Failure Modes, Effects and Diagnostic Analysis
Project:
Temperature transmitter PR5337 / PR6337 / PR7501 with 4..20 mA output
Customer:
PR electronics A/S
Rønde
Denmark

Contract No.: PR electronics A/S 11/12-052
Report No.: PR electronics A/S 11/12-052 R026
Version V3, Revision R1; August 2015

Stephan Aschenbrenner

The document was prepared using best effort. The authors make no warranty of any kind and shall not be liable inany event for incidental or consequential damages in connection with the application of the document.
© All rights on the format of this technical report reserved.

Management summary
This report summarizes the results of the hardware assessment carried out on the temperaturetransmitter PR5337 / PR6337 / PR7501 with 4..20 mA output for temperature sensors, voltage
signals, resistance-type sensors and potentiometers with software version V1.4 (7501: V1.1 forthe display part) and hardware version as shown in the referred circuit diagrams (see section
2.4.1). Table 1 gives an overview of the considered versions of the temperature transmitter
PR5337 / PR6337 / PR7501 with 4..20 mA output.
The hardware assessment consists of a Failure Modes, Effects and Diagnostics Analysis(FMEDA). A FMEDA is one of the steps taken to achieve functional safety assessment of adevice per IEC 61508. From the FMEDA, failure rates are determined and consequently the
Safe Failure Fraction (SFF) is calculated for the device. For full assessment purposes all
requirements of IEC 61508 must be considered.
Table 1: Version overview
PR5337A

Temperature transmitter, head mounted – (Standard)

PR5337D

Temperature transmitter, head mounted – (ATEX, FM, CSA)

PR6337A

Temperature transmitter, rail mounted, 1 / 2-channels – (Standard)

PR6337D

Temperature transmitter, rail mounted, 1 / 2-channels – (ATEX, FM, CSA)

PR7501

Temperature transmitter, field mounted – (ATEX, FM, CSA)

For safety applications only the described 4..20mA current output versions of the device wereconsidered. All other possible variants or electronics are not covered by this report.
The failure rates used in this analysis are the basic failure rates from the Siemens standard
SN 29500. This failure rate database is specified in the safety requirements specification fromPR electronics A/S for the temperature transmitter PR5337 / PR6337 / PR7501 with 4..20 mA
output.
The listed failure rates are valid for operating stress conditions typical of an industrial fieldenvironment similar to IEC 60654-1 class C (sheltered location) with an average temperature
over a long period of time of 40ºC. For a higher average temperature of 60°C, the failure rates
should be multiplied with an experience based factor of 2.5. A similar multiplier should be used
if frequent temperature fluctuation must be assumed.
The temperature transmitter PR5337 / PR6337 / PR7501 with 4..20 mA output can beconsidered to be a Type B1 element with a hardware fault tolerance of 0.
Assuming that the application program in the connected safety logic solver is configured
according to NAMUR NE43 to detect under-range and over-range failures of the 4..20 mA
output signal, and does not automatically trip on these failures; these failures have beenclassified as dangerous detected failures. For these applications the following tables show the
worst-case failure rates according to IEC 61508:2010 2 nd edition for the temperaturetransmitter PR5337 / PR6337 / PR7501 with 4..20 mA output (considering one input and one
output being part of the safety function) when used with RTD or Thermocouple sensor types.

1

Type B element:© exida.com GmbH
Stephan Aschenbrenner“Complex” element (using micro controllers or programmable logic); for details see
7.4.4.1.3 of IEC 61508-2.
PR electronics 5337 11-12-052 R026 V3R1; August 11, 2015
Page 2 of 4

Table 2: PR5337 / PR6337 / PR7501 for RTD sensor types – IEC 61508 failure rates
Failure category

Siemens SN 29500 [FIT]Fail Safe Detected ( SD)

0

Fail Safe Undetected ( SU)

0203

Fail Dangerous Detected ( DD)
Fail Dangerous Detected (dd)

144

Fail Annunciation Detected (AD)0

Fail High (H)

17

Fail Low (L)

42
71

Fail Dangerous Undetected ( DU)
Fail Annunciation Undetected (AU)1

No effect122

No part65

Total failure rate of the safety function ( Total)

274

Safe failure fraction (SFF)

74%

DCD

74%

SIL AC 2

SIL 1

2
SIL AC (architectural constraints) means that the calculated values are within the range for hardware architectural
constraints for the corresponding SIL but does not imply all related IEC 61508 requirements are fulfilled. In addition
it must be shown that the device has a suitable systematic capability for the required SIL and that the entire safetyfunction can fulfill the required PFD / PFH values.

© exida.com GmbH
Stephan Aschenbrenner

PR electronics 5337 11-12-052 R026 V3R1; August 11, 2015
Page 3 of 4

Table 3: PR5337 / PR6337 / PR7501 for TC sensor types – IEC 61508 failure rates
Failure category

Siemens SN 29500 [FIT]Fail Safe Detected ( SD)

0

Fail Safe Undetected ( SU)

0205

Fail Dangerous Detected ( DD)
Fail Dangerous Detected (dd)

146

Fail Annunciation Detected (AD)0

Fail High (H)

17

Fail Low (L)

42
74

Fail Dangerous Undetected ( DU)
Fail Annunciation Undetected (AU)1

No effect117

No part65

Total failure rate of the safety function ( Total)

279

Safe failure fraction (SFF)

73%

DCD

73%

SIL AC 3

SIL 1

These failure rates are valid for the useful lifetime of the temperature transmitter PR5337 /PR6337 / PR7501 with 4..20 mA output (see Appendix 2).

