Source: https://www.scribd.com/document/88520383/SIF-SIL-part-I
Timestamp: 2016-09-29 06:09:42
Document Index: 693719123

Matched Legal Cases: ['art 1', 'art 1', 'art 1', 'art 1', 'art 1', 'art 1', 'art 1', 'art 1', 'art 1', 'art 1', 'art 2', 'art 3', 'art 4', 'art 5', 'art 1', 'art 1', 'art 1', 'art 1', 'art 4', 'art 2', 'art 1', 'art 4', 'art 2', 'art 3', 'art 1', 'art 3', 'art 5', 'art 1', 'art 2', 'art 1', 'art 1', 'art 4', 'art 3', 'art 1', 'art 1', 'art 1', 'art 1', 'art 1', 'art 2', 'art 4', 'art 5', 'art 1', 'art 3', 'art 1', 'art 2', 'art 1', 'art 1', 'art 1', 'art 1', 'art 1', 'art 1', 'art 1', 'art 1', 'art 1', 'art 1', 'art.00', 'art 1', 'art 5', 'art 1', 'art 1', 'art 1', 'art 1', 'art 1', 'art 1', 'art 1', 'art 1', 'art 1', 'art 1', 'art 1', 'art 1', 'art 1', 'art 1', 'art 1', 'art 1', 'art 1', 'art 1', 'art 1', 'art 1', 'art 1', 'art 1', 'art 1', 'art 2', 'art 1', 'art 4', 'art 5', 'art 3', 'art 1', 'art 1', 'art 1', 'art 2', 'art 1', 'art 4', 'art 3', 'arts 2', 'art 5', 'art 2', 'art 3', 'art 4', 'art 1', 'arts 2', 'arts 2', 'arts 2', 'art 1', 'art 2', 'art 3', 'art 3', 'art 4', 'art 2', 'art 3', 'art 4', 'arts 3', 'arts 2', 'art 6', 'art 1', 'art 1', 'art 1', 'art 1', 'art 1', 'art 1', 'art 1', 'art 1', 'art 1', 'art 1', 'art 1', 'art 1', 'art 1', 'art 1', 'art 1', 'art 1', 'art 1', 'art 1', 'art 1', 'arts 2', 'art 1', 'art 1', 'art 1', 'art 1', 'art 1', 'art 1', 'art 1', 'art 1', 'art 1', 'art 1', 'art 1', 'art 2']

BrowseBrowseInterestsBiography & MemoirBusiness & LeadershipFiction & LiteraturePolitics & EconomyHealth & WellnessSociety & CultureHappiness & Self-HelpMystery, Thriller & CrimeHistoryYoung AdultBrowse byBooksAudiobooksComicsSheet MusicBrowse allUploadSign inJoinBooksAudiobooksComicsSheet MusicSIF SIL part IUploaded by Mohamed Altaf JafferElectronicsReliability EngineeringSafety415 viewsDownloadEmbedSee MoreCopyright: Attribution Non-Commercial (BY-NC)List price: $0.00Download as PDF, TXT or read online from ScribdFlag for inappropriate contentWelcome to Scribd! Start your free trial and access books, documents and more.Find out moreTECHNICAL REPORTISA-TR84.00.02-2002 - Part 1
ISA–The Instrumentation, Systems, and Automation Society
ISA-TR84.00.02-2002 – Part 1 Safety Instrumented Functions (SIF)  Safety Integrity Level (SIL) Evaluation Techniques Part 1: Introduction ISBN: 1-55617-802-6 Copyright © 2002 by ISA —The Instrumentation, Systems, and Automation Society. All rights reserved. Not for resale. Printed in the United States of America. No part of this publication may be reproduced, stored in a retrieval system, or transmitted in any form or by any means (electronic mechanical, photocopying, recording, or otherwise), without the prior written permission of the Publisher. ISA 67 Alexander Drive P.O. Box 12277 Research Triangle Park, North Carolina 27709
