Failure Modes, Effects and Diagnostic Analysis

Size: px
Start display at page:

Download "Failure Modes, Effects and Diagnostic Analysis"

Transcription

1 Failure Modes, Effects and Diagnostic Analysis Project: Variable area flow meter RAMC Customer: Rota Yokogawa GmbH & Co. KG Wehr Germany Contract No.: Rota Yokogawa 05/04-20 Report No.: Rota Yokogawa 05/04-20 R001 Version V1, Revision R1.0, November 2005 Stephan Aschenbrenner The document was prepared using best effort. The authors make no warranty of any kind and shall not be liable in any event for incidental or consequential damages in connection with the application of the document. All rights on the format of this technical report reserved.

2 Management summary This report summarizes the results of the hardware assessment carried out on the variable area flow meter RAMC. Table 1 gives an overview of the considered versions of the variable area flow meter RAMC. The hardware assessment consists of a Failure Modes, Effects and Diagnostics Analysis (FMEDA). A FMEDA is one of the steps taken to achieve functional safety assessment of a device per IEC From the FMEDA, failure rates are determined and consequently the Safe Failure Fraction (SFF) is calculated for the device. For full assessment purposes all requirements of IEC must be considered. Table 1: Version overview Version Description [V1] RAMC with inductive limit switches [V2] RAMC with ma output; software version F2.30 (without HART) and F3.00 (HART) For safety applications only the above described outputs were considered. All other possible output variants or electronics are not covered by this report. The local indicator is not part of the considered safety function. The failure rates used in this analysis are the basic failure rates from the Siemens standard SN Rota Yokogawa and exida together did a quantitative analysis of the mechanical parts of the variable area flow meter RAMC to calculate the mechanical failure rates using different failure rate databases ([N5], [N6], [N7] and exida s experienced-based data compilation) for the different mechanical components (see [R1] and [R2]). The results of the quantitative analysis are included in the calculations described in section 5.1 and 5.2. According to table 2 of IEC the average PFD for systems operating in low demand mode has to be 10-2 to < 10-1 for SIL 1 safety functions and 10-3 to < 10-2 for SIL 2 safety functions. However, as the modules under consideration are only one part of an entire safety function they should not claim more than 35% of this range, i.e. they should be better than or equal to 3,50E-02 for SIL 1 or 3,50E-03 for SIL 2 respectively. The variable area flow meter RAMC with inductive limit switches is considered to be a Type A 1 component with a hardware fault tolerance of 0 ([V1]). For Type A components the SFF has to be 60% to < 90% according to table 2 of IEC for SIL 2 (sub-) systems with a hardware fault tolerance of 0. The variable area flow meter RAMC with ma output is considered to be a Type B 2 component with a hardware fault tolerance of 0 ([V2]). Type B components with a SFF of 60% to < 90% must have a hardware fault tolerance of 1 according to table 3 of IEC for SIL 2 (sub-) systems. The following tables show how the above stated requirements are fulfilled based on the different applications. 1 Type A component: Non-complex component (all failure modes are well defined); for details see of IEC Type B component: Complex component (using micro controllers or programmable logic); for details see of IEC Stephan Aschenbrenner Page 2 of 4

3 Table 2: Summary for RAMC with inductive limit switches Failure rates λ sd λ su 3 λ dd λ du SFF DC S 4 DC D 4 0 FIT 101 FIT 10 FIT 56 FIT 66% 0% 15% Table 3: Summary for RAMC with inductive limit switches PFD AVG values T[Proof] = 1 year T[Proof] = 5 years T[Proof] = 10 years PFD AVG = 2,46E-04 PFD AVG = 1,23E-03 PFD AVG = 2,45E-03 The boxes marked in green ( ) mean that the calculated PFD AVG values are within the allowed range for SIL 2 according to table 2 of IEC and do fulfill the requirement to not claim more than 35% of this range, i.e. to be better than or equal to 3,50E-03. Because the Safe Failure Fraction (SFF) is above 60%, also the architectural constraints requirements of table 2 of IEC for Type A subsystems with a Hardware Fault Tolerance (HFT) of 0 are fulfilled. Table 4: Summary for RAMC with ma output Failure rates Failure category Failure rates (in FIT) Fail Dangerous Detected 234 Fail detected (internal diagnostics or indirectly 5 ) 167 Fail low (detected by the logic solver) 13 Fail High (detected by the logic solver) 54 Fail Dangerous Undetected 187 No Effect 59 Annunciation Undetected 1 Not part 84 Table 5: Summary for RAMC with ma output IEC failure rates λ sd λ 3 su λ dd λ du SFF DC 4 S DC 4 D 0 FIT 60 FIT 234 FIT 187 FIT 61% 0% 55% Table 6: Summary for RAMC with ma output PFD AVG values T[Proof] = 1 year T[Proof] = 5 years T[Proof] = 10 years PFD AVG = 8,17E-04 PFD AVG = 4,08E-03 PFD AVG = 8,13E-03 3 Note that the SU category includes failures that do not cause a spurious trip 4 DC means the diagnostic coverage (safe or dangerous). 5 indirectly means that these failure are not necessarily detected by diagnostics but lead to either fail low or fail high failures depending on the device setting and are therefore detectable. Stephan Aschenbrenner Page 3 of 4

4 The boxes marked in green ( ) mean that the calculated PFD AVG values are within the allowed range for SIL 1 according to table 2 of IEC and do fulfill the requirement to not claim more than 35% of this range, i.e. to be better than or equal to 3,50E-02. Because the Safe Failure Fraction (SFF) is above 60%, also the architectural constraints requirements of table 3 of IEC for Type B subsystems with a Hardware Fault Tolerance (HFT) of 0 are fulfilled. The failure rates listed above do not include failures resulting from incorrect use of the variable area flow meter RAMC, in particular humidity entering through incompletely closed housings or inadequate cable feeding through the inlets. The listed failure rates are valid for operating stress conditions typical of an industrial field environment similar to IEC class C (sheltered location) with an average temperature over a long period of time of 40ºC. For a higher average temperature of 60 C, the failure rates should be multiplied with an experience based factor of 2,5. A similar multiplier should be used if frequent temperature fluctuation must be assumed. A user of the variable area flow meter RAMC can utilize these failure rates in a probabilistic model of a safety instrumented function (SIF) to determine suitability in part for safety instrumented system (SIS) usage in a particular safety integrity level (SIL). A full table of failure rates is presented in sections 5.1 and 5.2 along with all assumptions. It is important to realize that the no effect failures are included in the safe undetected failure category according to IEC Note that these failures on its own will not affect system reliability or safety, and should not be included in spurious trip calculations. The failure rates are valid for the useful life of the variable area flow meter RAMC, which is estimated to be between 8 to 12 years (see Appendix 2). Stephan Aschenbrenner Page 4 of 4

5 Table of Contents Management summary Purpose and Scope Project management exida.com Roles of the parties involved Standards / Literature used Reference documents Documentation provided by the customer Documentation generated by exida.com Description of the analyzed module Principle of measurement Principle of operation Failure Modes, Effects, and Diagnostic Analysis Description of the failure categories Methodology FMEDA, Failure rates FMEDA Failure rates Assumptions Results of the assessment Variable area flow meter RAMC with inductive limit switches Variable area flow meter RAMC with ma output Terms and Definitions Status of the document Liability Releases Release Signatures...21 Appendix 1: Possibilities to reveal dangerous undetected faults during the proof test..22 Appendix 1.1: Possible proof tests to detect dangerous undetected faults...24 Appendix 2: Impact of lifetime of critical components on the failure rate...26 Stephan Aschenbrenner Page 5 of 26

6 1 Purpose and Scope Generally three options exist when doing an assessment of sensors, interfaces and/or final elements. Option 1: Hardware assessment according to IEC Option 1 is a hardware assessment by exida.com according to the relevant functional safety standard(s) like DIN V VDE 0801, IEC or EN The hardware assessment consists of a FMEDA to determine the fault behavior and the failure rates of the device, which are then used to calculate the Safe Failure Fraction (SFF) and the average Probability of Failure on Demand (PFD AVG ). This option for pre-existing hardware devices shall provide the safety instrumentation engineer with the required failure data as per IEC / IEC and does not include an assessment of the software development process Option 2: Hardware assessment with proven-in-use consideration according to IEC / IEC Option 2 is an assessment by exida.com according to the relevant functional safety standard(s) like DIN V VDE 0801, IEC or EN The hardware assessment consists of a FMEDA to determine the fault behavior and the failure rates of the device, which are then used to calculate the Safe Failure Fraction (SFF) and the average Probability of Failure on Demand (PFD AVG ). In addition this option consists of an assessment of the proven-in-use documentation of the device and its software including the modification process. This option for pre-existing programmable electronic devices shall provide the safety instrumentation engineer with the required failure data as per IEC / IEC and justify the reduced fault tolerance requirements of IEC for sensors, final elements and other PE field devices. Option 3: Full assessment according to IEC Option 3 is a full assessment by exida.com according to the relevant application standard(s) like IEC or EN 298 and the necessary functional safety standard(s) like DIN V VDE 0801, IEC or EN The full assessment extends option 1 by an assessment of all fault avoidance and fault control measures during hardware and software development. This option is most suitable for newly developed software based field devices and programmable controllers to demonstrate full compliance with IEC to the end-user. This assessment shall be done according to option 1. This document shall describe the results of the hardware assessment carried out on the variable area flow meter RAMC with software version F2.30 (without HART) and F3.00 (HART) for [V2]. It shall be assessed whether the described variable area flow meter RAMC meets the average Probability of Failure on Demand (PFD AVG ) requirements and the architectural constraints for SIL 1 / SIL 2 sub-systems according to IEC It does not consider any calculations necessary for proving intrinsic safety. Stephan Aschenbrenner Page 6 of 26