3
SIL AC (architectural constraints) means that the calculated values are within the range for hardware architectural
constraints for the corresponding SIL but does not imply all related IEC 61508 requirements are fulfilled. In addition
it must be shown that the device has a suitable systematic capability for the required SIL and that the entire safetyfunction can fulfill the required PFD / PFH values.

© exida.com GmbH
Stephan Aschenbrenner

PR electronics 5337 11-12-052 R026 V3R1; August 11, 2015
Page 4 of 4

Table of Contents
Management summary .................................................................................................... 2
1

Purpose and Scope ................................................................................................... 6

2

Project management .................................................................................................. 7
2.1 exida ............................................................................................................................ 7
2.2 Roles and parties involved ........................................................................................... 7
2.3 Standards / Literature used .......................................................................................... 7
2.4 Reference documents .................................................................................................. 8
2.4.1 Documentation provided by the customer ......................................................... 8
2.4.2 Documentation generated by exida .................................................................. 93

Description of the temperature transmitters PR5337 / PR6337 / PR7501 ............... 10

4

Failure Modes, Effects, and Diagnostic Analysis ..................................................... 12
4.1 Description of the failure categories ........................................................................... 12
4.2 Methodology – FMEDA, Failure rates ........................................................................ 13
4.2.1 FMEDA ............................................................................................................ 13
4.2.2 Failure rates .................................................................................................... 13
4.2.3 Assumptions .................................................................................................... 14
4.3 Results ....................................................................................................................... 15
4.3.1 Temperature transmitter PR5337 / PR6337 / PR7501 with 4..20 mA output ... 16

5

Using the FMEDA results ........................................................................................ 18
5.1 Temperature sensing devices .................................................................................... 18
5.1.1 Thermocouple (TC) sensing devices ............................................................... 18
5.1.2 RTD sensing devices....................................................................................... 19

6

Applying the FMEDA results .................................................................................... 21
6.1 Example PFDAVG calculation ...................................................................................... 21

7

Terms and Definitions .............................................................................................. 22

8

Status of the document ............................................................................................ 23
8.1 Liability ....................................................................................................................... 23
8.2 Releases .................................................................................................................... 23
8.3 Release Signatures .................................................................................................... 23

Appendix 1: Possibilities to reveal dangerous undetected faults during the proof test . 24
Appendix 2: Impact of lifetime of critical components on the failure rate ...................... 25
Appendix 3: Failure rates according to IEC 61508:2000 1st Edition ............................. 26© exida.com GmbH
Stephan Aschenbrenner

PR electronics 5337 11-12-052 R026 V3R1; August 11, 2015
Page 5 of 27

1 Purpose and Scope
This document shall describe the results of the Failure Modes, Effects and Diagnostics
Analysis (FMEDA) carried out on the described temperature transmitter PR5337 / PR6337 /PR7501 with 4..20 mA output configurations with software version V1.4 (7501: V1.1 for the
display part) and hardware version as shown in the referred circuit diagrams (see section
2.4.1).
The FMEDA builds the basis for an evaluation whether a sensor subsystem, including thetemperature transmitter PR5337 / PR6337 / PR7501 with 4..20 mA output meets the average
Probability of Failure on Demand (PFDAVG) requirements and the architectural constraints /minimum hardware fault tolerance requirements per IEC 61508. This FMEDA does not replacea full assessment according to EC 61508 and it does not consider any calculations necessary
for proving intrinsic safety.

© exida.com GmbH
Stephan Aschenbrenner

PR electronics 5337 11-12-052 R026 V3R1; August 11, 2015
Page 6 of 27

2 Project management
2.1 exida
exida is one of the world’s leading accredited Certification Bodies and knowledge companies
specializing in automation system safety and availability with over 300 years of cumulative
experience in functional safety. Founded by several of the world’s top reliability and safety
experts from assessment organizations and manufacturers, exida is a global company with
offices around the world. exida offers training, coaching, project oriented system consulting
services, safety lifecycle engineering tools, detailed product assurance, cyber-security andfunctional safety certification, and a collection of on-line safety and reliability resources. exida
maintains a comprehensive failure rate and failure mode database on process equipment.

2.2 Roles and parties involved
PR electronics A/S

Manufacturer of the temperature transmitter PR5337 / PR6337 /PR7501 with 4..20 mA output.

exida

Performed the hardware assessment.

PR electronics A/S contracted exida in January 2012 for the FMEDA of the above mentioned
device, in July 2014 with the update of the FMEDA and in June 2015 with review of the
FMEDA for PR7501 and adding results to this report.

2.3 Standards / Literature used
The services delivered by exida were performed based on the following standards / literature.
[N1]

IEC 61508-2:2010[N2]

Siemens standard with failure rates for components
SN 29500-1:01.2004
SN 29500-1 H1:12.2005
SN 29500-2:12:2004
SN 29500-3:12.2004
SN 29500-4:03.2004
SN 29500-5:06.2004
SN 29500-7:11.2005
SN 29500-9:11.2005
SN 29500-10:12.2005
SN 29500-11:08.1990
SN 29500-12:03.1994
SN 29500-13:03.1994
SN 29500-14:03.1994© exida.com GmbH
Stephan Aschenbrenner

Functional Safety of Electrical / Electronic / Programmable
Electronic Safety-Related Systems, 2nd edition

PR electronics 5337 11-12-052 R026 V3R1; August 11, 2015
Page 7 of 27

2.4 Reference documents
2.4.1 Documentation provided by the customer[D1]

5337Auk.pdf

Datasheet "5337A - 2-WIRE TRANSMITTER WITH
HART® PROTOCOL"; 5337AY101-UK (1207)[D2]

5337Duk.pdf

Datasheet "5337D - 2-WIRE TRANSMITTER WITH
HART® PROTOCOL"; 5337AY101-UK (1207)[D3]

