# Modelling of Safety Instrumented Systems by using Bernoulli trials: towards the notion of odds on for SIS failures analysis

Laurent Cauffriez

► To cite this version:

Laurent Cauffriez. Modelling of Safety Instrumented Systems by using Bernoulli trials: towards the notion of odds on for SIS failures analysis. 13th European Workshop on Advanced Control and Diagnosis, Nov 2016, Lille, France. pp.012057, 10.1088/1742-6596/783/1/012057. [hal-03414914](https://HAL Id: hal-03414914)

Submitted on 26 Apr 2022

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
PAPER • OPEN ACCESS

# Modelling of Safety Instrumented Systems by using Bernoulli trials: towards the notion of odds on for SIS failures analysis

To cite this article: Laurent Cauffriez 2017 J. Phys.: Conf. Ser. 783 012057

View the article online for updates and enhancements.

You may also like

- *Weakly-correlated nodeless superconductivity in single crystals of Ca₃Ir₄Sn₁₃ and Sr₃Ir₄Sn₁₃ revealed by critical fields, Hall effect, and magnetoresistance measurements*
L M Wang, Chih-Yi Wang, Guan-Min Chen et al.

- *Biomatrix from goat-waste in sponge/gel/powder form for tissue engineering and synergistic effect of nanoceria*
Hemant Singh, Shiv Dutt Purohit, Rakesh Bhaskar et al.

- *Biomimetic porous scaffolds containing decellularized small intestinal submucosa and Sr²⁺/Fe³⁺ co-doped hydroxyapatite accelerate angiogenesis/osteogenesis for bone regeneration*
Wei Cui, Liang Yang, Ismat Ullah et al.

<figure><img src="image_2.png" /></figure>

IOP | ebooks™

Bringing together innovative digital publishing with
leading authors from the global scientific community.

Start exploring the collection-download the
first chapter of every title for free.
# Modelling of Safety Instrumented Systems by using Bernoulli trials: towards the notion of odds on for SIS failures analysis

Laurent Cauffriez

LAMIH - UMR CNRS 8201

University of Valenciennes

Le Mont Houy, F-59313, Valenciennes Cedex 9, France

laurent.cauffriez@univ-valenciennes.fr

**Abstract.** This paper deals with the modeling of a random failures process of a Safety Instrumented System (SIS). It aims to identify the expected number of failures for a SIS during its lifecycle. Indeed, the fact that the SIS is a system being tested periodically gives the idea to apply Bernoulli trials to characterize the random failure process of a SIS and thus to verify if the PFD (Probability of Failing Dangerously) experimentally obtained agrees with the theoretical one. Moreover, the notion of "odds on" found in Bernoulli theory allows engineers and scientists determining easily the ratio between “outcomes with success: failure of SIS” and “outcomes with unsuccess: no failure of SIS” and to confirm that SIS failures occur sporadically. A Stochastic P-temporised Petri net is proposed and serves as a reference model for describing the failure process of a 1oo1 SIS architecture. Simulations of this stochastic Petri net demonstrate that, during its lifecycle, the SIS is rarely in a state in which it cannot perform its mission. Experimental results are compared to Bernoulli trials in order to validate the powerfulness of Bernoulli trials for the modeling of the failures process of a SIS. The determination of the expected number of failures for a SIS during its lifecycle opens interesting research perspectives for engineers and scientists by completing the notion of PFD.

## 1. Introduction

The demand of a Safety Instrumented System (SIS) depends on the failure of the so called Equipment Under Control (EUC) which is an equipment, machinery, apparatus or plant used for manufacturing, process, transportation, medical or other activities [1]. The principle of SIS demand is given in Figure 1. The role of the SIS is to bring the EUC into a safe state when all safety barriers have failed (ultimate safety level) and to do it preventively when the SIS itself fails (integrity of the safety function).

Table 1 gives an overview of possible SIS architectures according to IEC 61508 standards [1]. Please note that for 1oo1 channel, any dangerous failure leads to a failure of the safety function when a demand arises. Two types of intrinsic failures can affect the well functioning of a SIS channel: Dangerous failure and Safe Failure. Dangerous failures are defined by [2] as failures that can provoke accidents because the failed SIS is unable to face a potentially dangerous event for the equipment under control. Safe failures of the SIS denote failures that have no consequence in terms of safety for the equipment under control.

<figure><img src="image_3.png" /></figure>
<figure><img src="image_4.png" /><figcaption>**Figure 1.** Principle of the demand of SIS</figcaption></figure>

<figure><img src="image_5.png" /><figcaption>**Table 1.** Architectures of Safety Instrumented Systems</figcaption></figure>

As a SIS is equipped with a self-diagnostic system, it is thus possible to detect intrinsic failures leading to a specific Safety Integrity Level of the SIS (SIL level of the SIS): the performance of the diagnostic depends on the ability of the diagnosis to care with some type of failures or not.

