GB/T 32202.1-2026Functional safety of safety instrumented systems in oil and gas pipelines - Part 1: Assessment requirements (English PDF)

5.1 Evaluation Nodes

5.1.1 Functional safety assessment should be conducted throughout the SIS safety lifecycle. This should be in accordance with GB/T 21109 (all parts) and the SIS safety standards for oil and gas pipelines. Functional safety assessment activities should be performed at the following points throughout the entire lifecycle (see Figure 1).

5.1.2 SIS safety requirements assessment and SIS design assessment should be completed during the design phase.

5.1.3 For similar stations or facilities that have already undergone functional safety assessments, the assessment conclusions may be adopted as a reference, but a difference analysis should be performed, and [further details should be provided]. The differences will be evaluated.

5.1.4 For renovation and expansion projects, functional safety assessments should be conducted at each stage of the safety lifecycle. For simple changes, they should be carried out in accordance with Article 8. This chapter requires execution. Any changes should be executed according to the relevant chapter based on the current lifecycle stage.

5.1.5 During the operation and maintenance phase, FSAs should be conducted regularly to ensure that maintenance and operation are performed in accordance with design expectations and meet GB/T standards. Requirements related to security management and verification in 21109 (all parts).

5.2 Personnel Requirements

5.2.1 The level of independence of personnel conducting functional safety assessments shall meet the requirements of

8.2 in GB/T 20438.1-2017.

5.2.2 Functional safety assessment personnel should be familiar with the basic functional safety standard GB/T 20438 (all parts) and applicable standards in the process industry. Comply with GB/T 21109 (all parts), and undergo training and assessment to obtain the corresponding certificate.

5.2.3 Personnel conducting functional safety assessments should possess relevant experience in oil and gas pipeline engineering and knowledge of relevant laws and regulations to ensure the reasonableness of the assessment results. Credible.

5.2.4 The number of senior qualified personnel in the assessment team should not be less than 2/3 of the total number. Note

5.3 Assessment Agency

5.3.1 Functional safety assessment activities should be conducted by qualified organizations within the scope of their accreditation certificates.

5.3.2 The level of independence of the assessment body shall meet the requirements of

8.2 in GB/T 20438.1-2017.

5.4 Assessment Management

5.4.1 The assessment organization shall establish an assessment team and clearly define the responsibilities and independence requirements of each member.

5.4.2 Personnel and organizations performing functional safety assessment activities shall meet the requirements of

5.4.3 The assessment team shall prepare a functional safety assessment plan, which shall include.

---The lifecycle phase that requires functional safety assessment activities, i.e., the scope of functional safety assessment;

---Activities required at each stage;

---Personnel, departments, organizations, or other entities involved in the evaluation activities;

---All resources needed to complete the functional safety assessment activities;

---The outputs that should be obtained from completing a functional safety assessment activity;

---The skills, responsibilities, and authority of the functional safety assessment team;

---The level of independence of the assessment team;

---The method used to re-verify functional safety assessments after system modifications.

5.4.4 Throughout the entire lifecycle, the functional safety assessment plan should be continuously updated and maintained. Any equipment or system change may... Additional functional safety assessment activities are required to determine whether any new hazards may arise.

5.4.5 Before conducting a functional safety assessment, the functional safety assessment plan should be approved by the assessment organization.

5.4.6 The assessment team shall manage and conduct functional safety assessments in accordance with the functional safety assessment plan.

6.2 Evaluation Basis

6.2.1 The assessment criteria that best reflect reality should be adopted.

6.2.2 The basis for the assessment includes. hazard analysis and risk assessment report, safety requirement allocation report, and safety requirement specifications. (Necessary conditions) In this case, it should also include the relevant procedural documents for each of the above activities, as well as the analysis and reference materials recorded in the analysis report. Note

1.Sometimes, the names of these documents are not fixed as above, and the document formats are not uniform. For example. HAZOP analysis method is used to conduct hazard analysis. If a risk assessment is included, the report can be a HAZOP analysis report. Note

2.Considering the characteristics of oil and gas pipelines, such as long distances, long routes, and complex environments, attention should be paid to the potential impact of external environments and natural disasters.

6.3 Assessment Content

6.3.1 Evaluate the SIS safety requirements specification.

6.3.1.1 The Security Requirements Standard (SRS) shall include both functional security requirements and security integrity requirements. The SRS may be a set of documents or materials. It is traceable.

6.3.1.2 The requirements for SIS in the SRS should be clearly, accurately, verifiable, maintainable, and feasible, and easily adaptable to any stage of the lifecycle. At what stage will the people who might use this information understand it.

