VDMA-Einheitsblatt February 2013 VDMA

Transcription

1 VDMA-Einheitsblatt February 2013 VDMA ICS ; Turbomachinery and generators Application of the principles of functional safety Part 1: Methods for determination of the necessary risk reduction Turbomaschinen und Generatoren Anwendung der Prinzipien der Funktionalen Sicherheit Teil 1: Verfahren zur Ermittlung der notwendigen Risikoreduktion Continued page 1 to 66 Verband Deutscher Maschinen- und Anlagenbau e.v. (VDMA) The VDMA Specification is protected by copyright and remains the sole property of the VDMA Verband Deutscher Maschinen- und Anlagenbau e.v., Frankfurt/Main. Any alteration, addition, editing, inclusion, translation, copying and/or distribution requires the express written agreement of the VDMA in advance. VDMA Specifications are available for purchase only via Beuth Verlag GmbH, Berlin. Price group 23

2 Page 2 Contents Page Foreword Explanations Scope Scope of the complete VDMA Specification Scope of the VDMA Specification part Normative references Terms and Definitions Equipment Probability of failure on demand Information for use Probability of occupancy F Intended use Intended operation Reference event Operating state Event-based risk Event rate Functional safety Hazard (or hazardous effect) Hazard analysis Hazard zone Hazardous situation Hazard Identification of hazards Individual risk Inherently safe design Collective risk Lifecycle Product lifecycle Process hazard Proof frequency Proof test Relative risk Risk Risk analysis Risk assessment Risk evaluation Risk estimation... 11

3 Page Risk recipient Risk reduction Risk reduction factor (RRF) Risk target Harm Severity of the harm Protection Layer of protection Layer of protection analysis Safety function Safety circuit Safety measure Safety instrumented function (SIF) Safety instrumented system (SIS) Safety integrity level (SIL) Safety lifecycle Technical safety measures Accident rate Unprotected accident rate Protected accident rate Accident scenario Probability of not avoiding the hazardous situation Validation Probability of avoiding the hazardous situation Vulnerability Proof test Applicability of existing directives and standards Specifics of turbomachinery and generators Derivation of functional safety from the Machinery directive Applicability of standards for functional safety Basic elements of functional safety Functional safety boundaries Risks outside the functional safety Lifecycle of the product Safety lifecycle of the safety loops Description of risks Process hazard Risk Probability and event rate Measurement and prediction of event rates... 24

4 Page Reference event Selection of the reference event Severity of the harm and harm categories Harm categories for turbomachinery and generators Risk definition types for persons Risk recipient as a function of the definition type Hazardous effect and hazard zone Accident scenarios Risk reduction - basic quantitative scheme Operating modes of safety functions Demand rate and unprotected accident rate Low demand rate - reduction of the risk High demand rate - limiting the risk General depiction of the operating modes of safety functions Demand rates for turbomachinery and generators Functional tests for safety functions Descriptors Functional tests in accordance with IEC standards Tests on safety functions Proof-test coverage - prerequisites Functional tests and safety requirements specification Methods for determining the protection requirements Basic logical structure The general risk equation and its parameters The risk reduction equation Specific procedures Quantitative - semi-quantitative - qualitative discretising: overview Layer of protection analysis - LOPA Risk matrix Risk graph Specification of the requirements on the safety function Procedure for the specification of the operating mode Specification of the safety integrity parameter Basis of the evaluation for the risk assessment on turbomachinery and generators State of the equipment Requirements on the personnel Hazard zones Groups of persons considered and their presence in the hazard zones Auxiliary systems... 57

5 Page Phases of life and operating states that are considered in the context of the functional safety Interface to the operating organisation Specification of risk targets General Event-based risk target Individual risk target Equivalence of the two definition types Collective risk target Relation between the risk targets and the intended level of safety Staffelung der Zielwerte nach Schadenskategorie Bibliography... 66

