ASTRID TM (Analyse STRucturée pour l'Industrialisation des procédés Discontinus) PRESENTATION_FBF-WBF_rev0_13/10/99/ F. Lebourgeois/ Rhône Poulenc Industrialisation

JMR Conseil has participated to this WG as external consultant ASTRID is the result of a working group founded by Health, Safety and Environnement Management of RHONE POULENC Group as part of the program "process control safety". JMR Conseil has participated to this WG as external consultant This program concerns the three components of the decision making system in process control. the operator safety interlock system monitoring & control system OPERATOR man machine interface monitoring & control control safety interlock PRESENTATION_FBF-WBF_rev0_13/10/99/ F. Lebourgeois/ Rhône Poulenc Industrialisation

OBJECTIVE : TO MASTER SAFE CONTROL OF OUR PLANTS. TO BE SAFE IN: control design (automatised or not) safety interlocks design. Operation of the process SAFETY MASTERED ALONG THE LIFE CYCLE OF THE PROJECT: Design -----> Construction -----> Operation ------> Maintenance. OPERATOR man machine interface Monitoring & control safety interlock TOTAL QUALITY APPROACH PRESENTATION_FBF-WBF_rev0_13/10/99/ F. Lebourgeois/ Rhône Poulenc Industrialisation

the answer of field people An analysis method of the control tasks based on a PROCESS MODEL INDEPENDANT OF THE CONTROL MODE (automatised, manual ) adapted to a mixed control (automatised and manual) MODULAR, hierarchised objects easily reconfigurable WITH A STRONG FORMALISM (no ambiguity, no redondances) to understand each other to communicate to validate PRESENTATION_FBF-WBF_rev0_13/10/99/ F. Lebourgeois/ Rhône Poulenc Industrialisation

GENERAL PRINCIPLES: FOUR CLASSES OF HIERARCHISED OBJECTS. Functional objects : RECIPES : production procedure management. (serial and/or parallel set of phases) PHASES : elementary phasis of chemical engineering Material objects: EQUIPMENT MODULES : group of control modules «statically» interdependant . CONTROL MODULES : images of inputs outputs. plant scheduling RECIPES Functional PHASES equipment modules EQUIPMENT MODULES Matérial CONTROL MODULES software hardware SENSORS ACTUATORS PRESENTATION_FBF-WBF_rev0_13/10/99/ F. Lebourgeois/ Rhône Poulenc Industrialisation

COMPARISON WITH STANDARDS (ISA SP88 and IEC1512) ASTRID ISA/SP88 phasenel Matériel phasenel Matériel (Partial) RECIPE RECIPES OPERATION UNIT PHASES PHASES EQUIPMENT MODULE EQUIPMENT MODULE CONTROL MODULE CONTROL MODULE PRESENTATION_FBF-WBF_rev0_13/10/99/ F. Lebourgeois/ Rhône Poulenc Industrialisation

TRANSFER FROM A TO C PRESENTATION_FBF-WBF_rev0_13/10/99/ F. Lebourgeois/ Rhône Poulenc Industrialisation

SPLIT THE PLANT INTO INDEPENDANT ENTITIES, THE EQUIPMENT MODULE: defining somes rules for splitting the P&ID An equipment module start at the origin of the fluid and finishes before the isolating actuator The size of elementary equipment module is lower as the flexibility and multipurpose need is high Vacuum N2 F Q E T2 hot cold A B C D cold hot P1 purge purge fluid field F energy field P2 gas phase (event collector,vacuum...) field PRESENTATION_FBF-WBF_rev0_13/10/99/ F. Lebourgeois/ Rhône Poulenc Industrialisation

CONTROL MODES: ADAPTED TO THE COMPLEX SITUATIONS OF THE MULTIPURPOSE BATCH PLANTS . Commandes Production control Automatic mode: Automatic sequencing of the phases Semi automatic mode : Sequencing of the phases by operator Tele control mode: Actuators are controlled indivi- dually. Recipe control is the prefered control mode RECIPES Automatic mode Commandes Production control PHASES Semi automatic mode Commandes (development, adjustment) . EQUIPMENT MODULES Commandes telecontrol CONTROL MODULE Commandes (incidents , tunings) PRESENTATION_FBF-WBF_rev0_13/10/99/ F. Lebourgeois/ Rhône Poulenc Industrialisation

SINGLE COMMAND OF THE ACTUATORS : ACTUATOR (OR CONTROL MODULE) ALLOCATION TO A SINGLE EQUIPMENT MODULE An actuator is commanded by only one equipment module Internal actuator: by the equipment module Actuator at the border of two equipment modules: command allocation to a single equipment module the actuator command is allocated to the upward equipment module (recommendation) The actuator status can be read by the adjacent equipment modules PRESENTATION_FBF-WBF_rev0_13/10/99/ F. Lebourgeois/ Rhône Poulenc Industrialisation

