Professional Documents
Culture Documents
www.eit.edu.au
EIT: E-Cert SS: Unit 7 Instrument Selection
www.eit.edu.au
EIT: E-Cert SS: Unit 7 Instrument Selection
◆Sensors and Actuators remain the most critical reliability items in an SIS
◆Failure modes and common cause issues are potential problems for
intelligent instruments Slide 3
www.eit.edu.au
EIT: E-Cert SS: Unit 7 Instrument Selection
Certified
compliant to Fault
IEC 61508 Prior use
tolerance Slide 4
justification
www.eit.edu.au
EIT: E-Cert SS: Unit 7 Instrument Selection
• The field devices taken together contribute 97% of the PFD for this example.
• The PFD figures for the field devices are affected by environmental conditions
• and maintenance factors.
Slide 5
• PES logic solvers benefit from auto-diagnostics.
www.eit.edu.au
EIT: E-Cert SS: Unit 7 Instrument Selection
See Session 5
Slide 6
www.eit.edu.au
EIT: E-Cert SS: Unit 7 Instrument Selection
Slide 7
www.eit.edu.au
EIT: E-Cert SS: Unit 7 Instrument Selection
www.eit.edu.au
EIT: E-Cert SS: Unit 7 Instrument Selection
SIS
Logic SIS
380 v ac
power Logic
Interlocks
M
Slide 9
www.eit.edu.au
EIT: E-Cert SS: Unit 7 Instrument Selection
E-Stop operation with VSDlInverter Drive
Stop Category 1
Safety Control Category 2
Power
Safet
y
Reset
Relay
K1 Time
Delayed
K1
Relay Drive
M
controller
E-Stop
command
Slide 10
www.eit.edu.au
EIT: E-Cert SS: Unit 7 Instrument Selection
www.eit.edu.au
EIT: E-Cert SS: Unit 7 Instrument Selection
Slide 12
www.eit.edu.au
EIT: E-Cert SS: Unit 7 Instrument Selection
SIL 3 requires
assessement and a safety
manual
Apply IEC 61511
limitations
And PFD must satisfy SIL target Slide 13
www.eit.edu.au
EIT: E-Cert SS: Unit 7 Instrument Selection
Slide 14
www.eit.edu.au
EIT: E-Cert SS: Unit 7 Instrument Selection
Boiler
SIS Logic Solver Trip
Boiler Steam
Drum LSL Logic
LT LIC
1 1
Feed water
supply
www.eit.edu.au
EIT: E-Cert SS: Unit 7 Instrument Selection
Figure 7.5 cont.
Separate Sensors for Control and Trip: Acceptable
Boiler
SIS Logic Solver Trip
LSL Logic
LT LT LIC
2 1 1
Boiler Steam
Drum
Feed water
supply
Slide 16
www.eit.edu.au
EIT: E-Cert SS: Unit 7 Instrument Selection
Figure 7.6
Fault Tree Analysis for Boiler Low Level Trip
Shared Sensor Separate Sensor
Boiler Damage Boiler Damage
0.105 / yr. 0.0075 / yr.
Low level and NO TRIP Low level and NO TRIP
OR
AND
Low level
FW Fails and LT-1 Fails 0.3 / yr.
No Trip high-No Trip
LIC causes OR LT-2 Fails high
0.005 / yr. Trip fails on
low level
demand
0.1 / yr.
AND PFD = 0.1/2 X 0.5
= 0.025
FW Fails LT-1 Fails
FW Fails Trip fails on demand from high, LIC-1
0.2 / yr.
FW failure causes low
0.2 / yr.
PFD = 0.1/2 X 0.5
level Slide 17
= 0.025 0.1 / yr.
www.eit.edu.au
EIT: E-Cert SS: Unit 7 Instrument Selection
Separation Rules: Field Sensors
IEC 61511 part 2 : 11.2.4
www.eit.edu.au
EIT: E-Cert SS: Unit 7 Instrument Selection
Separation Rules: Final Elements
IEC 61511 part 2 : 11.2.4
•A single valve may be used for both BPCS and SIS but
is not recommended if valve failure places a demand on
the SIS.
•Normally shared valve can only be used if: Diagnostic
coverage and reaction time are sufficient to meet
safety integrity requirements
• Recommendations for a single valve application
•SIL 2 and SIL 3 normally require identical or diverse
separation. Diversity not always desireble
Slide 19
www.eit.edu.au
EIT: E-Cert SS: Unit 7 Instrument Selection
SIS
BPCS
Solenoid valve
direct acting,
direct mounted. FY
De-energise to
vent actuator.