This preface, as well as all footnotes and annexes, is included for information purposes and is not part of ISA-TR84.00.02-2002 – Part 1. This document has been prepared as part of the service of ISAthe Instrumentation, Systems, and Automation Societytoward a goal of uniformity in the field of instrumentation. To be of real value, this document should not be static but should be subject to periodic review. Toward this end, the Society welcomes all comments and criticisms and asks that they be addressed to the Secretary, Standards and Practices Board; ISA; 67 Alexander Drive; P. O. Box 12277; Research Triangle Park, NC 27709; Telephone (919) 549-8411; Fax (919) 549-8288; E-mail: standards@isa.org. The ISA Standards and Practices Department is aware of the growing need for attention to the metric system of units in general, and the International System of Units (SI) in particular, in the preparation of instrumentation standards. The Department is further aware of the benefits to USA users of ISA standards of incorporating suitable references to the SI (and the metric system) in their business and professional dealings with other countries. Toward this end, this Department will endeavor to introduce SI-acceptable metric units in all new and revised standards, recommended practices, and technical reports to the greatest extent possible. Standard for Use of the International System of Units (SI): The Modern Metric System, published by the American Society for Testing & Materials as IEEE/ASTM SI 1097, and future revisions, will be the reference guide for definitions, symbols, abbreviations, and conversion factors. It is the policy of ISA to encourage and welcome the participation of all concerned individuals and interests in the development of ISA standards, recommended practices, and technical reports. Participation in the ISA standards-making process by an individual in no way constitutes endorsement by the employer of that individual, of ISA, or of any of the standards, recommended practices, and technical reports that ISA develops. CAUTION — ISA ADHERES TO THE POLICY OF THE AMERICAN NATIONAL STANDARDS INSTITUTE WITH REGARD TO PATENTS. IF ISA IS INFORMED OF AN EXISTING PATENT THAT IS REQUIRED FOR USE OF THE STANDARD, IT WILL REQUIRE THE OWNER OF THE PATENT TO EITHER GRANT A ROYALTY-FREE LICENSE FOR USE OF THE PATENT BY USERS COMPLYING WITH THE STANDARD OR A LICENSE ON REASONABLE TERMS AND CONDITIONS THAT ARE FREE FROM UNFAIR DISCRIMINATION. EVEN IF ISA IS UNAWARE OF ANY PATENT COVERING THIS STANDARD, THE USER IS CAUTIONED THAT IMPLEMENTATION OF THE STANDARD MAY REQUIRE USE OF TECHNIQUES, PROCESSES, OR MATERIALS COVERED BY PATENT RIGHTS. ISA TAKES NO POSITION ON THE EXISTENCE OR VALIDITY OF ANY PATENT RIGHTS THAT MAY BE INVOLVED IN IMPLEMENTING THE STANDARD. ISA IS NOT RESPONSIBLE FOR IDENTIFYING ALL PATENTS THAT MAY REQUIRE A LICENSE BEFORE IMPLEMENTATION OF THE STANDARD OR FOR INVESTIGATING THE VALIDITY OR SCOPE OF ANY PATENTS BROUGHT TO ITS ATTENTION. THE USER SHOULD CAREFULLY INVESTIGATE RELEVANT PATENTS BEFORE USING THE STANDARD FOR THE USER’S INTENDED APPLICATION. HOWEVER, ISA ASKS THAT ANYONE REVIEWING THIS STANDARD WHO IS AWARE OF ANY PATENTS THAT MAY IMPACT IMPLEMENTATION OF THE STANDARD NOTIFY THE ISA STANDARDS AND PRACTICES DEPARTMENT OF THE PATENT AND ITS OWNER. ADDITIONALLY, THE USE OF THIS STANDARD MAY INVOLVE HAZARDOUS MATERIALS, OPERATIONS OR EQUIPMENT. THE STANDARD CANNOT ANTICIPATE ALL POSSIBLE APPLICATIONS OR ADDRESS ALL POSSIBLE SAFETY ISSUES ASSOCIATED WITH USE IN HAZARDOUS CONDITIONS. THE USER OF THIS STANDARD MUST EXERCISE SOUND
