6 July 2000CSAM Team1 CERN Safety Alarm Monitoring Invitation to Tender Strategy CERN Safety Alarm System Supervisory Board 3st meeting CSAM project team

6 July 2000CSAM Team2Outline u IEC basics S. Grau ST/MO u CSAM Safety requirements F. Balda ST/AA, A. Chouvelon TIS/GS, S. Grau, ST/MO u Contract Strategy P. Ninin ST/MO

6 July 2000CSAM Team3 IEC basics u Functional safety  Analysis of your system that provides you a justified confidence on the delivered service u Functional safety of electrical / electronic / programmable electronic safety-related systems structured via a Safety Lifecycle

6 July 2000CSAM Team4 How should the system diagnose errors ? Which auto tests should be defined? What should be the maintenance politic ? Will the user know if some functions are not available ? How much time do we accept system down-time per year ? Can the system become dangerous in case of functional or transmission path failure ? Reliability study Maintainability study Security study Availability study IEC basics

6 July 2000CSAM Team5 u Safety Integrity Level (SIL)  Associated to a function and to the risk that the function is dealing with SIL 1 SIL 2 SIL 3 SIL 4 Non redundant architectures with PLCs Integrated control system for subways Equipment of Electrical Substations Sub-system of boiler safeties for thermal power plants IEC basics

6 July 2000CSAM Team6 Why should we use it ? u Objectives definition è Accessible, realistic è quantify + Domain of tolerance or variability u Specification of requirements è Functional, service quality, dysfunctional behavior u Anticipate degraded modes and control the risks u Justify confidence in the system è Based on: experience, expertise, forecast, methods and standards. IEC basics

6 July 2000CSAM Team7 AIMS OF THE SPECIFICATION: u Define a safety strategy both for the team and CSAM developers u Trace a path for a RAMS-validated system u Prepare specific requirements u Be consistent with IEC u Use validated risk analysis techniques CSAM Safety Requirements

6 July 2000CSAM Team8 Contents Safety Requirements Based on IEC Constraints Undesired Events Objectives Safety functions and SIL assignment Risk analysis strategy CSAM Safety Requirements

6 July 2000CSAM Team9 u Basic safety conditions that the system must satisfy in order to be approved u Example: “The system must be in operation 24 hours a day, 365 days per year” 1.- Safety Constraints CSAM Safety Requirements

6 July 2000CSAM Team10 u Any accident, simple or complex event that the system users or the community want to avoid u Example: “Total loss of the system” u ACTION:  Foresee consequences  Require a frequency to make the risk acceptable  ALARP model (As Low As Reasonably Practicable) 2.- Undesired Events CSAM Safety Requirements

6 July 2000CSAM Team11 The consequence on the process can be "Catastrophic " 1: Assign a "Consequence Category" Total loss of the system 2.- Undesired Events: technique CSAM Safety Requirements

6 July 2000CSAM Team12 The maximum allowed frequency is "Remote" 4: Individuate threshold for tolerable risk 3: Use the "Risk Matrix " 2: Define risk classes Risk is no more “Intolerable” 2.- Undesired Events: technique CSAM Safety Requirements

6 July 2000CSAM Team13 The "Required frequency" for the UE is "Improbable" or "Negligible" 6: Individuate the "Required frequency" 5: Individuate the "Maximum frequency" meaning Common use: Decrease the “Maximum frequency” of 1 or 2 orders of magnitude 2.- Undesired Events: technique CSAM Safety Requirements

6 July 2000CSAM Team14 > > u Risk = Frequency x Consequence u Individual risk and collective risk 2.- Undesired Events: Risk recall CSAM Safety Requirements

6 July 2000CSAM Team15 Frequency of the recorded events (LEP period): u Fire / small system(minor) ~5/an u Fire / installation (severe)~1/an u Fire / building (major)~2/5ans u Fire / experience (catastrophic)? u Fatalities (catastrophic)6/15ans u Injured (major) ~10/an 2.- Undesired Events: Statistics at CERN CSAM Safety Requirements

6 July 2000CSAM Team Undesired Events: Consequences Categories CSAM Safety Requirements

6 July 2000CSAM Team17 u Detailed conditions which the system is expected to cope with u Example: “Any Undesired Event or chain of events leading to a similar scenario should be characterised by a frequency of at least one or two orders of magnitude less than the one required for an acceptable risk” 3.- Safety Objectives CSAM Safety Requirements

