1. Innovation and leadership in Safety ABB Overview
© ABB Group
September 16, 2018 | Slide 1 1

2. Agenda ABB understand the Process Industries and its Risk
Safety is about Risk Reduction
International Safety Standards continues to evolve
Innovation and leadership in Safety over 30 years
The Power Of Integration and its relevance to Safety
The advantage of Integrated Safety
Safety Execution Centers the human factor
References
© ABB Group
September 16, 2018 | Slide 2

3. Process Safety Market is growing
Respond to energy demand at reduced production risk
In today’s environment, Process Safety is a top priority in the process industries and there is a faster growth rate in the safety automation market
In the process industry the increased energy demand particularly in the so-called BRICs economies and the need to reduce risk to balance safety, environmental and operational hazards and financial targets requires a closer look to the safety automation on site (see next slide)

4. Balancing operations in the Process Industries
Human factors, environment, operational risk, cost
Companies have a legal, moral and financial obligation to limit risk posed by their operation.
Make plant as safe as possible, disregard cost
Moral
Build the lowest cost plant, keep operating budget as small as possible
Legal
Financial
Comply with regulations as written, regardless of cost or actual level of risk
Companies in the process industries must consider multiple dimensions in their decision making regarding risk
Making the plant site a safe environment for the plant personnel and neighbour communities
Complying to the international, national and regional regulation
Operating at the lowest cost and highest performance possible
Balancing what appear to be contradicting targets can be a challenge in the process industries

5. Safety is about Risk Reduction
Tolerable Level of Risk
(Defined by user per application)
Calculated Process Risk
Residual
risk
Risk
Target
Process
risk
Increasing
risk
Necessary risk reduction
Actual risk reduction
Risk reduction
left to be
handled by the
Safety
Instrumented
Systems
SIS
Risk reduction
due to other technology:
-fire pumps,
-foam systems,
-water curtains,
-deluge systems
(hydraulic, pneumatic )
Risk reduction
due to mechanical
equipment like:
- relief valve,
non return valve,
dike …
Safety is about reducing risk to take the plant site from an unacceptable risk level to an acceptable risk level or target risk level defined to accomplish the balance described on the previous slide
In doing so, the plant must assess the existing risk and take the action to mitigate the risk to the target or accepted level
One of those risk reduction elements is the Safety Instrumented System

6. Evolution of Safety Standards
From prescriptive to performance based
PRESCRIPTIVE STANDARDS
1995
2005
PERFORMANCE STANDARDS
IEC SC 65
1995
Draft
IEC 61508
1999
International
IEC 61511
2003
ISO 10418
1993
DIN VDE 0801
1991
Germany
DIN
VDE 19250
1989 UK
HSE PES
1987
OHSA CFR
1992
USA
ISA dS84.01
1995
Draft
ANSI/ISA
S84.01
1996
2004
The design of a Safety Instrumented System has evolved from the prescriptive or normative scheme found 20 years ago to a performance based approach based on the assessment of the risk in the plant
Today‘s Safety Standards are performance based and adopted and enforced internationally
IEC Functional Safety (General Standard)
IEC61511 – Functional Safety for the Process Industries
These standards continues to evolve and there are new requirements on systems applied to safety automation, as a matter of fact some of the systems that are running today might not be certifiable under the latest revision of these standards
INFORMATION ONLY: There are other international and national standards and even application specific standards
API RP14C
1974
ANSI/ISA
S (IEC Mod)
1974, Flixborough
1986, Chernoble
1988, Piper Alpha
1976, Seveso
1989, Pasadena
1984, Bhopal
New installations must conform to IEC 61511

7. Protection is implemented in multiple layers
SIL 3
SIL 2
SIL 0-1
The traditional approach has been to reduce risk/increase safety by implementing multiple Layers of Protection
Process Control
Operator responses to Alarms or Abnormal conditions
Emergency Shutdowns or Safety Instrumented Systems
Are all Layers of Protection, each design to function independently and to prevent abnormal conditions to deteriorate to a major catastrophe
ABB’s approach has to provide solutions to the needs of each layer and to provide an integrated environment in which each layer functions independently and effectively
© ABB Group
September 16, 2018 | Slide 9

