Presentation on theme: "IEC – IEC Presentation G.M. International s.r.l"— Presentation transcript:
1IEC 61508 – IEC 61511 Presentation G.M. International s.r.l Document last revised 20 May 2005G.M. International s.r.lVia San Fiorano, 7020058 Villasanta (Milano)ITALY
2Standard Definitions Title: Standard for Functional Safety of Electrical / Electronic / Programmable ElectronicSafety-Related SystemIEC has been developed as aProcess Sector of IEC 61508Title: Safety Instrumented Systems for theProcess Industry
3Standard HistoryThe IEC was conceived to define and harmonize a method to reduce risks of human and/or valuable harms in all environments.The IEC integrates and extendsAmerican Standard ISA-S84.01 (1996)and German DIN (1994).
5Other related standards DIN (1994)Title: “Fundamental Safety aspects to be considered for measuring and control equipment”Deals with Quantitative Risk Analysis used for Part 5 of IEC 61508, classification in AK classes 1-8 similar to SIL levelsISA-S84.01 (1996)Title: “Application of Safety Instrumented Systems (SIS) for the process industry”Defines Safety Lifecycles assuming Risk analysis and SIL been carried out.
6Fundamental Concepts Risk Reduction and Risk Reduction Factor (RRF) Safety Integrity Level (SIL)Independence Levels and consequencesProbability of Failure on Demand (PFD)ReliabilityAvailabilityFailure Rate (λ)Proof Test Interval between two proof tests (T[Proof])Failure In Time (FIT)Mean Time To Failure (MTTF)Mean Time Between Failure (MTBF)Mean Time To Repair (MTTR)Safe Failure Fraction (SFF)Safety LifecycleSafety Instrumented System (SIS)
7As Low As Reasonably Practicable or Tollerable Risk Fundamental ConceptsRisk ReductionAs Low As Reasonably Practicable or Tollerable Risk(ALARP ZONE)
9Safety Integrity Level (SIL) Fundamental ConceptsSafety Integrity Level (SIL)SIL levels (Safety Integrity Level)RRF (Risk Reduction Factor)PFD avg (Average Probability of Failure on Demand)SIL Table for Demand and Continuous mode of Operation
10Independence Levels Assessement Independence Level Fundamental ConceptsIndependence LevelsAssessement Independence Levelas a function of consequences
11Probability of Failure on Demand Fundamental ConceptsPFDavg / RRFCorrelation betweenProbability of Failure on DemandandRisk Reduction Factor
12Reliability Reliability is a function of operating time. Fundamental ConceptsReliabilityReliability is a function of operating time.All reliability functions start from reliability one and decrease to reliability zero. The device must be successful for an entire time interval.The statement: “Reliability = 0.76 for a time of hs” makes perfect sense.R(t) = P(T>t)
13Fundamental ConceptsReliabilityReliability is the probability that a device will perform its intended function when required to do so,if operated within its specified design limits.The device “intended function” must be known.“When the device is required to function” must be judged.“Satisfactory performance” must be determined.The “specified design limits” must be known.Mathematically reliability is the probability that a devicewill be successful in the time interval from zero to tin term of a random variable T.
14Fundamental ConceptsAvailabilityAvailability is the probability that a device is successful attime t.No time interval is involved.A device is available if it’s operating.The measure of success is MTTF (Mean Time To Failure)
15Fundamental ConceptsMTTFMTTF is an indication of the average successful operating time of a device (system) before a failure in any mode.MTBF (Mean Time Between Failures)MTBF = MTTF + MTTRMTTF = MTBF - MTTRMTTR (Mean Time To Repair)Since (MTBF >> MTTR) MTBF is very near to MTTF in value.