7 2 Project management 2.1 exida.com exida.com is one of the world s leading knowledge companies specializing in automation system safety and availability with over 150 years of cumulative experience in functional safety. Founded by several of the world s top reliability and safety experts from assessment organizations like TUV and manufacturers, exida.com is a partnership with offices around the world. exida.com offers training, coaching, project oriented consulting services, internet based safety engineering tools, detail product assurance and certification analysis and a collection of on-line safety and reliability resources. exida.com maintains a comprehensive failure rate and failure mode database on process equipment. 2.2 Roles of the parties involved Rota Yokogawa GmbH & Co. KG Manufacturer of the considered variable area flow meter RAMC. exida.com Performed the hardware assessment according to option 1 (see section 1). Rota Yokogawa GmbH & Co. KG contracted exida.com in July 2005 with the FMEDA and PFD AVG calculation of the above mentioned device. 2.3 Standards / Literature used The services delivered by exida.com were performed based on the following standards / literature. [N1] IEC :2000 Functional Safety of Electrical/Electronic/Programmable Electronic Safety-Related Systems [N2] ISBN: John Wiley & Sons Electronic Components: Selection and Application Guidelines by Victor Meeldijk [N3] FMD-91, RAC 1991 Failure Mode / Mechanism Distributions [N4] FMD-97, RAC 1997 Failure Mode / Mechanism Distributions [N5] NPRD-95, RAC Non-electronic Parts Reliability Data 1995 [N6] SN Failure rates of components [N7] NSWC-98/LE1 Handbook of Reliability Prediction Procedures for Mechanical Equipment Stephan Aschenbrenner Page 7 of 26

8 2.4 Reference documents Documentation provided by the customer [D1] IM 01R01B02_00E_E_ed7_low_res.pdf Instruction manual Model RAMC Short Stroke ROTAMETER IM 01R01B02-00E-E 7 th edition, September 2005 [D2] GS_RAMC_Eng_ed12.pdf General specifications Model RAMC Short Stroke ROTAMETER GS 01R01B02-00E-E 12 th edition, October 2004 [D3] Anzeigeteil RAMC.pdf Diagram RAMC indicator T90 opt.k index d of [D4] Gehäuse WT-MAG.pdf Diagram WT-MAG housing for Typ 90,66, index d of [D5] Messrohr RAMC.pdf Diagram RAMC cone with ASME flanges index a of [D6] _test.004.jpg RAMC housing [D7] Stromlaufplan WT-MAG + HART Platine ST4.pdf Circuit diagram WT-MAG + HART Platine ST /DSN index A of [D8] Stromlaufplan WT-MAG Display (rundes Gehäuse).pdf [D9] Stromlaufplan WT-MAG Kalibrier- EEPROM.pdf [D10] Stromlaufplan WT-MAG mit HART Basisleiterplatte.pdf [D11] FMEDA SWK Blocking detection.xls of [D12] Versuch 352.xls of Documentation generated by exida.com Circuit diagram WT-MAG + DISPLAY (rundes Gehaeuse) /DSN index A of Circuit diagram WT-MAG KALIBRIER-EEPROM /DSN index A of Circuit diagram WT-MAG mit HART BASISLEITERPLATTE /DSN index C1 of Analysis of the diagnostic float blocking detection Practical tests for the diagnostic coverage of the diagnostic float blocking detection [R1] FMEDA V7 mechanical components V1R4 without inductive sensors.xls of [R2] FMEDA V7 mechanical components without FMD V1R4.xls of [R3] FMEDA V7 4-20mA output with mechanic V1R4.xls of Stephan Aschenbrenner Page 8 of 26

9 3 Description of the analyzed module 3.1 Principle of measurement The RAMC is a Variable Area Flow Meter for volume flow and mass flow measurements of gases and liquids. A float, whose movement is for low viscose fluids nearly independent of viscosity is guided concentrically in a specially shaped cone. The position of the float is transferred magnetically to the indicator, which shows the measurement values by a pointer on a scale. The indicator can be equipped with limit switches or an electronic transmitter (see Figure 2). Figure 1: Principle of measurement All units are calibrated with water by the manufacturer. By adjusting the calibration values to the measured substance s state of aggregation (density, viscosity), the flow rate scale for each application and measuring tube can be determined. Figure 2: RAMC unit showing the ma output and the output of the limit switches Stephan Aschenbrenner Page 9 of 26

10 3.2 Principle of operation The position of the float is magnetically transferred to a magnetic follow up system. For [V2] the position angle of this magnetic rocker is detected by magnet sensors. A micro controller determines the angle by means of a combining reference value table in the memory and calculates the flow rate by the angle with calibration and operation parameters of the calibration EEPROM. The flow rate is given as a current ma and in addition indicated on the digital display. The electronic transmitters have been electronically calibrated before shipping and, therefore, are mutually exchangeable. Calibration data of the metering tube as well as customer specific data are entered into a calibration EEPROM, inserted on the board. This calibration EEPROM and the indication scale are assigned to the respective metering tube. The variable area flow meter RAMC when used with inductive limit switches is considered to be a Type A component with a hardware fault tolerance of 0 ([V1]). The variable area flow meter RAMC when used with the ma output is considered to be a Type B component with a hardware fault tolerance of 0 ([V2]). Stephan Aschenbrenner Page 10 of 26

11 4 Failure Modes, Effects, and Diagnostic Analysis The Failure Modes, Effects, and Diagnostic Analysis was done together with Rota Yokogawa GmbH & Co. KG and is documented in [R1] to [R3]. 4.1 Description of the failure categories In order to judge the failure behavior of the variable area flow meter RAMC, the following definitions for the failure of the product were considered. Fail Safe Failure that causes the module / (sub)system to go to the defined fail-safe state without a demand from the process or has no effect on the safety function. Fail Dangerous Undetected Failure that is dangerous and that is not being diagnosed by internal diagnostics. Fail Dangerous Detected Failure that is dangerous but is detected by internal diagnostics (These failures may be converted to the selected fail-safe state). Annunciation Undetected Failure that does not directly impact safety but does impact the ability to detect a future fault (such as a fault in a diagnostic circuit) and that is not detected by internal diagnostics. For the calculation of the SFF it is treated like a safe undetected failure. Fail No Effect Failure of a component that is part of the safety function but that has no effect on the safety function or deviates the output current by not more than 2% full scale. For the calculation of the SFF it is treated like a safe undetected failure. Not part Failures of a component which is not part of the safety function but part of the circuit diagram and is listed for completeness. When calculating the SFF this failure mode is not taken into account. It is also not part of the total failure rate ma output Fail-Safe State The fail-safe state is defined as the output exceeding the user defined threshold. Fail Dangerous Failure that does not respond to a demand from the process (i.e. being unable to go to the defined fail-safe state) or deviates the output current by more than 2% full scale (+/-0.32mA). Fail High Failure that causes the output signal to go to the maximum output current (> 20,5 ma) Fail Low Failure that causes the output signal to go to the minimum output current (< 3.6 ma) Switch output Fail-Safe State The fail-safe state is defined as the output being de-energized. Fail Dangerous Failure that does not respond to a demand from the process (i.e. being unable to go to the defined fail-safe state). Stephan Aschenbrenner Page 11 of 26

12 The failure categories listed above expand on the categories listed in IEC which are only safe and dangerous, both detected and undetected. The reason for this is that, depending on the application, a fail low or fail high may be detected or undetected depending on the programming of the safety logic solver. Consequently during a Safety Integrity Level (SIL) verification assessment the fail high and fail low categories need to be classified as either detected or undetected. The No Effect and Annunciation Undetected failures are provided for those who wish to do reliability modeling more detailed than required by IEC In IEC the No Effect and Annunciation Undetected failures are defined as safe undetected failures even though they will not cause the safety function to go to a safe state. Therefore they need to be considered in the Safe Failure Fraction calculation. Stephan Aschenbrenner Page 12 of 26