8. “ For an ocean of safety experience you can trust...”
30 Years Of Experience With Safety Systems Pioneering Installations & Long-Term Support
First safety system delivered offshore to the North Sea in 1979
Pioneering engineering efforts
Close collaboration between ABB and end-users
Long customer relationships with close technical support and system evolution
Installed base continuously evolved and migrated to maximize customer value and minimize risk
Support throughout system life-cycle from installation to de-commissioning
ABB started in Safety more than 30 years ago (1979):
ABB delivered systems into the harshest possible environment (offshore), highest safety requirements (hydrocarbon production) and demanding applications from the very start.
ABB drove the development, standards were in some cases based on / influenced by ABB systems (rather then the other way around).
ABB has experience from all major architecture types, unlike most competitors. ABB is not married to an architecture, but to safety integrity and customer satisfaction.
End-users stay end-users, with satisfied end-users and a market leading evolution strategy ABB customers do not come back, they never leave in the first place.
Competitor Experience
HIMA – 39 years (1970)
Invensys (Triconex) – 26 years (1983)
Siemens – “More than” 20 years
Honeywell – 20 years (approx 1989)
Emerson – 5 Years (2004)
Yokogawa – 4 years (2005)
“ For an ocean of safety experience you can trust...”
© ABB Group
September 16, 2018 | Slide 10

9. Over The Years…Innovation and leadership And our experience continues to grow
1975
1980
1990
1985
2000
1995
2005
2010+
Statfjord B safety system goes online
1984 – First integrated MP200 based safety systems goes online at Gulfaks A platform
1993 – First integrated Safeguard 3000 safety system goes online at Sleipner A platform
2005 – First installations with Safeguard and HI in parallel
2007 – Largest HI system to date ( IOs) goes online
Key Projects
2005 – 800xA High Integrity (SIL2)
2008 – 800xA High Integrity (SIL3)
Products
1979– Triguard
2002 – Plantguard
1983 – Safeguard 9000
1993 – Safeguard 3000
1997 – Safeguard 400
1979: Statfjord B Safety system was pre-standard, leading and driving the safety development.
1984: Integrated MP200 based based safety system goes online at Gulfaks A, showing considerable experience in an area that was considered controversial up until not very long ago.
1993: Integrated Safeguard 3000 based safety system goes online at Sleipner A.
The goal is to highlight that ABB has been an innovator by introducing new technologies and methodologies
From introducing TMR technologies to adopting diversity as a way to accomplish a safe and reliable system in High Integrity
© ABB Group
September 16, 2018 | Slide 11

10. Over The Years… First Integrated System And Worlds Largest Platform
Control system evolution of integrated process control and safety systems solution optimize safety and control When the Gullfaks A platform went online in 1984 it featured the very first large scale integrated Process Control and Safety System, essentially constituting the starting point for ABB’s 25+ years experience with integrated safety systems. Live (no shutdown) retrofit of Control and Fire&Gas systems through 3 generations of systems.
The largest platform on the planet Troll A is the largest platform ever built. It produces about 75 million scm of natural gas and 10,000 bpd of NGL condensates per day. The original Infi90 based control and safety system for the platform was delivered in When the new integrated safety system went online on June 5, 2009 it was the first SIL3 certified 800xA High Integrity installation in the world.
Gullfaks A, North Sea
One key aspect to illustrate with this slide is that ABB has practical experience in real implementation of Integrated Control and Safety Systems
ABB was doing it while others were just talking about it, we’ve learned how to do it right and we’ve improved our implementation
First installation in 1979 at Statfjord B platform - Designed by safety enthusiasts and pioneers in Norway: Based on ABB PLC 700 and DS8 AP (alarms). Dual system with hardwired relay based voting system and ”zone modules”, i.e. 3rd party safety inputs. Probably the first safety system to replace ”diode matrix” Cause & Effect with programmable controllers
Troll A, North Sea

11. Access to information…Seamlessly and in context
Today, process operations worldwide can access information from their multiple protection layers, seamlessly and in context in order to make effective decisions to drive plant safety and productivity
© ABB Group
September 16, 2018 | Slide 13

12. System 800xA HI – Integrated Safety Customer value of integration – available today
Centralized Historian and Data Archiving
Same operations interface and engineering
Plant-wide Sequence of Events
Common system therefore reduced spare parts, training etc…
Process control and safety in the same HI controller
Centralized Historian and Data Archiving
Process control and safety running in separate controllers
Integrated process control and safety brings flexibility in implementation as well as all of the benefits of integration.
Integrated process control and safety is more than using the AC 800M HI controller for both process control and safety applications. Some small applications such as well heads or remote monitoring can be implemented in a cost effective way
Although that is a possibility few customers apply the system this way, the majority prefer to use separate hardware
From the point of view of integrated operations, some of the benefits from integrating both (process control and safety) on 800xA includes:
Same operator interface and engineering tool
Plantwide SOE for consolidated root cause analysis
Centralized historian and data archiving
Common hardware with reduced spares, training etc.
Common, integrated asset management strategy
Centralized Historian and Data Archiving
Common, integrated asset management strategy
© ABB Group
September 16, 2018 | Slide 14

