Failure Modes, Effects and Diagnostic Analysis
Project:
Diaphragm ValvesCompany:
Bürkert Fluid Control Systems
Ingelfingen
Germany

Contract Number: Q19/02-177
Report No.: BUR 19/02-177 R006
Version V1, Revision R1, July 23, 2019
Steven Close

The document was prepared using best effort. The authors make no warranty of any kind and shall not be liable in any
event for incidental or consequential damages in connection with the application of the document.
© All rights reserved.

Management Summary
This report summarizes the results of the hardware assessment in the form of a Failure Modes,
Effects, and Diagnostic Analysis (FMEDA) of the Diaphragm Valves. A Failure Modes, Effects, andDiagnostic Analysis is one of the steps to be taken to achieve functional safety certification per
IEC 61508 of a device. From the FMEDA, failure rates are determined. The FMEDA that is
described in this report concerns only the hardware of the Diaphragm Valve. For full functionalsafety certification purposes all requirements of IEC 61508 must be considered.
The Diaphragm Valve safety function is to close full stroke, close with tight shutoff and open on atrip of the safety system depending on the integral spring return actuator configuration.
This FMEDA is applicable to the following Diaphragm Valves:
Type 2030/2031/2032/2033/AP2030
Type 2103/2104/2105/AP09
The results are based on the analysis of the 2031 ANTG-H and the 2103 ANTG-P which wereconsidered representative of the Diaphragm Valve types. Table 1 gives an overview of the different
versions that were considered in this FMEDA.
Table 1 Version Overview

Option 1

2031 ANTG-H, Full Stroke, Tight Shutoff, & Open on Trip; Clean Service

Option 22031 ANTG-H, Full Stroke, Tight Shutoff, & Open on Trip; Severe Service

Option 32103 ANTG-P, Full Stroke, Tight Shutoff, & Open on Trip; Clean Service

Option 42103 ANTG-P, Full Stroke, Tight Shutoff, & Open on Trip; Severe Service

The Diaphragm Valves are classified as Type A 1 elements according to IEC 61508, having a
hardware fault tolerance of 0.
The failure rate data used for this analysis meets the exida criteria for Route 2H. See Section 5.2.
Therefore, the Diaphragm Valve can be classified as a 2H device when the listed failure rates areused. When 2H data is used for all of the devices in an element, then the element meets the
hardware architectural constraints up to SIL 2 at HFT=0 (or SIL 3 @ HFT=1) per Route 2H. If Route2H is not applicable for the entire final element, the architectural constraints will need to beevaluated per Route 1H.
Based on the assumptions listed in 4.3, the failure rates for the Diaphragm Valve are listed in
section 4.4.
These failure rates are valid for the useful lifetime of the product, see Appendix A.
The failure rates listed in this report are based on over 250 billion-unit operating hours of processindustry field failure data. The failure rate predictions reflect realistic failures and include site
specific failures due to human events for the specified Site Safety Index (SSI), see section 4.2.2.
A user of the Diaphragm Valve can utilize these failure rates in a probabilistic model of a safety
instrumented function (SIF) to determine suitability in part for safety instrumented system (SIS)
usage in a particular safety integrity level (SIL).
1 Type A element: “Non-Complex” element (using discrete components); for details see 7.4.4.1.2 of IEC 61508-2, ed2,

2010.
© exidaT-126 V3,R4

BUR_19-02-177_R006_Diaphragm_Valves_V1R1.docx
exida 80 N. Main St, Sellersville, PA 18960
Page 2 of 31

Table of Contents
1 Purpose and Scope ........................................................................................................ 4
2 Project Management ...................................................................................................... 5
2.1
2.2
2.3
2.4

exida ................................................................................................................................. 5
Roles of the parties involved .............................................................................................. 5Standards and literature used ............................................................................................ 5
Reference documents ....................................................................................................... 6
2.4.1 Documentation provided by Bürkert Fluid Control Systems ....................................... 6
2.4.2 Documentation generated by exida .......................................................................... 6

3 Product Description ........................................................................................................ 7
4 Failure Modes, Effects, and Diagnostic Analysis ............................................................ 8
4.1 Failure categories description ............................................................................................ 8
4.2 Methodology – FMEDA, failure rates ................................................................................. 9
4.2.1 FMEDA ..................................................................................................................... 9
4.2.2 Failure rates .............................................................................................................. 9
4.3 Assumptions .................................................................................................................... 10
4.4 Results ............................................................................................................................ 11

5 Using the FMEDA Results ............................................................................................ 15
5.1 PFDavg calculation Diaphragm Valve................................................................................ 15
5.2 exida Route 2H Criteria.................................................................................................... 15

6 Terms and Definitions................................................................................................... 17
7 Status of the Document ................................................................................................ 19
7.1
7.2
7.3
7.4

Liability ............................................................................................................................ 19
Version History ................................................................................................................ 19
Future enhancements...................................................................................................... 19
Release signatures .......................................................................................................... 19

Appendix A
Appendix B

Lifetime of Critical Components ................................................................ 20
Proof Tests to Reveal Dangerous Undetected Faults .............................. 21

B.1 Suggested Proof Test ...................................................................................................... 21
B.2 Proof Test Coverage ....................................................................................................... 22

Appendix C
Appendix D
Appendix E

exida Environmental Profiles ................................................................... 24
Determining Safety Integrity Level ............................................................ 25
Site Safety Index ...................................................................................... 29

E.1 Site Safety Index Profiles................................................................................................. 29
E.2 Site Safety Index Failure Rates – Diaphragm Valve ........................................................ 30© exidaT-126 V3,R4

BUR_19-02-177_R006_Diaphragm_Valves_V1R1.docx
exida 80 N. Main St, Sellersville, PA 18960
Page 3 of 31

1

Purpose and Scope

This document shall describe the results of the hardware assessment in the form of the Failure
Modes, Effects and Diagnostic Analysis carried out on the Diaphragm Valve. From this, failure
rates for each failure mode/category, useful life, and proof test coverage are determined.
The information in this report can be used to evaluate whether an element meets the average
Probability of Failure on Demand (PFDavg) requirements and if applicable, the architectural
constraints / minimum hardware fault tolerance requirements per IEC 61508 / IEC 61511.
A FMEDA is part of the effort needed to achieve full certification per IEC 61508 or other relevant
functional safety standard.

© exidaT-126 V3,R4

BUR_19-02-177_R006_Diaphragm_Valves_V1R1.docx
exida 80 N. Main St, Sellersville, PA 18960
Page 4 of 31

2

Project Management

2.1

exida

exida is one of the world’s leading accredited Certification Bodies and knowledge companies
specializing in automation system safety, availability, and cybersecurity with over 500-person yearsof cumulative experience in functional safety, alarm management, and cybersecurity. Founded byseveral of the world’s top reliability and safety experts from manufacturers, operators andassessment organizations, exida is a global corporation with offices around the world. exida
offers training, coaching, project-oriented consulting services, safety engineering tools, detailed
product assurance and ANSI accredited functional safety and cybersecurity certification. exida
maintains a comprehensive failure rate and failure mode database on electronic and mechanicalequipment and a comprehensive database on solutions to meet safety standards such as
IEC 61508.

