To: Gurupup who wrote (6876 ) 12/5/1997 1:29:00 AM From: Gerald L. Kerr Respond to of 31646
Excerpts From the Year 2000 Newsletter on Embedded Systems Reporting on the Recent Dallas Conference. Presenter: Ron Quiggins Company: Shell Services As noted in Part 1 of the coverage of this conference, Mr. Quiggins is the founder of the Year 2000 Energy Industry Group, in which representatives of 15 oil & gas companies (including 7 of the "majors") meet every six weeks for the exchange of information and the sharing of learning related to dealing with Year 2000 problems in the oils and gas industry environment. I've combined some of the comments from Mr. Quiggins' Q&A session with the report on his presentation below. Mr. Quiggins estimated that the costs to the US energy industry of achieving Year 2000 compliance would total around 3 billion dollars. The scope of the Year 2000 problem as it applies to his industry was defined by dividing it into three categories: The "IT Domain" part of the Year 2000 problem consists of addressing Year 2000 concerns related to in-house software applications, infrastructure, telecommunications, 3rd party software packages, interfaces and end user applications. The "Commercial Integrity" part of the Year 2000 problem consists of addressing Year 2000 concerns related to working with suppliers, customers, joint venture partners, public affairs and legal. The problem of maintaining commercial integrity of your business is a very difficult one, because the Year 2000 problem hits all businesses at the same time, and most companies have business processes that involve many external players. If external companies critical to your business have prolonged Y2K problems or go out of business, then your own company is at risk. The "Asset Integrity" part of the Year 2000 problem consists of addressing Year 2000 concerns related to physical systems such as platforms, pipelines, plants, refineries, building management, process control, SCADA/CAO, and instrumentation. The goal of asset integrity is to ensure that production facilities will continue to produce safely and without detriment to the environment. Production capability should not be interrupted during the millennium change. Embedded systems pose special challenges because there is no proven methodology for addressing these systems, impact assessment is very difficult, and many devices are remotely located. The testing of embedded systems can be extremely difficult, and Mr. Quiggins discussed a model that considers the risk of business impacts due to system failure. If some systems fail, they may have only a minor effect on a business, so it does not make sense to spend a lot of time and money extensively testing these systems. Other systems may be critical to safety or business operations, so more focus should be put on the testing of these systems. Mr. Quiggins described the structure of automation systems as forming a four tiered pyramid: Top tier: Business Level Systems Second tier: SCADA/Computer Assisted Operations (CAO)/ Distributed Control Systems (DCS) Third tier: RTU/PLC/PCs Fourth tier: Instrumentation Vendors that support the top tiers tend to be larger companies that want long term relationships and will be pro-active with their customers. Systems at the upper tiers tend to be more complex and expensive. Vendors at the lower tiers are sometimes small companies with high risks and may be reluctant to fix problems. However, it was noted that while PLC vendors have been quite forthright in talking about their problems, the big DCS vendors have not been so forthcoming, which is a real problem. Examples of possible failure scenarios include: PLCs "locking up" due to a year field overflowing. Historical log function in a SCADA system providing corrupted entries around mid-night, log record terminated. Fiscal metering system for a gas pipeline that will not work
into the next century. Sewage outflow controller found to misinterpret the tide-table beyond 12/31/99 500 MW Electrical Generator Date advanced to 12/31/99 for a test. 20 seconds after 2000, temperature of stator cooling water read high - failed safe. What are the alternative actions a company can take to deal with these problems: 1. Do nothing and keep running: this is totally unpredictable, and leads to the possibility of a operation shutdown or major catastrophe. 2. Do nothing except plan a shut-down at the end of 12/31/99: this is also totally unpredictable, and could lead to restart difficulties and health, safety and environment compromises. 3. Delay action until more is known about the problem: this is a tradeoff on value of more knowledge versus less time and resources. Consequences range from temporary unplanned shutdown to prolonged shutdown. 4. Begin action now to initiate remedial engineering program: this approach has a good chance of reducing the problem to manageable proportions. Consequences range from operational inconvenience to temporary shutdown. Mr. Quiggins noted that while the cost of addressing these problems now may be high, the cost of failure will likely be much higher.