Irregular redundant structure SIS system integrity evaluation method

Abstract

The invention relates to the technical field of petrochemical engineering, in particular to a special-shaped redundant structure SIS system integrity evaluation method. Comprising the following steps: determining an evaluation object and basic data; common cause failure parameters are analyzed; correcting the anisotropic redundant structure factors; evaluating the MDBN model through the special-shaped redundant structure; carrying out SIL and reliability evaluation; carrying out whole life cycle cost analysis; the engineering case is used for verification, and a result is output; by exploring the influence of the common cause failure parameters on the evaluation result, the SIL evaluation model of the SIS system suitable for the special-shaped redundancy architecture is constructed, accurate quantification of SIL levels is realized, and help is provided for selection of the redundancy structure of the SIS in combination with the configuration cost.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of petroleum chemical industry, and particularly relates to a method for evaluating integrity of an SIS system with heterogeneous redundancy structure. BACKGROUND

[0002] A safety instrumented system (SIS) is widely used in high-risk industries such as oil and gas exploration and petroleum chemical industry as a core device to ensure the safety of industrial production. Through the collaborative work of sensors, control units and actuators, it realizes real-time monitoring and rapid response to process abnormalities, effectively preventing the occurrence of catastrophic accidents. With the continuous upgrading of automation control technology and the continuous improvement of safety theory system, the safety integrity level (SIL) evaluation of the SIS system has become a key link to ensure the long-period safety operation of the equipment. As a core indicator to measure the reliability of the SIS, the SIL level is directly related to the average demand failure probability (PFD avg ) of the system. The higher the level, the stronger the system reliability, and the more significant the risk prevention and control capability.

[0003] The safety integrity level (SIL) evaluation of the existing safety instrumented system plays an important role in ensuring the normal work of process industry equipment, which can help designers and workers to determine the work capacity of the safety instrumented system, so as to ensure that the risk of the controlled equipment is reduced to a reasonable level. At the same time, combining the evaluation results of the safety instrumented system with the cost analysis in the safety life cycle can help designers to determine the redundancy configuration and selection of the safety instrumented system, and avoid the waste of resources caused by excessive redundancy configuration.

[0004] However, the existing safety integrity level evaluation of the safety instrumented system focuses on homogeneous configuration and fails to consider heterogeneous configuration, and fails to comprehensively analyze the difference in common cause failure between homogeneous and heterogeneous structures, thereby causing differences between the safety integrity level evaluation results and the actual results. SUMMARY

[0005] The present application aims to provide a method for evaluating the integrity of an SIS system with heterogeneous redundancy structure, which aims to solve the technical problem that the existing safety integrity level evaluation of the safety instrumented system focuses on homogeneous configuration and fails to consider heterogeneous configuration, and fails to comprehensively analyze the difference in common cause failure between homogeneous and heterogeneous structures, thereby causing differences between the safety integrity level evaluation results and the actual results.

[0006] To achieve the above-mentioned purpose, the present application adopts a method for evaluating the integrity of an SIS system with heterogeneous redundancy structure, which comprises the following steps: Defining the evaluation object and the basic data; Analyzing the common cause failure parameters; Correcting the heterogeneous redundancy structure factor; Assessing the MDBN model through heterogeneous redundancy structure; Conducting SIL and reliability assessment; Conducting life cycle cost analysis; Using engineering cases for verification and outputting results.

[0007] In the step of defining the assessment object and the basic data: The assessment object is a heterogeneous redundancy structure SIS system, including a sensor subsystem, a control unit and an actuator composed of different types of components, and the basic data includes historical failure data of the equipment, reliability parameters provided by the manufacturer, actual operation monitoring data, simulation experiment data and industry standard case data.

[0008] In the step of analyzing the common cause failure parameters: through the self-diagnosis function of the SIS system equipment, self-diagnosis is performed every certain period of time, and regular function test is performed, and in the system operation process, the test interval stage and the test stage can be represented by two different dynamic Bayesian networks, and the node state is defined in the safety instrument system, wherein the node state defines the working state and performance index of the equipment closely, including the opening, closing, opening fault and closing fault state of the actuator; Comprehensively utilizing historical failure data and equipment reliability parameters. The historical failure data is derived from long-term operation accumulation of the system, and the reliability parameters are provided by the equipment manufacturer, and the reliability parameters include mean time between failures, failure rate, and the dependency relationship between system states is determined according to the collected data, and a conditional probability table is constructed; Through the deployment of sensors and data acquisition equipment, real-time collection of SIS system actual operation monitoring data is performed, simulation experiments are performed to supplement the deficiency of actual operation data, and industry standard case data summarized from the practical experience of many SIS systems in the industry is utilized; The dynamic Bayesian network models of the test interval stage and the test stage are alternately connected to form the MDBN model of the SIS system SIL assessment, and in the SIL assessment, the accuracy, recall rate and F1 value are used as indicators to measure the accuracy of the MDBN model.

