Hima Safety Considerations

Safety considerations Dr.
Josef Brcsk, HIMA Paul Hildebrandt GmbH + Co KG A considerable amount of data is required in order to be able to assess safety systems properly. One of the most important criteria is consideration of the distribution of failures over a systems life cycle. In considering such failures, a basic distinction is made between safe and dangerous failures. Safe failures are further divided into safe detectable, and safe undetectable
failures. Safe failures, whether detected or undetected, are failures that exert no influence on the safe operation of the system. This is not the case with dangerous failures. These failures, when they occur, lead to a hazardous situation in the system which may even, under certain circumstances, seriously endanger human life. These failures are also divided into dangerous detectable, and dangerous undetectable
failures. In the event of dangerous detectable failures, however, the safety system, provided it is appropriately designed, can bring the entire system or plant into a safe state. It is undetectable, dangerous failures that constitute a critical state. No safety system is able to detect such failures when they occur. They may be present in the system until it switches off or, in the worst-case scenario, until it fails dangerously without the user being aware of it. HIMA systems are always developed, produced and certified in accordance with the prevailing national and international standards. One of the most important international standards in this regard is IEC/EN 61508. IEC/EN 61508 covers not only pure arithmetical values, such as PFD and PFH, which provide information about the probability of system failure, but also a systems entire safety life cycle.
by HIMA Paul Hildebrandt GmbH + Co KG
Concept
Definition of entire sphere of application
Hazard and risk analysis

Allocation of safety requirements
Totality of safety requirements
Overall planning:
Planning of overall operation and maintenance Planning of overall safety validation
Planning of overall installation and commissioning
Safetyrelated systems: E/E/PE Realisation (see E/E/PE safety life cycle)
Safety-related systems: other technologies
External risk reduction facilities
Realisation
Realisation
Overall installation and commissioning Back to corresponding phase of entire life cycle
Overall safety validation
Overall operation, maintenance and repair
Overall modification and retrofit
Decommissioning or disposal
Figure 1: Representation of the safety life cycle Consideration of the safety life cycle facilitates a systematic approach to the problems of functional safety. Moreover, the SIL capability each individual safety function must have is also laid down here (Table 1). Table 1: SILs for low and high demand modes of operation Safety integrity level (SIL) 4 3 2 1 Low demand mode of operation (mean probability of failure to perform design function on demand) 10-5 to <10-4 10-4 to <10-3 10-3 to <10-2 10-2 to <10-1 High demand mode of operation (probability of a dangerous failure per hour) 10-9 to <10-8 10-8 to <10-7 10-7 to 10-6 10-6 to <10-5
Specification of the demands on hardware is an important part of IEC/EN 61508. The safety life cycle of the hardware, the architecture requirements as well as type A (whose behaviour in the event of failure is fully known) and type B (whose behaviour in the event of failure is not fully known) subsystems and the corresponding SFF (safe failure fraction) are also defined here.
In order to draw up a specification of the safety function, precise information is required on how the required safety is to be achieved and maintained. Table 2: Type A subsystems and Type B subsystems Type A Hardware failure tolerance
0 failures 1 failure
Safe failure fraction < 60 % 60 % - < 90% 90 % - < 99% 99 %
Type B Hardware failure tolerance

1 failure 2 failures
2 failures 0 failures
SIL 1 SIL 2 SIL 3 SIL 3
Not allowed SIL 1 SIL 2 SIL 3
A safety-related system must be designed in accordance with the safety specification drawn up for it. The hardware architecture requirement has to be matched to the required SIL capability. This safety integrity level is limited by the hardware failure tolerance and the share of non-dangerous errors (Table 2). For example, the equations for the PFD/PFH calculations of different HIMA systems should be given here. In contrast to many other reports currently circulating, these observations are based on the applicable equations in IEC/EN 61508 and relate to a 10-year time period. Many reports are to be found that relate to a time period of half a year and are based on the simplified ISA equations but passed off as the IEC/EN 61508 figures. These calculations do not include common-cause failures or the systems diagnostic coverage capability. This gives rise to sometimes considerable discrepancies in the PFD figures. These consequences are always taken into account in all calculations and certification processes relating to HIMA systems, which consequently conform fully to IEC/EN61508. This report uses various examples of actual values to illustrate the calculation of the safety integrity level of various HIMA systems. First, however, the individual IEC/EN 61508 equations for the various system architectures must be presented in order to make a clear distinction between them and the ISA norm.
Equation for determining PFD of a 1oo1 system:

PFDG ,1oo1 = ( DU + DD ) t CE = D t CE T1 = DU 2 + MTTR ) + DD MTTR
(1)
with
t CE =
DU D
T1 DD MTTR + MTTR ) + 2 D
(2)
Equation for determining PFH of a 1oo1 system:
PFH G ,1oo1 = DU
(3)
Equation for determining PFD of a 1oo2 system:

PFDG ,1oo 2 = 2 ((1 D ) DD + (1 ) DU )2 t CE t GE T1 + D DD MTTR + DU 2 + MTTR
(4)
with
t CE =
DU T1 DD + MTTR ) MTTR + 2 D D DU D
T1 DD 3 + MTTR ) + MTTR D
(5)
t GE =
(6)
Equation for determining the PFH of a 1oo2 system:
PFH G ,1oo 2 = 2 ((1 D ) DD + (1 ) DU ) t CE

2
+ D DD + DU
with
t CE =
(7)
DU D
(8)
Equation for determining the PFD of a 2oo3 system:

PFDG ,2oo 3 = 6 ((1 D ) DD + (1 ) DU )2 t CE t GE T1 + D DD MTTR + DU 2 + MTTR
(9)
with
t CE =
DU D DU D
T1 DD 2 + MTTR ) + MTTR D T1 DD 3 + MTTR ) + MTTR D
(10)
t GE =
(11)
Equation for determining the PFH of a 2oo3 system:

PFH G , 2 oo 3 = 6 ((1 D ) DD + (1 ) DU ) tCE
2
+ D DD + DU
(12)
with
t CE =
DU D
(13)
Two further important indicators for safety-related systems are the SFF (safe failure fraction) and the DC (diagnostic coverage) factor. The SFF can be calculated by means of the following equation:
SFF =
S + DD S + DD + DU
(14)
The DC factor can be determined by means of the following equation:

DC = DD D
(15)
The SFF represents the share of safety-relevant failures and the DC factor the level of diagnostic coverage. The meaning of the individual factors in these equations is as follows:
D D
weighting factor for dangerous, undetected, common-cause failures weighting factor for dangerous, detected, common-cause failures system failure rate due to dangerous failures system failure rate due to dangerous, detected failures
DD
DU
system failure rate due to dangerous, undetected failures MTTR mean time to repair PFDG average probability of failure on low demand PFHG average probability of failure on high demand proof test time T1 average channel-related failure time tCE average system-related failure time tGE
In order to determine the safety integrity of safety-related systems consisting of several individual systems, the mean probability of failure PFDsys or PFHsys is required for the whole system. PFDsys or PFHsys is determined by obtaining and summing the mean probabilities for the individual systems.
PFD sys = PFD S + PFD L + PFD FE
(16) (17)
or
PFH sys = PFH S + PFH L + PFH FE
In order to determine the mean probability for each part of the system, the following information must be available: the basic architecture the diagnosis coverage of each channel the failure rate per hour for each channel the factors and D for common-cause failures
This last list introduces the notion of common-cause failures. The aim here is to detect common-cause failures as early as possible and to bring the system into a safe state. The -factor is introduced as the fraction of common-cause failures to normal (single) failures.
In the following, various system architectures are presented and the PFD/PFH values for the individual systems established. The following parameters should be identical for all systems D = common-cause factor for detectable failures = common-cause factor for undetectable failures T1 = maintenance interval MTTR = mean time to repair And have the following values D = 1% = 2% T1 = 10 years MTTR = 8 hours
The following individual systems are used in various configurations in the example calculations:
Module lambda_b in [1/h] MTTF in [years] Proof-check interval T1 in [years] MTTR in [h] D PFD1oo1 in [1] PFH1oo1 in [1/h] PFD1oo2/2oo3 in [1] * PFH1oo2/2oo3 in [1/h] *
) )
Pressure sensor
Temp. sensor
DI: F 3236
DI: F 3238
AI: F 6214
AI: F6217
V-BG: F 7553
CPU: F 8650E
DO: F 3330
DO: F 3334
AO: F 6705
Actuator: valve
7,43E-07 1,09E-06 1,11E-06 1,11E-06 5,60E-07 2,08E-06 8,17E-07 6,21E-07 9,45E-07 153,66 104,60 102,80 103,17 203,99 54,79 139,78 183,91 120,79
10
10
10
10
10
10
10
10
10
10
10
10
8 0,01 0,02
8 0,01 0,02
8 0,01 0,02
8 0,01 0,02
8 0,01 0,02
8 0,01 0,02
8 0,01 0,02
8 0,01 0,02
8 0,01 0,02
8 0,01 0,02
8 0,01 0,02
8 0,01 0,02
9,79E-06 2,38E-05 5,12E-05 2,87E-05 9,78E-06 2,94E-05 8,18E-06 1,40E-05 1,86E-05 2,05E-10 5,14E-10 1,11E-09 9,64E-10 5,76E-10 4,08E-09 6,58E-10 6,87E-10 6,17E-10 1,00E-04 1,56E-04 2,22E-08 3,47E-08 3 3 3 3 3 3 3 3 3 3,33E-05 7,40E-09
TV claimed SIL
For all the following architectures, the following two points should always apply: sensors in 2oo3 architecture actuators in 1oo2 architecture
The following systems are to be investigated: System 1 (Digital Loop 1)
Pressure sensor (2oo3)
DI F 3238 V-BG F 7553 CPU F 8650E DO F 3334 Actuator: Valve (1oo2)
Temperature sensor (2oo3)
DI F 3238
Architecture
PFD-IEC in [1]
PFH-IEC in [1/h]
SIL, PFD-IEC
SIL, PFH-IEC
Pressure sensor Temp. sensor DI: F 3238 V-BG: F 7553 CPU: F 8650E DO: F 3334 Actuator: valve System without sensor or actuator System with sensor and actuator TV claimed SIL for system without sensor and actuator
2oo3 2oo3 1oo2 1oo1 1oo1 1oo1 1oo2
1.00E-04 1.56E-04 4.63E-07 9.78E-06 2.94E-05 1.40E-05 3.33E-05
2.22E-08 3.47E-08 1.55E-09 5.76E-10 4.08E-09 6.87E-10 7.40E-09
3 3 4 4 3 4 4
3 3 3 4 3 4 3
5.36E-05 3.43E-04
6.90E-09 7.12E-08
4 3
4 3
System 2 (Digital Loop 2)
DI F 3238 V-BG F 7553
CPU F 8650E DO F 3334 CPU F 8650E Actuator: valve (1oo2)
DI F 3238