13 4.2 Methodology FMEDA, Failure rates FMEDA A Failure Modes and Effects Analysis (FMEA) is a systematic way to identify and evaluate the effects of different component failure modes, to determine what could eliminate or reduce the chance of failure, and to document the system in consideration. A FMEDA (Failure Modes, Effects, and Diagnostic Analysis) is a FMEA extension. It combines standard FMEA techniques with extension to identify online diagnostics techniques and the failure modes relevant to safety instrumented system design. It is a technique recommended to generate failure rates for each important category (safe detected, safe undetected, dangerous detected, dangerous undetected, fail high, fail low) in the safety models. The format for the FMEDA is an extension of the standard FMEA format from MIL STD 1629A, Failure Modes and Effects Analysis Failure rates The failure rate data used by exida.com in this FMEDA are the basic failure rates from the Siemens SN failure rate database. The rates are considered to be appropriate for safety integrity level verification calculations. The rates match operating stress conditions typical of an industrial field environment similar to IEC , class C. It is expected that the actual number of field failures will be less than the number predicted by these failure rates. The user of these numbers is responsible for determining their applicability to any particular environment. Accurate plant specific data may be used for this purpose. If a user has data collected from a good proof test reporting system that indicates higher failure rates, the higher numbers shall be used. Some industrial plant sites have high levels of stress. Under those conditions the failure rate data is adjusted to a higher value to account for the specific conditions of the plant Assumptions The following assumptions have been made during the Failure Modes, Effects, and Diagnostic Analysis of the variable area flow meter RAMC. Failure rates are constant, wear out mechanisms are not included. Propagation of failures is not relevant. Failures during parameterization are not considered. Sufficient tests are performed prior to shipment to verify the absence of vendor and/or manufacturing defects that prevent proper operation of specified functionality to product specifications or cause operation different from the design analyzed. The time to restoration after a safe failure is 8 hours. All modules are operated in the low demand mode of operation. External power supply failure rates are not included. The HART protocol is only used for setup, calibration, and diagnostics purposes, not during normal operation. The float blocking indication detection is activated for version [V2]. For version [V1] the output of the inductive limit switches is connected to a fail-safe NAMUR amplifier (e.g. Pepperl+Fuchs KF**-SH-Ex1). Practical fault insertion tests can demonstrate the correctness of the failure effects assumed during the FMEDAs. Stephan Aschenbrenner Page 13 of 26

14 The stress levels are average for an industrial environment and can be compared to the Ground Fixed classification of MIL-HNBK-217F. Alternatively, the assumed environment is similar to: o IEC , Class C (sheltered location) with temperature limits within the manufacturer s rating and an average temperature over a long period of time of 40ºC. Humidity levels are assumed within manufacturer s rating. Only the current output 4..20mA or the limit switch output are used for safety applications. The application program in the safety logic solver is configured to detect under-range and over-range failures and does not automatically trip on these failures; therefore these failures have been classified as dangerous detected failures. Stephan Aschenbrenner Page 14 of 26

15 5 Results of the assessment exida.com did the FMEDAs together with Rota Yokogawa GmbH & Co. KG. For the calculation of the Safe Failure Fraction (SFF) the following has to be noted: λ total consists of the sum of all component failure rates. This means: λ total = λ safe + λ dangerous + λ no effect + λ annunciation SFF = 1 λ du / λ total For the FMEDAs failure modes and distributions were used based on information gained from [N3] to [N5]. For the calculation of the PFD AVG the following Markov model for a 1oo1D system was used. As after a complete proof test all states are going back to the OK state no proof test rate is shown in the Markov models but included in the calculation. The proof test time was changed using the Microsoft Excel 2000 based FMEDA tool of exida.com as a simulation tool. The results are documented in the following sections. ok Abbreviations: du The system has failed dangerous undetected dd The system has failed dangerous detected s The system has failed safe λ du λ dd λ s τ Repair λ du λ dd λ s Failure rate of dangerous undetected failures Failure rate of dangerous detected failures Failure rate of safe failures T Test Test time τ Test Test rate (1 / T Test ) du dd τ Test s T Repair Repair time τ Repair Repair rate (1 / T Repair ) Figure 3: Markov model for a 1oo1D structure Stephan Aschenbrenner Page 15 of 26

16 5.1 Variable area flow meter RAMC with inductive limit switches ([V1]) The FMEDA carried out on the variable area flow meter RAMC with inductive limit switches leads under the assumptions described in section and 5 to the following failure rates: λ sd = 0,00E-00 1/h λ su = 4,98E-08 1/h λ dd = 9,70E-09 1/h 6 λ du = 5,61E-08 1/h λ no effect = 5,12E-08 1/h λ total = 1,67E-07 1/h λ not part = 3,36E-08 1/h MTBF = MTTF + MTTR = 1 / (λ total + λ not part ) + 8 h = 569 years Under the assumptions described in section 5 and the definitions given in section 4.1 the following tables show the failure rates according to IEC 61508: λ sd λ su 7 λ dd λ du SFF DC S DC D 0 FIT 101 FIT 10 FIT 56 FIT 66,38% 0% 15% The PFD AVG was calculated for three different proof test times using the Markov model as described in Figure 3. T[Proof] = 1 year T[Proof] = 5 years T[Proof] = 10 years PFD AVG = 2,46E-04 PFD AVG = 1,23E-03 PFD AVG = 2,45E-03 The boxes marked in green ( ) mean that the calculated PFD AVG values are within the allowed range for SIL 2 according to table 2 of IEC and do fulfill the requirement to not claim more than 35% of this range, i.e. to be better than or equal to 3,50E-03. Figure 4 shows the time dependent curve of PFD AVG. 6 These are failures which are detectable by the fail-safe NAMUR amplifier. 7 Note that the SU category includes failures that do not cause a spurious trip Stephan Aschenbrenner Page 16 of 26

17 1oo1D structure Probability 3,00E-03 2,50E-03 2,00E-03 1,50E-03 1,00E-03 5,00E-04 0,00E PFDavg Years Figure 4: PFD AVG (t) Stephan Aschenbrenner Page 17 of 26

18 5.2 Variable area flow meter RAMC with ma output ([V2]) The FMEDA carried out on the variable area flow meter RAMC with ma output leads under the assumptions described in sections and 5 to the following failure rates: λ sd = 0,00E-00 1/h λ su = 0,00E-00 1/h λ dd = 1,67E-07 1/h λ du = 1,87E-07 1/h λ high = 1,30E-08 1/h λ low = 5,43E-08 1/h λ annunciation = 1,20E-09 1/h λ no effect = 5,92E-08 1/h λ total = 4,81E-07 1/h λ not part = 8,43E-08 1/h MTBF = MTTF + MTTR = 1 / (λ total + λ not part ) + 8 h = 202 years These failure rates can be turned over into the following typical failure rates: Failure category Failure rates (in FIT) Fail Dangerous Detected 234 Fail detected (internal diagnostics or indirectly 8 ) 167 Fail High (detected by the logic solver) 13 Fail low (detected by the logic solver) 54 Fail Dangerous Undetected 187 No Effect 59 Annunciation Undetected 1 Not part 84 Under the assumptions described in section and 5 the following tables show the failure rates according to IEC 61508: λ sd λ su 9 λ dd λ du SFF DC S DC D 0 FIT 60 FIT 234 FIT 187 FIT 61,20% 0% 55% 8 indirectly means that these failure are not necessarily detected by diagnostics but lead to either fail low or fail high failures depending on the device setting and are therefore detectable. 9 Note that the SU category includes failures that do not cause a spurious trip Stephan Aschenbrenner Page 18 of 26

19 The PFD AVG was calculated for three different proof test times using the Markov model as described in Figure 3. T[Proof] = 1 year T[Proof] = 5 years T[Proof] = 10 years PFD AVG = 8,17E-04 PFD AVG = 4,08E-03 PFD AVG = 8,13E-03 The boxes marked in green ( ) mean that the calculated PFD AVG values are within the allowed range for SIL 1 according to table 2 of IEC and do fulfill the requirement to not claim more than 35% of this range, i.e. to be better than or equal to 3,50E-02. Figure 5 shows the time dependent curve of PFD AVG. 1oo1D structure Probability 9,00E-03 8,00E-03 7,00E-03 6,00E-03 5,00E-03 4,00E-03 3,00E-03 2,00E-03 1,00E-03 0,00E PFDavg Years Figure 5: PFD AVG (t) Stephan Aschenbrenner Page 19 of 26

20 6 Terms and Definitions DC S Diagnostic Coverage of safe failures (DC S = λ sd / (λ sd + λ su )) DC D Diagnostic Coverage of dangerous failures (DC D = λ dd / (λ dd + λ du )) FIT Failure In Time (1x10-9 failures per hour) FMEDA Failure Modes, Effects, and Diagnostic Analysis HART Highway Addressable Remote Transducer HFT Hardware Fault Tolerance Low demand mode Mode, where the frequency of demands for operation made on a safetyrelated system is no greater than one per year and no greater than twice the proof test frequency. PFD AVG Average Probability of Failure on Demand SFF Safe Failure Fraction summarizes the fraction of failures, which lead to a safe state and the fraction of failures which will be detected by diagnostic measures and lead to a defined safety action. SIF Safety Instrumented Function SIL Safety Integrity Level Type A component Non-complex component (all failure modes are well defined); for details see of IEC Type B component Complex component (using micro controllers or programmable logic); for details see of IEC T[Proof] Proof Test Interval Stephan Aschenbrenner Page 20 of 26