FV Positioner
A/S
www.eit.edu.au
EIT: E-Cert SS: Unit 7 Instrument SelectF
ioingure 7.8
Diverse Separation of Control and Shutdown Valves
SIL 2 and SIL 3
SIS BPCS
A/S
FY
Slide 21
Check hazard demands due to valve
www.eit.edu.au
EIT: E-Cert SS: Unit 7 Instrument Selection
Sensor Diagnostics
Slide 22
www.eit.edu.au
EIT: E-Cert SS: Unit 7 Instrument Selection
Valve Diagnostics
Assurance that a trip valve will respond correctly when needed
• Absence of sticking
www.eit.edu.au
EIT: E-Cert SS: Unit 7 Instrument Selection
• Discrepancy alarm
Slide 24
www.eit.edu.au
EIT: E-Cert SS: Unit 7 Instrument Selection
♦Limit is a function of
♦the hw fault tolerance
♦the safe failure fraction
♦the degree of confidence in the behaviour under fault
conditions
Details in IEC 61508 part 2
Slide 25
www.eit.edu.au
EIT: E-Cert SS: Unit 7 Instrument Selection
www.eit.edu.au
EIT: E-Cert SS: Unit 7 Instrument Selection
IEC 61511-1 Table 6: Minimum hardware fault tolerance of
sensors, final elements and non PES logic
SIL Minimum HW Fault Tolerance
1 0
2 1
3 2
4 Special requirements: See IEC 61508
The following summarized conditions apply for SIL 1,2 and 3 :
Alternatively tables 2 and 3 of IEC 61508 may be applied with an assessment Slide 27
www.eit.edu.au
EIT: E-Cert SS: Unit 7 Instrument Selection
Slide 28
www.eit.edu.au
EIT: E-Cert SS: Unit 7 Instrument Selection
Slide 29
www.eit.edu.au
EIT: E-Cert SS: Unit 7 Instrument Selection
Example for
Level
Switch:
Extract from
safety
manual
Slide 30
www.eit.edu.au
EIT: E-Cert SS: Unit 7 Instrument Selection
Table 7.4
Redundancy Options
Slide 31
www.eit.edu.au
EIT: E-Cert SS: Unit 7 Instrument Selection
♦Wrong specification
♦Environmental stress
♦Incorrect calibrators
Slide 32
www.eit.edu.au
EIT: E-Cert SS: Unit 7 Instrument Selection
SIS
PT PT
1A 1B
Be careful to analyze
for common cause
faults
e.g Try to avoid this
Slide 33
www.eit.edu.au
EIT: E-Cert SS: Unit 7 Instrument Selection
Comments on Diverse Redundancy in Sensors Figure 7.11
Where measurement is
the problem use diverse SIS
redundancy.
e.g. Steam or Ammonia
overpressure protection
PT
01
TT
01
Slide 34
www.eit.edu.au
EIT: E-Cert SS: Unit 7 Instrument Selection
• Adequate documentation
www.eit.edu.au
EIT: E-Cert SS: Unit 7 Instrument Selection
Key j ob f or
maint enance
• Each instrument that is suitable for SIS t eam
• Remove instruments from the list when they let you down
www.eit.edu.au
EIT: E-Cert SS: Unit 7 Instrument Selection
Additional requirements for smart transmitters
and actuators:
www.eit.edu.au
EIT: E-Cert SS: Unit 7 Instrument Selection
Figure 7.12
Hart Transmitter With Diagnostic Input
Hart
Interface SIS Logic Solver
Status Alarm
DI
Smart
Transmitter Hand Held
Programmer
Slide 38
FSK = Frequency Shift Keyed
www.eit.edu.au
EIT: E-Cert SS: Unit 7 Instrument Selection
Figure 7.14
Example of a Safety Critical Transmitter
Slide 39
www.eit.edu.au
EIT: E-Cert SS: Unit 7 Instrument Selection
Slide 40
www.eit.edu.au
EIT: E-Cert SS: Unit 7 Instrument Selection
Slide 41
www.eit.edu.au
EIT: E-Cert SS: Unit 7 Instrument Selection
www.eit.edu.au
EIT: E-Cert SS: Unit 7 Instrument Selection
www.eit.edu.au
EIT EQO26: Unit 8 Reliability Analysis
www.eit.edu.au Slide 44
EIT EQO26: Unit 8 Reliability Analysis
Introduction to Chapter 8:
Reliability Analysis of the SIS
• Identification of formulae
www.eit.edu.au Slide 45
EIT EQO26: Unit 8 Reliability Analysis
www.eit.edu.au Slide 46
EIT EQO26: Unit 8 Reliability Analysis
Terminology
www.eit.edu.au Slide 47
EIT EQO26: Unit 8 Reliability Analysis
Terminology
MTTFd Mean time to fail dangerously ( = 1/Zd)
MTTFs Mean time to fail safe (or spurious) ( = 1/Zs)
MTTRd Mean time to detect and repair a dangerous fault
Ti Time interval between proof tests
Zdd Failure rate for dangerous detectable faults
Zdu Failure rate for dangerous undetectable faults (requires
proof testing)
Zsd Safe revealed failure rate ( causes spurious trip or loss of
affected safety channel)
www.eit.edu.au Slide 48
EIT EQO26: Unit 8 Reliability Analysis
Compare PFDavg with the target PFDavg for the SIL range we need.