Gruhn C. Bender K. Lewis E. Carew K. Deceased Consultant Triconex Corporation ABS Consulting Fritsch Consulting Service Kellogg Brown & Root Dupont Consultant exida. Dunn* P. Syscon International Inc. Karydas* L.com LLC Rohm & Haas Company Siemens CDH Consulting Inc. Johnson* D. Laskowski T. Adler R. Ackerman R. UOP LLC Albert Garaody & Associates TUV Product Service Inc. Maggioli. The following people served as members of ISA Committee SP84: NAME V. Gandhi R. HIMA Americas Inc. Bailliet N. Beckman S. Fritsch K. Frederickson R. Leonard E. Webb. Adamski C. Bond A. Haysley M. Battikha L. Gilman W. Emerson Process Management D J Leonard Consultants Consultant Exida.02-2002 . Freeman D.ISA-TR84. THE USER OF THIS DOCUMENT SHOULD BE AWARE THAT THIS DOCUMENT MAY BE IMPACTED BY ELECTRONIC SECURITY ISSUES. Green* P. Marszal N. McLeod W. Managing Director C. Brown* J. Houtermans J. Early T. THE COMMITTEE HAS NOT YET ADDRESSED THE POTENTIAL ISSUES IN THIS VERSION. Flynt A. Hardin J. Harris D. E I du Pont Factory Mutual Research Corporation Solutia Inc.com Atofina WLM Engineering Company Creative Systems International
. S K Bender & Associates Shell Global Solutions Eindhoven University of Technology DuPont Company Consultant Baker Engineering & Lisk Consulting Rohm & Haas Company DuPont Engineering ABB Industrial Systems Inc. Invensys Moore Industries International Inc. Dejmek A. Bantrel Inc. Goble D. Fisher J. Mostia D. Layer D.Part 1
PROFESSIONAL JUDGMENT CONCERNING ITS USE AND APPLICABILITY UNDER THE USER’S PARTICULAR CIRCUMSTANCES. Gardner* J.00. Chair R. Jamison W. Bergo Tech Inc. THE USER MUST ALSO CONSIDER THE APPLICABILITY OF ANY GOVERNMENTAL REGULATORY LIMITATIONS AND ESTABLISHED SAFETY AND HEALTH PRACTICES BEFORE IMPLEMENTING THIS STANDARD. Dowell* R. Ogwude COMPANY Feltronics Corporation POWER Engineers Air Products & Chemicals Inc. Brombacher S.
Schilowsky D. Sniezek C. Chevron Texaco ERTC
This standard was approved for publication by the ISA Standards and Practices Board on 17 June 2002. Reimer J.−5−
ISA-TR84. McAvinew A. Zielinski D. Ramachandran K. Consultant Paprican Consultant Ametek. Summers L. Suttinger R. Williams G. Zetterberg ______ * One vote per company. Maggioli T. Szanyi R. Schneider Electric Southern Company ACES Inc Ivy Optiks Dow Chemical Company Feltronics Corporation ForeRunner Corporation Chagrin Valley Controls. Weidman J. Inc. G.
Cytec Industries Inc. McFarland R. Widmeyer C. Cohen M. Weber D. Webb W. Wood COMPANY Emerson Process Management David N Bishop. Rockwell Automation Factory Mutual Research Corporation Yamatake Corporation Syncrude Canada Ltd. Rennie H. Storey A. Spiker P.02-2002 .Part 1
G.00. POWER Engineers Parsons Energy & Chemicals Group KEMA Consulting Stanford Linear Accelerator Center Eastman Kodak Company Graeme Wood Consulting
. Sasajima I. Inc. Bishop D. Weiss M. Icayan A. GE FANUC Automation System Safety Inc. Tausch T. Walczak M. Taubert H. Marathon Ashland Petroleum Company LLC Lockheed Martin Federal Services WG-W Safety Management Solutions Yokogawa Industrial Safety Systems BV Factory Mutual Research Corporation Equilon Enterprises LLC SIS-TECH Solutions LLC Westinghouse Savannah River Company ExxonMobil Research Engineering BASF Corporation Honeywell Inc. Westinghouse Process Control Inc. Iverson R. McCauley. Jr. Jones V. Bouchard M. Dumortier W. Sossman R. Holland E. Stavrianidis* H. Coppler B. NAME M. Verhappen R.
