Undetectable failure

When initially commissioned all safety devices should be proved to be operating correctly. At intervals, these should be checked to ensure that no undetected failure has taken place. Checks that are necessary include ... 

The utilization of a fail steady - fail safe mode may allow an undetected failure to occur unless additional instrumentation is provided on the ESD system components or unless the system is constantly fully function tested. The prime feature of a full fail close or fail open failure mode is that it will immediately indicate if the component is functioning properly. 

An undetected failure in a system as non-identified hazards during risk analysis, or if insufficient measures are taken, or if an initially well-designed process gradually deviates from its design due to changes or lack of maintenance. 

A set of equipment used in a safety instrumented function is non-redundant (lool). The total dangerous detected failure rate is 0.002 failures per year. The total dangerous undetected failure rate is 0.0005 failures per year. Restore time average is 168 hours. The equipment is inspected and tested every two years with 100% test coverage. What is the PFD What is the PFDavg ... 

Based on the information in this Chapter, what is the expected dangerous undetected failure rate for a generic DP/Pressure transmitter ... 

Dangerous Undetected Failure Rate 0.01 Failures per Billion Hours ... 

The safe undetected failure rate is shown in column 14. This number is calculated by multiplying the failure rate (Column 8) by the failure mode number (Column 12) and one minus the detectability (Column 10). 

Problem A FMEDA shows that the dangerous detected failure rate is 4.84 E-7 failures per hour. The dangerous undetected failure rate is 3.3 E-8 failures per hour. What is the dangerous coverage factor ... 

The loolD architecture has a second diagnostic channel that will deenergize when failures are detected by the diagnostics. Therefore, the only failures that cause system failure with outputs energized are dangerous undetected failures. The fault tree has only one failure group, DU, as... 

The 2oo2D architecture will fail with outputs energized if either unit has a dangerous undetected failure or if the system experiences a dangerous undetected common cause failure. This is shown in the fault tree of Figure F-27. 

This should be compared to Equation B-5 for the loo2 architecture. The loo2D provides better safety performance than the loo2 because only undetected failures are included in the PFD. 

In state 1 the system has degraded to loolD operation. A second safe failure or a dangerous detected failure will fail the system safely. Like the loolD, a dangerous undetected failure will fail the system dangerously. In... 

Figure F-34. One Safe Undetected Failure in 1oo2D Architecture...

One unit has failed with a dangerous undetected failure in state 2. The system is still successful since it will respond to a demand as described... 

In state 3 one imit has failed in a safe undetected manner. In this condition the system has also degraded to loolD operation. Additional safe failures or dangerous detected failures will cause the system to fail safely. An additional dangerous undetected failure will fail the system dangerously taking the Markov model to state 6 where both units have an undetected failure. Failures from this state are not detected until there is a maintenance inspection. 

Xsu failure rate of a safe undetected failure (this failure leads to a safe state and is not detected during diagnosis)... 

Undetected failures For the specific part of the PFD that is caused by an undetected Failure (PFD DU), one can follow that ... 

One gets the overall result by adding both partial results for the detected and undetected failures ... 

A downside which presents itself for Markov approaches is when we are dealing with both detected and undetected failures. This vastly increases the complexity of the transition matrix and the number of... 

Undetectable failure—A postulated failure mode in the FMEA for which there is no failure detection method by which the operator is made aware of the failure. 

NOTE 1 The diagnostic coverage is used to compute the detected (. detected) and undetected failure rates (X.undecied) from the total failure rate (X.,, , ) as follows detected = DC x X,, and X decied = (1-DC) x X ... 

NOTE The following methods may be used to determine the undetected failures that need to be tested examination of fault trees failure mode and effect analysis reliability centred maintenance. 

Device failures can sometimes be detected by online, automatic diagnostics that notify the plant operator that the device has failed so that compensating measures can be implemented. These failures are classified as detected, leading to the identification of dangerous detected (DD) or safe detected (SD) failures. If online diagnostics are not available, the failure may remain undetected until a process demand occurs or the device is proof tested. These undetected failures may be dangerous undetected (DU) or safe undetected (SU). 

Dangerous Undetected Failure Exposure Time = MTDF + MTTR MTDF... 

Danaerous Undetected Failures Are Revealed Only By A Proof Test Or By A Demand, Whichever Comes First, And Then They Are Repaired... 

Where is the dangerous undetected failure rate, Tl is the proof-test interval, and A TI<1. 

Non-PE general requirements Now coming back to the specifics, one needs to note that when a device is designed and developed as per lEC 61508, for safety purposes, it is the responsibility of the manufacturer to specify safety level, capability, and limitation of the device including wetted parts. When these devices interface with process, it is the responsibility of the end-user to ensure that the interface is proper there are no untoward incidents coming from the process such hammering, corrosions, H2 embrittlement, etc. The end-user also needs to prove that there is no undetectable failure in the process. 

When PST is performed at regular intervals, it can be considered as diagnostic test in place of proof test as it helps in improving undetected failure rate, that is, diagnostic coverage (DC) and SFF. 

Certification Both products and processes can receive such a certification. Certification for the former is most common and is issued by an independent agency to show that the appropriate SIL calculations have been performed and analysis has been completed on a product. Self-certification, though not common, is also possible. Such certifications are used to signify that it is compatible for use within a system up to the certified SIL. As discussed earlier, FMEDA is normally used to determine the safe/unsafe and detected/undetected failure modes of a product. FMEDA is useful for calculations of safety failure fraction and PFD. Although not common, full certification of lEC 61508 is also possible for manufacturer s design and quality processes. 

---