6337Auk.pdf

Datasheet "6337A - 2-WIRE TRANSMITTER WITH
HART® PROTOCOL"; 6337AY101-UK (1207)[D4]6337Duk.pdf

Datasheet "6337D - 2-WIRE TRANSMITTER WITH
HART® PROTOCOL"; 6337AY101-UK (1207)[D5]

5337_BOM.xls

Parts list PR5337[D6]6337A2A_BOM.xls
6337A2B_BOM.xls

Parts list PR6337[D7]

5335-1-23-PDF.pdf

5335-1-23 schematic of 23.12.11[D8]6335-1-01-PDF.pdf

6335-1-01 schematic of 16.11.07[D9]

PRetop 5337 FMEDA v.6.xls

FMEDA dated 20.02.12[D10] PRetop 6337 FMEDA v.1.xls

FMEDA dated 22.02.12[D11] 5337 FMEDA Update July 2014- 5337 / 6337 FMEDA update July 2014, version
07-10.docx
V0R0 of 10.07.14[D12] PRetop 5337 FMEDA RTD
V1.xlsFMEDA dated 07.07.14[D13] PRetop 5337 FMEDA TC V1.xls

FMEDA dated 07.07.14[D14] PRetop 6337 FMEDA RTD
V1.xlsFMEDA dated 10.07.14[D15] PRetop 6337 FMEDA TC V1.xls

FMEDA dated 10.07.14[D16] Total SFF calculations.xlsx

SFF summary based on updated FMEDAs[D17] 7501-1-06.pdf

Schematics and Layouts of PR 7501, V6R0, dated
25.06.2015[D18] 7501-3-02.pdf

Connection board schematic and Layout of PR
7501, dated 01.06.2015[D19] 7501-1-06-BOM.xlsx

Parts list for PCB 7501-1-06[D20] 7501-2-06-BOM.xlsx

Parts list for PCB 7501-2-06[D21] 7501-3-02-BOM.xlsx

Parts list for PCB 7501-3-02[D22] 7501V100_UK.pdf

Product manual[D23] 7501-FIT-V3R0.pdf

Preliminary schematic with reference to FIT test

[D24] 7501-FIT-V6R0.pdf

Released schematic with reference to last FIT test

[D25] 7501-FMEDA-V6R1.xls

EXIDA FMEDA spread sheet, 29.7.2015[D26] 7501-FD-SFF-V1R0.docx

Overview for calculation, dated 26.06.2015

The list above only means that the referenced documents were provided as basis for the
FMEDA but it does not mean that exida checked the correctness and completeness of these
documents.
© exida.com GmbH
Stephan Aschenbrenner

PR electronics 5337 11-12-052 R026 V3R1; August 11, 2015
Page 8 of 27

2.4.2 Documentation generated by exida[R1]

PRetop 5337 FMEDA v.4.xls of 03.02.12[R2]

SV 5337 FMEDA report...msg of 10.02.12[R3]

SV Comments on last FMEDA.msg of 20.02.12[R4]

Review.txt of 22.02.12[R5]

SV 5337 FMEDA Report.msg of 02.07.14[R6]

Total SFF calculations V2R0.xlsx© exida.com GmbH
Stephan Aschenbrenner

PR electronics 5337 11-12-052 R026 V3R1; August 11, 2015
Page 9 of 27

3 Description of the temperature transmitters PR5337 / PR6337 / PR7501
The temperature transmitter PR5337 / PR6337 / PR7501 with 4..20 mA output can beconsidered to be a Type B element with a hardware fault tolerance of 0. Figure 1 shows thethree temperature transmitters PR5337 / PR6337 / PR7501.

Figure 1: Temperature transmitter PR5337 / PR6337 / PR7501
The temperature transmitter PR5337 / PR6337 / PR7501 with 4..20 mA output are isolated
two-wire 4..20mA device used in many different industries for both control and safety
applications. Combined with a temperature sensing device, the temperature transmitter
PR5337 / PR6337 / PR7501 with 4..20 mA output becomes a temperature sensor assembly.
PR7501 includes PR5337 as measuring part. It adds a display and an operating interface tothe loop.

© exida.com GmbH
Stephan Aschenbrenner

PR electronics 5337 11-12-052 R026 V3R1; August 11, 2015
Page 10 of 27

The temperature transmitter PR5337 / PR6337 / PR7501 with 4..20 mA output can be
configured in the following 3 ways:
With PR electronics A/S’ communications interface Loop Link and PReset PC
configuration software. (Except PR7501)

With a HART® modem and PReset PC configuration software.

With a HART® communicator with PR electronics A/S’ DDL driver.



PR7501: additionally with local operational interface

The transmitter operates with a 2-wire system. The same wires are used for the operating
voltage (depending on the transmitter) and the output signal (4...20 mA) including HART ®
protocol. This is also indicated in the following figure.
The temperature sensing devices
that can be connected to thetemperature transmitter PR5337 /PR6337 / PR7501 with 4..20 mA
output are:
2-, 3- and 4-wire RTD

Thermocouple

2-, 3- and 4-wireresistancemV input

Figure 2: Input configurations with temperature transmitter PR5337 / PR6337 / PR7501
The FMEDAs have been performed considering the worst-case input sensor configuration.

© exida.com GmbH
Stephan Aschenbrenner

PR electronics 5337 11-12-052 R026 V3R1; August 11, 2015
Page 11 of 27

4 Failure Modes, Effects, and Diagnostic Analysis
The Failure Modes, Effects, and Diagnostic Analysis, documented in [D14] and [D15], wasprepared by PR electronics A/S and reviewed by exida. When the effect of a certain
component failure mode could not be analyzed theoretically, the failure modes wereintroduced on component level and the effects of these failure modes were examined on
system level (see fault insertion tests documented in [D14] and [D15].
In case of the PR7501 an analysis was made to investigate the impact of the added circuits(mainly display, operation interface and HART communication). The final result of this showsthat the circuit does not add dangerous faults [D24], [D25], [D26]. The FMEDA results for the
PR 5337 / PR 6337 were taken over for the PR 7501, as the additional circuits do notcontribute to the dangerous failure rate.

