Failure modes effects and diagnostics

Appendix E FAILURE MODES EFFECTS AND DIAGNOSTIC ANALYSIS (FMEDA) 303... 

Instrumentation equipment can fail in different ways. We call these "failure modes." Consider a two-wire pressure transmitter. This instrument is designed to provide a 4 - 20 milliamp signal in proportion to the pressure input. Detailed failure modes, effects, and diagnostic analyses of several of these devices reveal a number of failure modes frozen output, current to upper limit, current to lower limit, diagnostic failure, communications failure, and drifting/erratic output among perhaps others. These instrument failures can be classified into failure mode categories when the application is known. 

A hardware analysis called a Failure Modes Effects and Diagnostics Analysis (FMEDA) can be done to determine the failure rates and failure modes of an instrument (Ref. 4). This is done to provide the safety design engineer with the data needed to more accurately perform probabilistic analysis. 

Fortunately, several instrumentation manufacturers are providing detailed analysis of their products to determine a more accurate set of numbers useful for safety verification purposes. A Failure Modes Effects and Diagnostic Analysis (FMEDA) will provide specific failure rates for each failure mode of an instrumentation product. The percentage of failures that are safe versus dangerous is clear and relatively precise for each specific product. The diagnostic ability of the instrument is precisely measured. Overall, the numbers from such an analysis are indeed product specific and provide a much higher level of accuracy when compared to industry database numbers and experience based estimates. 

Failure Modes, Effects and Diagnostic Analysis, R0S02/11-07 ROOl, PA Sellersville, exida, Eeb. 2004. 

Failure Modes Effects and Diagnostics Analysis (FMEDA)... 

FAILURE MODES, EFFECTS, AND DIAGNOSTIC ANALYSIS AND SYSTEM INTEGRATION ISSUES... 

Manufacturing controls to ensure to the desired safety requirements Control of management of change (MOC) to meet the requirements Failure modes, effects and diagnostic analysis (FMEDA) to determine SFF, PHF Details of proof test requirements... 

FMEDA Failure Modes, Effects and Diagnostic Coverage Analysis... 

It should be emphasized that a FMEDA provides failure rates, failure modes and diagnostic coverage effectiveness for random hardware failures. If done properly, it does not include failure rates due to "systematic" causes including incorrect installation, inadvertent damage, incorrect calibration or any other human error. 

Since diagnostics are such a critical variable in the calculations, the ability to measure and evaluate the effectiveness of the diagnostics is important. This is done using an extended failure modes and effects analysis technique (Ref. 9) and verified with fault injection testing (Ref. 10 and 11). The techniques were refined to include multiple failure modes (Ref. 12) and today are commonly used to evaluate diagnostic capability and failure mode split (Ref. 13). 

The FMEDA can be very effective but there are limitations. The method shows diagnostics only for known component failure modes. While an extensive body of knowledge exists in databases around the world (Ref. 4 and 7), newly designed components present a risk in that all failure modes may not be known. This can be included in the FMEDA by adding an additional undetected component labeled "imknown" and assigning a failure rate. 

The learning process of the net has followed several steps. The first one was the definition of the system variables it meant to decide which variables described the system behavior from the diagnostic and prognostic point of view. So some field measures have been excluded from the model while only the sensors measures that can be considered the effects of a failure modes has been introduced. Moreover, the model has been enriched by a set of variables with prognostic and diagnostic issues. So the variables failure modes and system prognosis have been modeled by some nodes that represent the support elements for the condition based maintenance. 

This is a detailed analysis of the different failure modes and diagnostic capabilities for a piece of equipment. It is an effective method for determining failure modes and failure rates, a requirement for certification against lEC 61508 in most certification agencies. 

The optimal approach to select devices is to collect information regarding field experience and the device s compliance to specific IEC 61508 requirements. For example, a manufacturer may provide a failure-modes-and-effects analysis for the device based on IEC 61508 criteria. This analysis may include the failure-modes listing, failure rate, and diagnostic coverage assumptions for the device as manufactured. 

Failure Mode and Effects Analysis Another method is failure mode and effects analysis. It considers what may go wrong and what the consequences will be. Most people are familiar with this method through diagnostic charts that aid in trouble shooting automobiles or other equipment. By locating the failure or symptom in the chart, one can locate possible causes and solutions for the problem. In failure mode and effects analysis for safety, one is trying to identify what controls will prevent or reduce the danger of some hazard. 

In continuous mode, the demand is effectively always present. Dangerous conditions always exist and a dangerous failure of the safety instrumented function will immediately result in an incident. There are no safety benefits that can be claimed for manual proof testing or even automatic on-line diagnostics in a single channel system (Tool). By the time the diagnostics detect the fault and initiate action, it is too late. Therefore, in continuous demand mode probability evaluation cannot take credit for any diagnostics except in redundant systems. 

When the demand frequency is more than twice the periodic proof-test frequency, the application should be considered a high-demand mode application. Therefore the equations and techniques that use test interval as a key variable are not valid. In effect, one cannot take credit for periodic inspection unless it is done very frequently. Credit may be taken for diagnostics that cause the device to fail to the safe state (i.e. automatic process shutdown on any detected dangerous failure) in the high-demand case, as long as the diagnostic time period plus the time necessary to safely return the process to a safe state is less than the available process safety time (the time period between initiation of a demand and the hazard). 

---