Final element subsystem

The final element subsystem consists of one solenoid. Type A. It has a hardware fault tolerance of 0. The SFF is 76%. According to Figure 7-8. Type A Architecture Requirements lEC 61508, the subsystem qualifies for SIL 2. The overall design is qualified to SIL 1 since lowest subsystem is the limiting factor. 

The results of the PFDavg calculations for SIL 2 Case 1 indicate that for a one-year test interval the PFDavg is 5.61E-3. This provides a Risk Reduction of 178 (SIL2). Figure 12-7 shows the PFDavg contribution of each subsystem. It can be seen that the final element subsystem is the primary limit. For a three-year test interval the PFDavg is 8.80E-03. This provides a Risk Reduction of 114 (SIL2). 

The fault tree for ESD2 is shown in Figure 13-7. ESD2 will fail dangerously if the sensor subsystem OR the logic solver subsystem OR the final element subsystem fails dangerously. 

Gate 4 represents the final element subsystem. Included in this portion of the fault tree is the solenoid and actuator/valve. The simplified approximation equation for gate 4, PFD is ... 

In any case, the design does not meet the requirements of SIL 2 for PFDavg. It can be clearly seen from Table 14-3 or Figure 14-5 that the problem is the final element subsystem. Consequently this part of the safety function needs to be changed in order to meet the SIL 2 requirement. In order to increase the safety integrity of the final element... 

The architectures modeled in this appendix are the "generic" architectures. Actual commercial implementations may vary. While the architecture concepts are presented with programmable electronic controllers the concepts apply to sensor subsystems and final element subsystems. 

Based on the data provided for this exercise, the FFDa g and other metrics pertaining to the final element subsystem is as per the table below ... 

PFDpp = average probability of failure on demand for the final element subsystem... 

Final element subsystem This may be an actuator (e.g., shutdown valve, blowdown valve, etc.), barrier, etc. 

The targets for average probability of failure on demand or frequency of dangerous failures per hour apply to the safety instrumented function, not to individual components or subsystems. A component or subsystem (for example, sensor, logic solver, final element) cannot have a SIL assigned to it outside its use in a specific SIF. However, it can have an independent maximum SIL capability claim. 

Each "input circuit" contains the electronics required to read one sensor input. The "input module" subsystem includes all the electronics common to all input channels on a module. The "main processor" encompasses all components common to any PLC function. The "output module" subsystem contains all components common to the output channels on one module. The "output circuit" consists of the components needed to interface to one final elements device. 

To determine the architectural requirements, the SFF number is calculated. This applies to each SIF subsystem, i.e., sensor, logic solver, and final element. To calculate the Safe Failure Fraction for the pressure switch we must first calculate and. ... 

During the 1990s the concept of Safety Integrity Levels (SIL) was developed [1]. It serves to assess safety-related systems and concerns aU components and subsystems required to realize safety functions from the sensor to the final element. Apart from that it applies to application software, which was developed for systems with limited variability language (no branching) or programmable logic controllers (PLC). 

Diagnostic fimctions of other devices within the SRECS (e.g., sensors and final elements) to be implemented by that subsystem. 

When the PFHd value for each subsystem is defined the total PFHd value for the safety function can be calculated by summarizing the PFHd value for the different subsystems (sensor, logic and final element). When the total PFHd value is known, it is possible to go into table 3 in [ISO 62061] (Figure 6) and check that the value is sufficient for the required SIL for the specific safety function. 

NOTE 2 Diagnostic coverage is applied to components or subsystems of a safety instrumented system. For example, the diagnostic coverage is typically determined for a sensor, final element or a logic solver. 

For all subsystems (for example, sensors, final elements and non-PE logic solvers) except PE logic solvers the minimum hardware fault tolerance shall be as shown in Table 6 provided that the dominant failure mode is to the safe state or dangerous failures are detected (see 11.3), otherwise the fault tolerance shall be increased by one. 

NOTE 1 An SIS usually consists of three architectural subsystems sensors, logic solver and final elements. Furthermore, subsystems could have redundant devices to achieve the required integrity level. 

Defined software safety life cycle - required activities defined to develop application software for each programmed SIS subsystem (sensor, logic solver, and final elements) -12.1.1.1... 

In other words, the safe-failure fraction is a measure that indicates the probability of a subsystem failure being either safe or detected by diagnostics. The measure is applied to each major subsystem in a safety instrumented function (sensor, logic solver, final element) separately. 

Now with these basic ideas in mind, it is time to go for little details into each system components and subsystems. Starting with safe fieldbus system, discussions will be presented on field instruments, alarm systems, logic solvers, and final elements also in sequence. 

Logically, if a response has an effect on some other system, then it must be a factor of that other system. It is not at all unusual for variables to have this dual identity as response and factor. In fact, most systems are seen to have a rather complicated internal subsystem structure in which there are a number of such factor-response elements (see Figure 1.4). The essence of responses as factors is illustrated in the drawings of Rube Goldberg (1930) in which an initial cause triggers a series of intermediate factor-response elements until the final result is achieved. 

The theory of multi-oscillator electron transitions developed in the works [1, 2, 5-7] is based on the Born-Oppenheimer s adiabatic approach where the electron and nuclear variables are divided. Therefore, the matrix element describing the transition is a product of the electron and oscillator matrix elements. The oscillator matrix element depends only on overlapping of the initial and final vibration wave functions and does not depend on the electron transition type. The basic assumptions of the adiabatic approach and the approximate oscillator terms of the nuclear subsystem are considered in the following section. Then, in the subsequent sections, it will be shown that many vibrations take part in the transition due to relative change of the vibration system in the initial and final states. This change is defined by the following factors the displacement of the equilibrium positions in the... 

Thus, knowing the expressions for density matrices of the intermolecular subsystem in the initial + (E, R )] and final pL (,( , )] states as well as the form of the matrix elements, I (E), calculation by Eqn. (54) presents no principal difficulties. 

The process of the transition into the intermediate excited state is described by the matrix element (p, u V a, w), i.e., the matrix element of the Coulomb electron-electron interaction. The evolution of the system in the intermediate state is described by the resolvent Ep - Epi + where Ep = p /2 and Ep/ = p ljl are the kinetic energies of the secondary electron in the final and intermediate states, respectively, and i 7 is a nonzero imaginary addition taking into account effects of decay of the many-electron excited subsystem of the sample. The transition of the secondary electron into the final state is described by the matrix element p tj p ), where tj is the operator of elastic scattering of the secondary electron by the yth neighboring atom. The amplitude of this transition may be presented graphically as a diagram (Fig. 7b). 

Intensity of Emission from the Vaience Band. In principle, the intensity of the electron emission from the valence state of the atom in the first-order process is determined by equations identical to those for the intensity of the emission from the core level [Eq. (23)]. The distinction lies in the matrix elements describing the atomic amplitude of this process. As mentioned above, the electron emission from the valence band may result from both the first- and the second-order processes. If the final state of the system formed as a result of these transitions is the same, these two processes must interfere. This interference is ignored in the present work. Such an approximation is justified by the fact that the final state of the system is determined by the secondary electron and the many-electron subsystem of the sample with a hole in the valence band. Neglect of the interference of the first- and second-order processes corresponds to the assumption that those processes give rise to different final states of the many-electron subsystem of the sample. Moreover, the contribution from the first-order processes of emission from the valence band is neglected in this work. The reason for that approximation is discussed in detail in Section 4. Thus, of all processes forming the spectrum of the secondary electron emission from the valence band of an atom, we shall consider only the second-order process. 

---