6.3.1.4 Application security requirements should be assessed. Application security requirements should be considered from the perspective of the SRS and SIS architecture (layout and internal structure). The derivation can be part of the SRS or a separate document (such as the application requirements specification). Application security requirements The input information should include.

---Detailed security requirements for each SIF, including the sensing unit voting structure, etc.;

---Requirements outlined in the SIS architecture and security manual, such as limitations and constraints on hardware and embedded software;

---Safety plan requirements. The safety plan should be prepared in accordance with the requirements of GB/T 21109.1;

---Application security requirements for each programmable SIS device required by each SIF, which should conform to the SIS architecture;

---Real-time performance parameters, such as (Central Processing Unit) capacity, network bandwidth, acceptable real-time performance under fault conditions, and a All chain signals received within a specific time period;

---Procedure order and delays (if applicable);

---Measures taken for abnormal process variables (such as sensor values exceeding range, excessive rate of change, no data updates, or detection of open/short circuits). action;

---The function of performing inspection tests and automatic diagnostic tests on external devices (such as sensing units and execution units) executed in the application;

---Application self-monitoring (e.g., application-driven watchdog and data range verification);

---Monitoring of other devices in the SIS (such as sensing units and execution units);

6.3.2.14 The details of each activity from

6.3.2.12 should be recorded in detail, documented, and signed by the relevant responsible person.

6.3.3 Evaluate the process of proposing security integrity requirements.

6.3.3.1 Safety requirements allocation should be carried out after a hazard and risk analysis has been conducted.

6.3.3.2 The allocation of security requirements shall include the allocation of security function requirements and the allocation of security integrity requirements.

6.3.3.3 The process of allocating safety requirements shall comply with relevant national, industry, or enterprise standards and specifications, including. analysis and assessment qualifications, Organizational management, implementation processes, documentation, and release and signing, etc.

6.3.3.4 The information on which the allocation of security requirements is based shall be reviewed.

6.3.3.5 The risk tolerance standard used in the analysis should be clearly defined, and the risk tolerance standard should at least meet the relevant national requirements.

6.4 Documentation Requirements

6.4.1 The SIS safety requirements assessment report shall be part of the functional safety assessment report.

6.4.2 The SIS security requirements assessment report should be clearly structured, accurately worded, unambiguous, and traceable.

6.4.3 Project Background It should include relevant content such as the significance of the project, the origin of the task, and the project overview.

6.4.4 Assessment Basis The relevant information, such as the laws, regulations, technical specifications and standards, and names of basic technical documents cited in the evaluation project, should be listed.

6.4.5 Purpose of Assessment The purpose of the assessment should be clearly described.

6.4.6 Scope and Content of Assessment The scope and content of the assessment should be clearly described.

6.4.7 Evaluation Methods Depending on the characteristics of the project, the evaluation methods used should be clearly stated.

6.4.8 Evaluation Process The evaluation process should be clearly described, including the evaluation procedures, work schedule, participants, etc., and can be expressed using diagrams, tables, or text. Expression.

6.4.9 Assessment Conclusions and Recommendations Based on the evaluation results described in section 6.3, a conclusion on the hazard and risk analysis of the station's processes and equipment, and a complete SIF should be provided. The report presents conclusions on the integrity of SIS security requirements, identifies existing problems, and offers targeted recommendations.

6.4.10 Attachment

6.4.10.1 Evaluation Worksheet The survey forms and analysis record forms generated during the evaluation process should be provided. Sample forms are shown in Appendix A.

6.4.10.2 Evaluation of the adoption of software tools The name, model, version number, manufacturer, and functional description of the software or auxiliary tools used for evaluation or testing should be clearly specified, as well as the information provided in this document. Usage in the project.

6.4.10.3 Other materials The necessary information on which the assessment work is based should be provided, such as analysis drawings, sources of assessment criteria, and analysis and assessment assumptions and their sources.

7.2 Assessment Basis

7.2.1 The assessment basis should be accurate and reliable.

7.2.2 The following information should be provided, but is not limited to.

---SIS Security Requirements Assessment Report and Rectification Report;

---Design Specification;

---Operating principle;

---Equipment Summary Table;

---SIL certification documents or previous usage proof materials that the supplier can provide for the equipment;

---SIL assessment report prepared during the design process.

7.3.1 SIS Performance Evaluation

7.3.1.1 When the SIS performs both SIF and non-SIF operations, under normal and fault conditions, all hard drives that negatively affect any SIF operation... Components, embedded software, and applications should all be considered as part of the evaluation and should meet the highest of the SIFs that they may affect. SIL requirements. When implementing SIFs with different SILs in a SIS, the evaluation should identify shared or common hardware, embedded software, and applications at least... It meets the highest SIL standard.