............5 5......................................... 85 Annex E (informative)  Common cause failures and systematic failure checklist.........................................................................4 5................................................................................................................................................2 4 5 Definition of terms............................................................................................. 17 Definitions of terms and symbols......................................................1 5...................................... 44 Hardware common cause failures......................................................................................................... 50 System modeling ................................. 62
Annex A (informative)  Methodology for quantifying the effect of hardware-related common cause failures in Safety Instrumented Functions...................................................................................................................................................................................................................... 79 Annex C (informative)  SIL quantification of SIS – Advisory software packages........... 93
................ 57
Comparison of system analysis techniques ................................................................................. 83 Annex D (informative)  Failure mode effect............................................................... 67 Annex B (informative)  Fault simulation test procedure .................................................................2 5............................................................................3 5....................... 44 Systematic failures ............................................................................................... 19 Definition of symbols .............................................00............................................................ 43 Modeling of SIF element failures ............. 44 Partitioning of SIF element failures .................... 19 3............. hazard and criticality analysis ...............................................................................................................................8 5......... 54 Statistical data analysis methods ..... 46 Modeling of field devices ................................................................7 5............................................. 91 Annex F — Index ........................................................................................................................................................................................................... 17 References ................................................ 54 Failure rate data for commonly used field instrumentation ............................... 44 5.................02-2002 .............................. 11 1 2 3 Scope..............................................................1 3...........................................................................................................................−7−
ISA-TR84....................... 9 Introduction .................. 49 Modeling of elements in PES arithmetic/logic solvers..9 Physical failures....................................................................................................6 5....................................................................................................................................................... 33
Probability of failure on demand (PFD) .........................................Part 1
02-2002 methodologies that can be used to evaluate the Safety Integrity Level (SIL) of Safety Instrumented Functions (SIF). This document demonstrates methodologies for the SIL and reliability evaluation of SIF. However.Part 1
Safety Instrumented Systems (SIS)  Safety Integrity Level (SIL) Evaluation Techniques Part 1: Introduction Foreword
The information contained in ISA-TR84. The users of ISA-TR84. It provides information on the benefits of various methodologies as well as some of the drawbacks they may have.. A secondary purpose of this document is to reinforce the concept of the performance based evaluation of SIF. etc.01-1996 to assist the designer in applying the concepts necessary to achieve an acceptable design. The document focuses on methodologies that can be used without promoting a single methodology.02-2002 is provided for information only and is not part of the (1) ANSI/ISA-84. etc.01-1996 provides the minimum requirements for implementing a SIS given that a set of functional requirements have been defined and a SIL requirement has been established for each safety instrumented function. redundancy.02-2002 include: • • • Process Hazards Analysis teams that wish to develop understanding of different methodologies in determining SIL SIS designers who want a better understanding of how redundancy. THE METHODOLOGIES ARE DEMONSTRATED THROUGH EXAMPLES (SIS ARCHITECTURES) THAT REPRESENT POSSIBLE SYSTEM CONFIGURATIONS AND SHOULD NOT BE INTERPRETED AS RECOMMENDATIONS FOR SIS. software. frequency and quality of testing.00. The basis for the performance evaluation of the SIF is safety targets determined through hazard analysis and risk (6) assessment of the process. Additional information of an informative nature is provided in the Annexes to ANSI/ISA-84. Standards Project 84 (SP84) determined that it was appropriate to provide supplemental information that would assist the user in evaluating the capability of any given SIF design to achieve its required SIL.) and the operational attributes (inspection/maintenance policy. namely the probability of the SIF to fail to respond to a demand and the probability that the SIF creates a nuisance trip. ANSI/ISA-84.00.−9−
ISA-TR84. diagnostic coverage. The performance parameters that satisfactorily service the process industry are derived from the SIL and reliability evaluation of SIF.01-1996 Standard requirements. diversity.02-2002 . Such evaluation addresses the design elements (hardware.) of the SIF. THE USER IS CAUTIONED TO CLEARLY UNDERSTAND THE ASSUMPTIONS AND DATA ASSOCIATED WITH THE METHODOLOGIES IN THIS DOCUMENT BEFORE ATTEMPTING TO UTILIZE THE METHODS PRESENTED HEREIN. etc. is to provide the process industry with a description of various The purpose of ISA-TR84.00. fit into the development of a proper SIS architecture Logic solver and field device suppliers
02-2002 consists of the following parts.ISA-TR84.00.00." Part 1: Part 2: Part 3: Part 4: Part 5: Introduction Determining the SIL of a SIF via Simplified Equations Determining the SIL of a SIF via Fault Tree Analysis Determining the SIL of a SIF via Markov Analysis Determining the PFD of Logic Solvers via Markov Analysis
. under the general title “Safety Instrumented Functions (SIF)  Safety Integrity Level (SIL) Evaluation Techniques.Part 1 • • • •
ISA-TR84.02-2002 .