21 7 Status of the document 7.1 Liability exida.com prepares FMEDA reports based on methods advocated in International standards. Failure rates are obtained from a collection of industrial databases. exida.com accepts no liability whatsoever for the use of these numbers or for the correctness of the standards on which the general calculation methods are based. 7.2 Releases Version: V1 Revision: R1.0 Version History: V0, R1.0: Initial version; October 24, 2005 V1, R1.0: Review comments incorporated; October 28, 2005 Authors: Stephan Aschenbrenner Review: V0, R1.0: Ralph Schmidt (Rota Yokogawa); October 25, 2005 Rachel Amkreutz (exida); November 4, 2005 Release status: Released to Rota Yokogawa GmbH & Co. KG 7.3 Release Signatures Dipl.-Ing. (Univ.) Stephan Aschenbrenner, Partner Dipl.-Ing. (Univ.) Rainer Faller, Principal Partner Stephan Aschenbrenner Page 21 of 26

22 Appendix 1: Possibilities to reveal dangerous undetected faults during the proof test According to section f) of IEC proof tests shall be undertaken to reveal dangerous faults which are undetected by diagnostic tests. This means that it is necessary to specify how dangerous undetected faults which have been noted during the FMEDA can be detected during proof testing. Table 7 and Table 8 show an importance analysis of the ten most critical dangerous undetected faults and indicate how these faults can be detected during proof testing. Appendix 1 shall be considered when writing the safety manual as it contains important safety related information. Table 7: Variable area flow meter RAMC with inductive limit switches Component % of total λ du Detection through Bearing ( ) 71,32% Float stop top 17,83% Housing bottom part incl. PG connector 3,21% Mounting screw ( ) 2,41% Retaining ring for indicator housing Mounting screw for inductive sensor 1,60% 1,60% Float 0,89% Housing seal ( ) 0,32% Inductive NAMUR sensors 0,32% Securing ring top 0,17% Stephan Aschenbrenner Page 22 of 26

23 Table 8: Variable area flow meter RAMC with ma output Component % of total λ du Detection through Magneto resistive sensors (R1, R2) 21,43% IC3 7,50% IC2 7,50% IC4 6,96% Mechanical components 6,47% IC5-4 4,29% Q1 3,21% IC6 3,21% IC1 3,21% D11 3,19% Stephan Aschenbrenner Page 23 of 26

24 Appendix 1.1: Possible proof tests to detect dangerous undetected faults Variable area flow meter RAMC with inductive limit switches Proof test 1 consists of the following steps, as described in Table 11. Table 9 Steps for Proof Test 1 Step Action 1 Take appropriate action to avoid a false trip 2 Force the variable area flow meter RAMC to reach a defined MAX threshold value and verify that the inductive limit switch goes into the safe state. 3 Restore the loop to full operation 4 Restore normal operation Proof test 2 consists of the following steps, as described in Table 12. Table 10 Steps for Proof Test 2 Step Action 1 Take appropriate action to avoid a false trip 3 Force the variable area flow meter RAMC to reach a defined MIN threshold value and verify that the inductive limit switch goes into the safe state. 4 Restore the loop to full operation 5 Restore normal operation Both tests together will detect approximately 90% of possible du failures. Stephan Aschenbrenner Page 24 of 26

25 Variable area flow meter RAMC with ma output Proof test 1 consists of the following steps, as described in Table 11. Table 11 Steps for Proof Test 1 Step Action 1 Bypass the safety PLC or take other appropriate action to avoid a false trip 2 Force the variable area flow meter RAMC to go to the high alarm current output and verify that the analog current reaches that value. This tests for compliance voltage problems such as a low loop power supply voltage or increased wiring resistance. This also tests for other possible failures. 3 Force variable area flow meter RAMC to go to the low alarm current output and verify that the analog current reaches that value. This tests for possible quiescent current related failures 4 Restore the loop to full operation 5 Remove the bypass from the safety PLC or otherwise restore normal operation This test will detect approximately 50% of possible du failures in the variable area flow meter RAMC. Proof test 2 consists of the following steps, as described in Table 12. Table 12 Steps for Proof Test 2 Step Action 1 Bypass the safety PLC or take other appropriate action to avoid a false trip 2 Perform Proof Test 1 3 Perform a two-point calibration of the variable area flow meter RAMC 4 Restore the loop to full operation 5 Remove the bypass from the safety PLC or otherwise restore normal operation This test will detect more than 90% of possible du failures in the variable area flow meter RAMC. Stephan Aschenbrenner Page 25 of 26

26 Appendix 2: Impact of lifetime of critical components on the failure rate Although a constant failure rate is assumed by the probabilistic estimation method (see section 4.2.3) this only applies provided that the useful lifetime of components is not exceeded. Beyond their useful lifetime, the result of the probabilistic calculation method is meaningless, as the probability of failure significantly increases with time. The useful lifetime is highly dependent on the component itself and its operating conditions temperature in particular (for example, electrolyte capacitors can be very sensitive). This assumption of a constant failure rate is based on the bathtub curve, which shows the typical behavior for electronic components. Therefore it is obvious that the PFD AVG calculation is only valid for components which have this constant domain and that the validity of the calculation is limited to the useful lifetime of each component. It is assumed that early failures are detected to a huge percentage during the installation period and therefore the assumption of a constant failure rate during the useful lifetime is valid. Table 13 shows which components are contributing to the dangerous undetected failure rate and therefore to the PFD AVG calculation and what their estimated useful lifetime is. Table 13: Useful lifetime of components contributing to λ du Type Name Useful life Mechanical part Appr. 10 years According to section of IEC , a useful lifetime, based on experience, should be assumed. According to section note 3 of IEC experience has shown that the useful lifetime often lies within a range of 8 to 12 years. Stephan Aschenbrenner Page 26 of 26

Failure Modes, Effects and Diagnostic Analysis

Failure Modes, Effects and Diagnostic Analysis Failure Modes, Effects and Diagnostic Analysis Project: Solenoid Drivers KFD2-SL2-(Ex)1.LK.vvcc KFD2-SL2-(Ex)*(.B).vvcc Customer: Pepperl+Fuchs GmbH Mannheim Germany Contract No.: P+F 06/09-23 Report No.:

More information

Failure Modes, Effects and Diagnostic Analysis. Rosemount Inc. Chanhassen, MN USA

Failure Modes, Effects and Diagnostic Analysis. Rosemount Inc. Chanhassen, MN USA Failure Modes, Effects and Diagnostic Analysis Project: 3095MV Mass Flow Transmitter Customer: Rosemount Inc. Chanhassen, MN USA Contract No.: Q04/04-09 Report No.: Ros 04/04-09 R001 Version V1, Revision

More information

Failure Modes, Effects and Diagnostic Analysis

Failure Modes, Effects and Diagnostic Analysis Failure Modes, Effects and Diagnostic Analysis Project: 3051S SIS Pressure Transmitter, with Safety Feature Board, Software Revision 3.0 Customer: Rosemount Inc. Chanhassen, MN USA Contract No.: Ros 02/11-07

More information

Failure Modes, Effects and Diagnostic Analysis

Failure Modes, Effects and Diagnostic Analysis Failure Modes, Effects and Diagnostic Analysis Project: Digital Output Module Valve DOMV 9478/22-08-51 Company: R. STAHL Schaltgeräte GmbH Waldenburg Germany Contract No.: STAHL 11/01-104 Report No.: STAHL

More information

Failure Modes, Effects and Diagnostic Analysis

Failure Modes, Effects and Diagnostic Analysis Failure Modes, Effects and Diagnostic Analysis Project: Solenoid Valves SNMF 532 024 ** ** and SMF 52 024 ** ** Customer: ACG Automation Center Germany GmbH & Co. KG Tettnang Germany Contract No.: ACG

More information

Failure Modes, Effects and Diagnostic Analysis

Failure Modes, Effects and Diagnostic Analysis Failure Modes, Effects and Diagnostic Analysis Project: Ground Monitoring Device 71**/5, 81**/5, 82**/5 Company: R. STAHL Schaltgeräte GmbH Waldenburg Germany Contract No.: STAHL 11/07-089 Report No.:

More information

H250 M9 Supplementary instructions

H250 M9 Supplementary instructions H250 M9 Supplementary instructions Variable area flowmeter Safety manual acc. to IEC 61508:2010 KROHNE CONTENTS H250 M9 1 Introduction 3 1.1 Fields of application... 3 1.2 User benefits... 3 1.3 Relevant

More information

Failure Modes, Effects and Diagnostic Analysis

Failure Modes, Effects and Diagnostic Analysis Failure Modes, Effects and Diagnostic Analysis Project: Temperature transmitter PR5337 / PR6337 / PR7501 with 4..20 ma output Customer: PR electronics A/S Rønde Denmark Contract No.: PR electronics A/S

More information

Failure Modes, Effects and Diagnostic Analysis

Failure Modes, Effects and Diagnostic Analysis Failure Modes, Effects and Diagnostic Analysis Project: Surge Protective Devices D9324S Customer: G.M. International s.r.l Villasanta Italy Contract No.: GM 16/02-055 Report No.: GM 16/02-055 R005 Version