Architecture Pressure sensor Temp. sensor DI: F 3238 V-BG: F 7553 CPU: F 8650E DO: F 3334 Actuator: valve System without sensor or actuator System with sensor and actuator TV claimed SIL for system without sensor or actuator 2oo3 2oo3 1oo2 1oo1 1oo2 1oo1 1oo2
PFD-IEC in [1] 1.00E-04 1.56E-04 4.63E-07 9.78E-06 3.08E-06 1.40E-05 3.33E-05
PFH-IEC in [1/h] 2.22E-08 3.47E-08 1.55E-09 5.76E-10 7.24E-09 6.87E-10 7.40E-09
SIL, PFD-IEC 3 3 4 4 4 4 4
SIL, PFH-IEC 3 3 3 4 3 4 3
2.73E-05 3.17E-04
1.01E-08 7.43E-08
4 3
3 3
10
DI F 3238
DO F 3334 V-BG F 7553 CPU F 8650E DO F 3334 Actuator: valve (1oo2)
DI F 3238 Temperature sensor (2oo3)
DI F 3238
SIL, PFD-IEC 3 3 4 4 3 4 4
SIL, PFH-IEC 3 3 3 4 3 4 3
4.03E-05 3.30E-04
7.52E-09 7.18E-08
4 3
4 3
11
DI F 3238
CPU F 8650E V-BG F 7553 CPU F 8650E
DO F 3334 Actuator: valve (1oo2) DO F 3334
DI F 3238 Temperature sensor (2oo3)
DI F 3238
SIL, PFD-IEC 3 3 4 4 4 4 4
SIL, PFH-IEC 3 3 3 4 3 4 3
1.39E-05 3.03E-04
1.07E-08 7.50E-08
4 3
3 3
12
System 5 (Analog-Digital Loop 1)
AI F 6214 V-BG F 7553 CPU F 8650E DO F 3334 Actuator: valve (1oo2)
AI F 6214
Architecture Pressure sensor Temp. sensor AI: F 6214 V-BG: F 7553 CPU: F 8650E DO: F 3334 Actuator: valve System without sensor or actuator System with sensor and actuator TV claimed SIL for system without sensor or actuator 2oo3 2oo3 1oo2 1oo1 1oo1 1oo1 1oo2
SIL, PFD-IEC 3 3 4 4 3 4 4
SIL, PFH-IEC 3 3 3 4 3 4 3
5.42E-05 3.43E-04
8.78E-09 7.31E-08
4 3
4 3
13
AI F 6214 V-BG F 7553
CPU F 8650E DO F 3334 CPU F 8650E Actuator: valve (1oo2)
AI F 6214
SIL, PFD-IEC 3 3 4 4 4 4 4
SIL, PFH-IEC 3 3 3 4 3 4 3
2.79E-05 3.17E-04
1.19E-08 7.62E-08
4 3
3 3
14
AI F 6214
DO F 3334 V-BG F 7553 CPU F 8650E DO F 3334 Actuator: valve (1oo2)
AI F 6214 Temperature sensor (2oo3)
AI F 6214
SIL, PFD-IEC 3 3 4 4 3 4 4
SIL, PFH-IEC 3 3 3 4 3 4 3
4.08E-05 3.30E-04
9.45E-09 7.37E-08
4 3
4 3
15
AI F 6214
DO F 3334 Actuator: valve (1oo2) DO F 3334
AI F 6214
SIL, PFD-IEC 3 3 4 4 4 4 4
SIL, PFH-IEC 3 3 3 4 3 4 3
1.45E-05 3.04E-04
1.26E-08 7.69E-08
4 3
3 3
16
System 9 (Analog Loop 1)
AI F 6214 V-BG F 7553 CPU F 8650E AO F 6705 Actuator: valve (1oo2)
AI F 6214
Architecture Pressure sensor Temp. sensor AI: F 6214 V-BG: F 7553 CPU: F 8650E AO: F 6705 Actuator: valve System without sensor or actuator System with sensor and actuator TV claimed SIL for system without sensor or actuator 2oo3 2oo3 1oo2 1oo1 1oo1 1oo1 1oo2
SIL, PFD-IEC 3 3 4 4 3 3 4
SIL, PFH-IEC 3 3 3 4 3 4 3
5.88E-05 3.48E-04
8.71E-09 7.30E-08
4 3
4 3
17
AI F 6214 V-BG F 7553
CPU F 8650E AO F 6705 CPU F 8650E Actuator: valve (1oo2)
AI F 6214
Architecture Pressure sensor Temp. sensor AI: F 6214 V-BG: F 7553 CPU: F 8650E AO: F 6705 Actuator: valve System without sensor or actuator System with sensor and actuator TV claimed SIL for system without system or actuator 2oo3 2oo3 1oo2 1oo1 1oo2 1oo1 1oo2
SIL, PFD-IEC 3 3 4 4 4 3 4
SIL, PFH-IEC 3 3 3 4 3 4 3
3.25E-05 3.22E-04
1.19E-08 7.62E-08
4 3
3 3
18
AI F 6214
AO F 6705 V-BG F 7553 CPU F 8650E AO F 6705 Actuator: valve (1oo2)
AI F 6214
SIL, PFD-IEC 3 3 4 4 3 4 4
SIL, PFH-IEC 3 3 3 4 3 3 3
4.06E-05 3.30E-04
1.04E-08 7.47E-08
4 3
3 3
19
AI F 6214
AO F 6705 Actuator: valve (1oo2) AO F 6705
AI F 6214
SIL, PFD-IEC 3 3 4 4 4 4 4
SIL, PFH-IEC 3 3 3 4 3 3 3
1.43E-05 3.04E-04
1.36E-08 7.79E-08
4 3
3 3
20
Bibliography [1] IEC/EN 61508: International Standard 61508 Functional Safety: SafetyRelated System. Geneva, International Electrotechnical Commission [2] Brcsk, J.: IEC/EN 61508- eine Norm fr viele Flle, atp 44, 2002 Oldenbourg-Verlag [3] Brcsk, J.: Konzepte zur methodischen Untersuchung von Hardwarearchitekturen in sicherheitsgerichteten Anwendungen, erscheint im VDE Verlag 2003 [4] Brcsk, J.: Sicherheits-Rechnerarchitekturen Teil 1 und 2, Vorlesung Universitt Kassel 2000/2001 [6] DIN VDE 0801: Funktionale Sicherheit sicherheitsbezogener elektrischer/elektronischer/programmierbarer elektronischer Systeme (E/E/PES), (IEC 65A/255/CDV:1998), S. 27f, August 1998. [7] DIN V 19250: Grundlegende Sicherheitsbetrachtungen fr MSRSchutzeinrichtungen. Beuth Verlag Berlin 1998 [8] DIN VDE 0801/A1: Grundstze fr Rechner in Systemen mit Sicherheitsaufgaben. Beuth Verlag [9] IEC 60880-2: Software fr Rechner mit sicherheitskritischer Bedeutung. 12/2001
21

