Fail-danger

Actuator structure failure - binding Fail-Danger  

Valve internal seal damage Fail-Danger 

Valve ball stuck in position Fail-Danger 

It should be noted that the above failure mode categories apply to an individual instrument and may not apply to the set of equipment that performs a safety instrumented function because the equipment set may contain redimdancy. It should be also made clear that the above listings are not intended to be comprehensive or representative of all component types. 

Most practitioners define Fail-Safe for an instrument as a failure that causes a false or spurious trip of a safety instrumented function unless that trip is prevented by the architecture of the safety instrumented function. Many formal definitions have been attempted that include a failure which causes the system to go to a safe state or increases the probability of going to a safe state. This definition is useful at the system level and includes many cases where redundant architectures are used. 

---

Failures can either be fail-safe or fail dangerously. Fail safe incidents may be initiated by spurious trips that may result in accidental shutdown of equipment or processes. Fail dangerously incidents are initiated by undetected process design errors or operations, which disable the safety interlock. The fail dangerously activation may also result in accidental process liquid or gas releases, equipment damage, or fire and explosions. 

Fail to Function (Fail - Danger) Spuriously Function (Fail - Safe) Function Delayed (Fail - Danger)... 

Fail-Danger Operating NO Not Without Normally Diagnostics... 

Figure 2-3 shows a chart of SIS operating conditions. The fail-danger mode is the fundamental problem. Under those conditions the process is operating normally but without the automatic protection of the SIS. Without special diagnostics, operations personnel have no indication that something has failed. 

Design diagnostics to automatically detect fail-danger... 

Actual failures of instruments can be classified as "fail-safe," "fail-danger," or another failure mode. Such failure modes will be defined in this chapter in the context of an individual instrument. Note that sometimes the application must be understood before these classifications can be made. It must be remembered that the safety instrumented function may or may not fail when one instrument has failed. A redundant architecture may compensate for instrument failures. 

Power supply high (out of tolerance) Fail-Danger ... 

Many practitioners define "Fail-Danger" as a failure that prevents a safety instrumented function from performing its automatic protection function. Variations of this definition exist in standards. lEC 61508 provides a definition similar to the one used herein, which reads "failure which has the potential to put the safety-related system in a hazardous or fail-to-function state." The definition from lEC 61508 goes on to add a... 

Some failures within a piece of equipment have no effect on the safety instrumented function, nor cause a false trip, nor prevent automatic diagnostics from working. Some functionality performed by the equipment is impaired, but that functionality is not needed. These may simply be called "No Effect" failures. They are typically not used in any reHabihty model intended to obtain probability of a false trip or probabihty of a fail-danger. Per 1EC61508, these would be classified as "Fail-Safe" or may be excluded completely from any analysis depending on interpretation of the analyst. 

Figure 13-4 is the fault tree for the safety instrumented function. It shows that the SIF will fail dangerously only when both ESDI and ESD2 fail dangerously. 

When the pressure switch fails dangerously but detected by the effectiveness of the proof test (PSHOl DU E),... 

OR when the pressure switch fails dangerously and not detected by... 

OR when the pressure switch impulse line fails dangerously and not detected by the proof test (IMP DU U),... 

---