Training Functional Safety 06 - Sil Pfd Calculations Rev0.1

FUNCTIONAL SAFETY TRAINING

06 – SIL PFD CALCULATIONS

1Dr. Ing. Carlo LebrunFunctional Safety Training


SIL CLASSIFICATION (IEC61508 & IEC61511)

W3 W2 W1

a = =

SIL1 a =

SIL2 SIL1 a

SIL3 SIL2 SIL1

SIL4 SIL3 SIL2

b SIL4 SIL3

CONSEQUENCE•Ca Minor Injury•Cb Serious injury, single death•Cc Some deaths•Cd Many deaths

FREQUENCY•Fa Rare to frequent•Fb Frequent to continuous

AVOIDANCE•Pa Sometimes possible•Pb Almost impossible

•OCCURRENCE PROBABILITY•W1 Very slight•W2 Slight•W3 Relatively High

a = no requirement / b = single SIS not enough

Ca

Cb

Cc

Cd

FaFb

FaFb

FaFb

PaPb

PaPb

PaPb

PaPb


SIL REDUCTION FACTOR (IEC61508 & IEC61511)

SIL PFD avg LOW DEMAND MODE Risk Reduction Factor PFH

HIGH DEMAND MODE

4 10E-5 <= PFD < 10E-4 10 000 < RRF <= 100 000 10E-9 <= PFH < 10E-8

3 10E-4 <= PFD < 10E-3 1 000 < RRF <= 10 000 10E-8 <= PFH < 10E-7

2 10E-3 <= PFD < 10E-2 100 < RRF <= 1 000 10E-7 <= PFH < 10E-6

1 10E-2 <= PFD < 10E-1 10 < RRF <= 100 10E-6 <= PFH < 10E-5


RELIABILITY OF PROTECTIONS

The compliance with IEC61508/IEC61511 is based on the estimation of the

Probability of Failure on Demand(the average in the system lifecycle)

=

The probability a protection will not work in the moment it is required to work


PROBABILITY OF FAILURE ON DEMAND

UNDETECTABLE FAILURE

DETECTABLE FAILURE

MTTR

time

time

Full functionality

Full functionality

Failure mode

Failure mode

Risk cause

Risk cause

ACCIDENT!

PROTECTION ACTION


LOW DEMAND MODE VERSUS HIGH DEMAND MODE

Low demand modethe frequency of demands for operation made on a safety-related system is no greater than one per year and no greater than twice the proof test frequency.

High demand or continuous modethe frequency of demands for operation made on a safety-related system is greater than one per year or greater than twice the proof test frequency. Continuous is regarded as very high demand.


LOW DEMAND MODE VERSUS HIGH DEMAND MODE

Low demand mode:- HIPPS

High demand or continuous mode:- Car brakes


PFD ASSESSMENT AS PER IEC61508

IEC61508/IEC61511 CONSIDER 3 METHODOLOGIES:

- Simplified equations (in detail in this presentation)

- Fault Tree Analysis (requires dedicated software)

- Markov Models (requires dedicated software)


EXAMPLE OF FAULT TREE


EXAMPLE OF MARKOV MODEL

10 2

EXAMPLE : 1oo2 SYSTEM0 - FULL FUNCTIONALITY1 - 1 ELEMENT IN FAILURE2 - 2 ELEMENTS IN FAILURE

λ 1-λ


SIL COMPATIBILITY ASSESSMENT

SIMPLIFIED EQUATIONS METHOD

1 - SYSTEM DECOMPOSITION

2 - FAILURE DATA COLLECTION

3 - PFD AVERAGE ASSESSMENT

4 - FAULT TOLERANCE ASSESSMENT


PT PT PT

SR

S

IASUPPLY

SIF DECOMPOSITION – STEP 1

POWER SUPPLY


PT PT PT

SR

S

IASUPPLY

SIF DECOMPOSITION – STEP 2

POWER SUPPLY

AI DOCPU

FAIL SAFE ACTION


RELIABILITY DIAGRAM









FAILURE RATE

17Dr. Ing. Carlo LebrunFunctional Safety TrainingFunctional Safety Training 17Dr. Ing. Carlo Lebrun