13. The Advantage of Integrated Safety
Potential common cause are analyzed and minimized during the design phase by the product development team and independently reviewed by the assessor during the certification of the product
Access control is implemented as a standard off-the shelf feature including write protection and bypassing and override mechanism
Integrated testing is performed during the design validation and verification test, which includes also Network Security as part of the test protocol
Version control, compatibility and interoperability testing are all part of the release procedure
For the safety community there are other benefits to highlight
Potential common cause failures are analyzed and minimized during the system/product design phase by the ABB product development team and independently reviewed by the assessor (TUV) during the certification of the product, this ensures that the system is designed, tested and certified to operated in an integrated manner
Access control is implemented as a standard off-the shelf feature including write protection and bypassing and override mechanism, it is not left to the end users or to the system integrator to determine how to communicate both system and to implement following the safety standards, this effort is typically expensive, resource intensive not only during the initial investment phase (buying a new system) but also over the lifecycle (because of higher maintenance cost)
Integrated testing is performed during the design validation and verification test, which includes also Network Security as part of the test protocol, the alternative is that the user would need to perform such integrated test on their own increasing the time of Factory Acceptance Test and Site Acceptance Test without any guarantees that the outcome will demonstrate the correct performance of the system
Version control, compatibility and interoperability testing are all part of the release procedure and not left to the end user to figure out
All of these represent significant cost savings, lower risk and increased functionality and performance to the end user
© ABB Group
September 16, 2018 | Slide 15

14. Product Safety Certificate Development Department Safety Certificate
What is the scope of TÜV Certification? 800xA High Integrity – ABB Safety Certificates
The “ABB recipe” starts with a certified engineering group and work processes (Functional Safety Management System) that produced our latest generation system, the High Integrity
The High Integrity is certified by TÜV to the relevant international safety and application standards
Here is the certificate for the PM 865 and SM 811,, together making a SIL3 controller.
The safety I/O AI 880, DI 880 and DO 880, is certified to be used in a SIL3 loop.
Additional the development groups in ABB in Vasteras, Malmø and Oslo are certified according to IEC
To program the HI controller you must follow the safety manual, in order to get your system certified.
Product Safety Certificate
Development Department Safety Certificate
Safety Manual
© ABB Group
September 16, 2018 | Slide 16

15. Is the “Integration” part of the Certification Process?
Absolutely , It’s Interference Free
Operation Client
PPA
Engineering Client
Control Network
DO880
DI880
AI880
TB840
Optical Modulebus
High Integrity Controller
High Integrity I/O
Potential common cause failures are analyzed and minimized during the system/product design phase by the ABB product development team and independently reviewed by the assessor (TUV) during the certification of the product, this ensures that the system is designed, tested and certified to operated in an integrated manner
CI854
SM811
PM865
BC810
Modulebus
CEX-bus interconnection
Safety certified
Profibus
Safety relevant
RCU link
Interference-free
SM811 Synchronization link (RJ45)

16. 800xA High Integrity Diverse Architecture, Diverse Implementation
The SIL 3 800xA High Integrity controller has parallel processing paths based on diverse technology
Integrity voting between paths compliments the built in active diagnostics
Controller and Supervision Module developed by diverse (different) teams (Vasteras and Malmo, Sweden) and tested by a third team (Oslo, Norway) by people with different backgrounds
The two channel architecture meets SIL3 requirements for hardware fault detection and reaction PM SM
Safety I/O SIL3
CB SIL3
AC800M HI SIL3
1oo1D
1oo2D
< 60
SFF (%)
SIL 3
SIL 2
SIL 1 1
SIL 4
HFT
> 99
IEC Table 3
Safety I/O will go to safe state if PM and SM ends up with different result from 1131 application execution
Non-SIL and SIL1-2 applications still only execute in PM (no changes from previous SIL2 version)
Safety Measures: Source Code Report, Difference Report, Latency supervision, VMT, CTA, MMU, RAM test, CPU test, Modulebus telegram storage in FPGA, System software integrity, Sequence verification, …
Highlight the extensive use of diversity of technoglogy, design teams and validation teams as a powerful and effective way to reduce the potential of common cause failures and maintain an integrated environment
© ABB Group
September 16, 2018 | Slide 18

17. Diversity: Software and Hardware
Software diversity
Different operating systems
Different base software layers
Different un-packing procedures
Hardware diversity
Diverse execution paths based on different hardware technology such as MCU and FPGA
This slide is an example of diversity, probably easier to identify at the hardware level where two different and independent technologies (Field Programmable Gate Arrays FPGA and Micro Controller Units MCUs) are used to perform the same function i.e. Discrete Input within the same DI 880 module but using diversity instead of redundancy of components
Diverse technologies will be less prone to Common Cause Failures