16MTBF and Failure Rate Relation between MTBF and Failure Rate λ Fundamental ConceptsMTBF and Failure RateRelation between MTBF and Failure Rate λFailure per unit timeλ = =Quantity Exposed MTBF1 Quantity ExposedMTBF = =λ Failure per unit time
17λ = ------------------------------- = ----------------- = Fundamental ConceptsMTBF - ExampleInstantaneous failure rate is commonly used as measure of reliability.Eg. 300 Isolators have been operating for 10 years. 3 failures have occurred. The average failure rate of the isolators is:Failure per unit timeλ = = =Quantity Exposed *10*8760= per hour == 38 FIT (Failure per billion hours) == 38 probabilities of failure in one billion hours.MTBF = 1 / λ = 303 years (for constant failure rate)
18Failure Rate Categories Fundamental ConceptsFailure Rate Categoriesλ tot = λ safe + λ dangerousλ s = λ sd + λ suλ d = λ dd + λ duλ tot = λ sd + λ su + λ dd + λ duWhere:sd = Safe detectedsu = Safe undetecteddd = Dangerous detecteddu = Dangerous undetected
19Fundamental ConceptsFITFailure In Time is the number of failures per one billion devices hours.1 FIT = 1 Failure in 109 hours == 10-9 Failures per hour
20SFF (Safe Failure Fraction) Fundamental ConceptsSFF (Safe Failure Fraction)SFF summarizes the fraction of failures,which lead to a safe state and the fraction of failurewhich will be detected by diagnostic measureand lead to a defined safety action
21Fundamental ConceptsType A SFF ChartType A components are described as simple devices with well-known failure modes and a solid history of operation
22Fundamental ConceptsType B SFF ChartType B: “Complex” component (using micro controllers or programmable logic); according of IEC
23Fundamental ConceptsHSE StudyResults of system failure cause study done by English “Health and Safety Executive” (HSE)
24Safety Lifecycle Origin Fundamental ConceptsSafety Lifecycle Origin
26Safety Lifecycle 2/5 First portion of the overall safety lifecycle Fundamental ConceptsSafety Lifecycle 2/5First portion of the overall safety lifecycleANALYSIS (End user / Consultant)
27Realisation activities in the overall safety lifecycle Fundamental ConceptsSafety Lifecycle 3/5Realisation activities in the overall safety lifecycle
28Safety Lifecycle 4/5 Safety lifecycle for the E/E/PES Fundamental ConceptsSafety Lifecycle 4/5Safety lifecycle for the E/E/PES(Electrical / Electronic / Programmable Electronic)Safety - Related System (IEC 61508, Part 2)
29Safety Lifecycle 5/5 Last portion of the overall safety lifecycle Fundamental ConceptsSafety Lifecycle 5/5Last portion of the overall safety lifecycleOPERATION (End User / Contractor)
30SIS SIS (Safety Instrumented System) Fundamental ConceptsSISSIS (Safety Instrumented System)according to IEC and IEC 61511
31Safety Instrumented Systems IEC 61511Safety Instrumented Systemsfor Process IndustryIEC has been developed as a Process Sector implementation of the IECThe Safety Lifecycle forms the central framework which links together most of the concepts in this standard, and evaluates process risks and SIS performance requirements (availability and risk reduction).Layers of protection are designed and analysed.A SIS, if needed, is optimally designed to meet particular process risk.
32Process sector system standard IEC 61511Process sector system standard
33The Standard is divided into three Parts IEC 61511IEC PartsThe Standard is divided into three PartsPart 1: Framework, Definitions, Systems, Hardware and Software RequirementsPart 2: Guidelines in the application of IECPart 3: Guidelines in the application of hazard and risk analysis
34IEC 61511IEC Part 3Guidelines in the application of hazard and risk analysis
35Failure Modes and Effects Diagnostic Analysis (FMEDA) Is one of the steps taken to achieve functional safety assessement of a device per IEC and is considered to be a systematic way to:identify and evaluate the effects of each potential component failure mode;classify failure severity;determine what could eliminate or reduce the chance of failure;document the system (or sub-system) under analysis.
36FMEDA The following assumptions are usually made during the FMEDA Constant Failure Rates (wear out mechanisms not included)Propagation of failures is not relevantRepair Time = 8 hoursStress levels according IEC , Class C (sheltered location), with temperature limits within the manufacturer’s rating and an average temperature over a long period of time of 40°C
41SIL3 using SIL2 subsystem SIL3 Control Loop or Safety Function using SIL2 SubSystems in 1oo2 Architecture
42Safety ManualA Safety Manual is a document provided to users of a product that specifies their responsabilities for installation and operation in order to maintain the design safety level.The following information shall be available for each safety-related sub-system ..