2.2

Roles of the parties involved

Bürkert Fluid Control Systems

Manufacturer of the Diaphragm Valve

exida

Performed the hardware assessment

Bürkert Fluid Control Systems contracted exida with the hardware assessment of the abovementioned device.

2.3

Standards and literature used

The services delivered by exida were performed based on the following standards / literature.
[N1]

IEC 61508-2: ed2, 2010

Functional Safety of Electrical/Electronic/Programmable
Electronic Safety-Related Systems[N2]

Mechanical Component
Reliability Handbook, 4th
Edition, 2016

exida LLC, Electrical & Mechanical Component Reliability

Safety Equipment
Reliability Handbook, 4th
Edition, 2015

exida LLC, Safety Equipment Reliability Handbook,[N4]

Goble, W.M., 2010

Control Systems Safety Evaluation and Reliability, 3rdedition, ISA, ISBN 97B-1-934394-80-9. Reference on
FMEDA methods[N5]

IEC 60654-1:1993-02,
second edition

Industrial-process measurement and control equipment –Operating conditions – Part 1: Climatic condition[N6]

O’Brien, C., Stewart, L., &Bredemeyer, L., 2018

exida LLC., Final Elements in Safety Instrumented

Scaling the Three Barriers,
Recorded Web Seminar,
June 2013

http://www.exida.com/Webinars/Recordings/SIFVerification-Scaling-the-Three-Barriers

[N3]

[N7]

© exidaT-126 V3,R4

Handbook, Fourth Edition, 2016 (pending publication, notpublicly available at the time of this report)
Fourth Edition, 2015, ISBN 978-1-934977-13-2

Systems IEC 61511 Compliant Systems and IEC 61508
Compliant Products, 2018, ISBN 978-1-934977-18-7

BUR_19-02-177_R006_Diaphragm_Valves_V1R1.docx
exida 80 N. Main St, Sellersville, PA 18960
Page 5 of 31

[N8]Meeting Architecture
Constraints in SIF Design,
Recorded Web Seminar,
March 2013

http://www.exida.com/Webinars/Recordings/MeetingArchitecture-Constraints-in-SIF-Design[N9]

Random versus
Systematic – Issues andSolutions, September 2016

http://www.exida.com/Resources/Whitepapers/randomversus-systematic-failures-issues-and-solutions[N10]

Bukowski, J.V. andChastain-Knight, D., April
2016

Assessing Safety Culture via the Site Safety IndexTM,
Proceedings of the AIChE 12th Global Congress on
Process Safety, GCPS2016, TX: Houston[N11]

Bukowski, J.V. and
Stewart, L.L., April 2016

Quantifying the Impacts of Human Factors on Functional
Safety, Proceedings of the 12th Global Congress on
Process Safety, AIChE 2016 Spring Meeting, NY: New
York

[N12]

Criteria for the Applicationof IEC 61508:2010 Route
2H, December 2016

exida White Paper, Sellersville, PA
www.exida.com[N13]

Goble, W.M. andBrombacher, A.C.,
November 1999, Vol. 66,
No. 2

Using a Failure Modes, Effects and Diagnostic Analysis(FMEDA) to Measure Diagnostic Coverage inProgrammable Electronic Systems, Reliability Engineeringand System Safety, Vol. 66, No. 2, November 1999.

2.4

Reference documents

2.4.1 Documentation provided by Bürkert Fluid Control Systems[D1]

9000455418, 13-May-19

Bill of Material, Type 2031 all DN[D2]9000455371, 13-May-19

Drawing, Typ 2031

[D3]

9000457048, 13-May-19

Bill of Material, Type 2103 all DN[D4]9000457044, 17-Apr-19

Drawing, Typ 2103

2.4.2 Documentation generated by exida[R1]

BUR 19-02-177_2031
FMEDA, 28-May-19

Failure Modes, Effects, and Diagnostic Analysis – Type2012 Diaphragm Valve (internal document)[R2]

BUR 19-02-177_2103
FMEDA, 28-May-19

Failure Modes, Effects, and Diagnostic Analysis – Type
2101 Diaphragm Valve (internal document)© exidaT-126 V3,R4

BUR_19-02-177_R006_Diaphragm_Valves_V1R1.docx
exida 80 N. Main St, Sellersville, PA 18960
Page 6 of 31

3

Product Description

The Diaphragm Valve safety function is to close full stroke, close with tight shutoff and open on atrip of the safety system depending.
This FMEDA is applicable to the following Diaphragm Valves:
Type 2030/2031/2032/2033/AP2030
Type 2103/2104/2105/AP09
The Diaphragm Valves utilize integral spring return piston actuators. The valves designated SFA
are for safety functions where the safe state is with the valve closed and SFB where the safe stateis with the valve open.

Type 2030/2031/2032/2033/AP2030

Type 2103/2104/2105/AP09

Figure 1 Typical Diaphragm Valve covered in this FMEDA

Table 2 gives an overview of the different versions that were considered in the FMEDA of theDiaphragm Valve.
Table 2 Version Overview

Option 1

2031 ANTG-H, Full Stroke, Tight Shutoff, & Open on Trip; Clean Service

Option 22031 ANTG-H, Full Stroke, Tight Shutoff, & Open on Trip; Severe Service

Option 32103 ANTG-P, Full Stroke, Tight Shutoff, & Open on Trip; Clean Service

Option 42103 ANTG-P, Full Stroke, Tight Shutoff, & Open on Trip; Severe Service

The Diaphragm Valves are classified as Type A 2 elements according to IEC 61508, having a
hardware fault tolerance of 0.

2 Type A element: “Non-Complex” element (using discrete components); for details see 7.4.4.1.2 of IEC 61508-2, ed2,

2010.
© exidaT-126 V3,R4

BUR_19-02-177_R006_Diaphragm_Valves_V1R1.docx
exida 80 N. Main St, Sellersville, PA 18960
Page 7 of 31

4

Failure Modes, Effects, and Diagnostic Analysis

The Failure Modes, Effects, and Diagnostic Analysis was performed based on the documentation
listed in section 2.4.1 and is documented in [R1] and [R2].

4.1

Failure categories description

In order to judge the failure behavior of the Diaphragm Valve, the following definitions for the failureof the device were considered.
Fail-Safe State:
Actuator, Spring Return

State where hold position air is released and the spring is extended.

Valve, Full Stroke

State where the valve is closed.

Valve, Tight-Shut-Off

State where the valve is closed and sealed with leakage no greaterthan the defined leak rate; Tight shut-off requirements shall be
specified according to the application, if shut-off requirements allow
flow greater than ANSI class V, respectively ANSI class IV, then Full
Stroke numbers may be used.

Valve, Open-To-Trip

State where the valve is open

Fail Safe

Failure that causes the device to go to the defined fail-safe state
without a demand from the process.

Fail Dangerous

Failure that does not respond to a demand from the process (i.e.
being unable to go to the defined fail-safe state).

Actuator

Failure that prevents the actuator from moving with sufficient force tomove the final control element valve to its fail-safe state.

Valve

Failure that prevents the valve from moving to the defined fail-safe
state within the normal time span.