00. The evaluation approaches outlined in this document are performance-based approaches and do not provide specific results that can be used to select a specific architectural configuration for a given SIL. common cause) applies to any • • element of a SIS that is common to more than one safety instrumented function. the logic solver could be the common cause failure that disables all of the SIFs. THE READER IS CAUTIONED TO CLEARLY UNDERSTAND THE ASSUMPTIONS ASSOCIATED WITH THE METHODOLOGY AND EXAMPLES IN THIS DOCUMENT BEFORE DERIVING ANY CONCLUSIONS REGARDING THE EVALUATION OF ANY SPECIFIC SIF.. SIL 1. This principle (i.
Each element should be evaluated with respect to all the safety instrumented functions with which it is associated • • • to ensure that it meets the integrity level required for each safety instrumented function.01-1996 or to other references. 2.).02-2002 .. The user is referred to ANSI/ISA-84. ISA-TR84. to understand the interactions of all the safety instrumented functions.01-1996 Annex A for methodologies that might be used in making this determination.022002 provides methodologies for evaluating SIF to determine if they achieve the specific SIL. which may be one of the risk reduction methods used. issues such as component technology.Part 1
ANSI/ISA-84. This document assumes that a SIS is required. Process industry experience shows that sensors and final elements are major contributors to loss of SIS integrity (high PFD).e. and redundant element with one or more safety instrumented function. This may be referred to as a probability of failure on demand (PFD) evaluation of the SIF.− 11 −
ISA-TR84.. SIL) that may be used to specify the capability that a safety instrumented function must achieve to accomplish the required risk reduction. Safety Lifecycle Model). installation.01-1996 describes a safety lifecycle model for the implementation of risk reduction measures for the process industry (Clause 4). When evaluating the performance of sensors and final elements. This document involves the evaluation of the whole SIF from the sensors through the logic solver to the final elements. Frequently multiple safety instrumented functions are included in a single logic solver.
This document does not provide guidance in the determination of the specific SIL required (e. The standard then proceeds to provide specific guidance in the application of SIS.00. The logic solver should be carefully evaluated since a problem in the logic solver may adversely impact the performance of all of the safety instrumented functions (i.g. and to understand the impact of failure of each component. The evaluation processes described in this document take place before the SIS detailed design phase of the life cycle (see Figure I.e. and 3) for the SIS. It does not provide guidance in the determination of the need for a SIS. The user is again referred to ANSI/ISA-84.00. The standard defines three levels of safety integrity (Safety Integrity Levels. ISA-TR84. and maintenance should be considered.02-2002 only addresses SIF operating in demand mode.
Figure I.1  Safety lifecycle model
.ISA-TR84.00.00. maintenance. The SIS lifecycle model is defined in ANSI/ISA-84.01 Safety Life Cycle steps not covered by 84. & verify it meets the SRS
SIS startup. periodic functional testing Modify Modify or Decommission SIS? Decommision SIS Decommissioning
SIS Installation. operation.Part 1
The primary focus of this document is on evaluation methodologies for assessing the capability of the SIS.01-1996.01
Safety Life Cycle * steps where TR84.2 shows the boundaries of the SIS and how it relates to other systems.02-2002 .02 is applicable
Figure I. Commissioning and Pre-Startup Acceptence Test
Legend: Safety Life Cycle steps covered by 84.
