1、 ISATR84.00.06 Safety Fieldbus Design Considerations for Process Industry Sector Applications Approved 2 October 2009 ISATR84.00.06 Safety Fieldbus Design Considerations for Process Industry Sector Applications ISBN: 978-1-936007-33-2 Copyright 2009 by the International Society of Automation. All ri
2、ghts reserved. Printed in the United States of America. No part of this publication may be reproduced, stored in a retrieval system, or transmitted in any form or by any means (electronic, mechanical, photocopying, recording, or otherwise), without the prior written permission of the publisher. ISA
3、67 Alexander Drive P.O. Box 12277 Research Triangle Park, North Carolina 27709 E-mail: standardsisa.org 3 ISATR84.00.06 Copyright 2009 ISA. All rights reserved. Preface This preface is included for information purposes only and is not part of ISATR84.00.06. This technical report has been prepared as
4、 part of the service of ISA, the International Society of Automation. To be of real value, this document should not be static but should be subject to periodic review. Toward this end, the Society welcomes all comments and criticisms and asks that they be addressed to the Secretary, Standards and Pr
5、actices Board; ISA, 67 Alexander Drive; P.O. Box 12277; Research Triangle Park, NC 277099; Telephone (919) 549-8411; Fax (919) 549-8288; E-mail: standardsisa.org. This ISA Standards and Practices Department is aware of the growing need for attention to the metric system of units in general, and the
6、International System of Units (SI) in particular, in the preparation of instrumentation standards, recommended practices, and technical reports. The Department is further aware of the benefits of USA users of ISA standards of incorporating suitable references to the SI (and the metric system) in the
7、ir business and professional dealings with other countries. Toward this end, the Department will endeavor to introduce SI and acceptable metric units in all new and revised standards to the greatest extent possible. The Metric Practice Guide, which has been published by the Institute of Electrical a
8、nd Electronics Engineers (IEEE) as ANSI/IEEE Std. 268-1992, and future revisions, will be the reference guide for definitions, symbols, abbreviations, and conversion factors. It is the policy of ISA to encourage and welcome the participation of all concerned individuals and interests in the developm
9、ent of ISA standards. Participation in the ISA standards-making process by an individual in no way constitutes endorsement by the employer of that individual, of ISA, or of any of the standards, recommended practices, and technical reports that ISA develops. ISATR84.00.06 4 Copyright 2009 ISA. All r
10、ights reserved. The following served as voting members of ISA84 and approved this technical report: NAME COMPANY W. Johnson, Chair E I du Pont V. Maggioli, Managing Director Feltronics Corp R. Adamski RA Safety Consulting LLC T. Ando Yokogawa Electric Co R. Avali Westinghouse Electric Corp L. Beckma
11、n Safeplex Systems Inc J. Campbell ConocoPhillips I. Chen Aramc M. Coppler Ametek Inc M. Corbo ExxonMobil K. Dejmek Baker Engineering & Risk Consultants P. Early Langdon Coffman Services K. Gandhi KBR J. Gilman JFG Technology Transfer LLC W. Goble Exida P. Gruhn ICS Triplex B. Hampshire BP J. Harris
12、 UOP A Honeywell Company J. Jamison EnCana Corporation Ltd R. Johnson Dow Process Automation SIS SME K. Klein Celanese Corp T. Layer Emerson Process Management E. Marszal Kenexis Consulting Corp N. McLeod ARKEMA R. Peterson Lyondell Chemical Company G. Ramachandran Shell Global Solutions US M. Scott
13、 AE Solutions D. Sniezek Lockheed Martin Federal Services C. Sossman CLS Tech-Reg Consultants R. Strube Strube Industries A. Summers SIS-TECH Solutions LP L. Suttinger Savannah River Nuclear Solutions R. Taubert Consultant H. Thomas Air Products & Chemicals Inc T. Walczak Conversions Inc M. Weber Sy
14、stem Safety Inc A. Woltman Shell Global Solutions P. Wright BHP Engineering & Construction Inc D. Zetterberg Chevron Energy Technology Company 5 ISATR84.00.06 Copyright 2009 ISA. All rights reserved. The following served as members of the ISA Standards and Practices board and approved this technical
15、 report: NAME COMPANY J. Tatera, VP Consultant D. Dunn, VP Elect Aramco Services Co P. Bret Honeywel, Inc M. Coppler Ametek, Inc E. Cosman The Dow Chemical Co B. Dumortier Schneider Electric R. Dunn DuPont Engineering J. Gilsinn NIST/MEL E. Icayan ACES Inc J. Jamison EnCana Corporation Ltd D. Kaufma
16、n Honeywell International Inc K. Lindner Endress+Hauser Process Solutions AG V. Maggioli Feltronics Corp T. McAvinew I&C Engineering LLC G. McFarland Emerson Process Mgmt Power & Water Sol R. Reimer Rockwell Automation N. Sands DuPont H. Sasjima Yamatke Corp T. Schnare Rosemount Inc I. Verhappen Ind