SAFE TELECOMMAND MODE: THE LOCK. In automatic or semi-automatic modes, we must be able to intervene in telecontrol modes. The lock concerns the actuators at the border of an occupied equipment module. The lock is set to prevent manual activation (by telecontrol) of an actuator). A phase can occupy an equipment module with border actuators locked. Then, the equipment module can command its internal actuators but cannot command the actuators which are protected by a lock. The unlock is done by the phase after the use of the equipment module or when a default has been detected (by the phase). In this case the unlock is done according to the sequence defined in the phase. PRESENTATION_FBF-WBF_rev0_13/10/99/ F. Lebourgeois/ Rhône Poulenc Industrialisation

IMPLEMENTATION MECHANISM THE LOCK IMPLEMENTATION MECHANISM FUNCTIONNAL SAFETY (SPECIALLY ADAPTED TO FLEXIBLE PLANT) PRESENTATION_FBF-WBF_rev0_13/10/99/ F. Lebourgeois/ Rhône Poulenc Industrialisation

IMPLEMENTATION MECHANISM OF THE LOCK : Tranfer phase from A to C. isolating actuator (of a control module) mail boxes E V5 to Y V14 T1 from X V6 V1 V3 T2 A B V7 V8 V10 V11 V4 V2 C D P1 P2 V9 V10 from F V13 to Z to Z The control module is able to identify the phase occupying the contiguous equipment modules. PRESENTATION_FBF-WBF_rev0_13/10/99/ F. Lebourgeois/ Rhône Poulenc Industrialisation

IMPLEMENTATION MECHANISM OF THE LOCK : -F1 phase occupies the needed equipment modules. - Each equipment module put in the border actuators mail boxes the phase identifier (F1) number identifying the phase which occupy the upper stream equipement module number identifying the phase which occupy the down stream equipment module E F1 to Y V5 V14 F1 T1 from X V6 F1 F1 V1 V3 T2 F1 F1 F1 F1 F1 V10 V11 A B V7 V8 F1 V2 V4 C D F1 F1 P1 F1 P2 V9 V12 from F V13 to Z to Z This mechanism occurs when the equipment module is occupied before any command. PRESENTATION_FBF-WBF_rev0_13/10/99/ F. Lebourgeois/ Rhône Poulenc Industrialisation

These identifiers determine which actuators can be controlled by the phase. The phase F1 occupies the upstream equipment module F1 LOCK: The actuator does not accept any command An other phase (or no phase) occupies the downstream equipment module (F10) The phase F1 occupies the upstream equipment module F1 Every command from the upstream equipment module is enabled. Other commands (automatic, semi automatic or telecontrol) are disabled. AND the downstream equipment module F1 No phase occupies the upstream and downstream equipment module Telecommand enabled on this actuator PRESENTATION_FBF-WBF_rev0_13/10/99/ F. Lebourgeois/ Rhône Poulenc Industrialisation

INSIDE THE PATH , ACTUATORS CONTROL IS POSSIBLE UNDER PHASE RESPONSABILITY Lock E V5 to Y V14 T1 from X V6 V1 V3 T2 V10 V11 A B V7 V8 V2 V4 C D P1 P2 V9 V12 from F V13 to Z to Z PRESENTATION_FBF-WBF_rev0_13/10/99/ F. Lebourgeois/ Rhône Poulenc Industrialisation

THE OPERATOR CAN SEE THE ACTIVATED PATH Lock E V5 to Y V14 T1 from X V6 V1 V3 T2 V10 V7 V8 V11 A B V2 V4 C D P1 P2 V9 V12 from F V13 to Z to Z the lock protects the path during the transfer PRESENTATION_FBF-WBF_rev0_13/10/99/ F. Lebourgeois/ Rhône Poulenc Industrialisation

FUNCTIONNAL SAFETY, PARTICULARLY ADAPTED TO MULTIPURPOSE PLANTS : A multipurpose plant must adapt quickly to new production campaign. This new campaign implies new plant configuration and new process rules. Example : One operation allows parallel transfer, an other operation does not. PRESENTATION_FBF-WBF_rev0_13/10/99/ F. Lebourgeois/ Rhône Poulenc Industrialisation

Phase F1 : Transfer from A to C concurrently with Phase F11 : transfer from F to D : Identication number of the phase occupying the upstream equipment module Identification number of the phase occupying the downstream equipment module E F1 to Y F11 V5 V14 F1 T1 from X V6 F1 F1 V1 V3 T2 F1 F1 F11 F1 F11 F1 F1 F11 F11 V10 V11 A B V7 V8 F1 V2 V4 C D F1 F1 P1 V9 F1 F11 P2 V12 from F V13 to Z to Z The lock set on V8, and the lock set on V10 , inhibit the parallel transfer to equipment modules B and C. Explicit interlock is not needed. PRESENTATION_FBF-WBF_rev0_13/10/99/ F. Lebourgeois/ Rhône Poulenc Industrialisation

