Unrevealed failures

Example 11-2 assumes that all failures in either the alarm or the shutdown system are immediately obvious to the operator and are fixed in a negligible amount of time. Emergency alarms and shutdown systems are used only when a dangerous situation occurs. It is possible for the equipment to fail without the operator being aware of the situation. This is called an unrevealed failure. Without regular and reliable equipment testing, alarm and emergency systems can fail without notice. Failures that are immediately obvious are called revealed failures. 

For unrevealed failures the failure becomes obvious only after regular inspection. This situation is shown in Figure 11-7. If ru is the average period of unavailability during the inspection interval and if r is the inspection interval, then... 

This is a useful and convenient result. It demonstrates that, on average, for unrevealed failures the process or component is unavailable during a period equal to half the inspection interval. A decrease in the inspection interval is shown to increase the availability of an unrevealed failure. 

Both systems demonstrate unrevealed failures. For the alarm system the failure rate is /t = 0.18 faults/yr. The inspection period is 1/12 = 0.083 yr. The unavailability is computed using Equation 11-25 ... 

Proof testing is executed periodically, and can be implemented using several strategies. The strategy establishes how the tests of the redundant components are scheduled with respect to one another. lEC 61508 (1998-2005) defines proof test as a periodic test performed to detect failures in a safety-related systems so that the system can be restored to an as new" condition or as close as practical to this condition". This standard establishes the need of routine maintenance action in order to detect unrevealed failures, being proof test one of these activities. It thus has an important role in the achievement of safety integrity. 

A bivariate optimum maintenance policy for a system under revealed and unrevealed failures... 

ABSTRACT This article surveys a bivariate maiatenaiice poUcy for a system subject to both revealed and unrevealed failures. It consists of inspections upon reaching ages kT,k = 1,2,... to detect the latter along with imperfect repairs following the first N — 1 failures. In addition a perfect repair restores the system to an as-good-as-new condition after the V failure. Conditions for the existence of an optimum policy (T, V ) are provided. 

Corrective maintenance is carried out after failures and intends to put the system back into function with the minor delay. Nevertheless, failures can occur and sometimes are not instantly detected but require some type of test to be discovered. These are known as unrevealed failures and take place in systems that are not in continuous operation hut alternate operating and idle periods. Safety systems may imdergo failures of this type. If a failure takes place while the system is not operating, it will remain undetected unless we inspect the system during the out-of-work periods. Otherwise the system will not be available when needed. 

Biswas et al. 2003) analyze the availability of a periodically tested system that undergoes a fixed number of imperfect repairs before a perfect repair is carried out. (Badia and Berrade 2006a) and (Badia and Berrade 2006b) study the cost function and analyze the optimum maintenance of a system subject to both revealed and unrevealed failures. In the former case a perfect restoration follows the A unrevealed failure whereas the maintenance policy includes a perfect repair after the A revealed failure in the latter. 

The inspection of the examples in Section 5 shows no decreasing patterns in both the optimiun cost and N as the probability of unrevealed failures, p. 

The Markov Analysis shows the various states and transitions between them. In particular, the significance of unrevealed failures in backup systems is brought to the fore. The various cut sets are ... 

Many modern component manufacturers design and provide test and builnin diagnostic facilities in their devices so that the unrevealed failure modes are insignificant in the expected lifetime. FFowever, a partial test can reveal the reality, especially when the devices are operated beyond their lifetime or there are changes in actual operating conditions (operational constraints). 

Diagnostics for all subsystems are recommended where necessary to detect dangerous unrevealed failures. Procedures should be in place to respond to diagnostic alarms. Diagnostics should be tested during proof testing... 

For revealed failures the MDT consists of the active mean time to repair (MTTR) PLUS any logistic delays (e.g., travel, site access, spares procurement, administration). For unrevealed failures the MDT is related to the proof-test interval (T), PLUS the active MTTR, PLUS any logistic delays. The way in which failure is defined determines, to some extent, what is included in the down time. If the unavailability of a process is confined to failures while production is in progress then outage due to scheduled preventive maintenance is not included in the definition of failure. However, the definition of dormant failures of redundant units affects the overall unavailability (as calculated by the equations in the next Section). 

Unrevealed failures will eventually be revealed by some form of auto test or proof test. Whether manually scheduled or automatically initiated (e.g., auto test using programmable logic) there will be a proof-test interval, T. Tables 5.3 and 5.4 provide the failure rate and unavailability equations for simplex and parallel (redundant) identical subsystems for unrevealed failures having a proof-test interval, T. The M lTK is assumed to be negligible compared with T. 

The mean down time (MDT) of unrevealed failures is a fraction of the proof-test interval (i.e., for random failures, it is half the proof-test interval as far an individual unit is concerned) PLUS the actual MTTR. 

In many cases there is both auto test, whereby a programmable element in the system carries out diagnostic checks to discover unrevealed failures, as well as a manual proof test. In practice, the auto-test will take place at some relatively short interval (e.g. 8 min) and the proof test at a longer interval (e.g., one year). 

PLC typically 2.5 failures per annum - 97% failures revealed - 50% unrevealed failures safe dangerous failure rate of 3.75" lO per annum... 

Relay typically 1.5 failures per annum - 50% failures revealed - 90% unrevealed failures safe - dangerous failure rate of 7.5" per annum. 

HIPS components are subjected to periodic tests to detect unrevealed failures occurring during a pending period and taking into account the policy applied during testing, which is an important element in SIL calculations. 

---