Safe failure

The extent to which faults lead to a safe condition or can be detected by diagnostics so that a specified action can be taken. This capability is termed the safe failure fraction of the device ... 

Instrumentation in safety applications (SIS) utilises vendor information on diagnostics and safe failure fraction (SFF) as well as performance information collected from the applications to calculate the probability of failure on demand (PFD). 

Results of the evaluation typically include a number of safety integrity and availability measurements. Most important, the average probability of failure on demand (PFDavg) and the safe failure fraction (SFF) is calculated for low demand mode. Probability of failure per hour is calculated for high demand mode. From charts, the SIL level that the... 

Safe failure of TXl Safe failure of TX2 Loss of power to transmitter... 

Probability of safe failure for a one-year interval of TXl = 0.02 Probability of safe failure for a one-year interval of TX2 = 0.02 Probability of loss of power for a one-year interval to transmitters = 0.01... 

The failure rate (X) for a pressure transmitter is 1.2 x 10 f/hr. The safe failure mode split is 50%. What is the dangerous failure rate ... 

SOLUTION The diagnostics operate rapidly and complete execution sixty times per expected demand period. The diagnostic test time plus the response time is within the process safety time. Therefore dangerous detected failures will be converted into safe failures. The remaining dangerous failure rate is 0.5 x 10 failures per hour. That meets the requirements for SIL2 per Figure 7-4. 

If these restrictions are met, only one transmitter or valve is needed for a S1L2 SIF to meet this requirement. Alternatively the charts of lEC 61508 may be used for field devices. Given the lack of definition as to what "prior use" really means, the authors prefer to use the tables from lEC 61508 which are more flexible, provide at least the same level of "exception" for products with sufficient design quahty and are clearly justifiable. The disadvantage of these charts is that the safe failure fraction must be calculated for the field devices. 

The use of this chart requires the calculation of a measure called the Safe Failure Fraction (SFF). This chart is completely equivalent to the same chart in lEC 61508. 

Safe Failure Fraction Hardware Fault Tolerance ... 

When considered alone as a component, there are no safe failures within a valve. When addressed with a specific type of actuator, some dangerous modes may convert to safe modes. Due to the flow and pressure within the valve, the dynamic and static loads may be used to assist the actuator during tripping. This needs to be carefully addressed for operation and installation since the direction of flow to achieve these characteristics may not be the typical direction of installation for the valve type. 

ITEM Failure Rate (per hr) (X) % Safe Failure C° (%) PFDavg 1 YEAR TEST INTERVAL (Tl) PFDavg 3 YEAR TEST INTERVAL (Tl) MTTFS (years) TI=3... 

To determine the architectural requirements, the SFF number is calculated. This applies to each SIF subsystem, i.e., sensor, logic solver, and final element. To calculate the Safe Failure Fraction for the pressure switch we must first calculate and. ... 

Component Failure rates (1/hr) Architectural Constraint Type Safe Failure Fraction... 

Component Failure Rate [1/h] MTTF (years) % Safe Failures Safe Coverage Factor (%) Dangerous Coverage Factor (%)... 

Total Safe Failure Rate 88,29 Dang. Coverage... 

The safe coverage factor for the circuit is calculated by taking the total safe detected failure rate and dividing by the total safe failure rate. 

Calculations are also done using matrix math solutions derived from the Markov model. MTTF (Mean Time to any Failure) for a lool configuration is calculated using Equation F-5. The total safe failure rate is 10094 FITS. The total dangerous failure rate is 6068 FITS. The total failure rate is 16162 FITS. Using Equation F-5 ... 

Two controllers can be wired to minimize the effect of dangerous failures. For de-energize-to-trip systems, a series cormection of two output circuits requires that both controllers fail in a dangerous manner for the system to fail dangerously The loo2 configuration typically utilizes two independent main processors with their own independent 1/O (see Figure F-6). The system offers low probability of failure on demand, but it increases the probability of a fail-safe failure. The "false trip" rate is increased in order to improve the ability of the system to shut down the process. 

Figure F-8 shows the PFS fault tree for the loo2 architecture. This shows the tradeoff in the architecture, any safe failure from either unit will cause a false trip.

The equation for loolD MTTF is obtained in a manner similar to the lool. After this process, it is discovered that this equation is identical to Equation B-4. This makes sense. The loolD architecture merely converts dangerous failures to safe failures, it does not provide any fault tolerance. 

The 2oo3 is a symmetrical architecture that successfully tolerates a short circuit or an open circuit failure. It will fail with outputs de-energized only when two failures occur as shown in Figure F-23. The fault tree for safe failures is shown in Figure F-24. It looks like the fault tree for dangerous failures except that the failure modes are different. This is the result of the s unmetrical nature of the architecture. Note that each major event in the top level of the fault tree is equivalent to the 2oo2 fault tree of Figure F-20. 

The 2oo2D architecture shows good tolerance to both "safe" and "dangerous" failures. However, since coverage is utilized to convert dangerous failures into safe failures, this tolerance depends in great part... 

Figure F-32 shows that a loo2D architecture will fail safely if there is a common cause safe failure, a common cause dangerous detected failure, if both units fail in a detected manner or if both units fail in a safe undetected mode.

In state 1 the system has degraded to loolD operation. A second safe failure or a dangerous detected failure will fail the system safely. Like the loolD, a dangerous undetected failure will fail the system dangerously. In... 

In state 3 one imit has failed in a safe undetected manner. In this condition the system has also degraded to loolD operation. Additional safe failures or dangerous detected failures will cause the system to fail safely. An additional dangerous undetected failure will fail the system dangerously taking the Markov model to state 6 where both units have an undetected failure. Failures from this state are not detected until there is a maintenance inspection. 

The required SIL is shown with the relationship between hardware fault tolerance (HWFT) and safe failure fraction (SFF) for two types in Table 4. 

Safe failure fractioD (SFF) Hardware fault tolerance (HFT) ... 

Langeron, Y. et al. 2007. Safe failures impact on Safety Instm-mented Systems. In Aven, T. Vinnem, J. (eds). Risk, reliability, and societal safety 641-648. London Taylor Francis... 

---