43Safety Manual Requirements Functional specification and safety functionEstimated rate of failure in any mode which would cause both undetected and detected safety function dangerous failuresEnvironment and lifetime limits for the sub-systemPeriodic Proof Tests and/or maintainance requirementsT proof test time intervalInformation necessary for PFDavg, MTTR, MTBF, SFF, λdu, λtotalHardware fault tolerance and failure categoriesHighest SIL that can be claimed (not required for proven in use sub-systems)Documentary evidence for sub-system’s validation (EXIDA)Proof Test Procedures to reveal dangerous faults which are undetected by diagnostic tests.
44SIL Table for operative modes “high” and “low” demand Using the Safety ManualStandard referencesRemembering that:SIL (Safety Integrity Level)RRF (Risk Reduction Factor)PFD avg (Average Probability of Failure on Demand)SIL Table for operative modes “high” and “low” demand
45Using the Safety Manual Standard referencesRemembring definitions given for type “A” and “B” components,sub-systems, and related SFF values
46Loop PFDavg calculation Using the Safety ManualLoop PFDavg calculation1oo1 typical control loopPFDavg(sys) = PFDavg(tx) + PFDavg(i) + PFDavg(c) + PFDavg(fe)
47Loop PFDavg calculation Using the Safety ManualLoop PFDavg calculationFor calculating the entire loop’s reliability (Loop PFDavg), PFDavg values for each sub-systems must first be found and be given a proportional value (“weight”) compared to the total 100%.This duty is usually assigned to personnel in charge of plant’s safety, process and maintainance.
48Loop PFDavg calculation Using the Safety ManualLoop PFDavg calculationEquation for 1oo1 loopWhere:RT = repair time in hours (conventionally 8 hours)T1 = T proof test, time between circuit functional tests ( years)λdd = failure rate for detected dangerous failuresλdu = failure rate for undetected dangerous failures
49Loop PFDavg calculation Using the Safety ManualLoop PFDavg calculationIf T1 = 1 year thenbut being λdd * 8 far smaller than λdu * 4380
50For D1014 λdu is equal to 34 FIT (see manual) Using the Safety ManualExample 1PFDavg = λdu * T1/2For D1014 λdu is equal to 34 FIT (see manual)ThereforePFDavg = 34 * 10-9 * 4380 == 0, = FIT
51Using the Safety Manual Example 2“Weights” of each sub-system in the loop must be verified in relation with expected SIL level PFDavg and data from the device’s safety manual.For example, supposing SIL 2 level to beachieved by the loop on the right in a lowdemand mode:PFDavg(sys) is between 10-3 and 10-2 per year“Weight” of D1014 Isolator is 10%Therefore PFDavg(i) should be between 10-4 and 10-3 per year.
52Using the Safety Manual Example 2Given the table above (in the safety manual) conclusions are:Being D1014 a type A component with SFF = 90%, it can be used both in SIL 2 and SIL 3 applications.PFDavg with T proof = 1yr allows SIL3 applicationsPFDavg with T proof = 5yr allows SIL2 applicationsPFDavg with T proof = 10yr allows SIL1 applications
53Using the Safety Manual 1oo2 architectureWhat happens if the total PFDavg does not reach the wanted SIL 2 level, or the end user requires to reach a higher SIL 3 level?The solution is to use a 1oo2 architecture which offers very low PFDavg, thus increasing fail-safe failure probabilites.
541oo2 architecture Using the Safety Manual For D1014S (1oo1): PFDavg = λdu* T1/2PFDavg = FITFor D1014D (1oo2):PFDavg = (λdun* T1)2/2 + (λdun* T1)2 /3PFDavg = 75 FITIn this case a 1oo2 architecture gives a 2000 times smaller PFDavg for the sub-system
55Final considerations Using the Safety Manual Always check that the Safety Manual contains information necessary for the calculation of SFF and PFDavg values.Between alternative suppliers, choose the one that offers:highest SIL level,highest SFF value,longest T[proof] time interval for the same SIL level,lowest value of PFDavg for the same T[proof].When in presence of units with more than one channel and only one power supply circuit, the safety function allows the use of only one channel. Using both of the channels is allowed only when supply is given by two independent power circuits (like D1014D).Check that the Safety Manual provides all proof tests procedures to detect dangerous undetected faults.
56Document last revised 20 May 2005 Credits and ContactsG.M. International s.r.lVia San Fiorano, 7020058 Villasanta (Milan)ITALYDocument last revised 20 May 2005TR Automatyka Sp. z o.o.ul. Lechicka 14WarszawaPOLAND