Perform SIS * Conceptual Design.
measures.00. The performance and interactions of these basic components are merged into reliability models (such as simplified equations. a systematic evaluation of the performance of a system may be obtained through the use of PFD analysis techniques. Systematic integrity is difficult to quantify due to the diversity of causes of failures. software.g. This document provides users with a number of PFD evaluation techniques that allow a user to determine if a SIF meets the required safety integrity level.) of the SIS. Markov models) to determine the overall system safety availability. systematic failures may be introduced during the specification. fault trees.” Safety integrity consists of two elements: 1) hardware safety integrity and 2) systematic safety integrity.01-1996 addresses systematic safety integrity by specifying procedures. etc. frequency and quality of testing. For SIF operating in the demand mode the target failure measure is PFDavg (average probability of failure to perform its design function on demand). components. etc. techniques. etc. have not been in use for a sufficiently long time and in large enough numbers to have a statistically significant population available for the evaluation of their performance solely based on actuarial data. implementation. PFDavg is also commonly referred to as the average probability of failure on demand. etc. design.02-2002 . that reduce systematic failures. operational and modification phase and may affect hardware as well as software.) and the operational attributes (inspection/maintenance policy. ANSI/ISA-84.− 13 −
ISA-TR84. These elements affect the PFD of each safety instrumented function. Where systems. subsystems.
. The PFD of these systems can be determined using historical system performance data (e. statistical analysis).01-1996 addresses the hardware safety integrity by specifying target failure measures for each SIL. Safety integrity is defined as “The probability of a Safety Instrumented Function satisfactorily performing the required safety functions under all stated conditions within a stated period of time.Part 1
Figure I..2  Definition of Saf ety Instrumented System (SIS)
The safety requirements specification addresses the design elements (hardware. ANSI/ISA-84. PFD analysis techniques employ systematic methodologies that decompose a complex system to its basic components. Hardware safety integrity which is based upon random hardware failures can normally be estimated to a reasonable level of accuracy. redundancy.
IEC 61508 and IEC 61511 standards.
The objective of this technical report is to provide users with techniques for the evaluation of the hardware spurious ." Part 4 should not be interpreted as the only evaluation technique that might be used. nuisance trip.02-2002 . since process start up and shutdown are frequently periods where chances of a hazardous event are high. To the extent possible the system analysis techniques allow these elements to be independently analyzed.00.ISA-TR84. It does. ISA-TR84.00. Fault Tree Analysis ." Part 2 should not be interpreted as the only evaluation technique that might be used. a brief introduction to the methodologies that will be used in the examples shown in this document. ISA-TR84.02-2002 . This allows the safety system designer to select the proper system configuration to achieve the required safety integrity level. however.Part 1
An acceptable safe failure rate is also normally specified for a SIF.00. The spurious trip rate is included in the evaluation of a SIF.02-2002 . (MTTF
NOTE In addition to the safety issue(s) associated with spurious trips the user of the SIS may also want the acceptable MTTFspurious to be increased to reduce the effect of spurious trips on the productivity of the process under control.02-2002 .
ISA-TR84. Methods of modeling systematic safety integrity of SIF (PFDavg) and the determination of MTTF failures are also presented so a quantitative analysis can be performed if the systematic failure rates are known.Part 4 provides Markov analysis techniques for calculating the SIL values for Demand Mode Safety Instrumented Functions (SIF) installed in accordance with ANSI/ISA-84.Part 2 provides simplified equations for calculating the SIL values for Demand Mode Safety Instrumented Functions (SIF) installed in accordance with ANSI/ISA-84. This increase in the acceptable MTTFspurious can usually be justified because of the high cost associated with a spurious trip.00. “Applications of Safety Instrumented Systems for the Process Industries. or spurious trip rate. ISA-TR84.
. It does." Part 3 should not be interpreted as the only evaluation technique that might be used. provide the engineer(s) performing design for a SIS with an overall technique for assessing the capability of the designed SIF. (3) (4) (5) They are Simplified equations .01-1996.01-1996.02-2002 .01-1996. the reduction of spurious trips will increase the safety of the process. the background information on how to model all the elements or components of a SIF. These are consistent with the ANSI/ISA-84. provide the engineer(s) performing design for a SIS with an overall technique for assessing the capability of the designed SIF.00. It focuses on the hardware components. The acceptable safe failure rate is typically expressed as the mean time to a spurious trip spurious ). It does. The safe failure rate is commonly referred to as the false trip.Part 1 provides
a detailed listing of the definition of all terms used in this document.02-2002 shows how to model complete SIF. the logic solver and final elements.00. provide the engineer(s) performing design for a SIS with an overall technique for assessing the capability of the designed SIF. however. “Applications of Safety Instrumented Systems for the Process Industries. which includes the sensors. provides some component failure rate data that are used in the examples calculations and discusses other important parameters such as common cause failures and functional failures. ISA-TR84.Part 3 provides fault tree analysis techniques for calculating the SIL for Demand Mode Safety Instrumented Functions (SIF) installed in accordance with ANSI/ISA-84. “Applications of Safety Instrumented Systems for the Process Industries.01-1996. however. and Markov Analysis . Hence in many cases.