[0009] In the step of correcting the heterogeneous redundancy structure factor: The common cause failure probability is calculated, the value range of β is determined through field investigation and industry failure database, the influence of common cause weight ω and β factor on PFDavg is analyzed, PFDavg is the average demand failure probability, it is found that the β factor has obvious influence on the evaluation result of the redundancy structure SIS, and the influence of ω is smaller; The heterogeneous redundancy structure is corrected, a correction factor is introduced to represent the difference degree between each channel of the heterogeneous redundancy structure, the common cause failure β factor is dynamically adjusted through the correction factor, and the reliability advantage of the heterogeneous redundancy structure is accurately reflected.

[0010] wherein in the step of evaluating the MDBN model by the heterogeneous redundancy structure: The heterogeneous redundancy structure is evaluated, and the common cause failure node CC is a key factor; In the reliability modeling of the heterogeneous redundancy system, the model architecture is divided into a basic layer, an intermediate layer and a lowermost layer; In the step of evaluating the model of the heterogeneous redundancy system, the probability dependency relationship between each layer of the system is described, the probability modeling between nodes is carried out through layered parameters, and the inter-chip parameter modeling is carried out by considering the transition transformation rule of the failure node state within the maintenance period.

[0011] wherein in the step of dividing the model architecture into a basic layer, an intermediate layer and a lowermost layer in the reliability modeling of the heterogeneous redundancy system: The basic layer is a failure layer, including device independent failure and common cause failure, the intermediate layer is a channel response layer, describing the running state of the heterogeneous redundancy unit under the action of multiple failures, and the lowermost layer is a system layer, reflecting the state of the SIS system under the cooperative action of each redundancy unit.

[0012] wherein in the step of performing life cycle cost analysis: In the life cycle cost composition of the safety instrument system, the fixed cost and the operating cost constitute the main economic elements.

[0013] The heterogeneous redundancy structure SIS system integrity evaluation method of the application adopts the following steps: determining the evaluation object and the basic data; analyzing the common cause failure parameters; correcting the heterogeneous redundancy structure factor; evaluating the MDBN model by the heterogeneous redundancy structure; performing SIL and reliability evaluation; performing life cycle cost analysis; verifying by using an engineering case, and outputting the result; by exploring the influence of the common cause failure parameters on the evaluation result, the SIL evaluation model of the SIS system suitable for the heterogeneous redundancy architecture is constructed, the accurate quantification of the SIL level is realized, and the configuration cost is combined to provide help for the redundancy structure selection of the SIS. BRIEF DESCRIPTION OF DRAWINGS

[0014] In order to more clearly illustrate the technical solutions of the embodiments of the application or the prior art, the following will briefly introduce the drawings needed to be used in the embodiment or prior art description. Obviously, the drawings in the following description are only some embodiments of the application, and for those skilled in the art, other drawings can also be obtained without creative labor on the basis of these drawings.

[0015] Figure 1 is the step flow chart of the heterogeneous redundancy structure SIS system integrity evaluation method of the application.

[0016] Figure 2is a step flow chart of S100 of the present invention.

[0017] Figure 3 is a step flow chart of S200 of the present invention.

[0018] Figure 4 is a step flow chart of S300 of the present invention.

[0019] Figure 5 is a common cause failure parameter influence chart of the present invention.

[0020] Figure 6 is a PFD influence chart of the present invention. avg and PFS of ω.

[0021] Figure 7 is a model architecture chart of the present invention.

[0022] Figure 8 is a state transition chart of the present invention.

[0023] Figure 9 is a state transition chart of the present invention.

[0024] Figure 10 is a reliability and cost relationship chart of the present invention.

[0025] Figure 11 is a SIS system interlock schematic chart of the present invention.

[0026] Figure 12 is a sensor subsystem MDBN model chart of the present invention.

[0027] Figure 13 is an actuator subsystem model chart of the present invention.

[0028] Figure 14 is a PFD change chart of the present invention. avg 1oo2 structure.

[0029] Figure 15 is a PFD change chart of the present invention. avg 2oo2 structure.

[0030] Figure 16 is a PFD change chart of the present invention. avg three-channel same type structure.

[0031] Figure 17 is a PFD change chart of the present invention. avg three-channel different type redundancy structure.

[0032] Figure 18 is a PFS change chart of the present invention. three-channel different type redundancy structure.

[0033] Figure 19 is a 1oo3 structure cost chart of the present application.

[0034] Figure 20 is a 2oo3 structure cost chart of the present application. DETAILED DESCRIPTION

[0035] The exemplary embodiments will be described in detail herein with reference to the attached drawings. In the following description, like reference numerals refer to like elements, unless the context clearly dictates otherwise. The following exemplary embodiments described herein are not meant to represent all embodiments consistent with the present application.

[0036] The terminology used in the present application is for the purpose of describing particular embodiments only and is not intended to be limiting of the present application. As used in the present application and the appended claims, the singular forms "a," "an" and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise. It will be further understood that the terms "comprises" and / or "comprising," when used in this specification, specify the presence of stated features, integers, steps, operations, elements, and / or components, but do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and / or groups thereof.