Phase F10 : simultaneous transfer from A and F to C. Identication number of the phaseoccupying the upstream equipment module Identification number of the phase occupying the downstream equipment module E F10 to Y V5 V14 F10 T1 from X V6 F10 F10 V1 V3 T2 F10 F10 F10 F10 F10 F10 F10 V7 V8 V10 V11 A B F10 V2 V4 C D F10 F10 P1 F10 P2 V9 V12 from F V13 to Z to Z In this case, parallel transfer is possible, if allowed by the phase. PRESENTATION_FBF-WBF_rev0_13/10/99/ F. Lebourgeois/ Rhône Poulenc Industrialisation

THIS ENCLOSED PATH INHERITS THE BEHAVIOR OF THE OBJECT CLASS «EQUIPMENT MODULE» Lock E V5 to Y V14 T1 from X V6 V1 V3 T2 V10 V11 A B V7 V8 V2 V4 C D P1 P2 V9 V12 from F V13 to Z to Z PRESENTATION_FBF-WBF_rev0_13/10/99/ F. Lebourgeois/ Rhône Poulenc Industrialisation

THE PROGRESS OF THE COMMAND FROM THE RECIPE TO THE CONTROL MODULE Product name Header Products, variables, etc... Process parameters Physical and chemical caracteristics, volume, capacity... Equipments parameters OBJECT «RECIPE» Procédure phases Dynamic links The manager send parameters to the phase to be activated (Id) Loads (Id) Agitates (Id) End Process parameters Process parameters Process parameters Equipment parameters Equipment parameters Equipment parameters OBJECT «EQUIPMENT MODULE» control description (1131-3) control description (1131-3) control description (1131-3) Dynamic links OBJECT «CONTROL MODULE» Equipment module1 Equipment module 2 Equipment module n Static links (plant configuration) Operator’s tele command brake this link OBJECT «CONTROL MODULE» control module 1 control module 2 control module 3 control module n ACTUATORS SENSORS PRESENTATION_FBF-WBF_rev0_13/10/99/ F. Lebourgeois/ Rhône Poulenc Industrialisation

LINKS AND INFORMATION EXCHANGES BETWEEN OBJECT CLASSES PHASE AGITATE LOAD Temporary Links (dynamic) RESSOURCE AGITATOR REACTOR C PIPE T1 PUMP P1 TANK E Permanent links (static) control module LEGENDE : Permanent link Dynamic link (activated when equipment module is occupied by the phase) Information Information (activated when equipment module is occupied by the phase) Lock A phase can read information coming from other phases or equipment module according to the description of the phase behaviour Information related to lock This is the single case of horizontal communication. PRESENTATION_FBF-WBF_rev0_13/10/99/ F. Lebourgeois/ Rhône Poulenc Industrialisation

ASTRID: conclusion monitoring & control OPERATOR man machine interface monitoring & control safety interlock Most of control equipment vendors refer to the model proposed by ISAS88/IEC1512 . The top down approach adopted by S88 working group is non ambiguous and based on a rigorous formalism for the upper functional layers, recipe, phase. The lack of rigorous formalism for the lower layers «hardware oriented» let the instrumentation people free to implement, on his own way, the transfer to the actuators (control module) of the orders coming from the upper functional layers. Therefore, the quality of the solution is higly dependent of the instrumentation people’s skill. PRESENTATION_FBF-WBF_rev0_13/10/99/ F. Lebourgeois/ Rhône Poulenc Industrialisation

OPERATOR man machine interface safety interlock monitoring & control ASTRID: conclusion To progress towards an «INTRINSEC» quality and safety solution, Rhône Poulenc has adopted a process model based on four hierarchised object classes. Rhône Poulenc focused on the material object «equipment module» which is the single path for transfering orders from the phases to the actuators or control module. The equipment module is the result of splitting the batch process plant into simple elements. Rhone Poulenc has defined a generic behaviour imbedded in the objets phase, equipment module and control module guaranteeing a safe cooperation between these objects . PRESENTATION_FBF-WBF_rev0_13/10/99/ F. Lebourgeois/ Rhône Poulenc Industrialisation

OPERATOR man machine interface safety interlock monitoring & control the model brings: a shared formal referential which makes validation easy: operating procedure validation (WHAT) monitoring &control system validation (HOW) an help for mastering the complexity thanks to rigorous procedure for splitting the global system into simple and prevalidated elements able to cooperate safely. a potential automation of the engineering, construction, capacity to automatise the engineering , programming and documentation activities: better responsiveness with a better quality and safety level lower cost PRESENTATION_FBF-WBF_rev0_13/10/99/ F. Lebourgeois/ Rhône Poulenc Industrialisation

OPERATOR man machine interface monitoring & control safety interlock ASTRID accept every existing descrition languages for specifiing the specific behaviour of the objects and particularly the 1131-3 languages. Up to you to choose the best fitting one. PRESENTATION_FBF-WBF_rev0_13/10/99/ F. Lebourgeois/ Rhône Poulenc Industrialisation

TRANSFER FROM A TO C PRESENTATION_FBF-WBF_rev0_13/10/99/ F. Lebourgeois/ Rhône Poulenc Industrialisation