using Markov Models for calculating the PFD of E/E/PE logic solvers because it allows the modeling of maintenance and repairs as a function of time. etc. software failures.00. and models the systematic failures (i.02-2002 .
.3 illustrates the relationship of each part to all other parts.00. explicitly allows the treatment of diagnostic coverage..e.Part 5 addresses the logic solver only.Part 1
ISA-TR84. Figure I.02-2002 .− 15 −
ISA-TR84.) and common cause failures. treats time as a model parameter. operator failures.
Part 2 Development of SIL for SIF using Simplified Equation Methodology.Part 1
Part 1 Development of the overall terms.02-2 002 Overall Framework
.00. the PFD of E/E/PE logic solver(s) via Markov Analysis.
Figure I.02-2002 . and uncertainty analysis examples. Part 4 Development of SIL for SIF using Markov Analysis Methodology.ISA-TR84.
Guidance in determining Part 3 Development of SIL for SIF using Fault Tree Analysis Methodology.3  ISA-TR84. symbols. comparison of system analysis techniques. explanation of SIS element failures.00.
Research Triangle Park. ISATR84. the probability that the SIF fails to respond to a demand and the probability that the SIF creates a nuisance trip.00.Part 1 serves as an introduction for all other parts. b) Each safety instrumented function to be carried out by the SIS(s) is defined." Center for Chemical Process Safety.Part 1 is to introduce the reader to the performance based approach for evaluating the reliability of SIF and to present system reliability methodologies that can be used to evaluate the system performance parameters.02-2002 .1 ISA-TR84. Part 1: Introduction." Instrumentation. c) The SIL for each safety instrumented function is defined. 3. NC. Instrument Society of America. New York. and f) discussion of the effect of functional test interval. 1. 27709. 1992.00.00.02-2002 in a safety application. common cause.Part 1
1. “Evaluating Control Systems Reliability”.2 ISA-TR84.00. Research Triangle Park.02-2002 . Research Triangle Park. covert faults. Reliability.02-2002 is intended to be used only with a thorough understanding of ANSI/ISA-84. NC.Part 1 provides
a) guidance in Safety Integrity Level analysis. Smith. W. b) methods to implement Safety Instrumented Functions (SIF) to achieve a specified SIL. 2002. ISA-TR84. D. Part 2: Determining the SIL of a SIF via Simplified Equations.00. 2.01-1996 (see Figure I. NC.00.
. Maintainability and Risk (Practical Methods for Engineers). c) discussion of failure rates and failure modes (Annex D) of SIS and their components. M. Goble. "Safety Instrumented Functions (SIF) – Safety Integrity Level Evaluation Techniques.02-2002 .02-2002 .J. systematic failures." ISA. 1993 5.02-2002 .00. ISA-TR84. Technical Report. Part 4: Determining the SIL of a SIF via Markov Analysis. the Hazards and Risk Analysis must have been completed and the following information provided a) It is determined that a SIS is required. ANSI/ISA-84.00. Part 5: Determining the PFDavg of SIS Logic Solvers via Markov Analysis. 27709.
1. redundancy of SIF. “Guidelines for Safe Automation of Chemical Processes. namely. e) tool(s) for verification of SIL. 4 Edition. NY 10017. 1993. Butterworth-Heinemann.− 17 −
ISA-TR84. ISBN 0-7506-0854-4.1). Systems and Automation Society.Part 1 is informative and does not contain any mandatory clauses. Prior to proceeding with use of ISA-TR84. 4. Part 3: Determining the SIL of a SIF via Fault Tree Analysis. February 1996. d) discussion of diagnostic coverage.3 The objective of ISA-TR84.02-2002. American Institute of Chemical Engineers. 27709.