[0037] It is to be understood that the singular forms "a," "an," and "the" include plural referents unless the context clearly dictates otherwise. It is to be further understood that the term "or" as used herein encompasses both exclusive and inclusive or unless the context clearly dictates otherwise. It is to be further understood that the terms "comprises" and / or "comprising," when used in this specification, specify the presence of stated features, integers, steps, operations, elements, and / or components, but do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and / or groups thereof.

[0038] Referring to Figures 1-7 The present application provides a method for integrity evaluation of a heterogeneous redundant SIS system, comprising the following steps: S100: defining the evaluation object and the basic data.

[0039] In the present embodiment, the evaluation object is a heterogeneous redundant SIS system, which comprises a sensor subsystem, a control unit and an actuator composed of different types of components, and the basic data comprises historical failure data of the equipment, reliability parameters provided by the manufacturer, actual operation monitoring data, simulation experiment data and industry standard case data.

[0040] S200: analyzing the common cause failure parameters.

[0041] In the present embodiment, the common cause failure parameters are analyzed, and the specific process is as follows: S201: Through the self-diagnosis function of the SIS system equipment, self-diagnosis is performed every certain period of time, and function test is performed regularly. In the system running process, the test interval stage and the test stage can be represented by two different dynamic Bayesian network models. In the safety instrument system, the node state is defined, wherein the node state defines the working state and performance index closely related to the equipment, including the opening, closing, opening fault and closing fault states of the actuator; S202: Historical failure data and equipment reliability parameters are comprehensively utilized. The historical failure data is derived from long-term operation accumulation of the system, and the reliability parameters are provided by the equipment manufacturer. The reliability parameters include the mean time between failures, failure rate, and the dependency relationship between system states is determined according to the collected data, and the conditional probability table is constructed; S203: Real-time collection of SIS system actual running monitoring data is performed by deploying sensors and data acquisition equipment, simulation experiments are performed to supplement the deficiency of actual running data, and industry standard case data summarized from the practical experience of many SIS systems in the industry is utilized; S204: The dynamic Bayesian network models of the test interval stage and the test stage are alternately connected to form the MDBN model of the SIL evaluation of the SIS system, and in the SIL evaluation, the accuracy, recall rate and F1 value are used as the indicators to measure the accuracy of the MDBN model.

[0042] In the above process, first, through the self-diagnosis function of the SIS system equipment, self-diagnosis is performed every certain period of time, and function test is performed regularly. In the system running process, the test interval stage and the test stage can be represented by two different dynamic Bayesian network models. In the safety instrument system, the node state is defined, wherein the node state defines the working state and performance index closely related to the equipment, including the opening, closing, opening fault and closing fault states of the actuator; Then, historical failure data and equipment reliability parameters are comprehensively utilized. The historical failure data is derived from long-term operation accumulation of the system, and the reliability parameters are provided by the equipment manufacturer. The reliability parameters include the mean time between failures, failure rate, and the dependency relationship between system states is determined according to the collected data, and the conditional probability table is constructed; Then, the actual operation monitoring data of the SIS system is collected in real time by deploying sensors and data acquisition devices, simulation experiments are carried out to supplement the deficiency of the actual operation data, and the industry standard case data summarized from the practical experience of many SIS systems in the industry are used. Among them, the operation parameters, state information and fault alarm data of the equipment are collected in real time by deploying various sensors and data acquisition devices in the system; secondly, the simulation experiment data can supplement the deficiency of the actual operation data; thirdly, the industry standard case data are summarized from the practical experience of many safety instrument systems in the industry, the existing safety instrument system cases are used to understand the operation law and fault mode of the system under different process conditions and equipment configurations, and more comprehensive knowledge support is provided for model training, so that the trained model can better adapt to the reliability evaluation requirements of the safety instrument system in different application scenarios; Then, the dynamic Bayesian network model of the test interval phase and the test phase is alternately connected, and the MDBN model of the SIS system SIL evaluation is constructed, and in the SIL evaluation, the accuracy, recall rate, F1 value and other indicators are used to measure the accuracy of the MDBN model. The dynamic Bayesian network model of the test interval phase and the dynamic Bayesian network model of the test phase are alternately connected, and the MDBN model of the SIL evaluation of the safety instrument system is constructed. Among them, in the SIL evaluation, the accuracy, recall rate, F1 value and other indicators play a key role in measuring the accuracy of the MDBN model. The accuracy rate refers to the proportion of the number of samples correctly predicted by the model to the total number of samples. In the SIL evaluation of the safety instrument system, it reflects the overall accuracy of the model in predicting the normal state and various fault states of the system. For example, in a test set containing 1000 samples, the model correctly predicts the state of 900 samples, then the accuracy is 900÷1000=0.9. The calculation formula is: accuracy = (number of correctly predicted samples ÷ total number of samples) × 100%. Recall is the proportion of samples correctly predicted as positive (in safety instrumented systems, fault states are typically considered positive) out of the total number of true positive samples. It measures the model's ability to detect actual faults. If there are 100 actual fault samples and the model correctly detects 80, the recall is 80 ÷ 100 = 0.8. The formula is: Recall = (Number of correctly predicted positive samples ÷ Number of true positive samples) × 100%. The F1 score is the harmonic mean of precision and recall, taking into account both the model's accuracy and recall capabilities. Precision is the proportion of samples predicted as positive by the model that are actually positive. In the example above, if the model predicts 90 fault samples, and 80 are correct, the precision is 80 ÷ 90 ≈ 0.89. The formula for calculating the F1 score is: F1 score = 2 × (precision × recall) ÷ (precision + recall). This metric can be used to more comprehensively evaluate the model's performance in SIL evaluation, avoiding a one-sided evaluation of the model's performance due to relying solely on precision or recall.