As described by [2], the tree of figure 2 gives the decomposition of the types of failures $\lambda$ ($\lambda$ is usually called failure rate and its unit is h$^{-1}$ or year$^{-1}$). Please note that all the SIL theory developed in IEC 61508 standards make a strong assumption: failure distributions are assumed to be exponential and failure rates are therefore constant regardless of the type of SIS architectures i.e. 1oo1, 1oo2, 1oo2D, 2oo2, 2oo3.

On this point of view, the architecture 1oo1 is the reference for theoretical SIL calculation. For the other types of architectures, SIL levels are usually deduced from the 1oo1 architecture by applying conventional probabilities for events i.e. $P(\text{Channel1} \cap \text{Channel2})$ for 1oo2 architecture and, $P(\text{Channel1} \cup \text{Channel2})$ for 2oo2 architecture,...

<figure><img src="image_6.png" /><figcaption>**Figure 2.** Classification of failures</figcaption></figure>

Markov models [3]-[4], Reliability block diagram [5], Cause-consequence diagrams [6], Stochastic Petri Nets models [7]-[9], Fault Tree models [10]-[11] or analytical expressions [12] have already
been proposed to assess the SIL level of safety systems architecture. This paper proposes a new and original approach to model the failure process of a SIS based onto Bernoulli trials theory, and aims to complete the notion of PFD given in IEC61508.

## 2. Reminder on PFDaverage (PFDavg)

The average probability of failing dangerously for the SIS architecture within the test interval [0, τ] is given in equation (1) and represented in figure 3. Applying simplifications proposed by [3] i.e. $ta \approx \frac{\tau}{2}$ and $\lambda D \cdot \frac{\tau}{2} \ll 1$, equation (1) becomes equation (2) which agrees with the one given in IEC standard 61508-6 for 1oo1 channel architecture. The mean value of time tcl for a channel unreliability on interval [0, τ] is equal to equation (3) (see figure 4).

$$PFDavg = 1 - e^{-\lambda D \cdot ta} \qquad (1)$$

$$PFDavg = 1 - e^{-\lambda D \cdot \frac{\tau}{2}} \approx \lambda D \cdot \frac{\tau}{2} \qquad (2)$$

$$tcl = \tau - ta \approx \frac{\tau}{2} \qquad (3)$$

<figure><img src="image_7.png" /><figcaption>Figure 3. Reminder of PFDavg</figcaption></figure>

<figure><img src="image_8.png" /><figcaption>Figure 4. Definition of the mean value of time tcl for dangerous failure in [0, τ]</figcaption></figure>
The corresponding value of SIL is found in Table 2 as defined by the standard IEC61508 [1]. A look at probabilities given in Table 2 points out that a dangerous failure occurs very rarely. Indeed, the probability that the SIS has no dangerous failures at age $\tau$ (inclusive or exclusive) i.e. that the SIS survives at age $\tau$ is very high and belongs to [0.99, 0.99999] according to SIL level 1 ($PFD<10^{-1}$) and SIL level 4 ($PFD\ge10^{-5}$) of Table 2.

<table><caption>**Table 2.** Safety Integrity Levels according to PFD</caption><thead><tr><th colspan="4">SIL</th></tr></thead><tbody><tr><td>4</td><td>10<sup>-5</sup> ≤</td><td>PFD</td><td>&lt; 10<sup>-4</sup></td></tr><tr><td>3</td><td>10<sup>-4</sup> ≤</td><td>PFD</td><td>&lt; 10<sup>-3</sup></td></tr><tr><td>2</td><td>10<sup>-3</sup> ≤</td><td>PFD</td><td>&lt; 10<sup>-2</sup></td></tr><tr><td>1</td><td>10<sup>-2</sup> ≤</td><td>PFD</td><td>&lt; 10<sup>-1</sup></td></tr></tbody></table>

For reminder, the probability to survive age $t$ (inclusive or exclusive) — i.e. the probability of no failure before age $t$ — is equal to (4).

$$R(t) = p = e^{-\lambda D \cdot t} \qquad (4)$$

Similarly, the probability of failure to age $t$ (inclusive or exclusive) is given by (5).

$$F(t) = 1 - p = 1 - e^{-\lambda D \cdot t} \qquad (5)$$

Therefore, a SIS can either survive at age $\tau$ with probability $p = e^{-\lambda D \cdot \tau}$ or fail dangerously within a test interval with a probability $F(t) = 1 - p = 1 - e^{-\lambda D \cdot t}$ for any $t \in [0, \tau]$. Please note that the maximal probability of failure is achieved at age $\tau$ and is equal to $U_{max} = F(\tau) = 1 - e^{-\lambda D \cdot \tau}$.

On the other hand, it is to be observed that there are two possible outcomes for the periodic test characterizing the failure process of the SIS: either "a failure appears within current test interval $[0,\tau]$" or "no failure appears within current test interval $[0,\tau]$". This observation has given us the idea to use Bernoulli trials for characterizing more deeply the failure behaviour of the SIS during its lifecycle.

### 3. Proposition of using Bernoulli trials to characterize the process failures of a SIS

#### 3.1 Reminder on Bernoulli experiment and Bernoulli trials

A Bernoulli experiment is a random experiment, the outcome of which can be classified in one of two mutually exclusive ways, say "success" or "unsuccess".