6 July 2000CSAM Team Safety Functions CSAM Safety Requirements

6 July 2000CSAM Team SIL Assignment CSAM Safety Requirements

6 July 2000CSAM Team SIL Assignment CSAM Safety Requirements

6 July 2000CSAM Team21 Example Function 1: > Related Undesired Events (UE): UE-8: Safety actions failure UE Consequences category: Catastrophic Event likelihood: Frequent SIL assignment: SIL SIL Assignment CSAM Safety Requirements

6 July 2000CSAM Team22 Preliminary Risk Assessment (PRA) Risk Analysis Keep into account the Maintenance politics Objectives: Identify and locate the hazards Individuate the weak points Point out causes and consequences of hazards Find corrective measures if necessary Set special protection systems if necessary Methods: HazOp, FMECA, Qualitative Fault Trees Objectives: Quantify the probability of foreseen accidents Quantify the consequences Estimate the risk Quantify reliability and availability Validate the good working of the system Verify that constraints are respected Iterate the process if corrective actions have to be undertaken Methods: Fault Trees, Event Trees, Markov graphs, Petri nets 5.- Risk analysis strategy for CSAM developers CSAM Safety Requirements

6 July 2000CSAM Team23 u A series of precise requirements have been defined u Requirements are based on IEC and on widely used safety techniques u A risk analysis strategy has been outlined for CSAM developers u Worst foreseen accidents have been identified u Safety Integrity Levels have been assigned Summary CSAM Safety Requirements

6 July 2000CSAM Team24  Product satisfying functional safety criteria of Availability, Reliability, Maintainability, Security  Upgrade of existing safety alarm systems Modularity, Standardisation, Integration  Operational and Maintenance service on a “per-alarm” driven and controlled by system performance indicators  INB compliant The Strategic Objectives Contract Strategy

6 July 2000CSAM Team25 1 contract -> 3 Work Packages (WP) Contract Strategy

6 July 2000CSAM Team26 WP Breakdown based on IEC Work Packages Breakdown Contract Strategy

6 July 2000CSAM Team27 u ds The CSAM commercial strategy Contract Strategy

6 July 2000CSAM Team28 u WP1: Concept validated -> payment u WP2: Migration of all Safety Zones u Bonus/Malus according to quality & deadlines u WP3: u Bonus/Malus according to system performance Results Oriented Contract Contract Strategy

6 July 2000CSAM Team29 Cost based on the level of integration Alarm Integration Cost Contract Strategy

6 July 2000CSAM Team30 u How the application of functional safety and the Operational and maintenance service will guarantee optimal contract performance? u The functional safety fixes clear measurable results for the functioning of the system u The O&M service has to satisfy the same functional requirements u Therefore there is an optimum when System is well functioning and Minimum O&M effort is required The CSAM commercial strategy Contract Strategy

6 July 2000CSAM Team31 System is not functioning System is well functioning Two Losers: CERN and the Contractor Two Winners: CERN and the Contractor Decrease the performance Increase the O&M effort to make it functioning LOWER THE GAINImprove the performance Maintain the minimum O&M effort to keep it functioning INCREASE THE GAIN The CSAM commercial strategy Contract Strategy

6 July 2000CSAM Team32 u Ds u ds The Safety Alarm Monitoring Center The Local Safety Alarms Controller The CERN Safety Alarm Network The CSAM commercial strategy

6 July 2000CSAM Team33 u Documentation structure u Detailed description of the safety alarm requirements The Technical Specification structure Contract Strategy

6 July 2000CSAM Team34 u Final version sent for approval to all the concerned parties u Replies expected by the end of June u Last Revision Mid-July The CSAM User Requirements Contract Strategy

6 July 2000CSAM Team35 u 18 Firms replied to the MS u 10 Fully qualified u 8 visit planned to take place June/July u Three types of companies: u Nuclear u Petrol-chemical u Security (intrusion and access control, fire detection, etc.) Status of the Market Survey Contract Strategy

6 July 2000CSAM Team36 u Real Outsourcing u Safety Objectives -> Contract (System, O&M) -> Result Oriented Payment u IEC as a safeguard (design, operation, benchmark) u The contractor needs to control its environment ! u Others u Open question on the Safety networks ( added in the IT2694) u IT under ST revision process, out of CERN end of September Conclusions Contract Strategy