More information

Failure Modes, Effects and Diagnostic Analysis. Rosemount Inc. Chanhassen, Minnesota USA

Failure Modes, Effects and Diagnostic Analysis. Rosemount Inc. Chanhassen, Minnesota USA Failure Modes, Effects and Diagnostic Analysis Project: 3051C Pressure Transmitter Customer: Rosemount Inc. Chanhassen, Minnesota USA Contract No.: Ros 03/10-11 Report No.: Ros 03/10-11 R001 Version V1,

More information

Failure Modes, Effects and Diagnostic Analysis

Failure Modes, Effects and Diagnostic Analysis Failure Modes, Effects and Diagnostic Analysis Project: Abc. X Series Ball Valve Company: Abc. Inc. Sellersville, PA USA Contract Number: Q11/12-345 Report No.: Abc 11/12-345 R001 Version V1, Revision

More information

Failure Modes, Effects and Diagnostic Analysis

Failure Modes, Effects and Diagnostic Analysis Failure Modes, Effects and Diagnostic Analysis Project: Isolating repeater 9164 Customer: R. STAHL Schaltgeräte GmbH Waldenburg Germany Contract No.: STAHL 16/08-032 Report No.: STAHL 16/08-032 R032 Version

More information

Safety Manual VEGAVIB series 60

Safety Manual VEGAVIB series 60 Safety Manual VEGAVIB series 60 NAMUR Document ID: 32005 Contents Contents 1 Functional safety... 3 1.1 General information... 3 1.2 Planning... 4 1.3 Adjustment instructions... 6 1.4 Setup... 6 1.5 Reaction

More information

Safety Manual VEGAVIB series 60

Safety Manual VEGAVIB series 60 Safety Manual VEGAVIB series 60 Contactless electronic switch Document ID: 32002 Contents Contents 1 Functional safety... 3 1.1 General information... 3 1.2 Planning... 4 1.3 Adjustment instructions...

More information

Safety Manual. Process pressure transmitter IPT-1* 4 20 ma/hart. Process pressure transmitter IPT-1*

Safety Manual. Process pressure transmitter IPT-1* 4 20 ma/hart. Process pressure transmitter IPT-1* Safety Manual Process pressure transmitter IPT-1* 4 20 ma/hart Process pressure transmitter IPT-1* Contents Contents 1 Functional safety 1.1 General information... 3 1.2 Planning... 4 1.3 Instrument parameter

More information

Failure Modes, Effects and Diagnostic Analysis

Failure Modes, Effects and Diagnostic Analysis Failure Modes, Effects and Diagnostic Analysis Project: Contact elements Type 8082 and Type 8208 with or without 8602 actuator Customer: R. STAHL Schaltgeräte GmbH Waldenburg Germany Contract No.: Stahl

More information

Safety Manual OPTISWITCH series relay (DPDT)

Safety Manual OPTISWITCH series relay (DPDT) Safety Manual OPTISWITCH series 5000 - relay (DPDT) 1 Content Content 1 Functional safety 1.1 In general................................ 3 1.2 Planning................................. 5 1.3 Adjustment

More information

Eutectic Plug Valve. SIL Safety Manual. SIL SM.015 Rev 0. Compiled By : G. Elliott, Date: 19/10/2016. Innovative and Reliable Valve & Pump Solutions

Eutectic Plug Valve. SIL Safety Manual. SIL SM.015 Rev 0. Compiled By : G. Elliott, Date: 19/10/2016. Innovative and Reliable Valve & Pump Solutions SIL SM.015 Rev 0 Eutectic Plug Valve Compiled By : G. Elliott, Date: 19/10/2016 Contents Terminology Definitions......3 Acronyms & Abbreviations...4 1. Introduction..5 1.1 Scope 5 1.2 Relevant Standards

More information

Failure Modes, Effects and Diagnostic Analysis

Failure Modes, Effects and Diagnostic Analysis Failure Modes, Effects and Diagnostic Analysis Project: Primary Elements Company: Rosemount Inc. (an Emerson Process Management company) Chanhassen, MN USA Contract Number: Q13/04-008 Report No.: ROS 13/04-008

More information

Bespoke Hydraulic Manifold Assembly

Bespoke Hydraulic Manifold Assembly SIL SM.0003 1 Bespoke Hydraulic Manifold Assembly Compiled By : G. Elliott, Date: 12/17/2015 Contents Terminology Definitions......3 Acronyms & Abbreviations..4 1. Introduction 5 1.1 Scope 5 1.2 Relevant

More information

Pneumatic QEV. SIL Safety Manual SIL SM Compiled By : G. Elliott, Date: 8/19/2015. Innovative and Reliable Valve & Pump Solutions

Pneumatic QEV. SIL Safety Manual SIL SM Compiled By : G. Elliott, Date: 8/19/2015. Innovative and Reliable Valve & Pump Solutions SIL SM.0010 1 Pneumatic QEV Compiled By : G. Elliott, Date: 8/19/2015 Contents Terminology Definitions......3 Acronyms & Abbreviations..4 1. Introduction 5 1.1 Scope 5 1.2 Relevant Standards 5 1.3 Other

More information

FP15 Interface Valve. SIL Safety Manual. SIL SM.018 Rev 1. Compiled By : G. Elliott, Date: 30/10/2017. Innovative and Reliable Valve & Pump Solutions

FP15 Interface Valve. SIL Safety Manual. SIL SM.018 Rev 1. Compiled By : G. Elliott, Date: 30/10/2017. Innovative and Reliable Valve & Pump Solutions SIL SM.018 Rev 1 FP15 Interface Valve Compiled By : G. Elliott, Date: 30/10/2017 FP15/L1 FP15/H1 Contents Terminology Definitions......3 Acronyms & Abbreviations...4 1. Introduction...5 1.1 Scope.. 5 1.2

More information

SIL Safety Manual. ULTRAMAT 6 Gas Analyzer for the Determination of IR-Absorbing Gases. Supplement to instruction manual ULTRAMAT 6 and OXYMAT 6

SIL Safety Manual. ULTRAMAT 6 Gas Analyzer for the Determination of IR-Absorbing Gases. Supplement to instruction manual ULTRAMAT 6 and OXYMAT 6 ULTRAMAT 6 Gas Analyzer for the Determination of IR-Absorbing Gases SIL Safety Manual Supplement to instruction manual ULTRAMAT 6 and OXYMAT 6 ULTRAMAT 6F 7MB2111, 7MB2117, 7MB2112, 7MB2118 ULTRAMAT 6E

More information

Solenoid Valves For Gas Service FP02G & FP05G

Solenoid Valves For Gas Service FP02G & FP05G SIL Safety Manual SM.0002 Rev 02 Solenoid Valves For Gas Service FP02G & FP05G Compiled By : G. Elliott, Date: 31/10/2017 Reviewed By : Peter Kyrycz Date: 31/10/2017 Contents Terminology Definitions......3

More information

Solenoid Valves used in Safety Instrumented Systems

Solenoid Valves used in Safety Instrumented Systems I&M V9629R1 Solenoid Valves used in Safety Instrumented Systems Operating Manual in accordance with IEC 61508 ASCO Valves Page 1 of 7 Table of Contents 1 Introduction...3 1.1 Terms and Abbreviations...3

More information

Hydraulic (Subsea) Shuttle Valves

Hydraulic (Subsea) Shuttle Valves SIL SM.009 0 Hydraulic (Subsea) Shuttle Valves Compiled By : G. Elliott, Date: 11/3/2014 Contents Terminology Definitions......3 Acronyms & Abbreviations..4 1. Introduction 5 1.1 Scope 5 1.2 Relevant Standards

More information

SPR - Pneumatic Spool Valve

SPR - Pneumatic Spool Valve SIL SM.008 Rev 7 SPR - Pneumatic Spool Valve Compiled By : G. Elliott, Date: 31/08/17 Contents Terminology Definitions:... 3 Acronyms & Abbreviations:... 4 1.0 Introduction... 5 1.1 Purpose & Scope...

More information

DeZURIK. KGC Cast Knife Gate Valve. Safety Manual

DeZURIK. KGC Cast Knife Gate Valve. Safety Manual KGC Cast Knife Gate Valve Safety Manual Manual D11036 August 29, 2014 Table of Contents 1 Introduction... 3 1.1 Terms... 3 1.2 Abbreviations... 4 1.3 Product Support... 4 1.4 Related Literature... 4 1.5

More information

DeZURIK. KSV Knife Gate Valve. Safety Manual

DeZURIK. KSV Knife Gate Valve. Safety Manual KSV Knife Gate Valve Safety Manual Manual D11035 August 29, 2014 Table of Contents 1 Introduction... 3 1.1 Terms... 3 1.2 Abbreviations... 4 1.3 Product Support... 4 1.4 Related Literature... 4 1.5 Reference

More information

DeZURIK Double Block & Bleed (DBB) Knife Gate Valve Safety Manual

DeZURIK Double Block & Bleed (DBB) Knife Gate Valve Safety Manual Double Block & Bleed (DBB) Knife Gate Valve Safety Manual Manual D11044 September, 2015 Table of Contents 1 Introduction... 3 1.1 Terms... 3 1.2 Abbreviations... 4 1.3 Product Support... 4 1.4 Related

More information

Failure Modes, Effects and Diagnostic Analysis

Failure Modes, Effects and Diagnostic Analysis Failure Modes, Effects and Diagnostic Analysis Project: Emerson s Rosemount 2051 Pressure Transmitter with 4-20mA HART Device Label SW 1.0.0-1.4.x Company: Rosemount Inc. Shakopee, MN USA Contract No.:

More information

Special Documentation Proline Promass 80, 83

Special Documentation Proline Promass 80, 83 SD00077D/06/EN/14.14 71272498 Products Solutions Services Special Documentation Proline Promass 80, 83 Functional safety manual Coriolis mass flow measuring system with 4 20 ma output signal Application

More information

This manual provides necessary requirements for meeting the IEC or IEC functional safety standards.