Fail Dangerous Undetected Failure that is dangerous and that is not being diagnosed byautomatic diagnostics, such as Partial Valve Stroke Testing.
Fail Dangerous Detected

Failure that is dangerous but is detected by automatic diagnostics,
such as Partial Valve Stroke Testing.

No Effect

Failure of a component that is part of the safety function but that has
no effect on the safety function.

External Leakage

Failure that causes process fluids, gas, hydraulic fluids or operating
media to leak outside of the valve or actuator; External Leakage is
not considered part of the safety function and therefore this failure
rate is not included in any of the numbers. External leakage failure
rates should be reviewed for secondary safety and environmental
issues.

The failure categories listed above expand on the categories listed in IEC 61508 in order to provide
a complete set of data needed for design optimization.

© exidaT-126 V3,R4

BUR_19-02-177_R006_Diaphragm_Valves_V1R1.docx
exida 80 N. Main St, Sellersville, PA 18960
Page 8 of 31

4.2

Methodology – FMEDA, failure rates

4.2.1 FMEDAA FMEDA (Failure Mode Effect and Diagnostic Analysis) is a failure rate prediction techniquebased on a study of design strength versus operational profile stress in each application. It
combines design FMEA techniques with extensions to identify automatic diagnostic techniques andthe failure modes relevant to safety instrumented system design. It is a technique recommended togenerate failure rates for each failure mode category [N13].

4.2.2 Failure rates
The accuracy of any FMEDA analysis depends upon the component reliability data as input to theprocess. Component data from consumer, transportation, military or telephone applications could
generate failure rate data unsuitable for the process industries. The component data used byexida in this FMEDA is from the Electrical and Mechanical Component Reliability Handbooks [N2]which were derived using over 250 billion-unit operational hours of process industry field failure
data from multiple sources and failure data from various databases. The component failure rates
are provided for each applicable operational profile and application, see Appendix C. The exida
profile chosen for this FMEDA was Profile 3 (General Field Equipment) and Profile 6 (Process
Wetted Parts) for the Valves process wetted parts as this was judged to be the best fit for the
product and application information submitted by Bürkert Fluid Control Systems. It is expected thatthe actual number of field failures will be less than the number predicted by these failure rates.
Early life failures (infant mortality) are not included in the failure rate prediction as it is assumed
that some level of commission testing is done. End of life failures are not included in the failure rate
prediction as useful life is specified.
The failure rates are predicted for a Site Safety Index of SSI=2 ([N10] & [N11]) as this level ofoperation is common in the process industries. Failure rate predictions for other SSI levels areincluded in the exSILentia® tool from exida.
The user of these numbers is responsible for determining the failure rate applicability to any
particular environment. exida Environmental Profiles listing expected stress levels can be found in
Appendix C. Some industrial plant sites have high levels of stress. Under those conditions thefailure rate data is adjusted to a higher value to account for the specific conditions of the plant.
exida has detailed models available to make customized failure rate predictions (Contact exida).
Accurate plant specific data may be used to check validity of this failure rate data. If a user has
data collected from a good proof test reporting system such as exida SILStatTM that indicateshigher failure rates, the higher numbers shall be used.

© exidaT-126 V3,R4

BUR_19-02-177_R006_Diaphragm_Valves_V1R1.docx
exida 80 N. Main St, Sellersville, PA 18960
Page 9 of 31

4.3

Assumptions

The following assumptions have been made during the Failure Modes, Effects, and Diagnostic
Analysis of the Diaphragm Valve.
•

The worst-case assumption of a series system is made. Therefore, only a single component
failure will fail the entire Diaphragm Valve, and propagation of failures is not relevant.

•Failure rates are constant for the useful life period.

•

Any product component that cannot influence the safety function (feedback immune) is
excluded. All components that are part of the safety function including those needed fornormal operation are included in the analysis.

•

The stress levels are specified in the exida Profile used for the analysis limited by the
manufacturer’s published ratings.

•

Materials are compatible with the environmental and process conditions.

•Clean and dry operating air is used per ANSI/ISA-7.0.01-1996 Quality Standard for
Instrument Air.

•The device is installed and operated per the manufacturer’s instructions.

•

Valves are installed such that the controlled substance will flow through the valve in the
direction indicated by the flow arrow, located on the valve body.

•

Breakage or plugging of air inlet and outlet lines has not been included in the analysis.

•

Loss of the Air Pressure supply is not included in these failure rates.

•

In order to claim diagnostic coverage for Partial Valve Stroke Testing it is automatically
performed at a rate at least ten times faster than the Demand frequency.

•

Partial Valve Stroke Testing of the final element includes position detection from actuator
top mounted position sensors.

•

Worst-case internal fault detection time is the PVST test interval time.

© exidaT-126 V3,R4

BUR_19-02-177_R006_Diaphragm_Valves_V1R1.docx
exida 80 N. Main St, Sellersville, PA 18960
Page 10 of 31

4.4

Results

Using reliability data extracted from the exida Electrical and Mechanical Component Reliability
Handbook the following failure rates resulted from the FMEDA analysis of the Diaphragm Valve.
Table 3 through Table 6 lists the failure rates for the Diaphragm Valve according to IEC 61508 witha Site Safety Index (SSI) of 2 (good site maintenance practices). See Appendix E for an
explanation of SSI and the failure rates for SSI of 4 (ideal maintenance practices).
Table 3 Failure rates for Static Applications3 with Good Maintenance Assumptions in FIT @ SSI=2

λSD

λSU4

λDD

λDU

#

E

Full Stroke, Clean Service

0

85

0

148

759

29

Tight Shut-Off, Clean Service

0

85

0

433

474

29

Open on Trip, Clean Service

0

145

0

152

590

29

Full Stroke with PVST , Clean Service

84

1

48

100

759

29

Tight Shut-Off with PVST, Clean Service

84

1

48

385

474

29

Open on Trip with PVST, Clean Service

144

1

84

68

590

29

Full Stroke, Severe Service

0

85

0

216

1104

50

Tight Shut-Off, Severe Service

0

85

0

784

535

50

Open on Trip, Severe Service

0

205

0

219

874

50

Full Stroke with PVST, Severe Service

84

1

53

163

1104

50

Tight Shut-Off with PVST, Severe Service

84

1

52

732

535

50

Open on Trip with PVST, Severe Service

203

2

124

95

874

50

Type 2030/2031/2032/2033/AP2030

5

3 Static Application failure rates are applicable if the device is static for a period of more than 200 hours.
4 It is important to realize that theNo Effect failures are no longer included in the Safe Undetected failure category

according to IEC 61508, ed2, 2010.
5 Partial Valve Stroke Test (PVST)© exidaT-126 V3,R4

BUR_19-02-177_R006_Diaphragm_Valves_V1R1.docx
exida 80 N. Main St, Sellersville, PA 18960
Page 11 of 31

Table 4 Failure rates for Dynamic Applications6 with Good Maintenance Assumptions in FIT @ SSI=2