A sequence of Bernoulli trials occurs when a Bernoulli experiment is performed several independent times so that the probability of success, say $p$, remains the same from trial to trial.

Let a random variable $X$ being the number of success for an infinite sequence of Bernoulli trials and $n$ being the first $n$ trials, then [13]:

i) random variable $X$ has a binomial distribution and the probability that exactly $k$ successes occur in the first $n$ trials is given by $p(X = k) = \frac{n!}{k!(n-k)!} p^k (1-p)^{n-k}$ (6)

ii) the expected value of the random variable $X$ is one measure of the "centre" of the distribution and is the average of infinitely many observations on $X$, the expected value is defined as
$$E(X) = \mu_X = np. \qquad (7)$$

iii) the variance of the random variable X measure its "spread" and is defined as

$$V(X) = np(1-p). \qquad (8)$$

iv) the standard deviation $\sigma_X$ is the positive square root of the variance $\sigma_X = \sqrt{np(1-p)}$ (9)

v) odds on favour of success is the ratio of the probability of an event occurring to the probability of

$$\text{its not occurring and is equal to } Of = \frac{p}{1-p} = \frac{\text{Outcomes with success}}{\text{Outcomes with unsuccess}}. \qquad (10)$$

vi) odds against a success is the ratio of the probability of a not occurring event to the probability of its

$$\text{occurring and is equal to } Oa = \frac{1-p}{p} = \frac{\text{Outcomes with unsuccess}}{\text{Outcomes with success}}. \qquad (11)$$

vii) For a very large population of trials i.e. for $n \to +\infty$, probability p that trials result in success is

$$\text{given by } \frac{\text{Outcomes with Success}}{n} \to p \text{ as } n \to +\infty. \qquad (12)$$

## 3.2 Bernoulli trials to characterize the process of failures for a SIS

Let a random variable X characterizing the failure process of the SIS. If a parallel is drawn between Bernoulli experiment and SIS testing process, it comes that the outcome of periodic testing of the SIS can be classified as either:

- a success, "X=1, a SIS failure appears within current time interval [0,τ]" with probability

$$p = 1 - e^{-\lambda D \cdot \tau}. \qquad (13)$$

- an unsuccess, "X=0, no SIS failure appears within current time interval [0,τ]" with probability

$$1 - p = e^{-\lambda D \cdot \tau}. \qquad (14)$$

This way to model the random process of SIS failures thanks to Bernoulli trials is given in figure 5.

<figure><img src="image_9.png" /><figcaption>Figure 5. Application of Bernoulli trials to the modelling of SIS failures</figcaption></figure>

A first step of our study is to assess "odds on favour of a failure" Of for a SIS according to equation (10). On this point of view equation (15) gives the definition of "odds on favour of a failure" applied to the modelling of the failure process of a SIS and is obtained by replacing in equation (10)

probabilities p and 1-p by respectively $p = 1 - e^{-\lambda D \cdot \tau}$ and $1 - p = e^{-\lambda D \cdot \tau}$.

$$Of = \frac{p}{1-p} = \frac{1 - e^{-\lambda D \cdot \tau}}{e^{-\lambda D \cdot \tau}} \qquad (15)$$
The notion of "odds on" seems to be very interesting for the study of SIL levels because it gives the relative probability that the SIS will experience a failure. Moreover, "odds on" depend only on the failure rate $\lambda D$ and test interval $\tau$ fixed by the designer.

Table 3 gives a correspondence table between "odds on favour a failure" and SIL levels according IEC61508 standard. As for example, for an odd equals to 1/99 (upper limit of SIL 1), the SIS designer has to expect 1 outcome with success i.e. "X=1, a failure of the SIS appears within current interval [0,τ]" against 99 outcomes with unsuccess "X=0, no failure of the SIS appears within current interval [0,τ]".

<table><caption>**Table 3.** Odds on favour of failures for a SIS in comparison with SIL levels</caption><thead><tr><th>SIL</th><th>PFD</th></tr></thead><tbody><tr><td>4</td><td>10<sup>-5</sup> ≤</td></tr><tr><td>3</td><td>10<sup>-4</sup> ≤</td></tr><tr><td>2</td><td>10<sup>-3</sup> ≤</td></tr><tr><td>1</td><td>10<sup>-2</sup> ≤</td></tr></tbody></table>

<table><thead><tr><th>SIL</th><th>Odds on<br>favour a<br>SIS failure</th></tr></thead><tbody><tr><td>4</td><td>1/99999 ≤</td></tr><tr><td>3</td><td>1/9999 ≤</td></tr><tr><td>2</td><td>1/999 ≤</td></tr><tr><td>1</td><td>1/99 ≤</td></tr></tbody></table>

Another interesting point is that, during a long working time (or during the lifecycle), the SIS is subjected to a total number of N tests whose outcomes are either the system experiences a failure or not. One another advantage of Bernoulli trials is to have, from the beginning of the design, a first approximation of the number of times $\hat{r}$ (equation 16) that the SIS will be subject to a failure for a long working time according to expected value (7) and standard deviation (9).

$$ \hat{r} = N \cdot \frac{p}{1-p} = N \cdot \frac{1-e^{-\lambda D \cdot \tau}}{e^{-\lambda D \cdot \tau}} \qquad (16) $$

Please note that this way of assessing the estimated number of failures for a SIS consider that repair duration after a failure detection does not take time. Indeed, a long repair time leads to a reduction of the SIS working time and therefore, in the same proportion, to a reduction of the number of testing periods during its working time. Table 4 gives the expected value $E(X)$ and standard deviation of random variable X characterizing the failure process of a SIS by applying equations (7) and (9) of the Bernoulli theory.