This manual provides necessary requirements for meeting the IEC or IEC functional safety standards. Instruction Manual Supplement Safety manual for Fisher Vee-Ball Series Purpose This safety manual provides information necessary to design, install, verify and maintain a Safety Instrumented Function (SIF)

More information

Safety manual for Fisher GX Control Valve and Actuator

Safety manual for Fisher GX Control Valve and Actuator Instruction Manual Supplement GX Valve and Actuator Safety manual for Fisher GX Control Valve and Actuator Purpose This safety manual provides information necessary to design, install, verify and maintain

More information

RESILIENT SEATED BUTTERFLY VALVES FUNCTIONAL SAFETY MANUAL

RESILIENT SEATED BUTTERFLY VALVES FUNCTIONAL SAFETY MANUAL Per IEC 61508 and IEC 61511 Standards BRAY.COM Table of Contents 1.0 Introduction.................................................... 1 1.1 Terms and Abbreviations...........................................

More information

Rosemount 2130 Level Switch

Rosemount 2130 Level Switch Rosemount 2130 Level Switch Functional Safety Manual Manual Supplement Reference Manual Contents Contents 1Section 1: Introduction 1.1 Scope and purpose of the safety manual.............................................

More information

Commissioning and safety manual

Commissioning and safety manual Commissioning and safety manual CNL35L DNL35L SIL2 LOREME 12, rue des Potiers d'etain Actipole BORNY - B.P. 35014-57071 METZ CEDEX 3 Phone 03.87.76.32.51 - Telefax 03.87.76.32.52 Contact: Commercial@Loreme.fr

More information

Neles ValvGuard VG9000H Rev 2.0. Safety Manual

Neles ValvGuard VG9000H Rev 2.0. Safety Manual Neles ValvGuard VG9000H Rev 2.0 Safety Manual 10SM VG9000H en 11/2016 2 Neles ValvGuard VG9000H Rev 2.0 Safety Manual Table of Contents 1 General information...3 1.1 Purpose of the document... 3 1.2 Description

More information

Safety Manual VEGASWING 61, 63. NAMUR With SIL qualification. Document ID: 52084

Safety Manual VEGASWING 61, 63. NAMUR With SIL qualification. Document ID: 52084 Safety Manual VEGASWING 61, 63 NAMUR With SIL qualification Document ID: 52084 Contents Contents 1 Document language 2 Scope 2.1 Instrument version... 4 2.2 Area of application... 4 2.3 SIL conformity...

More information

TRI LOK SAFETY MANUAL TRI LOK TRIPLE OFFSET BUTTERFLY VALVE. The High Performance Company

TRI LOK SAFETY MANUAL TRI LOK TRIPLE OFFSET BUTTERFLY VALVE. The High Performance Company TRI LOK TRI LOK TRIPLE OFFSET BUTTERFLY VALVE SAFETY MANUAL The High Performance Company Table of Contents 1.0 Introduction...1 1.1 Terms and Abbreviations... 1 1.2 Acronyms... 1 1.3 Product Support...

More information

Functional safety. Functional safety of Programmable systems, devices & components: Requirements from global & national standards

Functional safety. Functional safety of Programmable systems, devices & components: Requirements from global & national standards Functional safety Functional safety of Programmable systems, devices & components: Requirements from global & national standards Matthias R. Heinze Vice President Engineering TUV Rheinland of N.A. Email

More information

Vibrating Switches SITRANS LVL 200S, LVL 200E. Safety Manual. NAMUR With SIL qualification

Vibrating Switches SITRANS LVL 200S, LVL 200E. Safety Manual. NAMUR With SIL qualification Vibrating Switches SITRANS LVL 200S, LVL 200E NAMUR With SIL qualification Safety Manual Contents 1 Document language 2 Scope 2.1 Instrument version... 4 2.2 Area of application... 4 2.3 SIL conformity...

More information

Reliability of Safety-Critical Systems Chapter 3. Failures and Failure Analysis

Reliability of Safety-Critical Systems Chapter 3. Failures and Failure Analysis Reliability of Safety-Critical Systems Chapter 3. Failures and Failure Analysis Mary Ann Lundteigen and Marvin Rausand mary.a.lundteigen@ntnu.no RAMS Group Department of Production and Quality Engineering

More information

Ultima. X Series Gas Monitor

Ultima. X Series Gas Monitor Ultima X Series Gas Monitor Safety Manual SIL 2 Certified " The Ultima X Series Gas Monitor is qualified as an SIL 2 device under IEC 61508 and must be installed, used, and maintained in accordance with

More information

Neles trunnion mounted ball valve Series D Rev. 2. Safety Manual

Neles trunnion mounted ball valve Series D Rev. 2. Safety Manual Neles trunnion mounted ball valve Series D Rev. 2 Safety Manual 10SM D en 1/2017 2 Neles trunnion mounted ball valve, Series D Table of Contents 1 Introduction...3 2 Structure of the D series trunnion

More information

L&T Valves Limited SAFETY INTEGRITY LEVEL (SIL) VERIFICATION FOR HIGH INTEGRITY PRESSURE PROTECTION SYSTEM (HIPPS) Report No.

L&T Valves Limited SAFETY INTEGRITY LEVEL (SIL) VERIFICATION FOR HIGH INTEGRITY PRESSURE PROTECTION SYSTEM (HIPPS) Report No. L&T Valves Limited TAMIL NADU SAFETY INTEGRITY LEVEL (SIL) VERIFICATION FOR HIGH INTEGRITY PRESSURE PROTECTION SYSTEM (HIPPS) MAY 2016 Report No. 8113245702-100-01 Submitted to L&T Valves Ltd. Report by

More information

SIL explained. Understanding the use of valve actuators in SIL rated safety instrumented systems ACTUATION

SIL explained. Understanding the use of valve actuators in SIL rated safety instrumented systems ACTUATION SIL explained Understanding the use of valve actuators in SIL rated safety instrumented systems The requirement for Safety Integrity Level (SIL) equipment can be complicated and confusing. In this document,

More information

Rosemount 2120 Level Switch

Rosemount 2120 Level Switch Rosemount 2120 Level Switch Functional Safety Manual Manual Supplement Manual Supplement Contents Contents 1Section 1: Introduction 1.1 Scope and purpose of the safety manual.............................................

More information

Jamesbury Pneumatic Rack and Pinion Actuator

Jamesbury Pneumatic Rack and Pinion Actuator Jamesbury Pneumatic Rack and Pinion Actuator Valv-Powr Series VPVL Rev. 3.0 Safety Manual 10SM VPVL en 5/2017 2 Jamesbury Pneumatic Rack and Pinion Actuator, Valv-Powr Series VPVL, Rev 3.0, Safety Manual

More information

Section 1: Multiple Choice

Section 1: Multiple Choice CFSP Process Applications Section 1: Multiple Choice EXAMPLE Candidate Exam Number (No Name): Please write down your name in the above provided space. Only one answer is correct. Please circle only the

More information

Reliability of Safety-Critical Systems Chapter 4. Testing and Maintenance

Reliability of Safety-Critical Systems Chapter 4. Testing and Maintenance Reliability of Safety-Critical Systems Chapter 4. Testing and Maintenance Mary Ann Lundteigen and Marvin Rausand mary.a.lundteigen@ntnu.no RAMS Group Department of Production and Quality Engineering NTNU

More information

YT-3300 / 3301 / 3302 / 3303 / 3350 / 3400 /

YT-3300 / 3301 / 3302 / 3303 / 3350 / 3400 / Smart positioner YT-3300 / 3301 / 3302 / 3303 / 3350 / 3400 / 3410 / 3450 Series SIL Safety Instruction. Supplement to product manual July. 2015 YTC Ver 1.06 1 Table of contents 1 Introduction... 3 1.1

More information

Achieving Compliance in Hardware Fault Tolerance

Achieving Compliance in Hardware Fault Tolerance Mirek Generowicz FS Senior Expert (TÜV Rheinland #183/12) Engineering Manager, I&E Systems Pty Ltd Abstract The functional safety standards ISA S84/IEC 61511 (1 st Edition, 2003) and IEC 61508 both set

More information

SIL Safety Manual for Fisherr ED, ES, ET, EZ, HP, or HPA Valves with 657 / 667 Actuator