[0043] To ensure the reliability of a safety instrumented system (SIS), each subsystem is typically composed of redundant structures. Each redundant structure is called a unit, and multiple units constitute a subsystem of the SIS. When using MDBN to evaluate a SIS, the calculation of the common cause failure probability mainly considers the influence of two factors: the common cause weight ω and the β factor.

[0044] After selecting appropriate parameters, the effects of ω and β on the evaluation results are as follows: Figure 5 As shown in the figure. Based on field surveys and industry failure databases such as SERH and OREDA, β values ​​range from 0 to 0.5. As can be seen from the figure, ω and β have virtually no impact on PFS; therefore, the analysis mainly focuses on their effect on PFD. avg The impact of (average demand failure probability). Except for the PFD of the 2oo2 structure. avg Except for the PFD of other structures which decreases with increasing β value, avg All of these factors gradually increase, and the common cause failure factor β has a significant impact on the evaluation results of redundant structure SIS, while the common cause weight ω has a smaller impact. This can be seen from the figure. avg The value remains essentially unchanged. Therefore, to explore the common cause weights The influence of redundant structures is shown by ω, which ranges from 0 to 1, as follows: Figure 6 As shown. For the 2oo2 and 2oo3 structures, their PFD is... avg It shows an upward trend as ω increases.

[0045] In summary, ω is related to PFD avg The impact of β is negligible compared to β, regardless of whether it is the 1oo2 or 2oo2 structure. PFD caused by value change avgThe value fluctuates greatly. Therefore, in the SIL evaluation of the SIS system with the heterogeneous redundant structure, the influence of the factor is mainly considered in this paper .

[0046] S300: Correcting the heterogeneous redundant structure factor.

[0047] In this embodiment, the heterogeneous redundant structure factor is corrected, and the specific process is as follows: S301: Calculate the common cause failure probability, determine the β value range through field investigation and industry failure database, analyze the influence of the common cause weight ω and the β factor on PFDavg, PFDavg is the average demand failure probability, it is found that the β factor has obvious influence on the evaluation result of the redundant structure SIS, and the influence of ω is smaller; S302: Correcting the heterogeneous redundant structure, introducing a correction factor to represent the difference degree between each channel of the heterogeneous redundant structure, dynamically adjusting the common cause failure β factor through the correction factor, and accurately reflecting the reliability advantage of the heterogeneous redundant structure.

[0048] In the above process, firstly, the common cause failure probability is calculated, the β value range is determined through field investigation and industry failure database, the influence of the common cause weight ω and the β factor on PFDavg is analyzed, PFDavg is the average demand failure probability, it is found that the β factor has obvious influence on the evaluation result of the redundant structure SIS, and the influence of ω is smaller; then the heterogeneous redundant structure is corrected, a correction factor is introduced to represent the difference degree between each channel of the heterogeneous redundant structure, the common cause failure β factor is dynamically adjusted through the correction factor, and the reliability advantage of the heterogeneous redundant structure is accurately reflected; Among them, the SIS in the oil and gas exploitation and petrochemical industry usually adopts the MooN redundant structure, but its subsystem is often composed of different types of elements, for example, the sensor subsystem of a certain SIS adopts a 2oo3 structure liquid level sensor, two of which are liquid level transmitters and one is a flip plate liquid level meter. This structure is a common heterogeneous redundant structure, compared with the same type redundant structure composed of the same type of equipment, the influence of the common cause failure will be weakened, which will be reflected in the SIL evaluation result.

[0049] Because the failures, maintenance and other aspects of each element of the heterogeneous redundant structure are different, the correlation between each element is weakened, so that the common cause failure probability is reduced, which is obviously smaller than the corresponding parameter of the same type redundant structure, as shown in the following formula:

[0050] In the formula: which represents the common cause failure of the same type structure SIS.

[0051] Introducing a correction factor To characterize the difference between the two channels of the heterogeneous redundancy structure, we get:

[0052] By selecting two different types of pressure transmitters (PT1 and PT2) as the two channels of the heterogeneous redundancy structure, and referring to the typical parameters of industrial equipment and the failure database data, the basic parameters are set as shown in the table below: See the following formula, to generate random failure data conforming to uniform distribution, assume to generate 2 groups of random data, each group of data contains (PT1 and PT2) , , , , ) random values, the generation process is as follows: Determine the uniform distribution range of each parameter: usually based on the allowable fluctuation range of equipment parameters, such as Take the original value ±20%, Take the original value ±5%, CS, Take the original value ±10%, Take the original value ±15%.