λSD

λSU

λDD

λDU

#

E

Full Stroke, Clean Service

0

91

0

117

764

30

Tight Shut-Off, Clean Service

0

91

0

424

457

30

Open on Trip, Clean Service

0

149

0

63

628

30

Full Stroke with PVST, Clean Service

90

1

33

84

764

30

Tight Shut-Off with PVST, Clean Service

90

1

33

391

457

30

Open on Trip with PVST, Clean Service

148

1

30

33

628

30

Full Stroke, Severe Service

0

91

0

179

1081

50

Tight Shut-Off, Severe Service

0

91

0

791

468

50

Open on Trip, Severe Service

0

209

0

75

933

50

Full Stroke with PVST, Severe Service

90

1

34

145

1081

50

Tight Shut-Off with PVST, Severe Service

90

1

33

758

468

50

Open on Trip with PVST, Severe Service

207

2

37

38

933

50

Type 2030/2031/2032/2033/AP2030

Table 5 Failure rates for Static Applications with Good Maintenance Assumptions in FIT @ SSI=2

Type 2103/2104/2105/AP09

λSD

λSU

λDD

λDU

#

E

Full Stroke, Clean Service

0

92

0

153

792

29

Tight Shut-Off, Clean Service

0

92

0

438

507

29

Open on Trip, Clean Service

0

162

0

183

665

29

Full Stroke with PVST, Clean Service

91

1

46

107

792

29

Tight Shut-Off with PVST, Clean Service

91

1

46

392

507

29

Open on Trip with PVST, Clean Service

160

2

102

81

665

29

Full Stroke, Severe Service

0

92

0

220

1137

50

Tight Shut-Off, Severe Service

0

92

0

789

568

50

Open on Trip, Severe Service

0

222

0

251

948

50

Full Stroke with PVST, Severe Service

91

1

50

170

1137

50

Tight Shut-Off with PVST, Severe Service

91

1

50

739

568

50

Open on Trip with PVST, Severe Service

220

2

143

108

948

50

6 Dynamic Application failure rates may be used if the device moves at least once every 200 hours.

© exidaT-126 V3,R4

BUR_19-02-177_R006_Diaphragm_Valves_V1R1.docx
exida 80 N. Main St, Sellersville, PA 18960
Page 12 of 31

Table 6 Failure rates for Dynamic Applications with Good Maintenance Assumptions in FIT @ SSI=2

Type 2103/2104/2105/AP09

λSD

λSU

λDD

λDU

#

E

Full Stroke, Clean Service

0

99

0

109

797

30

Tight Shut-Off, Clean Service

0

99

0

416

490

30

Open on Trip, Clean Service

0

166

0

90

703

30

Full Stroke with PVST, Clean Service

98

1

20

89

797

30

Tight Shut-Off with PVST, Clean Service

98

1

20

396

490

30

Open on Trip with PVST, Clean Service

164

2

46

44

703

30

Full Stroke, Severe Service

0

99

0

171

1114

50

Tight Shut-Off, Severe Service

0

99

0

783

501

50

Open on Trip, Severe Service

0

226

0

103

1009

50

Full Stroke with PVST, Severe Service

98

1

21

150

1114

50

Tight Shut-Off with PVST, Severe Service

98

1

21

762

501

50

Open on Trip with PVST, Severe Service

224

2

54

49

1009

50

Where:
λSD = Fail Safe Detected
λSU = Fail Safe Undetected
λDD = Fail Dangerous Detected
λDU = Fail Dangerous Undetected# = No Effect Failures
E = External Leaks
As the External Leak failure rates are a subset of the No Effect failure rates, the total No Effectfailure rate is the sum of the listed No Effect and External Leak rates. External leakage failure rates
do not directly contribute to the reliability of the device but should be reviewed for secondary safety
and environmental issues.
These failure rates are valid for the useful lifetime of the product, see Appendix A.
According to IEC 61508-2 the architectural constraints of an element must be determined. This canbe done by following the 1H approach according to 7.4.4.2 of IEC 61508-2 or the 2H approachaccording to 7.4.4.3 of IEC 61508-2, or the approach according to IEC 61511:2016 which is basedon 2H (see Section 5.2).
The 1H approach involves calculating the Safe Failure Fraction for the entire element.
The 2H approach involves assessment of the reliability data for the entire element according to
7.4.4.3.3 of IEC 61508.
The failure rate data used for this analysis meets the exida criteria for Route 2H which is more
stringent than IEC 61508. Therefore, the Diaphragm Valve meets the hardware architectural
constraints for up to SIL 2 at HFT=0 (or SIL 3 @ HFT=1) when the listed failure rates are used.
If Route 2H is not applicable for all devices that constitute the entire element, the architectural
constraints will need to be evaluated per Route 1H.
© exidaT-126 V3,R4

BUR_19-02-177_R006_Diaphragm_Valves_V1R1.docx
exida 80 N. Main St, Sellersville, PA 18960
Page 13 of 31

The architectural constraint type for the Diaphragm Valve is A. The hardware fault tolerance of thedevice is 0. The SIS designer is responsible for meeting other requirements of applicablestandards for any given SIL.
Table 14 through Table 17 lists the failure rates for the Diaphragm Valve according to IEC 61508
with a Site Safety Index (SSI) of 4 (perfect site maintenance practices). This data should not be
used for SIL verification and is provided only for comparison with other analysis than has assumed
perfect maintenance. See Appendix E for an explanation of SSI.

© exidaT-126 V3,R4

BUR_19-02-177_R006_Diaphragm_Valves_V1R1.docx
exida 80 N. Main St, Sellersville, PA 18960
Page 14 of 31

5

Using the FMEDA Results

The following section(s) describe how to apply the results of the FMEDA.

5.1

PFDavg calculation Diaphragm Valve

Using the failure rate data displayed in section 4.4, and the failure rate data for the associatedelement devices, an average Probability of Failure on Demand (PFDavg) calculation can be
performed for the entire final element.
Probability of Failure on Demand (PFDavg) calculation uses several parameters, many of which are
determined by the particular application and the operational policies of each site. Some parameters
are product specific and the responsibility of the manufacturer. Those manufacturer specificparameters are given in this third-party report.
Probability of Failure on Demand (PFDavg) calculation is the responsibility of the owner/operator ofa process and is often delegated to the SIF designer. Product manufacturers can only provide a
PFDavg by making many assumptions about the application and operational policies of a site which
may be incorrect. Therefore, the use of pre-calculated PFDavg numbers requires complete
knowledge of the assumptions and a match with the actual application and site.
Probability of Failure on Demand (PFDavg) calculation is best accomplished with exida’s
exSILentia tool. See Appendix D for a complete description of how to determine the Safety Integrity
Level for the final element. The mission time used for the calculation depends on the PFDavg target
and the useful life of the product. The failure rates for all the devices in the final element and theproof test coverage for the final element are required to perform the PFDavg calculation. The proof
test coverage for the suggested proof test and the dangerous failure rate after proof test for the
Diaphragm Valves are listed in Table 8 through Table 11. This is combined with the dangerous
failure rates after proof test for other devices in the final element to establish the proof test
coverage for the final element.
When performing Partial Valve Stroke Testing at regular intervals, the Diaphragm Valve contributes
less to the overall PFDavg of the Safety Instrumented Function.

