Sensor subsystem

Presently, automotive sensors are mostly dedicated solely to a particular system. Future sensors will have to be designed as multiple-use sensors for incorporation into different automotive systems. Each sensor then either has to include a bus controller or will be combined - where possible - with other sensors into an intelligent sensor-subsystem that performs a certain level of information preprocessing, for example, an inertial sensor cluster that delivers vehicle dynamics data to the bus. Particularly in the field of inertial sensors will such sensor subsystems emerge in the future - this trend is already being seen in the emergence of multi-axis inertial sensors. 

TABLE 78.1 The Combination of the Human Sensor Subsystem (Determined by Stimulus Source) and Responder Isolates Unique Subsystems... 

The system of primary interest as presented here is the sensory processor. Processing times associated with the motoric processor involved in the response are substantially less in normal systems. However, it is recommended that a given processor speed capacity be identified not onlyby the sensor subsystem stressed, but also by the responder (e.g., visual shoulder flexor information processor speed). This identifies not only the test scenario employed but also the complete information path. 

The requirements for hardware fault tolerance can apply to individual components or subsystems required to perform a SIF. For example, in the case of a sensor subsystem comprising a number of redundant sensors, the fault tolerance requirement applies to the sensor subsystem in total, not to individual sensors. 

Solution The sensor subsystem consists of one switch. Type A. It has hardware fault tolerance of 0 since one dangerous failure will fail the SIF. The SFF is 40%. According to Figure 7-8. Type A Architecture Requirements lEC 61508, the subsystem qualifies for SIL 1. 

The fault tree for ESD2 is shown in Figure 13-7. ESD2 will fail dangerously if the sensor subsystem OR the logic solver subsystem OR the final element subsystem fails dangerously. 

A fault tree must be constructed for each subsystem in order to solve for PFD of the ESD2 portion of this SIR Starting with the sensor subsystem, the fault tree is shown in Figure 13-8. 

The sensor subsystem will also initiate a trip if either of the pressure transmitters (Gate G12) indicates an overpressure. The individual pressure transmitter failures are represented by Gates G18 and G19. G18 indicates that any dangerous failure of a pressure transmitter, its associated impulse line or the associated input circuit of the safety PLC will cause a gate failure. The PFD can be represented by approximate simplified equations. For Gate G18 ... 

The sensor subsystem. Gate 4, PFD results from an AND of Gate Gil and Gate G12. 

The sensor subsystem contributes an insignificant amount to the PFD of ESD2. That probably represents an opportunity to reduce the quantity of equipment and also reduce the lifecycle cost of manual proof testing. Comparing the failure rates of the switches that indicate closure of the valve to the failure rate of the radio system, it is clear that one of the two switches could easily be eliminated. This will reduce the false trip rate as well as lower capital and lifecycle cost. One could go further, however, by looking at the safety contribution of each of the sensor types. The PFD contribution of the ZS sensor subsystem (Gate Gil) and the PT sensor subsystem (Gate G12) is shown in Table 13-4. 

Given the high PFD of the ZS sensor subsystem, it is likely that the entire subsystem could be eliminated without a significant penalty in overall PFD. This would again reduce the false trip rate and lifecycle cost. Of course, the calculations must be repeated for each proposed design to assure that the changes will not impact safety integrity below the required levels. 

Considering the results of the SIF verification analysis it appears that an alternative design could not only save capital expense but could provide higher safety integrity and a lower false trip rate. The proposal for this design is shown in Figure 13-17. The ZS sensor subsystem is ehrninated and the ESDI subsystem is eliminated. 

Gate 2 represents the entire sensor subsystem. In addition to the Gate 5 results, common cause failures of the two sensors and the safety PLC input circuits are included. Given that the two switches are likely to be similar technology, a common cause beta factor of 5% was chosen. The simplified approximation equation for gate 2, PFD is ... 

The results of this analysis show improvement in the sensor subsystem. The results are shown in Table 15-6. 

Problem A fire sensor subsystem uses four sensors. If any two of the four sensors indicate a fire then an alarm will be sounded. There is a probability that a sensor will fail to indicate a fire for a one year interval of 0.01. What is the probability that the sensor subsystem will fail to indicate a fire ... 

Consider the case of a pressure switch and a process connection for that pressure switch (Figure C-6. Pressure Sensor Subsystem). If the pressure switch has a PFD of 0.005 and the process connection has a PFD of 0.02, the PFD of the system could be modeled with a fault tree OR gate. 

Figure C-7. Pressure Sensor Subsystem Fault Tree...

The architectures modeled in this appendix are the "generic" architectures. Actual commercial implementations may vary. While the architecture concepts are presented with programmable electronic controllers the concepts apply to sensor subsystems and final element subsystems. 

There are two different sensor subsystems namely, the wireless wearable accelerometer subsystem, and instrumented platform. The function of wireless wearable accelerometer subsystem is to measure joint kinematics and instrumented platform to quantify the vertical ground reaction forces of human movement. 

PFDgyg = average probability of failure on demand of a safety function for the E/E/PE safety-related system PFDg = average probability of failure on demand for the sensor subsystem... 

Sensor subsystem Sensor subsystem components may be sensors (e.g., pressure transmitter, temperature transmitter, etc.), barriers, input conditioning circuits, etc. 

---