www.eit.edu.au Slide 49
EIT EQO26: Unit 8 Reliability Analysis
www.eit.edu.au Slide 50
EIT EQO26: Unit 8 Reliability A nalysis
Failure scenario for an Untested SIF
Unrevealed Dangerous fault
occurs
Hazardous condition
State of Process occurs (Demand)
Operating
safely Reportable
accident
occurs
Operating but
not protected
Mission time
1 yr 2 yr
www.eit.edu.au Slide 51
EIT EQO26: Unit 8 Reliability Analysis
Low Demand Mode: Proof Tested SIF repaired before demand
Unrevealed Dangerous
fault occurs
Hazardous condition
Proof test reveals Occurs (Demand)
Proof test fault
State of Process
Operating
Accident
safely
prevented
Fault
repaired
Operating but not
protected
Mission time
0.5 yr 1 yr
www.eit.edu.au Slide 52
EIT EQO26: Unit 8 Reliability Analysis
Low Demand Mode: Proof tested SIF but failure on demand
Unrevealed Dangerous Reportable
fault occurs accident
occurs
Operating
safely
Mission time
0.5 yr 1 yr
www.eit.edu.au Slide 53
EIT EQO26: Unit 8 Reliability Analysis
Diagnostic + Proof Tested SIF
Detectable Dangerous
fault occurs PFDavg = MTTD&R x Fail danger rate
Fault
detected &
repaired
wwtw
im
.eeits./eddauy.au Slide 54
EIT EQO26: Unit 8 Reliability Analysis
Low Demand Mode versus High Demand Mode
• Low demand mode applies when the demand on the SIS is equal to
or less than once per year. ( IEC 61511) . Alternatively no more than
two demands per proof test interval.
• Low demand calculations use PFDavg.
• Hazard event rate H = D x PFDavg
• High demand mode applies when the demand on the SIS is more
than once per year. ( IEC 61511) . Alternatively more than two
demands per proof test interval.
• High demand mode calculations use PFH probability of dangerous
failure per hour.
• Hazard event rate H = PFH
www.eit.edu.au Slide 56
EIT EQO26: Unit 8 Reliability Analysis
www.eit.edu.au Slide 57
EIT EQO26: Unit 8 Reliability Analysis
Design Iteration for Target PFD in Low Demand Mode
SRS defines the Risk Reduction Factor
PFD = 1/RRF Set Target PFD
Yes
www.eit.edu.au Slide 58
EIT EQO26: Unit 8 Reliability Analysis
Elements and terms in the SIS model
Protective System
Hazard Hazard
Demand Rate D (SIS) H Event Rate
www.eit.edu.au Slide 59
EIT EQO26: Unit 8 Reliability Analysis
Zdu
www.eit.edu.au Slide 60
EIT EQO26: Unit 8 Reliability Analysis
Hazard Rate v Demand Rate showing low and high demand modes
Accident Rate
Hazard H = Ld H = Fail rate Zd
Event
Rate H
H = L d ( 1–e - DTi/ 2 )
D x T<< 1
D x T> 1
Average
value PFDavg = L d .Ti/ 2
0
Ti 2Ti Time t
www.eit.edu.au Slide 62
EIT EQO26: Unit 8 Reliability Analysis
λ S = 1/MTBFsp λ D = 1/MTTFD
λD
Loss of Production λ DD λ DU
λS + λDD
Detectable Undetectable
Trips plant unless
2oo3 or 2oo2 voting by Self except by manual
Diagnostics proof testing
www.eit.edu.au Slide 63
EIT EQO26: Unit 8 Reliability Analysis
Example: Find the Safe and Dangerous Failure Modes
SIS H igh Level T rip
Logic Solver
PSV
AS LC
1
I/P
Fluid
Feed
FC FC
LT LT
1 2
www.eit.edu.au Slide 64
EIT EQO26: Unit 8 Reliability Analysis
1oo1 SIS Formulae
λ S = 1/MTBFsp λ D = 1/MTTFD
C= Coverage λD
www.eit.edu.au Slide 65
EIT EQO26: Unit 8 Reliability Analysis
1oo2 SIS Formulae
Single Channel SIS Fail Rates
λ S = 1/MTBFsp λ D = 1/MTTFD
C= Coverage λD