17、ustrial Automation Networks Inc. R. Webb ICS Secure LLC W. Weidman WorleyParsons J. Weiss Applied Control Solutions LLC M. Widmeyer Kahler Engineering Inc M. Zielinski Emerson Process Management This page intentionally left blank. 7 ISATR84.00.06 Copyright 2009 ISA. All rights reserved. Contents Int
18、roduction 9 1 Scope 11 2 Criteria 11 2.1 Safety Requirements . 11 2.2 Speed of Response . 11 2.3 Interoperability & Integration 12 2.4 Fault Tolerance 12 2.5 Security 13 2.6 Operation . 13 2.7 Diagnostics 13 2.8 Documentation. 13 2.9 Testability. 14 3 Safety Lifecycle Approach 14 4 References . 19 5
19、 Definitions. 19 This page intentionally left blank. 9 ISATR84.00.06 Copyright 2009 ISA. All rights reserved. Introduction Safety Fieldbuses are currently being used in various industrial sectors, such as automotive and machinery, but they have only recently been introduced within the process sector
20、 for safety instrumented systems (SISs). ISA84 committee members are concerned that generic Fieldbuses may be incorrectly implemented in SIS applications. Consequently, the ISA84 committee formed Working Group 1 (ISA84 WG1) to develop guidance on the implementation of Safety Fieldbuses as part of an
21、 SIS for communicating between a safety logic solver and field devices. A generic Fieldbus is multi-drop digital network consisting of digital communication cable, terminators, hubs, links/couplers, power supplies, hosts and protocols, along with Fieldbus-compatible devices (Figure 1). It is used to
22、 communicate process information to and from multiple field devices within a segment. Fieldbus is a network structure that allows daisy-chain, star, ring, branch, and tree topologies. Figure 1 Generic Safety Fieldbus (adapted from ANSI/ISA-84.01-1996) ANSI/ISA-84.01-1996, Application of Safety Instr
23、umented Systems for the Process Industries, was developed under the assumption that each field device would be wired to the logic solver using dedicated field wiring. That standard did not address the use of a digital bus communications, such as a Fieldbus, for field device communications. ANSI/ISA-
24、84.01-1996 stated in clause 7.4.1.3, “Each individual field device shall have its own dedicated wiring to the system.” Clause 1.2.10 stated that the standard does not address ISATR84.00.06 10 Copyright 2009 ISA. All rights reserved. technologies not currently utilized in safety systems (e.g., Fieldb
25、uses), but that revisions to the standard will address new technologies as they become available. ANSI/ISA-84.00.01-2004, Clause 11.6.3 reflects ANSI/ISA-84.01-1996, Clause 7.4.1.3 above, with an added statement that addresses the alternative of “a digital bus communication with overall safety perfo
26、rmance that meets the integrity requirements of the SIF (safety instrumented function) it services.” Therefore, a Safety Fieldbus adds to the generic Fieldbus the additional hardware and software features necessary to be compliant with ANSI/ISA-84.00.01-2004. This technical report addresses the use
27、of Fieldbus for multi-drop digital network communication for implementation of Safety Instrumental Function (SIF) within a safety logic solver designed and managed in compliance with ANSI/ISA-84.00.01-2004. If the reader chooses to implement the safety logic in the Fieldbus segment only, the fieldbu
28、s and any instruments executing the safety logic should be evaluated as a logic solver under the requirements of ANSI/ISA-84.00.01-2004. This technical report does not address implementation of the SIF logic within the Fieldbus segment. 11 ISATR84.00.06 Copyright 2009 ISA. All rights reserved. 1 Sco
29、pe 1.1 This technical report: provides guidance on implementing Safety Fieldbus protocols and devices in safety instrumented systems in the process industries recommends additional considerations and practices for the implementation of Safety Fieldbus that are not currently included in ANSI/ISA-84.0
30、0.01-2004. 1.2 This technical report addresses Safety Fieldbus design and management. It does not provide detailed implementation guidance, which would be different for each Fieldbus technology. 1.3 This technical report is limited to the application of Safety Fieldbus to communicate between the saf
31、ety logic solver (i.e., compliant with ANSI/ISA-84.00.01-2004) and multiple field devices. It does not address implementation of the logic within the Fieldbus segment. 2 Criteria 2.1 Safety Requirements 2.1.1 The Safety Fieldbus should meet the requirements of the highest safety integrity level (SIL
32、) of any safety instrumented function (SIF) it supports, as measured by the: a. hardware integrity b. hardware fault tolerance c. systematic integrity d. data communications integrity 2.1.2 The software/firmware used to carry out the Safety Fieldbus diagnostics should meet the requirements of the hi
33、ghest SIL it supports. 2.1.3 The likelihood of random hardware undetected failures for the Safety Fieldbus should be sufficiently low in comparison to the overall safety integrity requirements. As a rule of thumb, for a demand mode SIS, the Safety Fieldbus should have a PFDavg less than 1% of the ta