SIL Safety Manual for Fisherr ED, ES, ET, EZ, HP, or HPA Valves with 657 / 667 Actuator SIL Safety Manual ED, ES, ET, EZ, HP, HPA Valves w/ 657/667 Actuator SIL Safety Manual for Fisherr ED, ES, ET, EZ, HP, or HPA Valves with 657 / 667 Actuator Purpose This safety manual provides information

More information

Understanding the How, Why, and What of a Safety Integrity Level (SIL)

Understanding the How, Why, and What of a Safety Integrity Level (SIL) Understanding the How, Why, and What of a Safety Integrity Level (SIL) Audio is provided via internet. Please enable your speaker (in all places) and mute your microphone. Understanding the How, Why, and

More information

Understanding safety life cycles

Understanding safety life cycles Understanding safety life cycles IEC/EN 61508 is the basis for the specification, design, and operation of safety instrumented systems (SIS) Fast Forward: IEC/EN 61508 standards need to be implemented

More information

The Key Variables Needed for PFDavg Calculation

The Key Variables Needed for PFDavg Calculation Iwan van Beurden, CFSE Dr. William M. Goble, CFSE exida Sellersville, PA 18960, USA wgoble@exida.com July 2015 Update 1.2 September 2016 Abstract In performance based functional safety standards, safety

More information

Accelerometer mod. TA18-S. SIL Safety Report

Accelerometer mod. TA18-S. SIL Safety Report Accelerometer mod. TA18-S SIL Safety Report SIL005/11 rev.1 of 03.02.2011 Page 1 of 7 1. Field of use The transducers are made to monitoring vibrations in systems that must meet particular technical safety

More information

PROCESS AUTOMATION SIL. Manual Safety Integrity Level. Edition 2005 IEC 61508/61511

PROCESS AUTOMATION SIL. Manual Safety Integrity Level. Edition 2005 IEC 61508/61511 PROCESS AUTOMATION Manual Safety Integrity Level SIL Edition 2005 IEC 61508/61511 With regard to the supply of products, the current issue of the following document is applicable: The General Terms of

More information

High performance disc valves Series Type BA, BK, BW, BM, BN, BO, BE, BH Rev Safety Manual

High performance disc valves Series Type BA, BK, BW, BM, BN, BO, BE, BH Rev Safety Manual High performance disc valves Series Type BA, BK, BW, BM, BN, BO, BE, BH Rev. 2.0 Safety Manual 10SM B Disc en 4/2018 2 High performance disc valves Series, Type BA, BK, BW, BM, BN, BO, BE, BH, Rev. 2.0

More information

Special Documentation Liquiphant M/S with electronic insert FEL56 + Nivotester FTL325N

Special Documentation Liquiphant M/S with electronic insert FEL56 + Nivotester FTL325N [Ex ia] CH1 CH1 [Ex ia] CH1 CH2 CH3 CH2 CH3 SD01521F/00/EN/02.16 71329742 Products Solutions Services Special Documentation Liquiphant M/S with electronic insert FEL56 + Nivotester FTL325N Functional Safety

More information

Continuous Gas Analysis. ULTRAMAT 6, OXYMAT 6 Safety Manual. Introduction 1. General description of functional safety 2

Continuous Gas Analysis. ULTRAMAT 6, OXYMAT 6 Safety Manual. Introduction 1. General description of functional safety 2 Introduction 1 General description of functional safety 2 Continuous Gas Analysis ULTRAMAT 6, OXYMAT 6 Device-specific safety instructions 3 List of abbreviations A Operating Instructions Supplement to

More information

Valve Communication Solutions. Safety instrumented systems

Valve Communication Solutions. Safety instrumented systems Safety instrumented systems Safety Instrumented System (SIS) is implemented as part of a risk reduction strategy. The primary focus is to prevent catastrophic accidents resulting from abnormal operation.

More information

New Thinking in Control Reliability

New Thinking in Control Reliability Doug Nix, A.Sc.T. Compliance InSight Consulting Inc. New Thinking in Control Reliability Or Your Next Big Headache www.machinerysafety101.com (519) 729-5704 Control Reliability Burning Questions from the

More information

Every things under control High-Integrity Pressure Protection System (HIPPS)

Every things under control High-Integrity Pressure Protection System (HIPPS) Every things under control www.adico.co info@adico.co Table Of Contents 1. Introduction... 2 2. Standards... 3 3. HIPPS vs Emergency Shut Down... 4 4. Safety Requirement Specification... 4 5. Device Integrity

More information

High Integrity Pressure Protection Systems HIPPS

High Integrity Pressure Protection Systems HIPPS High Integrity Pressure Protection Systems HIPPS HIPPS > High Integrity Pressure Protection Systems WHAT IS A HIPPS The High Integrity Pressure Protection Systems (HIPPS) is a mechanical and electrical

More information

Failure Modes, Effects, and Diagnostic Analysis of a Safety Device

Failure Modes, Effects, and Diagnostic Analysis of a Safety Device Elias Mabook Failure Modes, Effects, and Diagnostic Analysis of a Safety Device Helsinki Metropolia University of Applied Sciences Bachelor of Engineering Degree Programme in Electronics Bachelor s Thesis

More information

Implementing IEC Standards for Safety Instrumented Systems

Implementing IEC Standards for Safety Instrumented Systems Implementing IEC Standards for Safety Instrumented Systems ABHAY THODGE TUV Certificate: PFSE-06-607 INVENSYS OPERATIONS MANAGEMENT What is a Safety Instrumented System (SIS)? An SIS is designed to: respond

More information

DSB, DSF: Pressure monitors and pressure switches

DSB, DSF: Pressure monitors and pressure switches roduct data sheet 23.760 DSB, DSF: ressure monitors and pressure switches How energy efficiency is improved Control and monitoring according to needs and with no auxiliary energy Features For regulating

More information

YT-300 / 305 / 310 / 315 / 320 / 325 Series

YT-300 / 305 / 310 / 315 / 320 / 325 Series Volume Booster YT-300 / 305 / 310 / 315 / 320 / 325 Series SIL Safety Instruction. Supplement to product manual Apr. 2016 YTC Ver. 2.01 1 Table of contents 1 Introduction... 3 1.1 Purpose of this document...

More information

Data Sheet T 8389 EN. Series 3730 and 3731 Types , , , and. EXPERTplus Valve Diagnostic

Data Sheet T 8389 EN. Series 3730 and 3731 Types , , , and. EXPERTplus Valve Diagnostic Data Sheet T 8389 EN Series 3730 and 3731 Types 3730-2, 3730-3, 3730-4, 3730-5 and Type 3731-3 Electropneumatic Positioners EXPERTplus Valve Diagnostic Application Positioner firmware to detect potential

More information

THE IMPROVEMENT OF SIL CALCULATION METHODOLOGY. Jinhyung Park 1 II. THE SIL CALCULATION METHODOLOGY ON IEC61508 AND SOME ARGUMENT

THE IMPROVEMENT OF SIL CALCULATION METHODOLOGY. Jinhyung Park 1 II. THE SIL CALCULATION METHODOLOGY ON IEC61508 AND SOME ARGUMENT THE IMPROVEMENT OF SIL CALCULATION METHODOLOGY Jinhyung Park 1 1 Yokogawa Electric Korea: 21, Seonyu-ro45-gil Yeongdeungpo-gu, Seoul, 07209, Jinhyung.park@kr.yokogawa.com Safety Integrity Level (SIL) is

More information

EL-O-Matic E and P Series Pneumatic Actuator SIL Safety Manual

EL-O-Matic E and P Series Pneumatic Actuator SIL Safety Manual SIL Safety Manual DOC.SILM.EEP.EN Rev. 0 April 2017 EL-O-Matic E and P Series Pneumatic Actuator SIL Safety Manual schaal 1:1 EL Matic TM EL-O-Matic E and P Series DOC.SILM.EEP.EN Rev. 0 Table of Contents

More information

Section 1: Multiple Choice Explained EXAMPLE

Section 1: Multiple Choice Explained EXAMPLE CFSP Process Applications Section 1: Multiple Choice Explained EXAMPLE Candidate Exam Number (No Name): Please write down your name in the above provided space. Only one answer is correct. Please circle

More information

Transmitter mod. TR-A/V. SIL Safety Report

Transmitter mod. TR-A/V. SIL Safety Report Transmitter mod. TR-A/V SIL Safety Report SIL003/09 rev.1 del 09.03.2009 Pagina 1 di 7 1. Employ field The transmitters are dedicated to the vibration monitoring in plants where particular safety requirements

More information

COMPLIANCE with IEC EN and IEC EN 61511

COMPLIANCE with IEC EN and IEC EN 61511 COMPLIANCE with IEC EN 61508 and IEC EN 61511 Certificate No.: C- IS-260811 01 CERTIFICATE OWNER: ORION S.p.A. VIA CABOTO, 8 I-34148 TRIESTE (Italy) WE HEREWITH CONFIRM THAT THE ANALYSIS DEVELOPED BY ORION;

More information

Specifications and information are subject to change without notice. Up-to-date address information is available on our website.