4.1 Description of the failure categories
In order to judge the failure behavior of the temperature transmitter PR5337 / PR6337 /PR7501 with 4..20 mA output configurations, the following definitions for the failure of theconfigurations were considered.
Fail-Safe State
Fail Safe

Fail Dangerous

Fail Dangerous Undetected
Fail Dangerous Detected
Fail High
Fail Low
Annunciation© exida.com GmbH
Stephan Aschenbrenner

The fail-safe state is defined as the output reaching the user
defined threshold value.
A safe failure (S) is defined as a failure that plays a part in
implementing the safety function that:a) results in the spurious operation of the safety function to
put the EUC (or part thereof) into a safe state or maintaina safe state; or,b) increases the probability of the spurious operation of thesafety function to put the EUC (or part thereof) into a safe
state or maintain a safe state.
A dangerous failure (D) is defined as a failure that plays a partin implementing the safety function that:a) prevents a safety function from operating when required(demand mode) or causes a safety function to fail(continuous mode) such that the EUC is put into ahazardous or potentially hazardous state; or,b) decreases the probability that the safety function operates
correctly when required.
Failure that is dangerous and that is not being diagnosed byinternal diagnostics.
Failure that is dangerous but is detected by internal
diagnostics.
A fail high failure (H) is defined as a failure that causes theoutput signal to go to the maximum output current (> 21mA).
A fail low failure (L) is defined as a failure that causes theoutput signal to go to the minimum output current (< 3.6mA).
Failure that does not directly impact safety but does impact theability to detect a future fault (such as a fault in a diagnostic
circuit). Annunciation failures are divided into annunciation
detected (AD) and annunciation undetected (AU) failures.
PR electronics 5337 11-12-052 R026 V3R1; August 11, 2015
Page 12 of 27

No effectNo part

Failure mode of a component that plays a part in implementing
the safety function but is neither a safe failure nor a dangerous
failure.
Component that plays no part in implementing the safetyfunction but is part of the circuit diagram and is listed forcompleteness.

4.2 Methodology – FMEDA, Failure rates
4.2.1 FMEDAA Failure Modes and Effects Analysis (FMEA) is a systematic way to identify and evaluate theeffects of different component failure modes, to determine what could eliminate or reduce thechance of failure, and to document the system under consideration.
An FMEDA (Failure Mode Effect and Diagnostic Analysis) is an FMEA extension. It combines
standard FMEA techniques with extensions to identify online diagnostics techniques and thefailure modes relevant to safety instrumented system design. It is a technique recommended togenerate failure rates for each important category (safe detected, safe undetected, dangerous
detected, dangerous undetected, fail high, fail low) in the safety models. The format for the
FMEDA is an extension of the standard FMEA format from MIL STD 1629A, Failure Modes andEffects Analysis.

4.2.2 Failure rates
The failure rates used in this analysis are the basic failure rates from the Siemens standard
SN 29500. The rates were chosen in a way that is appropriate for safety integrity level
verification calculations. The rates were chosen to match operating stress conditions typical of
an industrial field environment. It is expected that the actual number of field failures due torandom events will be less than the number predicted by these failure rates.
For hardware assessment according to IEC 61508 only random equipment failures are ofinterest. It is assumed that the equipment has been properly selected for the application and isadequately commissioned such that early life failures (infant mortality) may be excluded fromthe analysis.
Failures caused by external events however should be considered as random failures.
Examples of such failures are loss of power or physical abuse.
The assumption is also made that the equipment is maintained per the requirements of
IEC 61508 or IEC 61511 and therefore a preventative maintenance program is in place toreplace equipment before the end of its “useful life”.
The user of these numbers is responsible for determining their applicability to any particularenvironment. Accurate plant specific data may be used for this purpose. If a user has datacollected from a good proof test reporting system that indicates higher failure rates, the higher
numbers shall be used. Some industrial plant sites have high levels of stress. Under thoseconditions the failure rate data is adjusted to a higher value to account for the specificconditions of the plant.

© exida.com GmbH
Stephan Aschenbrenner

PR electronics 5337 11-12-052 R026 V3R1; August 11, 2015
Page 13 of 27

4.2.3 Assumptions
The following assumptions have been made during the Failure Modes, Effects, and Diagnostic
Analysis of the temperature transmitter PR5337 / PR6337 / PR7501 with 4..20 mA output
converter configurations.


Failure rates are constant, wear out mechanisms are not included.

Propagation of failures is not relevant.



Failures during parameterization are not considered.



The HART protocol is only used for setup, calibration, and diagnostics purposes, not forsafety critical operation.



The device is installed per manufacturer’s instructions.



Sufficient tests are performed prior to shipment to verify the absence of vendor and/or
manufacturing defects that prevent proper operation of specified functionality to productspecifications or cause operation different from the design analyzed.

The device is locked against unintended operation/modification.



The worst-case internal fault detection time is 5 minutes.

External power supply failure rates are not included.



The Mean Time To Restoration (MTTR) after a safe failure is 24 hours.



Only the described HW and SW versions are used for safety applications.



The device is operated in the low demand mode of operation.



The safety function is carried out via 1 input and 1 output channel.