34、rget PFDavg for the SIF. 2.1.4 The Safety Fieldbus protocol should be compliant with IEC 61508 requirements to the applicable SIL claim limit. 2.1.5 Open (non-proprietary) protocols should be used to enhance interoperability and integration. 2.2 Speed of Response 2.2.1 The response time of the Safet
35、y Fieldbus should be incorporated in the calculation of the overall response time of the SIF (e.g., the time from process deviation detection through the process response to final element action). It is good engineering practice that overall response time should be no more than one-half the process
36、safety time allocated to the SIF. ISATR84.00.06 12 Copyright 2009 ISA. All rights reserved. 2.2.2 The response time should be sufficient to meet the shortest process safety time requirement of any SIF on the Safety Fieldbus. 2.3 Interoperability & Integration 2.3.1 The Safety Fieldbus selection shou
37、ld consider its ability to communicate with the field devices and safety logic solver. It should support interoperability of devices without degrading the safety integrity, the Risk Reduction Factor (RRF), the reliability (spurious trip rate), or the communication speed of the Safety Fieldbus. When
38、a manufacturer claims interoperability of sensors, logic solvers, final elements, and the like, that claim should be supported by analysis and testing. 2.3.2 The Safety Fieldbus should not be shared by non-safety devices. If non-safety devices are used on the Safety Fieldbus, the non-safety devices
39、should not impact the functionality or integrity of the SIS. If the non-safety devices could affect the functionality or integrity of the SIS, the non-safety devices should be designed and managed per ANSI/ISA-84.00.01-2004 and Clause 2.4 of this technical report. 2.3.3 The Safety Fieldbus should en
40、sure separation and independence of the Basic Process Control System (BPCS) and the SIS. This will include independent security for configuration and maintenance tools. 2.3.4 All devices that perform a safety function on a Safety Fieldbus should communicate using a protocol that is designed in compl
41、iance with IEC 61508 and has been demonstrated to work in the operating environment. 2.3.5 The integrity and reliability of the Safety Fieldbus devices should be considered in the SIL verification calculations in accordance with ISA-TR84.00.02-2002. 2.4 Fault Tolerance 2.4.1 Fault tolerance may be a
42、chieved either through redundant Safety Fieldbuses or through redundant subsystems/components on independent Safety Fieldbuses. 2.4.2 The nuisance trip rate of the Safety Fieldbus should support the assumptions in the safety requirements specification (SRS). The impact of safe failures should be ass
43、essed during the hazards and risk analysis. 2.4.3 A failure of any field device(s) connected to the Safety Fieldbus should not degrade the Fieldbus operation nor degrade the integrity or reliability of any safety devices connected to the Fieldbus. 2.4.4 A failure of any single Safety Fieldbus in a m
44、ultiple Fieldbus SIS should not degrade the performance of the other Fieldbuses nor degrade the performance of any devices connected to other Fieldbuses. The design of the Fieldbus should be assessed to ensure that the likelihood of common cause, common mode and dependent failures between protection
45、 layers and between protection layers and the BPCS are sufficiently low in comparison to the overall safety integrity requirements of the SIS. 2.4.5 The Fault Tolerance Tables 5 and 6 in ANSI/ISA-84.00.01-2004, Clause 11.4, should be followed. 13 ISATR84.00.06 Copyright 2009 ISA. All rights reserved
46、. 2.5 Security 2.5.1 The Safety Fieldbus should have sufficient security to prevent inadvertent changes to the SIS configuration. 2.5.2 Safety Fieldbus devices should have a means to ensure configuration parameters are protected. For example, inadvertent changes can be prevented through write-protec
47、tion. 2.5.3 Access to Safety Fieldbus device configuration and programming should be restricted to authorized personnel. Any changes to the configuration or programming should be reviewed and approved under management of change. 2.5.4 Industrial cyber security practices should be implemented (e.g.,
48、see the ISA-99 series of standards, www.isa.org). 2.6 Operation 2.6.1 On-line replacement of field devices should be possible without affecting the SIF operation (i.e., the absence of device should not impact the bus integrity). Field device replacement should be completed within the MTTR (mean time
49、 to repair) assumed in the SRS unless otherwise approved by management of change. 2.6.2 The Safety Fieldbus should be capable of performing its SIFs irrespective of the communication media. 2.6.3 The Safety Fieldbus should be designed to take a specified safe state on loss of support systems (e.g.,“off” state for de-energize to trip applications). 2.6.4 Fieldbus communication interruption, lasting longer