In Table 4, the number of trials $n$ is assessed for a SIS working time expressed in hours and corresponding respectively to 1 year, 10 years, 100 years, 1000 years working time assuming that the test has a period $\tau$ equal to 1 hour. One advantage of Table 4 is to give an expected number of times that the SIS will have a failure during its working time: the more the number of testing is important, the more the estimation of SIS failures is good (See column 6).

Looking at Table 4 for $p=10^{-5}$, one can observe that the value of $E(X)$ differs by a factor that is multiple to 10 for column 3 (1 year), 4 (10 years), 5 (100 years) and 6 (1000 years): 0.0876 (1 year), 0.876 (10 years), 8.76 (100 years) and 87.6 (1000 years).

Please note that theory with equation (12) stipulates that the outcomes with success tends toward the probability $p$ if the number of trials $n$ tends to infinity.

Table 4 confirms that, for a long working time, the more the level of SIL is high, the more the probability of failures is low.
<table><caption>**Table 4.** Theoretical expected value of random variable X and standard deviation characterizing the failure process of a SIS</caption><thead><tr><th>1</th><th>2</th><th>3</th><th>4</th><th>5</th><th>6</th></tr><tr><td></td><td></td><td>1 year</td><td>10 years</td><td>100 years</td><td>1000 years</td></tr></thead><tbody><tr><td>p=<br/>P(Failure of SIS)</td><td></td><td>n=<br/>8760</td><td>n=<br/>87600</td><td>n=<br/>876000</td><td>n=<br/>8760000</td></tr><tr><td>10<sup>-5</sup></td><td>E(X)<br/>σ<sub>X</sub></td><td><strong>0.0876</strong><br/>±0.087</td><td><strong>0.876</strong><br/>±0.935</td><td><strong>8.76</strong><br/>±2.959</td><td><strong>87.6</strong><br/>±9.359</td></tr><tr><td>10<sup>-4</sup></td><td>E(X)<br/>σ<sub>X</sub></td><td><strong>0.876</strong><br/>±0.935</td><td><strong>8.76</strong><br/>±2.959</td><td><strong>87.6</strong><br/>±9.359</td><td><strong>876</strong><br/>±29.595</td></tr><tr><td>10<sup>-3</sup></td><td>E(X)<br/>σ<sub>X</sub></td><td><strong>8.76</strong><br/>±2.958</td><td><strong>87.6</strong><br/>±9.354</td><td><strong>876</strong><br/>±29.582</td><td><strong>8760</strong><br/>±93.548</td></tr><tr><td>10<sup>-2</sup></td><td>E(X)<br/>σ<sub>X</sub></td><td><strong>87.6</strong><br/>±9.312</td><td><strong>876</strong><br/>±29.448</td><td><strong>8 760</strong><br/>±93.125</td><td><strong>87 600</strong><br/>±294.489</td></tr><tr><td>10<sup>-1</sup></td><td>E(X)<br/>σ<sub>X</sub></td><td><strong>876</strong><br/>±28.078</td><td><strong>8 760</strong><br/>±88.791</td><td><strong>87 600</strong><br/>±280.784</td><td><strong>876 000</strong><br/>±887.918</td></tr></tbody></table>

To conclude this paragraph, it seems that equations (15) and (16) proposed in this paper are sufficient to characterize the failure process of a SIS. Indeed, the notion of "odds on" and the estimation of the expected value of failures that the SIS will experience during its working time (or its lifecycle) seems to complete the notion of PFD.

The target of the next paragraph is to propose a Stochastic P-temporized Petri Net that will serve as reference model for a 1001 SIS architecture in order to compare experimental simulation results with the theoretical failure process of a SIS modelled thanks to Bernoulli trials.

**4. Proposition of a reference model based onto a Stochastic P-temporized Petri Net for a 1001 SIS architecture**

For purposes of validation, a reference model based onto a Stochastic P-temporized Petri Net for a 1001 SIS architecture is given in figure 6.

The probability to survive during a test interval $\tau$ is modelled thanks the left branch of the Petri net given in figure 6. This agrees with equation (14).

The probability to fail during a test interval $\tau$ is very low and is modelled thanks the right branch of the Petri net given in figure 6. This agrees with equation (13).

The functioning of Stochastic P-temporized Petri Net given in figure 6 is the following:

Places P1 and P10 are marked at the beginning of the interval $[0,\tau]$. The mark in place P1 moves in place P2 (no failure occurs with a probability $e^{-\lambda D \cdot \tau} = 1 - p$) either in place P3 (a failure occurs with a probability $1 - e^{-\lambda D \cdot \tau} = p$.) If the SIS experiences a failure within $[0,\tau]$ interval, the failure is generated at time $ti \in [0,\tau]$ and place P4 is marked.