Hima Safety Considerations

Uploaded by

Copyright:

Available Formats

Hima Safety Considerations

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Hima Safety Considerations

Uploaded by

Copyright:

Available Formats

Safety considerations Dr.

by HIMA Paul Hildebrandt GmbH + Co KG

Definition of entire sphere of application

Hazard and risk analysis

Totality of safety requirements

Planning of overall installation and commissioning

Safetyrelated systems: E/E/PE Realisation (see E/E/PE safety life cycle)

Safety-related systems: other technologies

External risk reduction facilities

Overall safety validation

Overall operation, maintenance and repair

Overall modification and retrofit

by HIMA Paul Hildebrandt GmbH + Co KG

Safe failure fraction < 60 % 60 % - < 90% 90 % - < 99% 99 %

Type B Hardware failure tolerance

SIL 1 SIL 2 SIL 3 SIL 3

SIL 2 SIL 3 SIL 4 SIL 4

SIL 3 SIL 4 SIL 4 SIL 4

Not allowed SIL 1 SIL 2 SIL 3

SIL 1 SIL 2 SIL 3 SIL 4

SIL 2 SIL 3 SIL 4 SIL 4

by HIMA Paul Hildebrandt GmbH + Co KG

Equation for determining PFD of a 1oo1 system:

Equation for determining PFH of a 1oo1 system:

Equation for determining PFD of a 1oo2 system:

Equation for determining the PFH of a 1oo2 system:

PFH G ,1oo 2 = 2 ((1 D ) DD + (1 ) DU ) t CE

by HIMA Paul Hildebrandt GmbH + Co KG

Equation for determining the PFD of a 2oo3 system:

T1 DD 2 + MTTR ) + MTTR D T1 DD 3 + MTTR ) + MTTR D

Equation for determining the PFH of a 2oo3 system:

The DC factor can be determined by means of the following equation:

by HIMA Paul Hildebrandt GmbH + Co KG

PFD sys = PFD S + PFD L + PFD FE

PFH sys = PFH S + PFH L + PFH FE

by HIMA Paul Hildebrandt GmbH + Co KG

by HIMA Paul Hildebrandt GmbH + Co KG

by HIMA Paul Hildebrandt GmbH + Co KG

The following systems are to be investigated: System 1 (Digital Loop 1)

Pressure sensor (2oo3)

DI F 3238 V-BG F 7553 CPU F 8650E DO F 3334 Actuator: Valve (1oo2)

Temperature sensor (2oo3)

2oo3 2oo3 1oo2 1oo1 1oo1 1oo1 1oo2

1.00E-04 1.56E-04 4.63E-07 9.78E-06 2.94E-05 1.40E-05 3.33E-05

2.22E-08 3.47E-08 1.55E-09 5.76E-10 4.08E-09 6.87E-10 7.40E-09

by HIMA Paul Hildebrandt GmbH + Co KG

System 2 (Digital Loop 2)

Pressure sensor (2oo3)

DI F 3238 V-BG F 7553

CPU F 8650E DO F 3334 CPU F 8650E Actuator: valve (1oo2)

Temperature sensor (2oo3)

PFD-IEC in [1] 1.00E-04 1.56E-04 4.63E-07 9.78E-06 3.08E-06 1.40E-05 3.33E-05

PFH-IEC in [1/h] 2.22E-08 3.47E-08 1.55E-09 5.76E-10 7.24E-09 6.87E-10 7.40E-09

by HIMA Paul Hildebrandt GmbH + Co KG

System 3 (Digital Loop 3)

Pressure sensor (2oo3)

DO F 3334 V-BG F 7553 CPU F 8650E DO F 3334 Actuator: valve (1oo2)

DI F 3238 Temperature sensor (2oo3)

PFD-IEC in [1] 1.00E-04 1.56E-04 4.65E-07 9.78E-06 2.94E-05 6.09E-07 3.33E-05

PFH-IEC in [1/h] 2.22E-08 3.47E-08 1.57E-09 5.76E-10 4.08E-09 1.29E-09 7.40E-09