The listed SN29500 failure rates are valid for operating stress conditions typical of anindustrial field environment with an average temperature over a long period of time of
40ºC. For a higher average temperature of 60°C, the failure rates should be multiplied withan experience based factor of 2.5. A similar multiplier should be used if frequent
temperature fluctuation (daily fluctuation of > 15°C) must be assumed. Other
environmental characteristics are assumed to be within the manufacturer’s ratings.

Only the 4..20mA current output is used for safety applications.



The 4..20 mA output signal is fed to a SIL 2 compliant analog input board of a safety PLC.



The application program in the safety logic solver is configured according to NAMUR
NE43 to detect under-range and over-range failures of the 4..20 mA output signal, anddoes not automatically trip on these failures; therefore these failures have been classified
as dangerous detected failures.

© exida.com GmbH
Stephan Aschenbrenner

PR electronics 5337 11-12-052 R026 V3R1; August 11, 2015
Page 14 of 27

4.3 Results
DC = DD / (DD + DU)
total = SD + SU + DD + DUMTBF = MTTF + MTTR = (1 / (total + no part + AU)) + 24 h
According to IEC 61508 the architectural constraints of an element must be determined. Thiscan be done by following the 1 H approach according to 7.4.4.2 of IEC 61508-2 or the 2H
approach according to 7.4.4.3 of IEC 61508-2.
The 1H approach involves calculating the Safe Failure Fraction for the entire element.
The 2H approach involves assessment of the reliability data for the entire element according to
7.4.4.3.3 of IEC 61508-2.
This assessment supports the 1H approach.
According to 3.6.15 of IEC 61508-4, the Safe Failure Fraction is the property of a safety
related element that is defined by the ratio of the average failure rates of safe plus dangerous
detected failures and safe plus dangerous failures. This ratio is represented by the following
equation:
SFF = (ΣλS avg + ΣλDD avg) / (ΣλS avg + ΣλDD avg+ ΣλDU avg)
When the failure rates are based on constant failure rates, as in this analysis, the equation canbe simplified to:
SFF = (ΣλS + ΣλDD) / (ΣλS + ΣλDD + ΣλDU)
Where:
λS = Fail Safe
λDD = Fail Dangerous Detected
λDU= Fail Dangerous Undetected
As the temperature transmitter PR5337 / PR6337 / PR7501 with 4..20 mA output is only one
part of an element, the architectural constraints should be determined for the entire sensor
element.
MTBF = MTTF + MTTR = (1 / (total + no part + no effect + AU)) + 24 h

© exida.com GmbH
Stephan Aschenbrenner

PR electronics 5337 11-12-052 R026 V3R1; August 11, 2015
Page 15 of 27

4.3.1 Temperature transmitter PR5337 / PR6337 / PR7501 with 4..20 mA output
The FMEDA carried out on the temperature transmitter PR5337 / PR6337 / PR7501 with 4..20mA output leads under the assumptions described in section 4.2.3 to the following failure
rates:
Table 4: PR5337 / PR6337 / PR7501 for RTD sensor types – IEC 61508 failure rates
Failure category

Siemens SN 29500 [FIT]Fail Safe Detected ( SD)

0

Fail Safe Undetected ( SU)

0203

Fail Dangerous Detected ( DD)
Fail Dangerous Detected (dd)

144

Fail Annunciation Detected (AD)0

Fail High (H)

17

Fail Low (L)

42
71

Fail Dangerous Undetected ( DU)
Fail Annunciation Undetected (AU)1

No effect122

No part65

Total failure rate of the safety function ( Total)

274

Safe failure fraction (SFF)

74%

DCD

74%

SIL AC 4

SIL 1

4SIL AC (architectural constraints) means that the calculated values are within the range for hardware architectural
constraints for the corresponding SIL but does not imply all related IEC 61508 requirements are fulfilled. In addition
it must be shown that the device has a suitable systematic capability for the required SIL and that the entire safetyfunction can fulfill the required PFD / PFH values.
© exida.com GmbH
Stephan Aschenbrenner

PR electronics 5337 11-12-052 R026 V3R1; August 11, 2015
Page 16 of 27

Table 5: PR 5337 / PR 6337 / PR 7501 for TC sensor types – IEC 61508 failure rates
Failure category

Siemens SN 29500 [FIT]Fail Safe Detected ( SD)

0

Fail Safe Undetected ( SU)

0205

Fail Dangerous Detected ( DD)
Fail Dangerous Detected (dd)

146

Fail Annunciation Detected (AD)0

Fail High (H)

17

Fail Low (L)

42
74

Fail Dangerous Undetected ( DU)
Fail Annunciation Undetected (AU)1

No effect117

No part65

Total failure rate of the safety function ( Total)

279

Safe failure fraction (SFF)

73%

DCD

73%

SIL AC 6

SIL 1

6SIL AC (architectural constraints) means that the calculated values are within the range for hardware architectural
constraints for the corresponding SIL but does not imply all related IEC 61508 requirements are fulfilled. In addition
it must be shown that the device has a suitable systematic capability for the required SIL and that the entire safetyfunction can fulfill the required PFD / PFH values.
© exida.com GmbH
Stephan Aschenbrenner

PR electronics 5337 11-12-052 R026 V3R1; August 11, 2015
Page 17 of 27

5 Using the FMEDA results
The following section describes how to apply the results of the FMEDA.

5.1

Temperature sensing devices

A temperature transmitter PR5337 / PR6337 / PR7501 with 4..20 mA output together with atemperature sensing device becomes a temperature sensor assembly. When using the resultsof the FMEDA in a SIL verification assessment also the failure rates and failure modes of thetemperature sensing device must be considered.