[0053]

[0054] Use random number generation tools (such as Excel's RAND function) to generate random numbers or calculate random failure data: multiply the basic parameters by the random coefficient to get each group of random data, and then calculate the random failure data according to the distribution range. The table below is two complete sets of random failure data. (Obtained by multiplying the basic parameters by the random coefficient) In the formula, To characterize the failure rate, To characterize the safety failure diagnosis coverage, To characterize the proportion of safety failure, To characterize the restart time of false shutdown, To characterize the dangerous failure diagnosis coverage.

[0055] Calculate the generated random failure values to get the redundancy structure ,

[0056]

[0057] In the formula, Characterizes the random variable (with a mean of zero).

[0058] In the formula, ε is a random variable with a mean of 0, representing the measurement error, and here ε = 0, directly using the parameter values of the first group of random failure data: PT1 failure parameters: λ1 = 0.0020, 1 = 0.28, 1 = 0.83, 1 = 0.80, MTSR1 = 2.0, PT2 failure parameters: λ2 = 0.0017, 2 = 0.26, 2 = 0.90, 2 = 0.89, MTSR2 = 1.7, By means of multiple linear regression, the weight influence of failure parameters is determined, which is represented as .

[0059] The weight bn is calculated by first constructing a multiple linear regression model that the actual index of the channel is linearly related to the failure parameters, and its model formula can be represented as Y = X · b + ε. In this formula, each failure parameter is represented as Xn, and ε is the error term (with a mean of 0). The error sum of squares formula is Σε2 = Σ(Y actual parameter - Y standard parameter). The partial derivative of bn is calculated and set to 0, and the linear equation system is obtained, and the weight bn = [0.3, 0.15, 0.2, 0.2, 0.15, 0.15] is obtained by solving. The actual index of the channel can be obtained by combining the calculated influence weight and the redundant structure,

[0060] The actual index of PT1 CH1 = 0.9686 and the actual index of PT2 CH2 = 0.88 can be obtained by the above formula, and the similarity coefficient matrix between channels is obtained,

[0061] The similarity coefficients in the matrix are:

[0062] Therefore, the correction coefficient is defined as the minimum value of the elements in the N-channel multidimensional similarity matrix. This coefficient is obtained by traversing all elements of the N × N matrix and selecting the smallest one as the system correction parameter.

[0063] The similarity coefficients are calculated by the above formula: S11 = S22 = 1, S12 = S21 = 0.933. The similarity coefficient matrix is 10.933 0.933 1, and the minimum element is 0.933, so d = 0.933.

[0064] The correction factor The essence is to dynamically adjust the common cause failure beta factor by quantifying the key parameters of each channel device, such as failure rate, dangerous failure diagnosis coverage, safe failure proportion, dangerous failure diagnosis coverage, parking and restarting time, and thus more accurately reflect the reliability advantage of heterogeneous redundancy, compared with the evaluation method of fixed beta factor of homogeneous redundancy, The beta factor can be dynamically adjusted according to the actual parameter difference of heterogeneous redundancy, avoiding overestimation or underestimation of common cause failure probability, so that the SIL evaluation result is more in line with the actual operation scene.

[0065] S400: Evaluate the MDBN model through the heterogeneous redundancy structure.

[0066] In this embodiment, the MDBN model is evaluated through the heterogeneous redundancy structure, and the specific process is as follows: S401: Evaluate the heterogeneous redundancy structure, and the common cause failure node CC is the key factor; S402: In the reliability modeling of the heterogeneous redundancy system, the model architecture is divided into the basic layer, the middle layer and the lowest layer; S403: Perform heterogeneous redundancy system evaluation model modeling, describe the probability dependency relationship between each level of the system, model the probability between nodes through hierarchical parameters, and consider the transition transformation rule of the failure node state within the maintenance period to develop inter-chip parameter modeling.

[0067] In the above process, first, the heterogeneous redundancy structure is evaluated, and the common cause failure node CC is the key factor; then, in the reliability modeling of the heterogeneous redundancy system, the model architecture is divided into the basic layer, the middle layer and the lowest layer; and then, the heterogeneous redundancy system evaluation model modeling is performed, the probability dependency relationship between each level of the system is described, the probability between nodes is modeled through hierarchical parameters, and the transition transformation rule of the failure node state within the maintenance period is considered to develop inter-chip parameter modeling; Among them, (1) model construction: When evaluating the heterogeneous redundancy structure, the common cause failure node CC is the key factor, and the nodes that cause common cause failure are no longer single, and multiple nodes may cause common cause failure. When the system is configured as x-channel heterogeneous redundancy, the number of potential common cause failure nodes is represented by y=2x-1, indicating all possible common cause failure mode combinations of each channel.

