time
All weathers
Derived Requirements
Keep SAFE
Product - CAR
• £££££’s
• Propulsion System 0-60mph
• Carries the goods
• Environmental - Human
• Navigation/Steering System
• Safety Target 6X10-5
Capability
Derived Requirements
© BAE Systems 2016

7. 29th June 2015 / Not Protectively Marked 7
Functional
Safety
Safety Goals
• The Car must be able to be controlled.
• Provide a Safe Environment for personnel.
• The car must not cause harm to third parties
or the environment.
Safety Roles
• The Car must be able to be controlled.
• Ability to Navigate its Environment Provide.
• Ability to Stop.
• Ability to view the road ahead.
• Provide a Safe Environment for personnel.
• Provide fresh air.
• Provide temperature control.
• Third Parties or Environment.
• Material Safety.
© BAE Systems 2016

8. 29th June 2015 / Not Protectively Marked 8
Functional
Safety
Safety Goals
The Car must
be able to be
controlled.
Provide a Safe
Environment
for personnel.
Not cause
harm to third
parties or the
environment.
Ability to
Navigate.
Safety Roles
Stop.
View the
road
ahead.
Provide
Fresh Air.
Provide
Temp
Contrl.
Material
Safety.
Functionally Safe
Functional
Justification
System
Justification
© BAE Systems 2016

9. 29th June 2015 / Not Protectively Marked 9
How’s that
work in Practice
Top Level Goal
The Car cannot
be controlled.
The
Environment
is not Safe for
personnel.
Causes harm
to third parties
or the
environment.
Cannot
Navigate.
Cannot
Stop.
Cannot
View
ahead.
Handbrake Footbrake
Acceptably
‘SAFE’
Breaking
Function
© BAE Systems 2016

10. 29th June 2015 / Not Protectively Marked 10
How’s that
work in Practice
Top Level Goal
The Car cannot
be controlled.
The
Environment
is not Safe for
personnel.
Causes harm
to third parties
or the
environment.
Cannot
Navigate.
Cannot
Stop.
Cannot
View
ahead.
Handbrake Footbrake
Acceptably
SAFE
Breaking
Function
PRODUCT
System
System
Function
Component
HAZARD
Top Level Event
EVENT
High Level
EVENT
Low Level
EVENT
Root Cause
© BAE Systems 2016

11. 29th June 2015 / Not Protectively Marked 11
How’s that
work in Practice
Handbrake Footbrake
• Cable failure
• Handbrake linkage
• Foot pedal linkage
• Hydraulic leak
Failure Modes
• Brake calliper's
• Brake calliper's
© BAE Systems 2016

12. 29th June 2015 / Not Protectively Marked 12
Failure Mode Hazard Prob Pre –
Class
Control(s) Post –
Class
Cable Failure Loss of
navigation
Handbrake
linkage
Loss of
navigation
Foot pedal Loss of
navigation
Hydraulic leak Loss of
navigation
Brake Callipers Loss of
navigation
RiskSafety Performance
Target 6X10-5
Analysis
© BAE Systems 2016

13. 29th June 2015 / Not Protectively Marked 13
Failure Mode Hazard Prob Pre –
Class
Control(s) Post –
Class
Cable Failure Loss of
navigation
Handbrake
linkage
Loss of
navigation
Foot pedal Loss of
navigation
Hydraulic leak Loss of
navigation
Brake Callipers Loss of
navigation
RiskSafety Performance
Target 6X10-5
λ = Failure Rate =
MTBF
1
λ x λ
1X10-6
λ+ λ
Analysis
© BAE Systems 2016

14. 29th June 2015 / Not Protectively Marked 14
Failure Mode Hazard Prob Pre –
Class
Control(s) Post –
Class
Cable Failure Loss of
navigation
1X10-6
Handbrake
linkage
Loss of
navigation
1X10-6
Foot pedal Loss of
navigation
1X10-6
Hydraulic leak Loss of
navigation
1X10-6
Brake Callipers Loss of
navigation
1X10-6
RiskSafety Performance
Target 6X10-5
Analysis
First-Aid
incident
Death
FREQ
INCREB
© BAE Systems 2016

15. 29th June 2015 / Not Protectively Marked 15
Failure Mode Hazard Prob Pre –
Class
Control(s) Post –
Class
Cable Failure Loss of
navigation
1X10-6
Handbrake
linkage
Loss of
navigation
1X10-6
Foot pedal Loss of
navigation
1X10-6
Hydraulic leak Loss of
navigation
1X10-6
Brake Callipers Loss of
navigation
1X10-6
RiskSafety Performance
Target 6X10-5
Analysis
1. Auto-brake
2. Airbag
© BAE Systems 2016

16. 29th June 2015 / Not Protectively Marked 16
Failure Mode Hazard Prob Pre –
Class
Control(s) Post –
Class
Cable Failure Loss of
navigation
1X10-6
Handbrake
linkage
Loss of
navigation
1X10-6
Foot pedal Loss of
navigation
1X10-6
Hydraulic leak Loss of
navigation
1X10-6
Brake Callipers Loss of
navigation
1X10-6
RiskSafety Performance
Target 6X10-5
Analysis
First-Aid
incident
Death
FREQ
INCREB
© BAE Systems 2016

17. 29th June 2015 / Not Protectively Marked 17
Failure Mode Hazard Prob Pre –
Class
Control(s) Post –
Class
Cable Failure Loss of
navigation
1X10-6
Handbrake
linkage
Loss of
navigation
1X10-6
Foot pedal Loss of
navigation
1X10-6
Hydraulic leak Loss of
navigation
1X10-6
Brake Callipers Loss of
navigation
1X10-6
RiskSafety Performance
Target 6X10-5
Analysis
1. Auto-brake
2. Airbag
© BAE Systems 2016

18. 29th June 2015 / Not Protectively Marked 18
Failure Mode Hazard Prob Pre –
Class
Control(s) Post –
Class
Cable Failure Loss of
navigation
1X10-6
Handbrake
linkage
Loss of
navigation
1X10-6
Foot pedal Loss of
navigation
1X10-6
Hydraulic leak Loss of
navigation
1X10-6
Brake Callipers Loss of
navigation
1X10-6
RiskSafety Performance
Target 6X10-5
Analysis
1. Auto-brake
2. Airbag
© BAE Systems 2016

19. 29th June 2015 / Not Protectively Marked 19
In Summary
• Stakeholder Engagement
• Customers Capability
• Safety Goals
• Safety Roles
• Failure Modes & Relationship
• Identify Probabilities
• Manage Risks
Thank you
Contact: uk@profibus.com
Website: www.profibusgroup.com
Acceptably
SAFE
© BAE Systems 2016