5.1.1 Thermocouple (TC) sensing devices
The failure mode distribution for thermocouples varies in published literature but there is strong
agreement that open circuit or “burn-out” failure is the dominant failure mode. While someestimates put this failure mode at 99%+, a more conservative failure rate distribution suitablefor SIS applications is shown in Table 6 and Table 7, when thermocouples are supplied fromthe temperature transmitter PR5337 / PR6337 / PR7501 with 4..20 mA output. The drift failuremode is primarily due to T/C aging. The temperature transmitter PR5337 / PR6337 / PR7501
with 4..20 mA output will detect a thermocouple burn-out failure and drive its output to thespecified failure state.
Table 6 Typical failure rates for thermocouples (with extension wire)
Thermocouple Failure Mode Distribution
Open Circuit (Burn-out)
Short Circuit (Temperature measurement in error)
Drift (Temperature measurement in error)

Low StressHigh Stress

900 FIT
50 FIT
50 FIT

18000 FIT
1000 FIT
1000 FIT

Table 7 Typical failure rates for thermocouples (close coupled)
Thermocouple Failure Mode Distribution
Open Circuit (Burn-out)
Short Circuit (Temperature measurement in error)
Drift (Temperature measurement in error)

Low StressHigh Stress

95 FIT
4 FIT
1 FIT

1900 FIT
80 FIT
20 FIT

A complete temperature sensor assembly consisting of a temperature transmitter PR5337 /PR6337 / PR7501 with 4..20 mA output and a temperature sensing device can be modeled byconsidering a series subsystem where a failure occurs if there is a failure in either component.
For such a system, failure rates are added.
Assuming that the temperature transmitter PR5337 / PR6337 / PR7501 with 4..20 mA output
will go to the pre-defined alarm state on detected failures of the thermocouple, the failure rate
contribution for the thermocouple is:
Low stress environment (close coupled)

High stress environment (close coupled)dd = 95 FIT

dd = 1900 FIT

du = 4 FIT + 1 FIT = 5 FIT

du = 80 FIT + 20 FIT = 100 FIT© exida.com GmbH
Stephan Aschenbrenner

PR electronics 5337 11-12-052 R026 V3R1; August 11, 2015
Page 18 of 27

Low stress environment (extension wire)High stress environment (extension wire)dd = 900 FIT

dd = 18000 FIT

du = 50 FIT + 50 FIT = 100 FIT

du = 1000 FIT + 1000 FIT = 2000 FITThis results in a failure rate distribution and SFF of:
Table 8: PR5337 / PR6337 / PR7501 with TC
Environment

 SD

 SU

 DD

 DU

SFF

Low stress, close coupled

0 FIT

0 FIT

300 FIT79 FIT

79%

High stress, close coupled

0 FIT

0 FIT

2105 FIT

174 FIT92%

Low stress, with ext. wire

0 FIT

0 FIT

1105 FIT

174 FIT86%

High stress, with ext. wire

0 FIT

0 FIT

18205 FIT

2074 FIT

89%

5.1.2 RTD sensing devices
The failure mode distribution for an RTD also depends on the application with the key
variables being stress level, RTD wire length and RTD type (4 wire). The key stress variables
are high vibration and frequent temperature cycling as these are known to cause cracks in thesubstrate leading to broken lead connection welds. Failure rate distributions are shown in
Table 9 and Table 10. The temperature transmitter PR5337 / PR6337 / PR7501 with 4..20 mA
output will detect open circuit, short circuit and a certain percentage of drift RTD failures anddrive its output to the specified alarm state.
Table 9 Typical failure rates for 4-Wire RTDs (with extension wire)
RTD Failure Mode Distribution
Open Circuit (Burn-out)
Short Circuit (Temperature measurement in error)
Drift (Temperature Measurement in error)

Low StressHigh Stress

410 FIT
20 FIT
70 FIT 88200 FIT
400 FIT
1400 FIT 9Table 10 Typical failure rates for 4-Wire RTDs (close coupled)
RTD Failure Mode Distribution
Open Circuit (Burn-out)
Short Circuit (Temperature measurement in error)
Drift (Temperature Measurement in error)

Low StressHigh Stress

41,5 FIT
2,5 FIT
6 FIT 10830 FIT
50 FIT
120 FIT 11

A complete temperature sensor assembly consisting of a temperature transmitter PR5337 /PR6337 / PR7501 with 4..20 mA output and a temperature sensing device can be modeled byconsidering a series subsystem where a failure occurs if there is a failure in either component.
For such a system, failure rates are added.
8

It is assumed that 65 FIT are detectable if the 4-wire RTD is correctly used.

9

It is assumed that 1300 FIT are detectable if the 4-wire RTD is correctly used.
10
It is assumed that 3.5 FIT are detectable if the 4-wire RTD is correctly used.

11

It is assumed that 70 FIT are detectable if the 4-wire RTD is correctly used.

© exida.com GmbH
Stephan Aschenbrenner

PR electronics 5337 11-12-052 R026 V3R1; August 11, 2015
Page 19 of 27

Assuming that the temperature transmitter PR5337 / PR6337 / PR7501 with 4..20 mA output
will go to the pre-defined alarm state on a detected failure of the RTD, the failure rate
contribution for the RTD is:
4-Wire RTD close coupled:
Low stress environment

High stress environment

dd= 41,5 FIT + 2,5 FIT + 3,5 FIT =47,5 FIT

dd= 830 FIT + 50 FIT + 70 FIT = 950 FIT

du= 2,5 FIT

du= 50 FIT

4-Wire RTD with extension wire:
Low stress environment

High stress environment

dd= 410 FIT + 20 FIT + 65 FIT = 495 FIT

dd= 8200 FIT + 400 FIT + 1300 FIT = 9900 FIT

du= 5 FIT

du= 100 FITThis results in a failure rate distribution and SFF of:
Table 11: PR5337 / PR6337 / PR7501 with 4-Wire RTD
Environment

 SD

 SU

 DD

 DU

SFF

Low stress, close coupled

0 FIT

0 FIT

251 FIT

74 FIT

77%

High stress, close coupled

0 FIT

0 FIT

1153 FIT

121 FIT90%

Low stress, with ext. wire

0 FIT

0 FIT

698 FIT

76 FIT

90%

High stress, with ext. wire

0 FIT

0 FIT

10103 FIT

171 FIT

98%

These numbers could be used in safety instrumented function SIL verification calculations forthis set of assumptions.