[0068] In the reliability modeling of the heterogeneous redundancy system, the time dimension modeling logic of the Bayesian network can be compatible with the homogeneous system evaluation model. Specifically, the dynamic network structure describes the propagation characteristics of system failure in different stages through phase alternation. The change rule of the system in the running cycle and the maintenance detection stage Figure 7As shown, the topology has three layers: the base layer is the failure layer, which includes two core influencing factors: device-independent failure (IF) and common-cause failure (CC); the middle layer is the channel response layer (CN), which describes the operating status of heterogeneous redundant units under multiple failures; and the bottom layer is the system layer (S), which reflects the SIS system status under the coordinated action of various redundant units. (2) MDBN model parameter modeling: Modeling an evaluation model for a heterogeneous redundant system generally involves two aspects. First, it describes the probabilistic dependencies between different levels of the system, using hierarchical parameters to model the probabilistic relationships between nodes. Second, it considers the state transition patterns of failed nodes during the maintenance cycle, performing inter-chip parameter modeling. For example... Figure 8 As shown, taking the channel state node (CN) as an example, its state changes are jointly affected by IF and CC. Specifically, when IF is in the normal state (NS) and all relevant CC nodes are not triggered, the channel node is necessarily in the normal state. However, if any CC node is activated at this time, the overall failure state of the channel node needs to be calculated using probability weighting. If all CC nodes are triggered, then:

[0069] When the independent failure node IF is in a detectable dangerous failure state, the CC nodes remain silent, and P(CN=DD)=1; once all CC nodes are in an abnormal state, then:

[0070] When IF is in an undetected dangerous failure state, if all CC nodes remain silent, then P(CN=DU)=1; if the CC nodes affecting CN nodes are not in a normal state, then:

[0071] When a detectable security failure occurs in the IF and the CC node is in normal condition, P(CN=SD)=1; if the state of the CC node changes, then:

[0072] When an undetected security failure occurs at an independent failed node, and the CC node is in normal operation, then P(CN=SU)=1; if the state of the CC node changes, then:

[0073] In the formula: Characterizing CC node security failure ; Characterizing undetected security failures in CC nodes ; characterizing a dangerous failure of a CC node ; characterizing an undetected dangerous failure of a CC node ; characterizing an abnormal CC node .

[0074] The running state of the system state node S depends on the joint action of multiple channel nodes. The failure determination of the heterogeneous redundant structure S node is as follows: when the combined relationship of the channel nodes meets formula (1), it is a safe failure state; if the channel state meets formula (2), it is a DD state; if the channel state meets formula (3), it is a DU state. This failure determination principle can more accurately quantify the fault tolerance capability and failure change of the redundant structure.

[0075] (1) (2) (3) In the formula, is the total number of safe failure channels; is the total number of detected dangerous failure channels; is the number of detected safe failure channels; is the number of detected dangerous failure channels.

[0076] Since the independent failure (IF) nodes of different channels have unique degradation, detection and maintenance characteristics, after determining the relevant parameters of a specific channel, the conditional probability table of each IF node needs to be built independently. The state change of the common cause failure node within the test interval is as shown in Figure 8 In this model, the reliability parameters of multiple common cause failure nodes need to be modeled by taking the minimum value of the failure frequency and maintenance time parameters of the physical channels affected by them as the benchmark.

[0077] In the inspection test phase, the state transition of the independent failure IF node and the common cause failure CC node is as shown in Figure 9 .

[0078] S500: Perform SIL and reliability evaluation.

[0079] In this embodiment, SIL and reliability evaluation are performed.

[0080] S600: Perform life cycle cost analysis.

[0081] In this embodiment, life cycle cost analysis is performed, and in the life cycle cost composition of the safety instrument system, the fixed cost and the operating cost constitute the main economic elements; Among the life cycle cost of SIS, the fixed cost (CG) and the running cost (CY) are the main economic factors. As shown in the following figure, these two cost indicators have a significant correlation with system reliability: CG increases monotonously with the reliability indicator, CY shows a negative correlation, and the total cost curve formed by the superposition of the two shows a parabolic feature of first decreasing and then increasing. Therefore, when configuring SIS, the cost and reliability need to be balanced. Figure 10

[0082] According to literature review and field research, the running cost of SIS mainly includes engineering changes, running consumption, maintenance, failure and risk control:

[0083] The calculation formulas of system failure cost and risk cost are as follows:

[0084]

[0085] In the formula, the production loss of EUC per unit time is represented by

[0086] S700: Verify by engineering case and output results.

[0087] In this embodiment, the engineering case is verified and the results are output; In the process industry, abnormal pressure rise of gas pipeline or closed pressure equipment may cause serious consequences such as equipment rupture. Taking the gas pressure protection of the gas trunk line of a treatment station as an example. The pressure sensor of the upstream pipeline detects the pressure change in real time, and triggers the SIF when the inlet pressure is greater than or equal to 13 MPa, and the emergency shutdown is opened. This protection system controls the risk in the minimum range by physical isolation when the risk is found, avoiding the risk from further expansion, and constitutes part of the SIS sensor subsystem, which is two pressure transmitters belonging to different models and manufacturers. One is ROSEMOUNT, and the other is Siemens. The actuator subsystem is composed of a shutdown valve (SDV1), a valve (SDV2) and an export pipeline control valve (BV). The failure data of the components are shown in the following table: SIS system modeling Before calculating the redundancy structure, the main parameters of the two-channel components are combined to quantify the correction factor according to the method.