Specifications and information are subject to change without notice. Up-to-date address information is available on our website. www.smar.com Specifications and information are subject to change without notice. Up-to-date address information is available on our website. web: www.smar.com/contactus.asp LD302 - AssetView HMI LD302

More information

CHANGE HISTORY DISTRIBUTION LIST

CHANGE HISTORY DISTRIBUTION LIST Issue Date of Issue CR/DR Numbers CHANGE HISTORY No. of Pages Draft A Aug 2011 N/A 28 Draft Issue Pages Changed and Reasons for Change Sept 2011 N/A 28 Formal issue with client comments from draft issue

More information

Session: 14 SIL or PL? What is the difference?

Session: 14 SIL or PL? What is the difference? Session: 14 SIL or PL? What is the difference? Stewart Robinson MIET MInstMC Consultant Engineer, Pilz Automation Technology UK Ltd. EN ISO 13849-1 and EN 6061 Having two different standards for safety

More information

DSL, DSH: Specially designed pressure limiter

DSL, DSH: Specially designed pressure limiter Product data sheet 11.1 23.770 DSL, DSH: Specially designed pressure limiter How energy efficiency is improved Control and monitoring according to needs and with no auxiliary energy. Features Switching

More information

Competence in Functional Safety

Competence in Functional Safety MANUAL Competence in Functional Safety Safety-instrumented system Instrumentation Automation SMART IN FLOW CONTROL. SAMSON AIR TORQUE CERA SYSTEM KT-ELEKTRONIK LEUSCH PFEIFFER RINGO SAMSOMATIC STARLINE

More information

Special Documentation Liquiphant M/S with electronic insert FEL57 + Nivotester FTL325P

Special Documentation Liquiphant M/S with electronic insert FEL57 + Nivotester FTL325P [Ex ia] CH1 CH1 [Ex ia] CH1 CH2 CH3 CH2 CH3 SD01508F/00/EN/02.16 71329740 Products Solutions Services Special Documentation Liquiphant M/S with electronic insert FEL57 + Nivotester FTL325P Functional Safety

More information

PL estimation acc. to EN ISO

PL estimation acc. to EN ISO PL estimation acc. to EN ISO 3849- Example calculation for an application MAC Safety / Armin Wenigenrath, January 2007 Select the suitable standard for your application Reminder: The standards and the

More information

Service & Support. Questions and Answers about the Proof Test Interval. Proof Test According to IEC FAQ August Answers for industry.

Service & Support. Questions and Answers about the Proof Test Interval. Proof Test According to IEC FAQ August Answers for industry. Cover sheet Questions and Answers about the Proof Test Interval Proof Test According to IEC 62061 FAQ August 2012 Service & Support Answers for industry. Contents This entry originates from the Siemens

More information

Functional Safety SIL Safety Instrumented Systems in the Process Industry

Functional Safety SIL Safety Instrumented Systems in the Process Industry Products Solutions Services Functional Safety SIL Safety Instrumented Systems in the Process Industry BASF - Press Photo 2 section Foreword rubric 3 Foreword has come into focus since the publication of

More information

THE CANDU 9 DISTRffiUTED CONTROL SYSTEM DESIGN PROCESS

THE CANDU 9 DISTRffiUTED CONTROL SYSTEM DESIGN PROCESS THE CANDU 9 DISTRffiUTED CONTROL SYSTEM DESIGN PROCESS J.E. HARBER, M.K. KATTAN Atomic Energy of Canada Limited 2251 Speakman Drive, Mississauga, Ont., L5K 1B2 CA9900006 and M.J. MACBETH Institute for

More information

Series 3730 and Series 3731 EXPERTplus Valve Diagnostics with Partial Stroke Test (PST)

Series 3730 and Series 3731 EXPERTplus Valve Diagnostics with Partial Stroke Test (PST) Series 3730 and Series 3731 EXPERTplus Valve Diagnostics with Partial Stroke Test (PST) Application Positioner firmware for early detection of control valve faults giving maintenance recommendations. Valid

More information

Safety-critical systems: Basic definitions

Safety-critical systems: Basic definitions Safety-critical systems: Basic definitions Ákos Horváth Based on István Majzik s slides Dept. of Measurement and Information Systems Budapest University of Technology and Economics Department of Measurement

More information

EMERGENCY SHUT-DOWN RELIABILITY ADVANTAGE

EMERGENCY SHUT-DOWN RELIABILITY ADVANTAGE Your partner in Fluid Control Solutions EMERGENCY SHUT-DOWN RELIABILITY ADVANTAGE George Cao 06 May, 2011 1. ESD Overview Why Do You Need ESD Solution? Safety! Safety!! Safety!!! Safety Is a Must! The

More information

Reliability predictions in product development. Proof Engineering Co

Reliability predictions in product development. Proof Engineering Co Reliability predictions in product development Proof Engineering Co Contents Review of reliability theory Ways to predict part reliability Converting parts reliability into a system reliability Ways to

More information

Transducer mod. T-NC/8-API. SIL Safety Report

Transducer mod. T-NC/8-API. SIL Safety Report CEMB S.p.a. Transducer mod. T-NC/8-API SIL Safety Report SIL006/11 rev.0 dated 03.03.2011 Page 1 di 7 1. Employ field The transducers can measure the static or dynamic distance in plants which need to

More information

CoriolisMaster mass flowmeter Diagnostics, verification and proof test

CoriolisMaster mass flowmeter Diagnostics, verification and proof test ABB MEASUREMENT & ANALYTICS WHITE PAPER CoriolisMaster mass flowmeter Diagnostics, verification and proof test Automatic in situ verification of accuracy for CoriolisMaster mass flowmeters. By Frank Frenzel

More information

E2K-L. Liquid Level Sensor That Is Unaffected by the Color of the Pipe or Liquid. Liquid Level Sensor. Ordering Information

E2K-L. Liquid Level Sensor That Is Unaffected by the Color of the Pipe or Liquid. Liquid Level Sensor. Ordering Information Liquid Level EK-L CSM_EK-L_DS_E 3 Liquid Level That Is Unaffected by the Color of the or Liquid Mount to bypass pipes. Fit a wide range of pipe diameters: 8 to mm or to mm Built-in Amplifiers to save space.

More information

What safety level can be reached when combining a contactor with a circuitbreaker for fail-safe switching?

What safety level can be reached when combining a contactor with a circuitbreaker for fail-safe switching? FAQ 01/2015 What safety level can be reached when combining a contactor with a circuitbreaker for fail-safe switching? SIRIUS Safety Integrated http://support.automation.siemens.com/ww/view/en/40349715

More information

DETERMINATION OF SAFETY REQUIREMENTS FOR SAFETY- RELATED PROTECTION AND CONTROL SYSTEMS - IEC 61508

DETERMINATION OF SAFETY REQUIREMENTS FOR SAFETY- RELATED PROTECTION AND CONTROL SYSTEMS - IEC 61508 DETERMINATION OF SAFETY REQUIREMENTS FOR SAFETY- RELATED PROTECTION AND CONTROL SYSTEMS - IEC 61508 Simon J Brown Technology Division, Health & Safety Executive, Bootle, Merseyside L20 3QZ, UK Crown Copyright

More information

UNDERSTANDING SAFETY INTEGRITY LEVEL

UNDERSTANDING SAFETY INTEGRITY LEVEL UNDERSTANDING SAFETY INTEGRITY LEVEL S p e c i a l A p p l i c a t i o n S e r i e s 2 THE NEW STANDARDS IN SAFETY On the morning of 12/11/05, the largest detonation since the end of WWII rocked the Buncefield

More information

Proof Testing A key performance indicator for designers and end users of Safety Instrumented Systems

Proof Testing A key performance indicator for designers and end users of Safety Instrumented Systems Proof Testing A key performance indicator for designers and end users of Safety Instrumented Systems EUR ING David Green BEng(hons) CEng MIET MInstMC RFSE Ron Bell OBE BSc CEng FIET Engineering Safety

More information

DSB, DSF: Pressure monitors and pressure switches

DSB, DSF: Pressure monitors and pressure switches roduct data sheet 12.1 23.760 DSB, DSF: ressure monitors and pressure switches How energy efficiency is improved Control and monitoring according to needs and with no auxiliary energy. Features For regulating

More information

Session One: A Practical Approach to Managing Safety Critical Equipment and Systems in Process Plants

Session One: A Practical Approach to Managing Safety Critical Equipment and Systems in Process Plants Session One: A Practical Approach to Managing Safety Critical Equipment and Systems in Process Plants Tahir Rafique Lead Electrical and Instruments Engineer: Qenos Botany Site Douglas Lloyd Senior Electrical

More information

FULL STAINLESS STEEL EXPLOSION-PROOF SOLUTIONS OIL & GAS I OFFSHORE AND ONSHORE

FULL STAINLESS STEEL EXPLOSION-PROOF SOLUTIONS OIL & GAS I OFFSHORE AND ONSHORE FULL STAINLESS STEEL EXPLOSION-PROOF SOLUTIONS OIL & GAS I OFFSHORE AND ONSHORE ASCO Numatics ASCO Numatics is the world leader in design, manufacturer of solenoid valves and accessories for both offshore

More information