18. Security System Security And Embedded Firewalls
Provides functions for protection of SIL classified applications in AC800M HI Controllers
SIL Access Control and Authorization
Force Control / Override Control / Bypass Management
Confirmed Online Write / Confirmed Operation
Embedded firewalls and confirmation procedures protect the SIL application from inadvertent / accidental control actions
Security is a significant concern, however the integrated environment makes security more manageable throughout the facility
Access Management
Access Management is a set of functions that may be divided in the two following main branches: • Access Control, • Override Control
Access Control
AC 800M HI controller need to be able to communicate with other safety controllers and with process control systems on the same network. This enables use of common HSI facilities and introduces the possibility of connecting external equipment used in the process operation and production monitoring also to the safety system. Undesired access is therefore necessary to avoid, by implementing an access control function.
User Re-authentication and Double Authentication
Re-authentication can be optionally used for critical operations such as writes to the control system, batch operations, and configuration changes. This option forces the user to re-supply his/her user credentials before the operation is executed.
A double authentication may also be optionally used. In this case an additional person who has the respective secondary authentication authority has to give username and password in order to approve the operation.
(1. User re-authentication and double authentication are together with user log-over, see User log-over on page 42, called Advanced Access Control in price lists, etc.)
Override Control
The use of override functions in safety related equipment introduces a potential hazard to the installation and to the people it is designed to secure. Any force of a safety critical input or output represents a degradation of the safety level and a possibility for failure on demand. Nevertheless, such functions are necessary to gain a reasonable availability of the process. All field equipment needs maintenance or replacement at regular intervals and this is included in the design of the safety system regarding e.g. number, wiring and location of field instruments. In these cases the safety level may be maintained
by other measures, while necessary maintenance operations are carried out. Access management enable project/application specific configuration of the appropriate level of restrictions regarding operation of the AC 800M HI controllers
and have the following functionality:
• Setting forced I/O points in an application will be restricted by the access control mechanisms. The override control restricts the number of concurrent forced I/O points
• User configurable maximum number of forced I/O points in the application when programming a SIL application in the Control Builder M
• The Access Management system software will keep track of the number of forced I/O points for each application as well as make the figures visible
• If the maximum number of forced I/O points is reached, the user will be notified by a system event and the force will not be set
• System event or alarm upon force (operator write actions)
• Audit trail
//// Text from the overview.
Access Control to SIL applications includes functionality for configuration, operations and maintenance. When designing a SIL application, each safety object is given an applicable access level; Read Only, Confirm or Confirm and Access Enable. In Operations, these SIL access levels are automatically enabled. However for the highest access level, a physical input must be enabled to secure authorized access. When Access Enable is active, permission is given to make online changes in the SIL application.
Confirm Operation, together with Access Control, is the embedded firewall mechanism for safe access of object variables during operation and maintenance.
Force Control, Override Control, or Bypass Management functionality is necessary to maintain availability of the process in many situations, for example during automatic startup or maintenance of SIS related field equipment.
The Force Control in the AC 800xA HI follows the lifecycle of the SIS. During design of a SIL application, the safety engineer defines the maximum number of concurrent forced inputs and outputs. During operations and maintenance, the Access Management SW keeps track of the active number of forced I/O points. This information is presented via the safety operator's personalized workplace. To meet regulatory compliance, a Digital Input is embedded in the SIS for Reset of all forces. In case it is not possible to reset, the operator may reset all forces through the workplace. An output “Any Force Active” feedback signal is also available.
© ABB Group
September 16, 2018 | Slide 20

19. Security Roles & Responsibilities
Users can be assigned with different permissions according to their responsibilities
Restriction of access to the SIS (operation and engineering)
High flexibility
Process Operator
Safety Operator
Process Engineer
Safety Engineer
Operate BPCS X
Operate SIS
Engineer BPCS
Engineer SIS
Defining roles and responsibilities is another way to increase security in the integrated environment
© ABB Group
September 16, 2018 | Slide 21

20. Monitor the Process and respond to Abnormal Conditions
Thanks to a Common Operation Environment… …Operator can take timely action
The end result is a common operation environment in which the operator can take timely action to potential risky conditions in the plant
Monitor the Process and respond to Abnormal Conditions
© ABB Group
September 16, 2018 | Slide 22