After a duration $d1$ equal to the duration of the periodic test interval $[0,\tau]$, the temporized place P10 is left and place P11 is marked: this models the duration of the testing of the SIS and repair process by making the assumption in this case study that the repair duration is equal to $d2=0$ hour. The
synchronization between Stochastic P-temporized Petri Nets -a- and -b- of figure 6 is made by the new arrival of the token in place P10.

<figure><img src="image_10.png" /><figcaption>**Figure 6.** Reference model based onto a Stochastic P-temporized Petri Net for a 1001 SIS architecture</figcaption></figure>

Discussion:

1) Please note that the use of a truncated exponential distribution function $EXPO(\lambda D, \tau)$ is absolutely necessary to generate with Monte Carlo algorithm failure events within $[0, \tau]$ interval. This crucial modelling point was demonstrated in [14] and is summarized in figure 7: $tevent \le \tau$ is equivalent to $Umax \le F(\tau)$ because $F(t)$ is an increasing function i.e. $\forall t \in [0, \tau]$, $F(t) \in [0, 1 - e^{-\lambda D \cdot \tau}]$ Therefore $F(t)$ must be truncated to the maximal value $Umax = F(\tau) = 1 - e^{-\lambda D \cdot \tau}$ when inverting the distribution function for the simulation of Monte Carlo. This is an essential condition to have statistical results closest to reality. Indeed, this modelling approach decomposes the simulation time $t$ into $n$ intervals, each interval having a length equals to $\tau$.

<figure><img src="image_11.png" /><figcaption>**Figure 7.** Truncation of failure distribution function $F(t)$ due to periodic testing of SIS</figcaption></figure>

2) This way of modelling the failure process of a SIS is closer to reality in so far as the probability to survive (left branch of Petri net -a-) or to fail (right branch of Petri net -a-) for the SIS is represented. Moreover, successive test intervals are really implemented and are not deduced "a posteriori" using mathematical modulo function "mod" as proposed in [1].
## 5. Validation of Bernoulli trials approach thorough simulation using Petri net reference model

To implement the Stochastic P-temporised Petri Nets of figure 6, we need a tool which:

1) can generate intermediate reports giving exactly the occurrence of failure events during the whole Monte Carlo simulation in order to verify failures appear within current time interval [nτ, (n+1)τ] with n ∈ [1,N] and N being the highest test number for the simulation.

2) implements the truncation of the failure distribution F(t) described in figure 7.

We have not found such Petri Nets open source software and we have therefore implemented the two proposed Stochastic P-temporised Petri Nets with SIMAN/ARENA discrete event simulation tool. Indeed, this tool allows to define user defined distribution functions and to generate intermediate reports during Monte Carlo simulation.

### 5.1 First experimental campaign: one year simulation (8760 hours)

During one year simulation, a total of N=8760 tests were observed and r=48 failures were counted. Over the whole Monte Carlo simulation duration i.e. 8760 h, the SIS was in down state during 20.53676887 h and in well functioning state during $\sum_{i=1}^{r} TTFi + (N - r) \cdot \tau = 27.46323113h + 8712h = 8739.463231 h$. An estimator of experimental MTTF can be assessed by using (17)

$$MTTF' = \frac{1}{\lambda'} = \frac{\sum_{i=1}^{r} TTFi + (N - r) \cdot \tau}{r} \qquad (17)$$

Therefore, it comes for this simulation $MTTF' = 182.0721506 h$ and $\lambda' = 5.492328 \cdot 10^{-3} h^{-1}$. These both values agree with input data of the model for $\lambda D = 5.10^{-3} h^{-1}$ and $\tau = 1h$. Moreover, Table 5 (last raw) shows an experimental $PFDavg$ equal to $2.344380 \cdot 10^{-3}$ and the system is of SIL2.

This experimental $PFDavg$ converges to the theoretical $PFDavg$ according to IEC61508 which is equal

$$\text{to } PFDavg - \text{IEC61508} = 1 - e^{-\lambda D \cdot \frac{\tau}{2}} = 2.4968776 \cdot 10^{-3}$$

There is a small deviation between the experimental PFD and the theoretical one of $1.52 \cdot 10^{-4}$ due to the simulation approach. Indeed, the mean value to failure for the whole simulation during one year is equal to 0.5721506486 h and is not therefore fully equal to $\tau/2$ as assumed by the theory due to the simulation duration of only one year. The simulation was deliberately limited to 1 year to display in this paper intermediate results such as number of failures and the time to failures.

