Hardware fault tolerance

The requirements for hardware fault tolerance can apply to individual components or subsystems required to perform a SIF. For example, in the case of a sensor subsystem comprising a number of redundant sensors, the fault tolerance requirement applies to the sensor subsystem in total, not to individual sensors. 

This subclause allows the hardware fault tolerance of all subsystems except PE logic solvers to be reduced by one on certain conditions. These conditions will apply to devices such as valves or smart transmitters and reduce the likelihood of systematic failures such that the requirements are aligned to the requirements of lEC 61508-2 for non PE devices. 

The 3051S SIS can be used in safety instrumented functions up to SIL2 with a single instrument and SIL3 with hardware fault tolerance of 1. No special installation is required. Follow standard installation practices as outlined in this document. 

Problem A set of non-redundant (hardware fault tolerance = 0) safety equipment is used to perform a safety instrumented function in continuous demand mode. Diagnostic time is given as one second. The following failure rate data is obtained when adding the failure rates of the categories of all components ... 

ANSl/lSA-84.00.01-2004 (lEC 61511 Mod) has a requirement for nainimum levels of "hardware fault tolerance" as a function of SIL level. This means that redundancy for purposes of achieving the safety function must be done depending on the SIL level target of the SIF. For field instruments and non-programmable logic solvers, the chart is shown in Figure 7-6. 

Figure 7-6. lEC 61511 Minimum Hardware Fault Tolerance for Field Devices... 

For Type A components, the minimum hardware fault tolerance chart per lEC 61508 is shown in Figure 7-8. 

Safe Failure Fraction Hardware Fault Tolerance ... 

Solution The sensor subsystem consists of one switch. Type A. It has hardware fault tolerance of 0 since one dangerous failure will fail the SIF. The SFF is 40%. According to Figure 7-8. Type A Architecture Requirements lEC 61508, the subsystem qualifies for SIL 1. 

Sometimes the hardware fault tolerance is confused with redimdancy. They are not necessarily the same thing. Sometimes redundant instruments are used to maintain process operation, not to perform the safety function. In those cases, redundancy is not the same as hardware... 

Problem Two smart transmitters have been chosen for a SIF design. The logic solver is programmed to trip if either transmitter indicates a dangerous condition (1oo2). The manufacturer s data sheet lists the SFF as 78.4%. To what SIL level is this design qualified per lEC 61508 hardware fault tolerance... 

Solution The design has a hardware fault tolerance of 1 since one instrument can fail and the SIF can still perform the safety function. The SFF is between 60% and 90%, therefore the design qualifies for SIL 2. 

It can be seen by comparison that if a Type B field component has a SFF of 92% and a hardware fault tolerance of 0, then it meets SIL 2 per Figure 7-8. Using Figure 7-6, the conclusion would be SIL 1 unless a "prior use" justification is documented. 

A 2oo3 architecture has what level of hardware fault tolerance 7-7. A loo2D architecture has what level of hardware fault tolerance ... 

The 3051S SIS has a 61508 assessment certificate states that the product can be used in SIL 2 applications as a single transmitter and SIL 3 applications if more than one transmitter is used in an identical redundant (hardware fault tolerance > 0) architecture. This helps point out the differences between random and systematic failures. The design process used to create the transmitter and its software met the more rigorous criteria of SIL 3. The chance of a systematic fault is lower. 

The Hardware Fault Tolerance (HFT) is 0. This is a Type A device. Therefore, from Figure 7-8, the allowed SIL level can be obtained. In this case it is SILl. The same process is used for the logic solver and final element. All are Type A devices. The results are summarized in Table 12-2. 

Based on the requirements of lEC 61508, the above system satisfies the minimum hardware fault tolerance for SIL 1. 

Since the PFDavg requirements have not been met, it is likely that the architecture or technology used may have to be changed. It is therefore of no value at this point to investigate whether the hardware fault tolerance... 

The required SIL is shown with the relationship between hardware fault tolerance (HWFT) and safe failure fraction (SFF) for two types in Table 4. 

For example, if a pressure transmitter configuration of HIPPS has 2 oo3 architecture, then the safety function can be kept although one dangerous hardware failure occur. According to lEC standard, the hardware fault tolerance of the pressure transmitters is defined as 1. 

Safe failure fractioD (SFF) Hardware fault tolerance (HFT) ... 

Hardware fault tolerance Systems must have a certain level of resilience to random hardware faults, depending on the SIL specification. This may be achieved using a combination of redundant components and sub-systems, frequent manual testing and repair and computer-automated testing ( diagnostics ). 

The subsystems architectural constraints, SILCL, is determined by use of Table 5 in lEC 62061. The SFF and hardware fault tolerance gives the claimed SIL level in the table, also a use of two parallel (N=l) connected systems/elements gives a one step increase of the single component SILCL level. 

Safe failure fiactlon Hardware fault tolerance (see Note 1) ... 

NOTE 1 Hardware fault tolerance is the ability of a component or subsystem to continue to be able to undertake the required safety instrumented function in the presence of one or more dangerous faults in hardware. A hardware fault tolerance of 1 means that there are, for example, two devices and the architecture is such that the dangerous failure of one of the two components or subsystems does not prevent the safety action from occurring. 

NOTE 2 The minimum hardware fault tolerance has been defined to alleviate potential shortcomings in SIF design that may result due to the number of assumptions made in the design of the SIF, along with uncertainty in the failure rate of components or subsystems used in various process applications. 

NOTE 3 It is important to note that the hardware fault tolerance requirements represent the minimum component or subsystem redundancy. Depending on the application, component failure rate and proof-testing interval, additional redundancy may be required to satisfy the SIL of the SIF according to 11.9. 

For PE logic solvers, the minimum hardware fault tolerance shall be as shown in Table 5. 

Table 5 - Minimum hardware fault tolerance of PE logic solvers...

For all subsystems (for example, sensors, final elements and non-PE logic solvers) except PE logic solvers the minimum hardware fault tolerance shall be as shown in Table 6 provided that the dominant failure mode is to the safe state or dangerous failures are detected (see 11.3), otherwise the fault tolerance shall be increased by one. 

---