21. More Efficient and Effective Troubleshooting Safety relevant information is readily available
Alarms, Events, Audit Trail, and SOE displays for root cause analysis
Real-time information
Standard functionality for inhibiting of specific safety functions
Status supervision of Safety System Elements
Flexible Report Creation and Scheduling
Valve Leak Test, Verification, Automatic Shutdown Reporting, SIL status
and more effective troubleshooting as experienced in the multiple installations in which ABB has applied these concepts
© ABB Group
September 16, 2018 | Slide 23

22. 25 Years With Fully Integrated Safety Systems Fully Leverage System 800xA Capabilities
Integrated safety system implementations enable end-users to fully leverage System 800xA functionality across the entire automation system
Information Management / Reporting
Alarm Management/Sequence Of Events
Asset Management
Engineering
Etc…
Fully flexible system configuration capabilities enable tailored systems solutions
Systems designed according to application and end-user requirements
Integration is fully optional and allows customized degrees of separation based on customer requirements
Cost optimization and end-user satisfaction go hand in hand
Notes
Integrated safety systems are still by some considered controversial.
While other have discussed integration ABB has been doing it. From the very first system developed (Safeguard) and with end-user involvement from concept, development to delivery and execution phase.
Stand-alone safety systems lacks most (if not all) of the system level tools and functionalities of process control systems. Information management, asset management and common engineering environments are but a few of the benefits associated with integrated systems.
While integrated systems are more and more becoming the norm ABB’s systems have always been developed to allow completely stand-alone systems. Various possible semi-integrated configurations makes the choice of integration a highly non-digital selection with near complete freedom of configuration.
Allowing for solutions to be tailored to customer requirements allow cost optimization to go hand in hand.
800xA High Integrity is the MOST WELL integrated system on the market.
© ABB Group
September 16, 2018 | Slide 24

23. 25 Years With Fully Integrated Safety Systems Experience And Know-How
“ While others have been debating it ABB has been doing it. Operating for 25 years to the benefit of end-users and without incidents...”
ABB has been installing and operating integrated safety system for 25 years without incidents
The first fully integrated Safeguard system was installed at the Gullfaks A platform in 1984
The latest generation ABB safety system 800xA High Integrity offers market leading integration capabilities
Enabling significant cost reductions throughout systems lifecycle
Notes
Integrated safety systems are still by some considered controversial.
While other have discussed integration ABB has been doing it. From the very first system developed (Safeguard) and with end-user involvement from concept, development to delivery and execution phase.
Stand-alone safety systems lacks most (if not all) of the system level tools and functionalities of process control systems. Information management, asset management and common engineering environments are but a few of the benefits associated with integrated systems.
While integrated systems are more and more becoming the norm ABB’s systems have always been developed to allow completely stand-alone systems. Various possible semi-integrated configurations makes the choice of integration a highly non-digital selection with near complete freedom of configuration.
Allowing for solutions to be tailored to customer requirements allow cost optimization to go hand in hand.
800xA High Integrity is the MOST well-integrated system on the market.
© ABB Group
September 16, 2018 | Slide 25

24. Installed Base Installations Across The Globe
ABB’s intimate knowledge of and experience from all conceivable locations, environments and applications directly benefits end-users
With more 30 years on the market the installed base is spread across
…more than 55 countries…
…on all continents and across all regions…
…and all traditional safety systems industry segments such as oil & gas, petrochemical and chemical industries…
…as well as more non-traditional safety systems industry segments such as pulp & paper, semiconductor and minerals & mining facilities.
More than 3,000 controllers sold since initial release in January 2005
“Reducing risk where it is needed…”
© ABB Group
September 16, 2018 | Slide 26

25. 30 Years Of Experience With Safety Systems ABB Safety Execution Centers
In closing, it’s important to highlight the importance of human factors and competence
Competence (skills) was made mandatory in the latest revision of the standards and ABB has been building the competence of our implementation centers world wide in the form of Safety Execution Centers
These SECs operate under a TUV certified, common and consistent Functional Safety Management Systems as an added value to the user
Safety Execution Center (SEC)
TUV Certified SEC
© ABB Control Systems
September 16, 2018 | Slide 27

26. Conclusion
ABB has been a leader and an innovator in the area of Safety Automation
800xA provides information to rapidly convey critical operating conditions consistently enabling Operator Effectiveness , specially under abnormal conditions
800xA High Integrity is the latest example with its innovative use of diversity of design to provide a safe and reliable safety system
ABB has over 30 years of experience in Safety, reflected on the global installed base and accumulated application experience in the Safety Execution Centers
© ABB Group
September 16, 2018 | Slide 28

27. Questions & Answers
© ABB Inc.
September 16, 2018 | Slide 29

28. © ABB Group
September 16, 2018 | Slide 30