SP Trip Rate = 2 ( λs + λ DD) PFD1 =2(λ DD)2( MTTR)2 PFD2 =((λ D U .Ti)2)/3
www.eit.edu.au Slide 66
EIT EQO26: Unit 8 Reliability Analysis
Formula sets
Single Channel SIS Fail Rates
Overt Failures
Covert Failures
Spurious Trip Rate
Dangerous Failure Rate
λ S = 1/MTBFsp
λD = D
1/MTTF
C= Coverage
λD
www.eit.edu.au Slide 67
EIT EQO26: Unit 8 Reliability Analysis
Multi-channel Formula Sets for PFD and λs (excluding Figure 8.6
common mode failures )
Covert Failures
Overt Failures Dangerous Failure Rate
Spurious Trip Rate λd = 1/MTTF
λs = 1/MTBFsp Detectable Detectable
By Self By Manual
Diagnostics Proof testing
λ D D = DC. λ D λ D U = (1-DC) λ D
Voting Formula set 1 Formula set 2 Formula set 3
Spurious trip rate PFD due to diagnostics PFD due to proof test
(if detected but not tripped)
www.eit.edu.au Slide 68
EIT EQO26: Unit 8 Reliability Analysis
Sources of Reliability Data
http://www.sintef.no/Projectweb/PDS-Main-Page/PDS-Handbooks/
Sintef: http://www.sintefbok.no/Product.aspx?sectionId=65&productId=559&categoryId=10
Also see:
1. exida.com Reliability Handbook
2. Manufacturers’ Safety manuals for
specific SIL certified instruments
3. Faradip 3 Database
4. exida.com: Safety Automation
Equipment List ..Functional Safety
Assessment Reports
http://www.exida.com/index.php/resour
ces/sael/
www.eit.edu.au Slide 69
EIT EQO26: Unit 8 Reliability Analysis
Dual Channel Basic calculation of PFD
Note: Zdd omitted for clarity
Zdu
Zdu
If the fail to danger rate is Zdu and proof test interval is Ti.
(1-β) λd β λd
(1-β) λd Example:
2oo3 sensor with
common cause
failures
(1-β) λd
www.eit.edu.au Slide 71
EIT EQO26: Unit 8 Reliability Analysis
Formulae Sets with Common Cause Factor included
www.eit.edu.au Slide 72
EIT EQO26: Unit 8 Reliability Analysis
Dual Channel Basic calculation of PFD inc Common Cause 5%
Note: Zdd omitted for clarity
(1-β) λdu
β λdu
(1-β) λdu
www.eit.edu.au Slide 73
EIT EQO26: Unit 8 Reliability Analysis
2oo3 Channel Basic calculation of PFD inc Common Cause 5%
(1-β) λd
β λd
(1-β) λd
(1-β) λd
www.eit.edu.au Slide 74
EIT EQO26: Unit 8 Reliability Analysis
Formulae Sets with Common Cause Factor included
www.eit.edu.au Slide 75
EIT EQO26: Unit 8 Reliability Analysis
Calculation Table for PFDavg
Worked example for 1oo1
www.eit.edu.au Slide 76
EIT EQO26: Unit 8 Reliability Analysis
Calculation Table for PFDavg
Worked example for 1oo1
www.eit.edu.au Slide 77
EIT EQO26: Unit 8 Reliability Analysis
Formatted Calculation Table for PFDavg
(1-β) λ d
Worked example for 1oo2 β λd
(1-β) λ d
www.eit.edu.au Slide 78
EIT EQO26: Unit 8 Reliability Analysis
Formatted Calculation Tables for PFDavg
(1-β) λ d
Worked example for 2oo3 β λd
(1-β) λ d
(1-β) λ d
Formula for calculating PFDavg for 2oo3
PFDavg = ((1-þ)LDU xTi)2 + 6((1-þ)LDD x MTTR)2 +þ(LDU xTi/2)+þ(LDD)x MTTR
www.eit.edu.au Slide 79
EIT EQO26: Unit 8 Reliability Analysis
SIS Analysis Model Example
www.eit.edu.au Slide 80
EIT EQO26: Unit 8 Reliability Analysis
SIL 1
www.eit.edu.au Slide 81
EIT EQO26: Unit 8 Reliability Analysis
SIS Analysis: Step 2, identify channels in each stage
Example:Dual channel sensors and actuators, single channel logic
D Sensor Actuator H
Logic
Sensor
1oo2D Logic
Sensor 1oo1D
Expand detail of sensor sub system and apply fail rates for each item