5.2

exida Route 2H Criteria

IEC 61508, ed2, 2010 describes the Route 2H alternative to Route 1H architectural constraints. The
standard states:"based on data collected in accordance with published standards (e.g., IEC 60300-3-2: or ISO
14224); and, be evaluated according to• the amount of field feedback; and• the exercise of expert judgment; and when needed• the undertaking of specific tests,
in order to estimate the average and the uncertainty level (e.g., the 90% confidence interval or
the probability distribution) of each reliability parameter (e.g., failure rate) used in thecalculations."

exida has interpreted this to mean not just a simple 90% confidence level in the uncertainty
analysis, but a high confidence level in the entire data collection process. As IEC 61508, ed2, 2010
does not give detailed criteria for Route 2H, exida has established the following:
1. field unit operational hours of 100,000,000 per each component; and© exidaT-126 V3,R4

BUR_19-02-177_R006_Diaphragm_Valves_V1R1.docx
exida 80 N. Main St, Sellersville, PA 18960
Page 15 of 31

2. a device and all of its components have been installed in the field for one year or more; and3. operational hours are counted only when the data collection process has been audited forcorrectness and completeness; and4. failure definitions, especially "random" vs. "systematic" are checked by exida; and5. every component used in an FMEDA meets the above criteria.
This set of requirements is chosen to assure high integrity failure data suitable for safety integrity
verification.

© exidaT-126 V3,R4

BUR_19-02-177_R006_Diaphragm_Valves_V1R1.docx
exida 80 N. Main St, Sellersville, PA 18960
Page 16 of 31

6

Terms and Definitions

Automatic Diagnostics

Tests performed online internally by the device or, if specified,externally by another device without manual intervention.

DeviceA device is something that is part of an element; but, cannot perform
an element safety function on its own.

Dynamic Applications

The movement interval of the final element device is less than 200
hours. Movement may be accomplished by PVST, full stroke proof
testing or a demand on the system.

Element

A collection of devices that perform an element safety function such asa final element consisting of a logic solver interface, actuator and valve.

exida criteria

A conservative approach to arriving at failure rates suitable for use inhardware evaluations utilizing the 2H Route in IEC 61508-2.

Fault tolerance

Ability of a functional unit to continue to perform a required function in
the presence of faults or errors (IEC 61508-4, 3.6.3).

FIT

Failure in Time (1x10-9 failures per hour)

FMEDA

Failure Mode Effect and Diagnostic Analysis

HFT

Hardware Fault Tolerance

High demand Mode

Mode, where the demand interval for operation made on a safetyrelated system is less than twice the proof test interval.

Low demand mode

Mode, where the demand interval for operation made on a safetyrelated system is greater than twice the proof test interval.

PFDavgAverage Probability of Failure on Demand

PVST

Partial Valve Stroke Test - It is assumed that Partial Valve Stroke
Testing, when performed, is automatically performed at least an orderof magnitude more frequently than the proof test; therefore, the test
can be assumed an automatic diagnostic. Because of the automatic
diagnostic assumption, the Partial Valve Stroke Testing also has an
impact on the Safe Failure Fraction.

Random Capability

The SIL limit imposed by the Architectural Constraints for eachelement.

Severe Service

Condition that exists when material through the valve has abrasive
particles, as opposed to Clean Service where these particles areabsent.

SFF

Safe Failure Fraction, summarizes the fraction of failures which lead toa safe state plus the fraction of failures which will be detected byautomatic diagnostic measures and lead to a defined safety action.

SIF

Safety Instrumented Function

SIL

Safety Integrity Level© exidaT-126 V3,R4

BUR_19-02-177_R006_Diaphragm_Valves_V1R1.docx
exida 80 N. Main St, Sellersville, PA 18960
Page 17 of 31

SIS

Safety Instrumented System – Implementation of one or more Safety
Instrumented Functions. A SIS is composed of any combination of
sensor(s), logic solver(s), and final element(s).

SSI

Site Safety Index (See Appendix E)

Static Applications

The movement interval of the final element device is greater than 200
hours. Movement may be accomplished by PVST, full stroke proof
testing or a demand on the system.

Type A element“Non-Complex” element (using discrete components); for details see
7.4.4.1.2 of IEC 61508-2

Type B element“Complex” element (using complex components such as microcontrollers or programmable logic); for details see 7.4.4.1.3 of IEC
61508-2© exidaT-126 V3,R4

BUR_19-02-177_R006_Diaphragm_Valves_V1R1.docx
exida 80 N. Main St, Sellersville, PA 18960
Page 18 of 31

7

Status of the Document

7.1

Liability

exida prepares FMEDA reports based on methods advocated in International standards. Failure
rates are obtained from exida compiled field failure data and a collection of industrial databases.
exida accepts no liability whatsoever for the use of these numbers or for the correctness of thestandards on which the general calculation methods are based.
Due to future potential changes in the standards, product design changes, best available
information and best practices, the current FMEDA results presented in this report may not be fully
consistent with results that would be presented for the identical model number product at somefuture time. As a leader in the functional safety market place, exida is actively involved in evolving
best practices prior to official release of updated standards so that our reports effectively anticipate
any known changes. In addition, most changes are anticipated to be incremental in nature andresults reported within the previous three-year period should be sufficient for current usage without
significant question.
Most products also tend to undergo incremental changes over time. If an exida FMEDA has notbeen updated within the last three years, contact the product vendor to verify the current validity of
the results.

7.2

Version History

Contract
Number
Q19/02-177
Q19/02-177

BUR 19/02-177 R006 V1R1
BUR 19/02-177 R006 V0R1

Reviewer:
Status:Loren Stewart, exida, May 29, 2019
Draft, June 3, 2019

7.3

Report Number

Revision Notes
Initial Release
Draft

Future enhancements

At request of client.

7.4

Release signatures

Steven Close, Senior Safety Engineer

Loren L. Stewart, CFSE, Senior Safety Engineer© exidaT-126 V3,R4

BUR_19-02-177_R006_Diaphragm_Valves_V1R1.docx
exida 80 N. Main St, Sellersville, PA 18960
Page 19 of 31

Appendix A Lifetime of Critical Components
According to section 7.4.9.5 of IEC 61508-2, a useful lifetime, based on experience, should bedetermined and used to replace equipment before the end of useful life.
Although a constant failure rate is assumed by the exida FMEDA prediction method (see section
4.2.2) this only applies provided that the useful lifetime7 of components is not exceeded. Beyond
their useful lifetime the result of the probabilistic calculation method is therefore meaningless, as
the probability of failure significantly increases with time. The useful lifetime is highly dependent on
the subsystem itself and its operating conditions.
This assumption of a constant failure rate is based on the bathtub curve. Therefore, it is obviousthat the PFDavg calculation is only valid for components that have this constant domain and that thevalidity of the calculation is limited to the useful lifetime of each component.
It is the responsibility of the end user to maintain and operate the Diaphragm Valve per
manufacturer’s instructions. Furthermore, regular inspection should show that all components areclean and free from damage.
A major factor influencing the useful life is the air quality / quality of the hydraulic oil used.
Based on general field failure data a useful life period of approximately 15 years (actuators, valves,
actuator-valve combinations) is expected for the Diaphragm Valve.
When plant/site experience indicates a shorter useful lifetime than indicated in this appendix, thenumber based on plant/site experience should be used.