6 Page 6 Foreword High requirements are placed on the safety of turbomachinery and generators in power stations and industrial plants. They have always satisfied these requirements. More than 40 years ago operating organisations and manufacturers of turbomachinery and generators prepared detailed safety concepts to ensure safe operation. For steam turbines the VGB standard VGB-R 103 was published, and for gas turbines the VGB standard VGB-R 121 and ISO The VGB standards have been revised several times since then. The selection and realisation of the underlying control and safety functions represents a significant aspect for the safety of turbomachinery and generators. Mechanical, hydraulic, pneumatic, electrical and electromechanical and electronic components that have been proven over decades are primarily used for this purpose. In recent years new standards on the concepts, design and validation of safety functions have been approved in the process industry and for machine tool manufacture. With IEC 61508, or its sector-specific derivation IEC for the process industry, and the standards IEC and ISO harmonised under the Machinery directive, the consideration of failure rates has been introduced as a statistical parameter in functional safety, among other aspects. Despite their differences, a common feature of all the newer standards is that they introduce probabilities to the design and evaluation of safety functions as "state-of-the-art". Even though turbomachinery and generators are safe and there is no specific reason to place in question the actual high level of safety, turbomachinery manufacturers must take into account this new state-of-the-art that requires the methodical usage of the calculation of probabilities. Key aspects for the specification of the protection requirement are the evaluation of the rate of occurrence of an event and the possible severity of the harm. Due to the low frequency of harm during the operation of turbomachinery and, as a result, the shortage of data, estimations by experts are required for the evaluation. The experts at Alstom Power, Atlas Copco, MAN Diesel & Turbo, and Siemens Energy have formed a working group Functional Safety of Turbomachinery and Generators under the umbrella of the VDMA to implement the new requirements for turbomachinery and generators. During this process a text has been prepared that does not rely on the parallel usage of underlying standards. The objectives of the working group are to define how to suitably apply standards to turbomachinery and generators and to define the basic evaluations for typical safety loops. For the turbomachinery: steam turbines, gas turbines, power station generators and compressors, requirements on the safety function are defined that are satisfied on compliance with the high safety standard familiar from the past; these requirements also take into account those in the new standards.

7 1. Explanations This VDMA Specification is part of a series of specifications with the following titles: Page 7 "Turbomachinery and generators Application of the principles of functional safety" Part 1 Part 2 Part 3 Part 4 Part 5 Part 6 Part 7 Part 8 Methods for determination of the necessary risk reduction Risk assessment in existing installations spare spare Risk assessment steam turbines Risk assessment gas turbines Risk assessment compressor train Risk assessment power plant generators The following companies were involved in the project work on the functional safety of turbomachinery and generators: Alstom Power Atlas Copco Energas MAN Diesel & Turbo Siemens Energy Sector as well as the VDMA associations Power Systems and Compressors, Compressed Air and Vacuum Technology 2. Scope 2.1 Scope of the complete VDMA Specification This VDMA Specification addresses the application of the principles of functional safety on safetyrelated systems/control functions to continuous flow gas and steam machinery and related machinery. Among other areas, this machinery is used in the following applications: The utility business for the generation of electricity The process industry Processing plants The oil and gas industry Turbomachinery for propulsion in aircraft is not considered here (see section 5.1.). The following machinery including its auxiliary systems is considered in the context of this VDMA Specification: Steam turbines Gas turbines Turbocompressors Gas expansion turbines (expanders) Turbogenerators This VDMA Specification can also be applied analogously to process gas screw compressors. This VDMA Specification addresses the protection of persons against the process hazards from turbomachinery and generators. The health of persons is the expressly stated protection objective of the European directives, in particular the Machinery directive. In the relevant standards on functional safety, the protection of persons is stated as the primary objective of the standard in the majority of cases (IEC 61508, IEC61511, IEC62061, ISO13849), even though other protection objectives are not excluded in the process.

8 Page 8 Damage to equipment and environment are not considered here. This VDMA Specification addresses the functional safety of turbomachinery and generators (see section 6.1 Functional safety boundaries ). In relation to the general safety of the product this is a sub-section. The sole application of the VDMA Specification is not sufficient to make turbomachinery and generators into safe machinery. In particular it is to be noted that the requirements of the Machinery directive (2006/42/EC) and other European directives on the safety of products go beyond this VDMA Specification. This VDMA Specification addresses the definition of the safety integrity requirements on safety loops. The design of safety loops in accordance with these requirements and the verification of the safety integrity are not included here. This VDMA Specification can be applied worldwide. It has been prepared based on international standards that define the recognised state-of-the-art worldwide for safety-related systems. The authors of the specification constitute a representative portion of the developers of turbomachinery and generators. From the point of view of the authors there is no aspect that would limit the validity of the specification geographically. 2.2 Scope of the VDMA Specification part 1 This, part 1 of the VDMA Specification, describes the methods for determination of the necessary risk reduction.