© exida.com GmbH
Stephan Aschenbrenner

PR electronics 5337 11-12-052 R026 V3R1; August 11, 2015
Page 20 of 27

6 Applying the FMEDA results
It is the responsibility of the Safety Instrumented Function designer to do calculations for theentire SIF. exida recommends the accurate Markov based exSILentia tool for this purpose.
The following section describes how to apply the results of the FMEDA.

6.1

Example PFDAVG calculation

The following results must be considered in combination with PFD AVG values of other devicesof a Safety Instrumented Function (SIF) in order to determine suitability for a specific Safety
Integrity Level (SIL).
An average Probability of Failure on Demand (PFD AVG) calculation is performed for a single(1oo1) temperature transmitter PR5337 / PR6337 / PR7501 with 4..20 mA output with exida's
exSILentia tool. The failure rate data used in this calculation are displayed in section 4.3.1. A
mission time of 10 years has been assumed, a Mean Time To Restoration of 24 hours and amaintenance capability of 100%. Table 12 lists the results for different proof test intervals
considering an average proof test coverage of 95% (see Appendix 1).
Table 12: PFDAVG values
T[Proof] = 1 year

T[Proof] = 2 years

T[Proof] = 5 years

PR5337 / PR6337 /PR7501with RTD

PFDAVG = 4.55E-04

PFDAVG = 7.50E-04

PFDAVG = 1.64E-03

PR5337 / PR6337 /PR7501with TC

PFDAVG = 4.74E-04

PFDAVG = 7.82E-04

PFDAVG = 1.70E-03

For SIL2 the overall PFDAVG shall be better than 1.00E-02. As temperature transmitter PR5337/ PR6337 / PR7501 with 4..20 mA output is contributing to the entire safety function it should
only consume a certain percentage of the allowed range. Assuming 25% of this range as areasonable budget it should be better than or equal to 2.50E-03. The calculated PFDAVG values
are within the allowed range for SIL 2 according to table 2 of IEC 61508-1 and do fulfill the
assumption to not claim more than 25% of the allowed range, i.e. to be better than or equal to2.50E-03.
The resulting PFDAVG graphs generated from the exSILentia tool for a proof test of 1 year are
displayed in Figure 3.
PR 5337 / PR 6337 / PR7501 (RTD)

PR 5337 / PR 6337 / PR7501 (TC)

Figure 3: PFDAVG(t)© exida.com GmbH
Stephan Aschenbrenner

PR electronics 5337 11-12-052 R026 V3R1; August 11, 2015
Page 21 of 27

7 Terms and Definitions
DCD

Diagnostic Coverage of dangerous failures (DCD = dd / (dd + du))FIT

Failure In Time (1x10-9 failures per hour)

FMEDA

Failure Modes, Effects, and Diagnostic Analysis

HFT

Hardware Fault Tolerance

Low demand mode

Mode where the frequency of demands for operation made on a safetyrelated system is no greater than one per year and no greater than
twice the proof test frequency.

MTBF

Mean Time Between Failure

MTTF

Mean Time To Failure

MTTR

Mean Time To Restoration

PFDAVG

Average Probability of Failure on Demand

RTD

Resistance temperature detector

SFF

Safe Failure Fraction summarizes the fraction of failures, which lead toa safe state and the fraction of failures which will be detected bydiagnostic measures and lead to a defined safety action.

SIF

Safety Instrumented Function

SIL

Safety Integrity Level

TC

Thermocouple

Type B element“Complex” element (using micro controllers or programmable logic).
For details see 7.4.4.1.3 of IEC 61508-2, 2nd edition

T[Proof]

Proof Test Interval© exida.com GmbH
Stephan Aschenbrenner

PR electronics 5337 11-12-052 R026 V3R1; August 11, 2015
Page 22 of 27

8 Status of the document
8.1 Liability
exida prepares FMEDA reports based on methods advocated in International standards.
Failure rates are obtained from a collection of industrial databases. exida accepts no liability
whatsoever for the use of these numbers or for the correctness of the standards on which thegeneral calculation methods are based.
Due to future potential changes in the standards, best available information and best practices,
the current FMEDA results presented in this report may not be fully consistent with results thatwould be presented for the identical product at some future time. As a leader in the functionalsafety market place, exida is actively involved in evolving best practices prior to official releaseof updated standards so that our reports effectively anticipate any known changes. In addition,
most changes are anticipated to be incremental in nature and results reported within theprevious three year period should be sufficient for current usage without significant question.
Most products also tend to undergo incremental changes over time. If an exida FMEDA has
not been updated within the last three years and the exact results are critical to the SIL
verification you may wish to contact the product vendor to verify the current validity of theresults.