FAILURES RATE FROM IEC61508 CERTIFICATION


FAILURES RATE FROM OREDA DATA BASE


FAILURES RATE FROM OREDA DATA BASE


FAILURES RATE FROM OTHER SOURCES

1 - CORPORATE FAILURE RATES COLLECTIONS

2 - MILITARY (USA) FAILURE RATES COLLECTIONS

3 - OTHER REFERENCE DATABASE (e.g. EXIDA)

4 - PROJECT SPECIFICATIONS

5 - OTHER REFERENCE NATIONAL STANDARDS (es OLF-70)


input_device_failure_data_conversion_tool.xls









SIMPLIFIED EQUATIONS FOR REDUNDANCY OPTIONS


SELECT RIGHT EQUATION PER EACH COMPONENT


CREATE THE SEQUENCE

COPY & PASTE


THE SUM OF ALL PFDAVG


THE BEST ARCHITECTURE


MTTFspurious

MTTFspurious GIVES INFORMATION ON THE PROBABILITY OF SPURIOUS TRIP: SOME PORTION OF FAILURES MAY PROMOTE THE TRIP WHEN IT IS NOT REALLY REQUIRED.

A PROBLEM: THE RATE OF SPURIOUS FAILURES λspurious IS MOSTLY UNKNOWN.


HOW TO ACHIEVE TARGET SIL

Beta: probability of common cause of dangerous undetectable failure. See dedicated lesson. Some moderate influence is in the hands of designer and end-user.

BetaD: probability of common cause of dangerous detectable failure. See dedicated lesson. Some moderate influence is in the hands of designer and end-user.

MTTR: Mean Time To Restore (… the full functionality). Depends on end-user procedures, tools available for corrective actions (eg valve bypass), and spare parts availability.

T1: time interval for full proof test

Tid (PST): time interval for partial proof test

To achieve the target SIL you need to optimize the choice of right redundancy with the correct selection of variable parameters:


OTHER SOURCES FOR PFDAVG CALCULATION

HIMA SILENCE


OTHER SOURCES FOR PFDAVG CALCULATION

HIMA SILENCE








33Dr. Ing. Carlo LebrunFunctional Safety TrainingFunctional Safety Training 33Dr. Ing. Carlo Lebrun

SFF = (λSD + λSU + λDD) / (λS + λD) =

= 1 – λDU / λ

λS = safe failure rateλD = dangerous failure rateλSD = rate of detectable safe failureλSU = rate of undetectable safe failureλDD = rate of detectable dangerous failure

SAFE FAILURE FRACTION


DEVICE TYPES

DEVICE TYPE A“Non-Complex” component (using discrete elements); for details see 7.4.3.1.2 of IEC 61508-2= mechanical components (poor or no diagnostic)

DEVICE TYPE B“Complex” component (using micro controllers or programmable logic); for details see 7.4.3.1.3 of IEC 61508-2= electronic components (important diagnostic)


FAULT TOLERANCE ANALYSYS – TYPE A DEVICES

SFF 1 FAULT TOLERATED 2 FAULTS TOLERATED 3 FAULTS TOLERATED

< 60% SIL1 SIL2 SIL3

60% <= < 90% SIL2 SIL3 SIL4

90% <= < 90% SIL3 SIL4 SIL4

>= 99% SIL3 SIL4 SIL4


FAULT TOLERANCE ANALYSYS – TYPE B DEVICES

SFF 1 FAULT TOLERATED 2 FAULTS TOLERATED 3 FAULTS TOLERATED

< 60% Not allowed SIL1 SIL2

60% <= < 90% SIL1 SIL2 SIL3

90% <= < 90% SIL2 SIL3 SIL4

>= 99% SIL3 SIL4 SIL4


http://www.ecisgroup.it/

END OF PRESENTATION

Documents

Training Functional Safety 06 - Sil Pfd Calculations Rev0.1