7 Useful lifetime is a reliability engineering term that describes the operational time interval where the failure rate of adevice is relatively constant. It is not a term which covers product obsolescence, warranty, or other commercial issues.
© exidaT-126 V3,R4

BUR_19-02-177_R006_Diaphragm_Valves_V1R1.docx
exida 80 N. Main St, Sellersville, PA 18960
Page 20 of 31

Appendix B Proof Tests to Reveal Dangerous Undetected Faults
According to section 7.4.5.2 f) of IEC 61508-2, proof tests shall be undertaken to reveal dangerous
faults which are undetected by automatic diagnostic tests. This means that it is necessary to
specify how dangerous undetected faults which have been noted during the Failure Modes,
Effects, and Diagnostic Analysis can be detected during proof testing.

B.1

Suggested Proof Test

The suggested Proof Test consists of a full stroke of the associated device, see Table 7. Refer tothe table in B.2 for the Proof Test Coverages.
Table 7 Suggested Proof Test – Diaphragm Valve

Step

Action1.

Bypass the safety function and take appropriate action to avoid a false trip.

2.

Interrupt or change the air supply/input to the Actuator to force the Actuator/Valveassembly to the Fail-Safe state and confirm that the Safe State was achieved and within
the correct time.
Note:-This tests for all failures that could prevent the functioning of the Control Valve as well as the rest of
the final control element.

3.

Inspect the Actuator and Valve for any leaks, visible damage or contamination

4.

Re-store the original air supply/input to the Actuator and confirm that the normal
operating state was achieved.

5.

Remove the bypass and otherwise restore normal operation.

For the test to be effective the movement of the Valve must be confirmed. To confirm theeffectiveness of the test both the travel of the Valve and slew rate must be monitored andcompared to expected results to validate the testing.

© exidaT-126 V3,R4

BUR_19-02-177_R006_Diaphragm_Valves_V1R1.docx
exida 80 N. Main St, Sellersville, PA 18960
Page 21 of 31

B.2

Proof Test Coverage

The Proof Test Coverage for the various device configurations are given in Table 8 through Table
11.
Table 8 Proof Test Results – Type 2030/2031/2032/2033/AP2030 Diaphragm Valve – Static Application

Clean Service

Severe Service

Proof Test Coverage

λDUPT8(FIT)

No PVST

with PVSTClose On Trip – Full
Stroke

83

44%

17%

Close On Trip – Tight
Shutoff

368

15%

4%

Open On Trip

28

82%

59%

Close On Trip – Full
Stroke

144

33%

12%

Close On Trip – Tight
Shutoff

713

9%

3%

Open On Trip

35

84%

63%

Type
Safety Function
2030/2031/2032/2033/AP2030

Table 9 Proof Test Results – Type 2030/2031/2032/2033/AP2030 Diaphragm Valve – Dynamic
Application

Clean Service

Severe Service

8

Proof Test Coverage

λDUPT
(FIT)

No PVST

with PVSTClose On Trip – Full
Stroke

78

33%

7%

Close On Trip – Tight
Shutoff

385

9%

2%

Open On Trip

19

70%

42%

Close On Trip – Full
Stroke

139

22%

4%

Close On Trip – Tight
Shutoff

751

5%

1%

Open On Trip

21

72%

45%

Type
Safety Function
2030/2031/2032/2033/AP2030

λDUPT = Dangerous undetected failure rate after performing the recommended proof test.

© exidaT-126 V3,R4

BUR_19-02-177_R006_Diaphragm_Valves_V1R1.docx
exida 80 N. Main St, Sellersville, PA 18960
Page 22 of 31

Table 10 Proof Test Results – Type 2103/2104/2105/AP09 Diaphragm Valve – Static Application

Clean Service

Severe Service

Proof Test Coverage

λDUPT
(FIT)

No PVST

with PVSTClose On Trip – Full Stroke

85

44%

21%

Close On Trip – Tight
Shutoff

370

16%

6%

Open On Trip

32

83%

60%

Close On Trip – Full Stroke

147

33%

14%

Close On Trip – Tight
Shutoff

715

9%

3%

Open On Trip

39

84%

64%

Type
Safety Function
2103/2104/2105/AP09

Table 11 Proof Test Results – Type 2103/2104/2105/AP09 Diaphragm Valve – Dynamic Application

Clean Service

Severe Service© exidaT-126 V3,R4

Proof Test Coverage

λDUPT
(FIT)

No PVST

with PVSTClose On Trip – Full Stroke

80

27%

10%

Close On Trip – Tight
Shutoff

387

7%

2%

Open On Trip

23

74%

48%

Close On Trip – Full Stroke

141

18%

6%

Close On Trip – Tight
Shutoff

753

4%

1%

Open On Trip

24

77%

51%

Type
Safety Function
2103/2104/2105/AP09

BUR_19-02-177_R006_Diaphragm_Valves_V1R1.docx
exida 80 N. Main St, Sellersville, PA 18960
Page 23 of 31

Appendix C exida Environmental Profiles
Table 12 exida Environmental Profiles

exida Profile

1

2

3

4

5

6

Description(Electrical)

Cabinetmounted/ClimateControlled

Low
Power
Field
MountedGeneralField
MountedSubseaOffshore

N/A

no selfheating

self-heating

GeneralField
MountedGeneralField
MountedSubseaOffshore

Process
Wetted

N/A

C3

N/A

Description(Mechanical)

IEC 60654-1 Profile

Average Ambient
Temperature
Average Internal
Temperature
Daily Temperature
Excursion (pk-pk)
Seasonal Temperature
Excursion

Cabinetmounted/ClimateControlled
B2

C3

C3

also
applicablefor D1also
applicablefor D1

30°C

25°C

25°C

5°C

25°C

25°C

60°C

30°C

45°C

5°C

45°C

Process
Fluid Temp.

5°C

25°C

25°C

0°C

25°C

N/A

5°C

40°C

40°C

2°C

40°C

N/A

No

Yes

Yes

Yes

Yes

Yes

(winter average vs.
summer average)

Exposed to Elements /Weather Conditions
Humidity9

0-95%

also
applicablefor D1

NonCondensing

0-100%

0-100%

0-100%

0-100%

Condensing

Condensing

Condensing

Condensing

10 g
2g

15 g
3g

15 g
3g

15 g
3g

15 g
3g

G2

G3

G3

G3

G3

0.5 kV
1 kV

0.5 kV
1 kV

0.5 kV
1 kV

0.5 kV
1 kV

0.5 kV
1 kV

10 V/m
3 V/m
1 V/m
6 kV

10 V/m
3 V/m
1 V/m
6 kV

10 V/m
3 V/m
1 V/m
6 kV

10 V/m
3 V/m
1 V/m
6 kV

10 V/m
3 V/m
1 V/m
6 kV

Shock10Vibration11
Chemical Corrosion12

N/A
N/A
N/A
Compatible
Material

Surge13
Line-Line
Line-Ground
EMI Susceptibility14
80 MHz to 1.4 GHz
1.4 GHz to 2.0 GHz
2.0Ghz to 2.7 GHz
ESD (Air)15