[0088] ​​​​First, the multiple linear regression is calculated by least square method, and the bn=[0.25, 0.15, 0.3, 0.08, 0.12, 0.1] is obtained.

[0089] Second, the actual indexes of PT1 and PT2 are calculated: CH1=14.65925, CH2=18.47995.

[0090] Finally, the similarity coefficients are calculated: S11=S22=1, S12=S21=0.9486. The minimum element is 0.9486, and d=0.9486.

[0091] The sensor subsystem of the SIS is modeled according to the modeling method, as shown in Figure 12 , the model has only one CC node.

[0092] The difference between the actuator subsystem and the sensor subsystem is that the CC nodes increase, and the node channels increase, so the types of CCF also increase, as shown in Figure 13 , the CC nodes have 4, which represent the failure of no less than two actuators due to the same reason. It can be found that the difficulty of building a model increases with the complexity of the system structure.

[0093] Result analysis: The evaluation results of the 1oo2 redundant structure are shown in Figure 14 . The double combination of the PT1 channel forms the isomorphic redundant unit AA, and the double combination of the PT2 channel forms the isomorphic redundant unit BB. When the PT1 and PT2 channels are combined heterogeneously, the AB type redundant architecture is generated. Through analysis, it can be seen that the average failure probability of the AB type architecture is very small compared with the average failure probability of the AA type isomorphic redundant architecture, and the system SIL level reaches SIL3, but the BB type only reaches SIL2 level. Overall, this shows that the heterogeneous redundant structure has the greatest reliability improvement for 1oo2. The evaluation results of the 2oo2 redundant structure are shown in Figure 15 . The results show that the PFDavg value of the AB type structure is at the intermediate level of the AA structure and the BB structure. Therefore, the contribution of the heterogeneous redundant structure to the reliability improvement of the 2oo2 redundant structure is relatively limited.

[0094] By comparing the analysis results of the two structures, it can be found that the 1oo2 structure not only meets the SIL level requirements, but also effectively improves the system operation performance, forming an engineering implementation path that meets the safety specifications and has cost effectiveness, and has better reliability. If faced with equipment selection constraints and budget limitations, the heterogeneous redundant configuration of PT1 and PT2 can achieve a balance between technology and economy.

[0095] Figure 16The calculation results of the three-channel isomorphic redundancy structure. Among them, (a) is a 1oo3 architecture, (b) is a 2oo3 architecture. AAA is an isomorphic redundancy architecture constructed by three SDV1 channels, BBB is an isomorphic redundancy architecture constructed by three SDV2 channels, and CCC is an isomorphic redundancy architecture constructed by three same BV channels. The results show that for the three-module redundancy system of the execution unit, the 2oo3 architecture performs outstanding in running stability, and the 1oo3 architecture is more suitable for scenes with strict safety integrity level (SIL) requirements. It is worth noting that among existing homogeneous configuration schemes, only the AAA structure can meet the SIL level requirements, which provides a key decision basis for the selection and configuration of the execution unit Figure 17 The PFD of the heterogeneous redundancy structure is shown avg The analysis results show that, except for the BBC and BCC heterogeneous combination, other heterogeneous redundancy combinations can make the 1oo3 structure SIS meet the SIL level requirements, and the change range of the 2oo3 heterogeneous redundancy structure is smaller compared with it. Overall, the use of heterogeneous redundancy design can significantly improve the reliability of the three-channel heterogeneous redundancy structure SIS As shown in Figure 18 , the PFS value of the 1oo3 structure is shown in Figure 2 .14a, Figure 2 and the PFS value of the 2oo3 structure is shown in .14b. Compared with the double-channel redundancy structure, the availability of the three-channel redundancy structure SIS is greatly improved, and the availability of the 2oo3 structure is the best. Through the analysis of the results combined with engineering actual cases, it can be found that the SIL level and running stability of the heterogeneous redundancy SIS system are mainly restricted by the element failure rate, but the heterogeneous redundancy configuration can significantly improve the safety level and running stability of the safety instrument system.

[0096] The cost analysis is carried out taking the SIS as an example. By assuming that the cost components of each basic system are as shown in Table 2.3, and assuming that the PnoSIS of the system is 0.01: Figure 19 The life cycle cost of the SIS is calculated according to the formula. The cost of the 1oo3 structure is shown in Figure 20 . Figure 20 The cost of the 2oo3 structure is shown, where Figure 20 a is the operating cost, b is the total cost.

[0097] Figure 19 In the production and operation process, risk cost and failure cost are the main factors. Through the analysis of Figure 20The comparative analysis can know that, under the 1oo3 structure, the risk cost is at a higher level, which exceeds the system failure cost; and in the 2oo3 structure, the system failure cost presents a higher trend, which exceeds the risk cost.

