Danger detection

A set of equipment used in a safety instrumented function is non-redundant (lool). The total dangerous detected failure rate is 0.002 failures per year. The total dangerous undetected failure rate is 0.0005 failures per year. Restore time average is 168 hours. The equipment is inspected and tested every two years with 100% test coverage. What is the PFD What is the PFDavg ... 

SOLUTION The diagnostics operate rapidly and complete execution sixty times per expected demand period. The diagnostic test time plus the response time is within the process safety time. Therefore dangerous detected failures will be converted into safe failures. The remaining dangerous failure rate is 0.5 x 10 failures per hour. That meets the requirements for SIL2 per Figure 7-4. 

Lambda SD = 0 x 10 failures per hour, Safe Detected Lambda SU = 2.4 x 10 failures per hour, Safe Undetected Lambda DD = 0 x 10 failures per hour. Dangerous Detected Lambda DU = 3.6 x 10 failures per hour. Dangerous Undetected... 

When the transmitter fails with its output saturated under-range (< 3.6 mA), the safety PLC will automatically detect this as a failure and send an alarm. No false trip will occur. As above, the transmitter is not capable of responding to a demand during this time so the failure should be classified as Dangerous Detected. 

Dangerous Detected Dangerous Undetected Safe Detected Safe Undetected No Effect ... 

Column 15 lists the dangerous detected failure rate. It is obtained by multiplying the failure rate (Column 8) by one minus the failure mode number (Column 12) and the detectability (Column 10). 

Problem A FMEDA shows that the dangerous detected failure rate is 4.84 E-7 failures per hour. The dangerous undetected failure rate is 3.3 E-8 failures per hour. What is the dangerous coverage factor ... 

Figure F-3 shows the fault tree for dangerous failures. The system will fail dangerously if the imit fails dangerous detected (DD) or dangerous undetected (DU).

In the Markov model for this configuration, state 0 represents the condition where there are no failures. From this state, the controller can reach two other states. State 1 represents the fail-safe condition. In this state, the controller has failed with its outputs de-energized. The system has failed dangerously in state 3 and the failure is not detected by on-line diagnostics. The Markov model for the loolD is similar to the lool except that the dangerous detected failures automatically trip the system (go to state 1). 

Three system success states that are similar to the other dual systems previously developed are shown. State 1 is an interesting case. It represents a safe detected failure or a dangerous detected failure. The result of both failures is the same since the diagnostic cutoff switch deenergizes the output whenever a dangerous failure is detected. The only other system success state, state 2, represents the situation in which one controller has failed in a safe undetected manner. The system operates because the other controller manages the load. 

Figure F-32 shows that a loo2D architecture will fail safely if there is a common cause safe failure, a common cause dangerous detected failure, if both units fail in a detected manner or if both units fail in a safe undetected mode.

In state 1 the system has degraded to loolD operation. A second safe failure or a dangerous detected failure will fail the system safely. Like the loolD, a dangerous undetected failure will fail the system dangerously. In... 

In state 3 one imit has failed in a safe undetected manner. In this condition the system has also degraded to loolD operation. Additional safe failures or dangerous detected failures will cause the system to fail safely. An additional dangerous undetected failure will fail the system dangerously taking the Markov model to state 6 where both units have an undetected failure. Failures from this state are not detected until there is a maintenance inspection. 

No, more data is usually required to carry out SIL verification calculations, e.g. SFF, dangerous detected failure rates, etc. In addition, the methods used to calculate the failure rate are missing. The given number is very suspicious and seems quite optimistic. 

In the procedure of probabilistic modeling of E/E/PE systems the diagnostic coverage (DC) parameter allow to obtain for each component of given category the failure rate (danger undetected, danger detected, safe undetected and safe detected). It is obtained from some tables in lEC 61508 and expert opinions. 

Note that similar to the above argument, more complicated reconfigured 2oo3 systems can be calculated, e.g. when dangerous detected (DD) failures or even safe failures are included. For the PFD s the formulas of lEC 61508 may be used and the relevant times to first failme must be derived. 

The PFD is a function of the rate kou of dangerous undetected (DU) failures of the components of the SIS, the length, r of the functional test interval, and of several other parameters. A dangerous (D) failure is a failure that prevents the execution of a SIF, and a failure is undetected (U) if it is hidden until there is a real demand or a functional test. Some dangerous failures may also be detected by online diagnostics and are referred to as dangerous detected (DD). If the DD failures are repaired within a short time, we may consider the effect from DD failures on the PFD to be negligible. 

Device failures can sometimes be detected by online, automatic diagnostics that notify the plant operator that the device has failed so that compensating measures can be implemented. These failures are classified as detected, leading to the identification of dangerous detected (DD) or safe detected (SD) failures. If online diagnostics are not available, the failure may remain undetected until a process demand occurs or the device is proof tested. These undetected failures may be dangerous undetected (DU) or safe undetected (SU). 

The diagnostics are incorporated into the calculation using the diagnostic coverage (DC). The PFDavg for dangerous, detected (DD) failures is... 

Common-cause failures can be safe, dangerous, detected, or undetected. Those common-cause failures that exhibit random behavior are typically modeled using the beta factor method. (Refer to ISA-... 

ANSI/ISA-84.00.01-2004-1 requires the use of minimum fault tolerance (i.e. device redundancy) to ensure that adequate protection is provided. The required fault tolerance is related to the device complexity. It is important to note that the device s safe failures tend to drive the process toward the safe state, whereas the safe failure fraction is based on the safe failures and the dangerous detected failures. Thus, there is an implicit assumption in the safe failure fraction that the requirements of ANSI/ISA-84.00.01-2004-1, Clause 11.3, are met. Refer to ISA-TR84.00.04-1, Clause K.4, for more information concerning the safe failure fraction. 

DC° X, where a is the dangerous detected failure, DC° is the diagnostic coverage for dangerous failure... 

---