7.3.1.2 The SIS should be designed so that once it places the process in a safe state, the process should remain in that safe state unless otherwise specified in the SRS. The state continues until the SIS is reset.

7.3.1.3 A manual mechanism (such as an emergency stop button) independent of the logic solver should be provided to trigger the chain actions of the final SIS components, except... Non-SRS specifications may vary. When the SIL capability of the SIS controller is at least one level higher than the SIL of the SIF, a manual mechanism can be used via SIS control. Implemented by the device.

7.3.1.4 All communications used for SIF shall use technologies suitable for functional safety applications and meet the required SIL, as detailed in [link to relevant documentation]. GB/T 34040.

7.3.2 Independence Assessment

7.3.2.1 The design of SIS should fully consider the independence and correlation between SIS and BPCS, as well as between SIS and other protective layers.

7.3.2.2 When a device is used for BPCS, it should not be used for SIS simultaneously, because failure of this device will result in the failure of the SIF and the SIF itself. The risk of failure is high. Unless analysis confirms that the overall risk is acceptable.

7.3.3 Feasibility Assessment

7.3.3.1 The operability of the SIS should be assessed to ensure it complies with the SRS, and the relevant requirements should be clearly defined in the design documents.

7.3.3.2 A safety manual should be provided, covering the operation and maintenance of the SIS under the expected configuration and operating environment of the equipment. Protection, fault detection and constraint.

7.3.4 Maintainability Assessment The maintainability of the SIS should be assessed to ensure it meets SRS requirements, and these requirements should be clearly defined in the design documents. Systems requiring online maintenance... The system needs to take into account bypass facilities and specify the requirements for their installation.

Note. The requirements for bypass facilities generally include. the maximum time that the SIS can be in bypass mode (maintenance or testing) while maintaining safe operation of the process. Bypass-related warning settings, compensation measures, how to set up and eliminate bypasses, etc.

7.3.5 Testability Assessment The testability of the SIS should be assessed to ensure it meets SRS requirements. For systems requiring online testing, bypass facilities must be considered and clearly defined. Requirements.

7.3.6 Usability Assessment To ensure SIL capabilities can be maintained during the operational phase, human capabilities and limitations must be considered; the suitability of the SIS design for the system should be reviewed. Tasks assigned to operators and maintenance personnel. All human-machine interface designs should follow good human operating practices and be suitable for operator accessibility. The level of training or knowledge received.

Note. For example, if the operation requires frequent input of limit data or other operator input, then human factors analysis is required.

7.3.7 SIS Information Security Assessment The design of a SIS should provide the necessary protection against identified information security risks.

8.3 Assessment Content

8.3.1 The following items should be reviewed and evaluated.

---Does the design, operation, and maintenance of the SIS comply with the latest national and corporate standards and specifications? Are the SIS operating procedures, maintenance procedures, spare parts management, and document management regulations followed and implemented?

---Does the safety function loop design and instrument selection of the SIS meet the necessary risk reduction requirements?

---Based on the actual operation and maintenance of SIS, the SIL assessment calculation of SIF is based on the required rate, failure rate, and TI, etc. The assessment basis should be updated and revised as necessary; Do the SIS operators and maintenance personnel possess the corresponding professional skills? Did the modifications and changes to the SIS comply with relevant change management regulations? Were the scope and depth of the impact assessed? And necessary countermeasures were taken;

---Review the content of previous functional safety assessments.

8.3.2 The evaluation may take the form of on-site surveys, visits, reviews and discussions, and actual functional tests should be conducted when necessary.

8.4 Documentation Requirements

8.4.1 Basic Requirements The functional safety operation and maintenance phase assessment report should be part of the functional safety assessment report, and the report should be clearly structured, accurately worded, and unambiguous. Meaning, and traceable.

8.4.2 Project Background It should include relevant content such as the significance of the project, the origin of the task, and the project overview.

8.4.3 Assessment Basis The relevant information, such as the laws, regulations, technical specifications and standards, and names of basic technical documents cited in the evaluation project, should be listed.

8.4.4 Purpose of Assessment The purpose of the assessment should be clearly described.

8.4.5 Scope and Content of Assessment The scope and content of the assessment should be clearly described.

8.4.6 Evaluation Methods The evaluation method used should be clearly stated based on the characteristics of the project.

8.4.7 Evaluation Process The evaluation process should be clearly described, including the evaluation procedures, work schedule, participants, etc., and can be expressed using diagrams, tables, or text. Expression.