[0098] The total cost of the 1oo3 configuration structure is significantly lower than that of the 2oo3 configuration structure. From the redundancy configuration, the cost of the AAC special-shaped redundancy configuration is slightly lower than that of the ABC special-shaped redundancy configuration. If the reliability and economic cost are considered, the AAC type 1oo3 structure SIS is selected.

[0099] Other embodiments of the application will be apparent to those skilled in the art from consideration of the specification and practice of the application disclosed herein. It is intended that the application cover any and all variations of the application that come within the scope of the general concept of the application and that the application include all changes and modifications that fall within the scope of the general concept of the application and that the application include all changes and modifications falling within the scope of the general concept of the application.

[0100] It should be understood that the application is not limited to the precise construction that has been described above and shown in the accompanying drawings, and that various modifications and changes can be made by those skilled in the art without departing from the scope of the application.

Claims

1. A method for integrity assessment of a heterogeneous redundant structure SIS system, characterized in that, Includes the following steps: Clearly define the assessment targets and basic data; Analyze common cause failure parameters; Correction of heterogeneous redundancy structure factor; Evaluate the MDBN model using heterogeneous redundant structures; Perform SIL and reliability assessments; Conduct a full life cycle cost analysis; Verify using engineering cases and output the results.

2. The integrity assessment method for a heterogeneous redundant structure SIS system as described in claim 1, characterized in that, In the step of clearly defining the evaluation object and the basic data: The evaluation object is a heterogeneous redundant structure SIS system, including sensor subsystems, control units and actuators composed of different types of components. The basic data includes historical fault data of the equipment, reliability parameters provided by the manufacturer, actual operation monitoring data, simulation test data and industry standard case data.

3. The integrity assessment method for a heterogeneous redundant structure SIS system as described in claim 2, characterized in that, In the steps of analyzing common cause failure parameters: Through the self-diagnostic function of the SIS system equipment, a self-diagnosis is performed every certain period of time, and functional verification tests are performed regularly. During system operation, the verification test interval and the verification test phase can be represented by two different dynamic Bayesian network models. Node states are defined in the safety instrumented system, where the node state definition is closely related to the working status and performance indicators of the equipment, including the actuator's on, off, on-fault, and off-fault states. Historical fault data and equipment reliability parameters are comprehensively utilized. The historical fault data comes from long-term system operation and is provided by the equipment manufacturer. The reliability parameters include mean time between failures (MTBF) and failure rate. Based on the collected data, the dependencies between system states are determined and a conditional probability table is constructed. By deploying sensors and data acquisition devices, real-time monitoring data of the actual operation of the SIS system is collected, simulation experiments are conducted to supplement the deficiencies of actual operation data, and industry standard case data summarized from the practical experience of many SIS systems in the industry are utilized. The dynamic Bayesian network model alternates between the test interval phase and the test phase to form the MDBN model for SIL evaluation of the SIS system. In the SIL evaluation, the accuracy of the MDBN model is measured by the indicators of precision, recall, and F1 score.

4. The integrity assessment method for a heterogeneous redundant structure SIS system as described in claim 3, characterized in that, In the step of correcting the heterogeneous redundancy structure factor: The probability of common cause failure was calculated. The range of β values ​​was determined through field surveys and industry failure databases. The influence of common cause weight ω and β factor on PFDavg was analyzed. PFDavg is the average demand failure probability. It was found that β factor has a significant impact on the evaluation results of redundant structure SIS, while ω has a smaller impact. The heterogeneous redundancy structure is modified by introducing a correction factor to characterize the degree of difference between channels in the heterogeneous redundancy structure. By dynamically adjusting the common cause failure β factor through the correction factor, the reliability advantage of the heterogeneous redundancy structure can be accurately reflected.

5. The integrity assessment method for a heterogeneous redundant structure SIS system as described in claim 4, characterized in that, In the steps of evaluating the MDBN model using heterogeneous redundant structures: When evaluating heterogeneous redundant structures, the common-cause failure node (CC) is a key factor. In the reliability modeling of heterogeneous redundant systems, the model architecture is divided into a basic layer, an intermediate layer, and a bottom layer. A heterogeneous redundancy system evaluation model is constructed. By describing the probabilistic dependencies between different levels of the system, probabilistic modeling between nodes is performed through hierarchical parameters. The transition and transformation rules of the state of failed nodes during the maintenance cycle are also considered, and inter-chip parameter modeling is carried out.

6. The integrity assessment method for a heterogeneous redundant structure SIS system as described in claim 5, characterized in that, In reliability modeling of heterogeneous redundant systems, the model architecture is divided into three layers: the base layer, the intermediate layer, and the bottom layer. The base layer is the failure layer, which includes independent device failures and common cause failures. The middle layer is the channel response layer, which describes the operating status of heterogeneous redundant units under multiple failures. The bottom layer is the system layer, which reflects the SIS system status under the coordinated action of various redundant units.

7. The integrity assessment method for a heterogeneous redundant structure SIS system as described in claim 6, characterized in that, In the steps of conducting a life-cycle cost analysis: In the life-cycle cost structure of safety instrumented systems, fixed costs and operating costs constitute the main economic elements.

Images