N/A

N/A
N/A

9 Humidity rating per IEC 60068-2-3
10 Shock rating per IEC 60068-2-27
11 Vibration rating per IEC 60068-2-6
12 Chemical Corrosion rating per ISA 71.04
13 Surge rating per IEC 61000-4-5
14 EMI Susceptibility rating per IEC 61000-4-3
15 ESD (Air) rating per IEC 61000-4-2© exidaT-126 V3,R4

BUR_19-02-177_R006_Diaphragm_Valves_V1R1.docx
exida 80 N. Main St, Sellersville, PA 18960
Page 24 of 31

Appendix D Determining Safety Integrity Level
The information in this appendix is intended to provide the method of determining the Safety
Integrity Level (SIL) of a Safety Instrumented Function (SIF). The numbers used in the examples
are not for the product described in this report.
Three things must be checked when verifying that a given Safety Instrumented Function (SIF)
design meets a Safety Integrity Level (SIL) [N4] and [N7].
These are:
A. Systematic Capability or Prior Use Justification for each device meets the SIL level of the SIF;
B. Architecture Constraints (minimum redundancy requirements) are met; andC. a PFDavg calculation result is within the range of numbers given for the SIL level.
A. Systematic Capability (SC) is defined in IEC 61508:2010. The SC rating is a measure of design
quality based upon the methods and techniques used to design and development a product. All
devices in a SIF must have a SC rating equal or greater than the SIL level of the SIF. For example,
a SIF is designed to meet SIL 3 with three pressure transmitters in a 2oo3 voting scheme. The
transmitters have an SC2 rating. The design does not meet SIL 3. Alternatively, IEC 61511 allows
the end user to perform a "Prior Use" justification. The end user evaluates the equipment to a given
SIL level, documents the evaluation and takes responsibility for the justification.
B. Architecture constraints require certain minimum levels of redundancy. Different tables show
different levels of redundancy for each SIL level. A table is chosen, and redundancy is incorporated
into the design [N8].
C. Probability of Failure on Demand (PFDavg) calculation uses several parameters, many of which
are determined by the particular application and the operational policies of each site. Someparameters are product specific and the responsibility of the manufacturer. Those manufacturer
specific parameters are given in this third-party report.
A Probability of Failure on Demand (PFDavg) must be done based on a number of variables
including:
1. Failure rates of each product in the design including failure modes and any diagnostic
coverage from automatic diagnostics (an attribute of the product given by this FMEDA report);
2. Redundancy of devices including common cause failures (an attribute of the SIF design);
3. Proof Test Intervals (assignable by end user practices);
4. Mean Time to Restore (an attribute of end user practices);
5. Proof Test Effectiveness; (an attribute of the proof test method used by the end user with an
example given by this report);
6. Mission Time (an attribute of end user practices);
7. Proof Testing with process online or shutdown (an attribute of end user practices);
8. Proof Test Duration (an attribute of end user practices); and9. Operational/Maintenance Capability (an attribute of end user practices).
The product manufacturer is responsible for the first variable. Most manufacturers use the exida
FMEDA technique which is based on over 250 billion hours of field failure data in the processindustries to predict these failure rates as seen in this report. A system designer chooses thesecond variable. All other variables are the responsibility of the end user site. The exSILentia®
SILVerTM software considers all these variables and provides an effective means to calculate
PFDavg for any given set of variables.

© exidaT-126 V3,R4

BUR_19-02-177_R006_Diaphragm_Valves_V1R1.docx
exida 80 N. Main St, Sellersville, PA 18960
Page 25 of 31

Simplified equations often account for only the first three variables. The equations published in IEC
61508-6, Annex B.3.2 [N1] cover only the first four variables. IEC 61508-6 is only an informative
portion of the standard and as such gives only concepts, examples and guidance based on theidealistic assumptions stated. These assumptions often result in optimistic PFDavg calculations andhave indicated SIL levels higher than reality. Therefore, idealistic equations should not be used for
actual SIF design verification.
All the variables listed above are important. As an example, consider a high-level protection SIF.
The proposed design has a single SIL 3 certified level transmitter, a SIL 3 certified safety logic
solver, and a single remote actuated valve consisting of a certified solenoid valve, certified scotchyoke actuator and a certified ball valve. Note that the numbers chosen are only an example andnot the product described in this report.
Using exSILentia with the following variables selected to represent results from simplified
equations:• Mission Time = 5 years• Proof Test Interval = 1 year for the sensor and final element, 5 years for the logic solver• Proof Test Coverage = 100% (ideal and unrealistic but commonly assumed)• Proof Test done with process offline
This results in a PFDavg of 6.82E-03 which meets SIL 2 with a risk reduction factor of 147. The
subsystem PFDavg contributions are Sensor PFDavg = 5.55E-04, Logic Solver PFDavg = 9.55E-06,
and Final Element PFDavg = 6.26E-03 (Figure 2).

Figure 2: exSILentia results for idealistic variables© exidaT-126 V3,R4

BUR_19-02-177_R006_Diaphragm_Valves_V1R1.docx
exida 80 N. Main St, Sellersville, PA 18960
Page 26 of 31

If the Proof Test Interval for the sensor and final element is increased in one-year increments, theresults are shown in Figure 3.
3.50E-02
3.00E-02

PFDavg

2.50E-02
2.00E-02
Series1
Sensor

1.50E-02

Final
Series2
Element

1.00E-02
5.00E-03
0.00E+00
1

2

3

4

5

Proof Test Interval (Years)

Figure 3: PFDavg versus Proof Test Interval

If a set of realistic variables for the same SIF are entered into the exSILentia software including:
•
•
•
•
•
•

Mission Time = 25 years
Proof Test Interval = 1 year for the sensor and final element, 5 years for the logic solver
Proof Test Coverage = 90% for the sensor and 70% for the final element
Proof Test Duration = 2 hours with process online.
MTTR = 48 hours
Maintenance Capability = Medium for sensor and final element, Good for logic solver

with all other variables remaining the same, the PFDavg for the SIF equals 5.76E-02 which barely
meets SIL 1 with a risk reduction factor of 17. The subsystem PFDavg contributions are Sensor
PFDavg = 2.77E-03, Logic Solver PFDavg = 1.14E-05, and Final Element PFDavg = 5.49E-02 (Figure
4).

© exidaT-126 V3,R4

BUR_19-02-177_R006_Diaphragm_Valves_V1R1.docx
exida 80 N. Main St, Sellersville, PA 18960
Page 27 of 31

Figure 4: exSILentia results with realistic variables

It is clear that PFDavg results can change an entire SIL level or more when all critical variables are
not used.

© exidaT-126 V3,R4

BUR_19-02-177_R006_Diaphragm_Valves_V1R1.docx
exida 80 N. Main St, Sellersville, PA 18960
Page 28 of 31

Appendix E Site Safety Index
Numerous field failure studies have shown that the failure rate for a specific device (sameManufacturer and Model number) will vary from site to site. The Site Safety Index (SSI) was
created to account for these failure rates differences as well as other variables. The information inthis appendix is intended to provide an overview of the Site Safety Index (SSI) model used byexida to compensate for site variables including device failure rates.