8.2 Releases
Version History: V3R1 Omitted MTBF values; August 11, 2015
V3R0 PR7501 field mounted device added; August 4, 2015
V2R0: Failure rates updated; July 11, 2014
V1R0: Review comments incorporated; February 27, 2012
V0R1: Initial version; February 22, 2012
Authors:
Stephan Aschenbrenner
Review:
V0R1: Rudolf P. Chalupa (exida); February 24, 2012
Dennis Gregersen (PR electronics A/S); February 23, 2012
Release status: Released to PR electronics A/S

8.3 Release Signatures

Dipl.-Ing. (Univ.) Stephan Aschenbrenner, Partner

Dipl.-Ing (FH)Jürgen Hochhaus, Senior safety engineer© exida.com GmbH
Stephan Aschenbrenner

PR electronics 5337 11-12-052 R026 V3R1; August 11, 2015
Page 23 of 27

Appendix 1: Possibilities to reveal dangerous undetected faults during theproof test
According to section 7.4.5.2 f) of IEC 61508-2 proof tests shall be undertaken to reveal
dangerous faults which are undetected by diagnostic tests. This means that it is necessary to
specify how dangerous undetected faults which have been noted during the FMEDA can bedetected during proof testing.
A possible proof test consists of the following steps:
Step

Action1

Bypass the safety PLC or take other appropriate actions to avoid a false trip

2

Perform a multi-point calibration of the temperature transmitter covering theapplicable temperature range

3

Apply an adequate input signal to reach the pre-defined alarm level and verify thatthe safe state is reached (The analog current output corresponds to the provided
input signal).

4

Restore the loop to full operation

5

Remove the bypass from the safety PLC or otherwise restore normal operation

It is assumed that this proof test will detect 95% of possible “du” failures in the device.

© exida.com GmbH
Stephan Aschenbrenner

PR electronics 5337 11-12-052 R026 V3R1; August 11, 2015
Page 24 of 27

Appendix 2: Impact of lifetime of critical components on the failure rate
According to section 7.4.9.5 of IEC 61508-2, a useful lifetime, based on experience, should beassumed.
Although a constant failure rate is assumed by the probabilistic estimation method (see section
4.2.3) this only applies provided that the useful lifetime 12 of components is not exceeded.
Beyond their useful lifetime, the result of the probabilistic calculation method is meaningless,as the probability of failure significantly increases with time. The useful lifetime is highly
dependent on the component itself and its operating conditions – temperature in particular (forexample, electrolytic capacitors can be very sensitive).
This assumption of a constant failure rate is based on the bathtub curve, which shows the
typical behavior for electronic components. Therefore it is obvious that the PFD AVG calculationis only valid for components which have this constant domain and that the validity of thecalculation is limited to the useful lifetime of each component.
It is assumed that early failures are detected to a huge percentage during the installation
period and therefore the assumption of a constant failure rate during the useful lifetime is valid.
Table 13 shows which components with reduced useful lifetime are contributing to thedangerous undetected failure rate and therefore to the PFD AVG calculation and what theirestimated useful lifetime is.
Table 13: Useful lifetime of components with reduced useful lifetime contributing to  duType

Useful lifetime

Tantalum electrolytic (C40)

Approximately 500000 hours

Temperature sensor

According to manufacturer specification

When plant experience indicates a shorter useful lifetime than indicated in this appendix, thenumber based on plant experience should be used.

12

Useful lifetime is a reliability engineering term that describes the operational time interval where the failure rate ofa device is relatively constant. It is not a term which covers product obsolescence, warranty, or other commercial
issues.
© exida.com GmbH
Stephan Aschenbrenner

PR electronics 5337 11-12-052 R026 V3R1; August 11, 2015
Page 25 of 27

Appendix 3: Failure rates according to IEC 61508:2000 1st Edition
Table 14 PR5337 / PR6337 / PR7501 for RTD sensor types – IEC 61508 failure rates
Failure category

Siemens SN 29500 [FIT]Fail Safe Detected ( SD)

0

Fail Safe Undetected ( SU)

123

Fail Safe Undetected (su)0

No effect

122

Fail Annunciation Undetected (AU)

1
203

Fail Dangerous Detected ( DD)
Fail Dangerous Detected (dd)

144

Fail Annunciation Detected (AD)0

Fail High (H)

17

Fail Low (L)

42
71

Fail Dangerous Undetected ( DU)
No part65

Total failure rate of the safety function ( Total)

397

Safe failure fraction (SFF)

82%

DCD

74%

SIL AC 13

SIL 1

13

SIL AC (architectural constraints) means that the calculated values are within the range for hardware
architectural constraints for the corresponding SIL but does not imply all related IEC 61508 requirements are
fulfilled. In addition it must be shown that the device has a suitable systematic capability for the required SIL andthat the entire safety function can fulfill the required PFD / PFH values.

© exida.com GmbH
Stephan Aschenbrenner

PR electronics 5337 11-12-052 R026 V3R1; August 11, 2015
Page 26 of 27

Table 15 PR5337 / PR6337 / PR7501 for TC sensor types – IEC 61508 failure rates
Failure category

Siemens SN 29500 [FIT]Fail Safe Detected ( SD)

0

Fail Safe Undetected ( SU)

118

Fail Safe Undetected (su)0

No effect117

Fail Annunciation Undetected (AU)

1
205

Fail Dangerous Detected ( DD)
Fail Dangerous Detected (dd)

146

Fail Annunciation Detected (AD)0

Fail High (H)

17

Fail Low (L)

42
74

Fail Dangerous Undetected ( DU)
No part65

Total failure rate of the safety function ( Total)

397

Safe failure fraction (SFF)

81%

DCD

73%

SIL AC 14

SIL 1

14

SIL AC (architectural constraints) means that the calculated values are within the range for hardware
architectural constraints for the corresponding SIL but does not imply all related IEC 61508 requirements are
fulfilled. In addition it must be shown that the device has a suitable systematic capability for the required SIL andthat the entire safety function can fulfill the required PFD / PFH values.
© exida.com GmbH
Stephan Aschenbrenner

PR electronics 5337 11-12-052 R026 V3R1; August 11, 2015
Page 27 of 27