Applying equation (15) to this case study, we have:

$$Of = \frac{p}{1-p} = \frac{1 - e^{-\lambda D \cdot \tau}}{e^{-\lambda D \cdot \tau}} = \frac{1 - e^{-0.005 \cdot 1}}{e^{-0.005 \cdot 1}} = 5.012 \cdot 10^{-3} \approx \frac{5}{995} \approx \frac{1}{199}$$

i.e. SIL2 according to our proposed Table 3 giving a correspondance between "odds on" Of and SIL levels. Equation (16) gives an estimated value of the number of failures equal to
$$ \hat{r} = N \cdot \frac{p}{1-p} = N \cdot \frac{1 - e^{-\lambda D \cdot \tau}}{e^{-\lambda D \cdot \tau}} = 43.90 $$

with a standard deviation $\sigma_X$ equals to

$$ \sigma_X = \sqrt{np(1-p)} = \sqrt{8760 \cdot e^{-0.005(1-e^{-0.005})}} = 6.59 $$
Therefore, it appears that the estimated number of failures with Bernoulli trials is equal to $43.9 \pm 6.59$ and agrees with experimental results that shows a number of failures of 48 for one year simulation i.e. 8760 tests.

<table><caption>**Table 5.** Time to failure of SIS within [0,τ] test interval for Petri Net of figure 6</caption><thead><tr><th>1</th><th>2</th><th>3</th><th>4</th></tr><tr><th>Test Number</th><th>[0,τ]<br>Test Interval</th><th>TTFi<br>Time To<br>Failure (h)</th><th>PFDi</th></tr></thead><tbody><tr><td>23</td><td>22 23</td><td>0.840897475</td><td>4.195661E-03</td></tr><tr><td>96</td><td>95 96</td><td>0.815554973</td><td>4.069472E-03</td></tr><tr><td>177</td><td>176 177</td><td>0.481352907</td><td>2.403871E-03</td></tr><tr><td>511</td><td>510 511</td><td>0.013132646</td><td>6.566108E-05</td></tr><tr><td>706</td><td>705 706</td><td>0.368733084</td><td>1.841967E-03</td></tr><tr><td>787</td><td>786 787</td><td>0.430220239</td><td>2.148789E-03</td></tr><tr><td>958</td><td>957 958</td><td>0.498859511</td><td>2.491189E-03</td></tr><tr><td>961</td><td>960 961</td><td>0.337026511</td><td>1.683714E-03</td></tr><tr><td>992</td><td>991 992</td><td>0.776835878</td><td>3.876646E-03</td></tr><tr><td>1679</td><td>1678 1679</td><td>0.519807192</td><td>2.595661E-03</td></tr><tr><td>1681</td><td>1680 1681</td><td>0.661869227</td><td>3.303876E-03</td></tr><tr><td>2307</td><td>2306 2307</td><td>0.505977449</td><td>2.526690E-03</td></tr><tr><td>2865</td><td>2864 2865</td><td>0.861548284</td><td>4.298476E-03</td></tr><tr><td>2922</td><td>2921 2922</td><td>0.957011002</td><td>4.773625E-03</td></tr><tr><td>3025</td><td>3024 3025</td><td>0.670537633</td><td>3.347074E-03</td></tr><tr><td>3061</td><td>3060 3061</td><td>0.943014111</td><td>4.703972E-03</td></tr><tr><td>3287</td><td>3286 3287</td><td>0.90349766</td><td>4.507300E-03</td></tr><tr><td>3461</td><td>3460 3461</td><td>0.959439348</td><td>4.785709E-03</td></tr><tr><td>3722</td><td>3721 3722</td><td>0.848264938</td><td>4.232343E-03</td></tr><tr><td>3920</td><td>3919 3920</td><td>0.619847404</td><td>3.094439E-03</td></tr><tr><td>4183</td><td>4182 4183</td><td>0.724616967</td><td>3.616529E-03</td></tr><tr><td>4190</td><td>4189 4190</td><td>0.499254092</td><td>2.493157E-03</td></tr><tr><td>4232</td><td>4231 4232</td><td>0.105261534</td><td>5.261692E-04</td></tr><tr><td>4382</td><td>4381 4382</td><td>0.253986804</td><td>1.269128E-03</td></tr><tr><td>4705</td><td>4704 4705</td><td>0.918368707</td><td>4.581317E-03</td></tr><tr><td>4789</td><td>4788 4789</td><td>0.865380558</td><td>4.317555E-03</td></tr><tr><td>4833</td><td>4832 4833</td><td>0.777793087</td><td>3.881413E-03</td></tr><tr><td>4882</td><td>4881 4882</td><td>0.62124863</td><td>3.101424E-03</td></tr><tr><td>5248</td><td>5247 5248</td><td>0.333491237</td><td>1.666067E-03</td></tr><tr><td>5303</td><td>5302 5303</td><td>0.138910404</td><td>6.943109E-04</td></tr><tr><td>5537</td><td>5536 5537</td><td>0.206943178</td><td>1.034181E-03</td></tr><tr><td>5605</td><td>5604 5605</td><td>0.47362704</td><td>2.365333E-03</td></tr><tr><td>5659</td><td>5658 5659</td><td>0.589422393</td><td>2.942773E-03</td></tr><tr><td>6044</td><td>6043 6044</td><td>0.440582291</td><td>2.200487E-03</td></tr><tr><td>6182</td><td>6181 6182</td><td>0.415179222</td><td>2.073743E-03</td></tr><tr><td>6222</td><td>6221 6222</td><td>0.476599278</td><td>2.380159E-03</td></tr><tr><td>6299</td><td>6298 6299</td><td>0.144121796</td><td>7.203494E-04</td></tr><tr><td>6444</td><td>6443 6444</td><td>0.809779702</td><td>4.040713E-03</td></tr><tr><td>6602</td><td>6601 6602</td><td>0.776676663</td><td>3.875853E-03</td></tr><tr><td>6632</td><td>6631 6632</td><td>0.921155936</td><td>4.595189E-03</td></tr><tr><td>7015</td><td>7014 7015</td><td>0.159845484</td><td>7.989081E-04</td></tr><tr><td>7181</td><td>7180 7181</td><td>0.605390804</td><td>3.022377E-03</td></tr><tr><td>7506</td><td>7505 7506</td><td>0.157438503</td><td>7.868828E-04</td></tr><tr><td>7589</td><td>7588 7589</td><td>0.863700893</td><td>4.309193E-03</td></tr><tr><td>7647</td><td>7646 7647</td><td>0.323336046</td><td>1.615374E-03</td></tr></tbody></table>
<table><tr><td>7655</td><td>7654</td><td>7655</td><td>0.546007133</td><td>2.726313E-03</td></tr><tr><td>7864</td><td>7863</td><td>7864</td><td>0.643066131</td><td>3.210167E-03</td></tr><tr><td>8226</td><td>8225</td><td>8226</td><td>0.658619149</td><td>3.287679E-03</td></tr><tr><td>Total of<br>8760 tests</td><td colspan="3">Mean value of<br>TTF=<br>0.5721506486h<br>≈ τ/2</td><td>PFDavg =<br>2.855810E-03</td></tr></table>