E.1

Site Safety Index Profiles

The SSI is a number from 0 – 4 which is an indication of the level of site activities and practices
that contribute to the safety performance of SIF’s on the site. Table 13 details the interpretation ofeach SSI level. Note that the levels mirror the levels of SIL assignment and that SSI 4 implies that
all requirements of IEC 61508 and IEC 61511 are met at the site and therefore there is nodegradation in safety performance due to any end-user activities or practices, i.e., that the productinherent safety performance is achieved.
Several factors have been identified thus far which impact the Site Safety Index (SSI). These
include the quality of:Commission Test
Safety Validation Test
Proof Test Procedures
Proof Test Documentation
Failure Diagnostic and Repair Procedures
Device Useful Life Tracking and Replacement Process
SIS Modification Procedures
SIS Decommissioning Procedures
and others
Table 13 exida Site Safety Index Profiles

Level

Description

SSI 4

Perfect - Repairs are always correctly performed, Testing is always done correctly andon schedule, equipment is always replaced before end of useful life, equipment isalways selected according to the specified environmental limits and process compatible
materials. Electrical power supplies are clean of transients and isolated, pneumatic
supplies and hydraulic fluids are always kept clean, etc. Note: This level is generally
considered not possible but retained in the model for comparison purposes.

SSI 3

Almost perfect - Repairs are correctly performed, Testing is done correctly and onschedule, equipment is normally selected based on the specified environmental limits
and a good analysis of the process chemistry and compatible materials. Electrical power
supplies are normally clean of transients and isolated, pneumatic supplies and hydraulicfluids are mostly kept clean, etc. Equipment is replaced before end of useful life, etc.

SSI 2

Good - Repairs are usually correctly performed, Testing is done correctly and mostly onschedule, most equipment is replaced before end of useful life, etc.

SSI 1

Medium – Many repairs are correctly performed, Testing is done and mostly onschedule, some equipment is replaced before end of useful life, etc.

SSI 0

None - Repairs are not always done, Testing is not done, equipment is not replaced until
failure, etc.

© exidaT-126 V3,R4

BUR_19-02-177_R006_Diaphragm_Valves_V1R1.docx
exida 80 N. Main St, Sellersville, PA 18960
Page 29 of 31

E.2

Site Safety Index Failure Rates – Diaphragm Valve

Failure rates of each individual device in the SIF are increased or decreased by a specific multiplier
which is determined by the SSI value and the device itself. It is known that final elements are more
likely to be negatively impacted by less than ideal end-user practices than are sensors or logic
solvers. By increasing or decreasing device failure rates on an individual device basis, it is possible
to more accurately account for the effects of site practices on safety performance.
Table 14 through Table 17 lists the failure rates for the Diaphragm Valve according to IEC 61508
with a Site Safety Index (SSI) of 4 (ideal maintenance practices).
Table 14 Failure rates for Static Applications with Ideal Maintenance Assumption in FIT (SSI=4)

Type 2030/2031/2032/2033/AP2030

λSD

λSU

λDD

λDU

#

E

Full Stroke, Clean Service
Tight Shut-Off, Clean Service
Open on Trip, Clean Service
Full Stroke with PVST, Clean Service
Tight Shut-Off with PVST, Clean Service
Open on Trip with PVST, Clean Service
Full Stroke, Severe Service
Tight Shut-Off, Severe Service
Open on Trip, Severe Service
Full Stroke with PVST, Severe Service
Tight Shut-Off with PVST, Severe Service
Open on Trip with PVST, Severe Service

0
0
0
50
50
86
0
0
0
50
50
122

51
51
87
1
1
1
51
51
123
1
1
1

0
0
0
24
25
42
0
0
0
26
26
62

74
217
76
50
192
34
108
392
110
82
366
48

456
285
354
456
285
354
662
321
524
662
321
524

18
18
18
18
18
18
30
30
30
30
30
30

Table 15 Failure rates for Dynamic Applications with Ideal Maintenance Assumption in FIT (SSI=4)

Type 2030/2031/2032/2033/AP2030

λSD

λSU

λDD

λDU

#

E

Full Stroke, Clean Service
Tight Shut-Off, Clean Service
Open on Trip, Clean Service
Full Stroke with PVST, Clean Service
Tight Shut-Off with PVST, Clean Service
Open on Trip with PVST, Clean Service
Full Stroke, Severe Service
Tight Shut-Off, Severe Service
Open on Trip, Severe Service
Full Stroke with PVST, Severe Service
Tight Shut-Off with PVST, Severe Service
Open on Trip with PVST, Severe Service

0
0
0
54
54
88
0
0
0
54
54
124

55
55
89
1
1
1
55
55
125
1
1
1

0
0
0
17
16
15
0
0
0
16
17
19

59
212
31
42
196
16
89
396
38
73
379
19

458
274
377
458
274
377
648
281
560
648
281
560

18
18
18
18
18
18
30
30
30
30
30
30

© exidaT-126 V3,R4

BUR_19-02-177_R006_Diaphragm_Valves_V1R1.docx
exida 80 N. Main St, Sellersville, PA 18960
Page 30 of 31

Table 16 Failure rates for Static Applications with Ideal Maintenance Assumption in FIT (SSI=4)

Type 2103/2104/2105/AP09

λSD

λSU

λDD

λDU

#

E

Full Stroke, Clean Service
Tight Shut-Off, Clean Service
Open on Trip, Clean Service
Full Stroke with PVST, Clean Service
Tight Shut-Off with PVST, Clean Service
Open on Trip with PVST, Clean Service
Full Stroke, Severe Service
Tight Shut-Off, Severe Service
Open on Trip, Severe Service
Full Stroke with PVST, Severe Service
Tight Shut-Off with PVST, Severe Service
Open on Trip with PVST, Severe Service

0
0
0
54
54
96
0
0
0
54
54
132

55
55
97
1
1
1
55
55
133
1
1
1

0
0
0
23
23
52
0
0
0
25
25
71

76
219
92
53
196
40
110
394
125
85
369
54

475
304
399
475
304
399
682
341
569
682
341
569

18
18
18
18
18
18
30
30
30
30
30
30

Table 17 Failure rates for Dynamic Applications with Ideal Maintenance Assumption in FIT (SSI=4)

Type 2103/2104/2105/AP09

λSD

λSU

λDD

λDU

#

E

Full Stroke, Clean Service
Tight Shut-Off, Clean Service
Open on Trip, Clean Service
Full Stroke with PVST, Clean Service
Tight Shut-Off with PVST, Clean Service
Open on Trip with PVST, Clean Service
Full Stroke, Severe Service
Tight Shut-Off, Severe Service
Open on Trip, Severe Service
Full Stroke with PVST, Severe Service
Tight Shut-Off with PVST, Severe Service
Open on Trip with PVST, Severe Service

0
0
0
58
58
98
0
0
0
58
58
135

59
59
99
1
1
1
59
59
136
1
1
1

0
0
0
10
10
23
0
0
0
11
11
27

55
208
45
45
198
22
86
392
51
75
381
24

478
294
422
478
294
422
668
301
605
668
301
605

18
18
18
18
18
18
30
30
30
30
30
30

© exidaT-126 V3,R4

BUR_19-02-177_R006_Diaphragm_Valves_V1R1.docx
exida 80 N. Main St, Sellersville, PA 18960
Page 31 of 31