www.eit.edu.au Slide 83
EIT EQO26: Unit 8 Reliability Analysis
SIS Analysis:
Step 4: Decide λdu, λdd and λs for the elements Step 5: Enter the
values to table and totalize
www.eit.edu.au Slide 84
EIT EQO26: Unit 8 Reliability Analysis
SIS Analysis: Step 6, find the PFDavg for the 1oo2 subsystem
Break out the common cause failure fraction for the redundant channels and calculate
PFD for each portion and add them together
(1-β) λ d
β = common cause failure fraction
(1-β) λ d
β λd 1oo1
www.eit.edu.au Slide 85
EIT EQO26: Unit 8 Reliability Analysis
SIS Analysis: Step 7, repeat steps 3 to 6 for each stage
Example: Dual channel sensors and actuators, single channel logic
Sensor Actuator
Logic
www.eit.edu.au Slide 86
EIT EQO26: Unit 8 Reliability Analysis
www.eit.edu.au Slide 87
EIT EQO26: Unit 8 Reliability Analysis
SIS Analysis: Example using the EIT Calculator
Data Input Table for Sensor Subsystem File na me: EIT GP SIL Calculator .xls
Proof Test Interval in Hrs (Ti) 8760
Common cause factor (B)% 5%
Mean Time To Test & Repair (Hrs) (MTTR) 24
www.eit.edu.au Slide 88
EIT EQO26: Unit 8 Reliability Analysis
www.eit.edu.au Slide 89
EIT EQO26: Unit 8 Reliability Analysis
Honeywell Safecalc example relevant to fig 8.16
www.eit.edu.au Slide 90
EIT EQO26: Unit 8 Reliability Analysis
SIS Analysis: Example Calculation for Spurious Trip
Example:Dual channel sensors and actuators, single channel logic
Sensor MTTF = 5 years, 75% safe failure fraction. C=0%, β = 10%, Ti = 0.5 yrs, MTTR = 8hrs
Logic MTTF = 10 years, 50% safe failure fraction. C= 95%, β = 10%, Ti = 1 yr
auto diagnostics test interval = 2 secs, MTTR = 24hrs
Actuator MTTF = 2 years, 80 % safe failure fraction. C= 0%, β = 10%, Ti = 0.25 yrs, MTTR =
24hrs
www.eit.edu.au Slide 91
EIT EQO26: Unit 8 Reliability Analysis
SIS Analysis: Example Calculation for Spurious Trip
Example :Dual channel sensors and actuators, single channel logic
Spurious Trip for 1oo1
ST = LS + LDD Logic solver 1oo1
.36
..0135
.0135
1oo1 .36
1oo2 1oo2
www.eit.edu.au Slide 93
EIT EQO26: Unit 8 Reliability Analysis
Reducing Spurious Trip Rate
Design Version B
.135
1oo2
www.eit.edu.au Slide 94
EIT EQO26: Unit 8 Reliability Analysis
• Show whether or not the SIS will satisfy the SIL target
www.eit.edu.au Slide 95
EIT EQO26: Unit 8 Reliability Analysis
www.eit.edu.au Slide 96
EIT EQO26: Unit 8 Reliability Analysis
Supplementary notes on Low Demand Mode versus High Demand
Mode
(also known as continuous mode)
■ Low demand mode applies when the demand on the SIS is equal to
or less than once per year. ( IEC 61511) . Alternatively no more than
two demands per proof test interval.
■ Low demand calculations use PFDavg.
■ Hazard event rate H = D x PFDavg
www.eit.edu.au Slide 97
EIT EQO26: Unit 8 Reliability Analysis
PSH
Pump
Zd=0.05 and Ti = 1/yr:
High v Low
SIS
Demand
Power
Hp safety Trip Calculation
Suppose the demand rate D is once per year and the overpressure event rate
= H/yr
www.eit.edu.au Slide 98
EIT EQO26: Unit 8 Reliability Analysis
PSH
Pump
Zd=0.05 and Ti = 1/yr: High v Low
Demand
Calculation
SIS
Power
PFDavg = 0.05 x ½ = 0.025. and
PFH = 0.05 /8760 = 5.7E-06/hr
www.eit.edu.au Slide 99
EIT EQO26: Unit 8 Reliability Analysis