## 5.2 Second experimental campaign to validate Bernoulli trials approach: simulation of 50×1000 years

To validate more deeply the Bernoulli trials approach, five experimental campaigns are processed for 1001 architecture. For each campaign, the duration of the Monte Carlo simulation is equal to 1000 years i.e. 8760000h and 50 replications of 1000 years have been processed with input data for the Petri Net of figure 6 equal to $\tau=1h$, $d2=0h$, and $p$ respectively equal to $10^{-5}$, $10^{-4}$, $10^{-3}$, $10^{-2}$, $10^{-1}$.

Experimental results are given in Table 6, these results agree with Bernoulli trials approach:

- for $p=10^{-5}$, the total number of failures 85.42±10.115839 (column 2, raw 1 of Table 6) agrees with the theoretical expected value $E(X) \pm \sigma X = 87.6 \pm 9.3659$ of Table 4.

- the mean value of time to failure $ta$ is nearly equal to $\tau/2$ i.e. 0.5h (column 4, Table 6).

- the mean value of time to failures TTF (column 6, Table 6) and the mean time between failures (column 7, Table 6) agree with the Petri net input probability $p = 1 - e^{-\lambda D \cdot \tau}$ (column 1, Table 6).

<table><caption>**Table 6.** Experimental Mean and standard deviation of the SIS failures</caption><thead><tr><th>1</th><th>2</th><th>3</th><th>4</th><th>5</th><th>6</th><th>7</th><th>8</th></tr><tr><th>p</th><th>Total number of failures</th><th>Minimum value of ta</th><th>Mean value of ta</th><th>Maximum value of ta</th><th>Mean value of TTF</th><th>Mean time between failures</th><th>Mean number of test intervals between failures</th></tr></thead><tbody><tr><td>10<sup>-5</sup></td><td><strong>85.42</strong><br>±10.115839</td><td>0.00009458</td><td><strong>0.49900079</strong><br>±0.032264</td><td>0.99981460</td><td><strong>118653.484</strong><br>±123086.377</td><td><strong>129251.6532</strong><br>±140754.6694</td><td><strong>129251.6515</strong><br>±140754.6343</td></tr><tr><td>10<sup>-4</sup></td><td><strong>877.18</strong><br>±34.856375</td><td>0.00004919</td><td><strong>0.50241008</strong><br>±0.007729</td><td>0.99998673</td><td><strong>10949.0895</strong><br>±9945.1393</td><td><strong>9990.92294859</strong><br>±411.707434</td><td><strong>9990.91426960</strong><br>±411.71604453</td></tr><tr><td>10<sup>-3</sup></td><td><strong>8751.66</strong><br>±91.427591</td><td>0.00000299</td><td><strong>0.50039523</strong><br>±0.002863</td><td>0.99999839</td><td><strong>1201.17544004</strong><br>±1143.487393</td><td><strong>1000.93603695</strong><br>±10.436939</td><td><strong>1000.93603025</strong><br>±10.43694450</td></tr><tr><td>10<sup>-2</sup></td><td><strong>87539.18</strong><br>±307.392237</td><td>0.00000003</td><td><strong>0.49932122</strong><br>±0.001051</td><td>0.99999919</td><td><strong>125.116336</strong><br>±125.076263</td><td><strong>100.089623</strong><br>±0.409214</td><td><strong>100.0696276</strong><br>±0.350987401</td></tr><tr><td>10<sup>-1</sup></td><td><strong>875881.02</strong><br>±678.46812</td><td>0.00000002</td><td><strong>0.49129591</strong><br>±0.000355</td><td>0.999999964</td><td><strong>8.7671654</strong><br>±6.630121</td><td><strong>10.00135287</strong><br>±7.749970E-03</td><td><strong>10.00134994</strong><br>±7.745831E-03</td></tr></tbody></table>
## Conclusion

