Diagnostic coverage

Most of the techniques in Annex A of this standard require some quantification of the diagnostic coverage of the SIS. Diagnostics are tests performed automatically to detect faults in the SIS that may result in safe or dangerous failures. 

A particular diagnostic technique cannot usually detect all possible faults. An estimate of the effectiveness of the diagnostics used may be provided for the set of faults being addressed. Subclauses 7.4.4.5 and 7.4.4.6 of lEC 61508-2 provide requirements for how diagnostics could be determined (see also Annex C of lEC 61508-6 for an example of how diagnostic coverage is calculated). 

Safety-configured or lEC 61508 series compliant PE logic solvers typically include diagnostics which detect various faults. The types and diagnostic coverage will generally be described in the safety manual. 

It should be emphasized that a FMEDA provides failure rates, failure modes and diagnostic coverage effectiveness for random hardware failures. If done properly, it does not include failure rates due to "systematic" causes including incorrect installation, inadvertent damage, incorrect calibration or any other human error. 

However, if the diagnostic coverage were high, the annunciation failures will have a greater impact. Consider the failure rates from Table 9-3. These values were taken from the FMEDA report for the Rosemount 3051S SIS transmitter (Ref. 4) and converted to units of failures per year. 

What diagnostic coverage would be expected using a high quality partial valve stroke test for a gate valve with piston actuator ... 

ESDI Lambda %Safe Automatic Test Diagnostic Coverage CD Repair Time (RT) Proof Test Coverage Lambda DD Lambda DU E Lambda DU U Reference... 

The analysis indicates that for this circuit, the safe diagnostic coverage factor is 0.96 and the dangerous coverage factor is 0.9996. This is an excellent result. 

The FMEDA method also provides diagnostic coverage factors for the mechanical components when external diagnostic techniques are applied such as partial valve stroke testing. 

For complex devices with safety critical functionality, more extensive analysis may be justified. A new technique called Random Intelligent Failure Injection Technique (RIFIT) can provide diagnostic coverage via computer simulation of the complex circuit (Ref. 16). Internal faults can be simulated and diagnostics can be measured. The results of a RIFIT analysis can be incorporated into the FMEDA. 

Where Cpx = the diagnostic coverage of the proof test and LT = the lifetime of the instrument. This period is often the time between major overhauls where an instrument is removed from service and completely renewed. 

In the procedure of probabilistic modeling of E/E/PE systems the diagnostic coverage (DC) parameter allow to obtain for each component of given category the failure rate (danger undetected, danger detected, safe undetected and safe detected). It is obtained from some tables in lEC 61508 and expert opinions. 

The system is visualized in Figure 3 from which it also becomes clear that the detailed operational rules are crucial in determining the reliability of safety systems. For simplicity we assume here that all failures are non-detected (i.e. must be detected by prooftests). This is by no means evident since especially redundant systems can have quite a high diagnostic coverage, such that most failures may be revealed immediately. 

The safety level was defined as category 2 according to standard NF EN ISO 13849 (PL d ). In category 2, the safety function is controlled at suitable intervals by the machine control system. The occurrence of a fault can lead to loss of the safety function in the interval between two checks. The MTTFd is hi and the diagnostic coverage is average . Common cause failures are taken into account. 

Diagnostic Coverage (DC). According to TR 62061-1 2010 the diagnostic measure and its DC value can be taken from the simplified approach in ISO 13849-1 Table E.l. 

---