After an introduction, section 2 of the paper gives a reminder on PFDavg according to IEC61508. Section 3 proposes to use Bernoulli trials to characterize the process failure of a SIS during its working time i.e. during its lifecycle. The notion of "odds on" found in Bernoulli trials theory seems to be very interesting because it allows engineers and scientists to determine easily the ratio between "outcomes with failure of SIS" and "outcomes with no failure of SIS" for the whole population of tests of the SIS during its lifecycle. Section 4 proposes a Stochastic P-Temporized Petri net reference model for a 1001 SIS architecture, this Petri net helps to simulate the failure process of the SIS thanks to a Monte Carlo simulation. Section 5 makes a validation of the proposed approach by comparing simulation results of Stochastic Petri net with those based onto "odds on" and "expected value" of Bernoulli trials theory. Simulation results point out that expected values of SIS failures computed with Bernoulli trials approach agree with those obtained by Monte Carlo simulation for two experimental campaigns, the first one of one year and the second of 50 replications of thousand years. The ability of Bernoulli trials to characterize the sporadic occurrences of failures for a 1001 SIS architecture during its lifecycle was demonstrated in this paper. The main result of this study is to give the relative probability that the SIS will experience a failure in correspondence with SIL levels (see Table 3). Moreover, the introduction of expected value and standard deviation of the random variable characterizing the number of SIS failures for an infinite sequence of tests intervals (Bernoulli trials) complete the notion of PFD and allow to give a new approach to model the safety level of a SIS.

## References

[1] IEC 61508-6. Functional safety of electrical/electronic /programmable electronic safety-related systems. NF EN 61508-6. AFNOR Standard, January 2011.

[2] W.M. Goble, Control Systems Safety Evaluation and Reliability (2nd ed.). Research Triangle Park (NC): ISA (The Instrumentation, Systems, and Automation Society), 1998.

[3] T. Zhang, W. Long, Y. Sato, Availability of systems with self-diagnostic components - applying Markov model to IEC 61508-6. Reliability Engineering & System Safety, Vol. 80, pp. 133-141, 2003.

[4] W. Mechri, C. Simon, K.B. Othman, Switching Markov chains for a holistic modeling of SIS unavailability, Reliability Engineering and System Safety, Vol. 133, pp.212-222, 2015.

[5] H. Guo, X. Yang, "A simple reliability block diagram method for safety integrity verification", Reliability Engineering and System Safety, Vol. 92, pp. 1267-1273, 2007.

[6] J. Beugin, D. Renaux, L. Cauffriez, A SIL quantification approach based on an operating situation model for safety evaluation in complex guided transportation systems, In Reliability Engineering and System Safety, Vol. 92, pp. 1686-1700, 2007.

[7] P.J. Cacheux, S. Collas, Y. Dutuit, C. Folleau, J.P. Signoret, P. Thomas, Assessment of the expected number and frequency of failures of periodically tested systems, Reliability Engineering and System Safety, Vol. 118, pp. 61-70, 2013.

[8] J.P. Signoret, Y. Dutuit, P.J. Cacheux, C. Folleau, S. Collas, P. Thomas. Make your Petri nets understandable: Reliability block diagrams driven Petri nets, Reliability Engineering and System Safety, Vol. 113, pp. 61-75, 2013.

[9] Y. Liu, M. Rausand, Proof-testing strategies induced by dangerous detected failures of safety-instrumented systems, Reliability Engineering and System Safety, Vol. 145, pp. 366-372, 2016.

[10] F. Brissaud, D. Charpentier, A. Barros, C. Bérenguer, Design of complex safety-related systems in accordance with IEC 61508, Reliability, Risk and Safety: Theory and applications, Guedes Soares & Martorell (Eds), Taylor & Francis Group, London, ISBN 978-0-415-55509-8, 2010.

[11] Y. Dutuit, F. Innal, A. Rauzy J-P. Signoret. Probabilistic assessments in relationship with safety integrity levels by using fault trees. Reliability Engineering and System Safety, Vol. 93, pp. 1867-1876, (2008).

[12] M. Chebila, F. Innal, Generalized analytical expressions for safety instrumented systems' performance measures: PFDavg and PFH, Vol. 34, 167-176, 2015.

[13] J.B. Walsh, Knowing the Odds: An Introduction to Probability, American Mathematical Society, Vol. 139, ISBN: 978-0-8218-8532-1, 421 pages, 2012.

[14] L. Cauffriez, A review of SIL theory and a demonstration on the need to truncate the exponential distribution for the generation of SIS failures: Example for a 1001 channel architecture, QUALITA' 2015, Mar 2015, Nancy, France, https://hal.archives-ouvertes.fr/hal-01149814.