1.01-1996 “Application of Safety Instrumented Systems for the Process Industries.
" 2 1993. “Assurance Technologies . 1992. 30. 12. American Institute of Chemical Engineers.ISA-TR84." D. 13. G." Technical Report. 11. 18. 1987. Raheja. 24. 22. Reliability Analysis Centre-1991. Apostolakis." John Wiley & Sons. Lowe and Garrick Inc. N. Marshfield. New York. IEEE and John Wiley & Sons. “The 'Why’s' of Grounding Isolated Ground Planes and Power Supplies. Bell Communications Research. RAC. Allan. Equipment Reliability Data for Nuclear Power Generating Stations. Pleasant Ave." E. Humphreys. New York. McGraw and Hill Inc. 1995. Pitman Advanced Publishing Program.G. 1989. 1987.C. 19. Elsevier Science Press. “Reliability Evaluation of Engineering Systems.S.. 1990. American Institute of Chemical Engineers. NY. “Introduction to Reliability Engineering. Guidelines For Process Equipment Reliability Data With Data Tables. HMSO.00. OKrent... 17. A. 1989. New York.. M. "Methodology for Probabilistic Risk Assessment of Nuclear Power Plants. Livingston." A. 21. AEA Technology. 16. Brombacher. Evans.. ISBN 0-941247-00-7. Programmable electronic systems in safety-related applications. John Wiley & Sons. G.. ISBN 82-515-0188-1. New York.Principles and Practices. Levenson. Mt. "Uncertainties in System Reliability: Probabilistic versus Nonprobabilistic Theories.
edition.G. IEEE Std 500-1984. Licensing Division.
. Vol. Reliability '87. OREDA-92 (Offshore Reliability Data) DNV Industry. Assigning a numerical value to the beta factor common cause evaluation.E. 1991. John Wiley & Sons. Kaplan." R.Part 1
25. 7. “Statistical Distributions. 15. Health and Safety Executive. NSN7540-01-280-5500. “Software Reliability Handbook. G. Wu and D. 1992. R. NJ 07039-2729. 20. Part 2: General technical guidelines." P. UPM3. “Safeware . Inc. NY 10158. NY 10010. Pickard.02-2002 . Center for Chemical Process Safety. Reliability Prediction of Electronic Equipment. MIL-Handbook-217. R. ISBN 0 11 883906 3. “Guidelines for Chemical Process Quantitative Risk Analysis. 1989. NY. 8. Reading. Hastings and B. MA 02050. Rook.N. Billinton. NY.1: A pragmatic approach to dependent failures assessment for standard systems. NY. NY 10158. 1983. John Wiley & Sons. “Reliability by Design. Center for Chemical Process Safety. 1974. Addison-Wesley Publishing Co. Fishman. ISBN 471-80785-0. 23. J. ISBN 8169-0422-7. 1981. MA. Lewis. Peacock. Apostolakis. "Concepts and Methods in Discrete Event Simulation. 1983." N. New York. 14. S. 290 W." Reliability Engineering and System Safety.System Safety and Computers. ISBN 085 356 4337. 10. 1991.
“What Went Wrong? Case Histories of Process Plant Disasters. P.1. 39. 3." Trevor A. and fuel/air controls in fired heaters. "Reliability and Uncertainty Analysis of Hardware Failures of a Programmable Electronic System.1. Kletz.02-2002 .. Sweet.5 Basic Process Control System (BPCS): a system which responds to input signals from the process. January 1994. 27. anti-surge control of a compressor. "On the Hazard Rate of Lognormal Distribution.3. Kletz.C. other programmable systems and/or an operator and generates output signals causing the process and its associated equipment to operate in the desired manner but which does not perform any safety instrumented functions with a claimed SIL ≥ 1. Rouvroye J. Runger G." Reliability Engineering and System Safety Journal. Robust Design Toolbox Reference Manual. and Kumamoto. Stavrianidis. Spence. 31. 32.1. Montgomery D. 1993.C. 34. 28. (4) voting. Tolerance Design of Electronic Circuits. Reliability by Design..
3. A. 1997. Texas. March 1997.00.
." IEEE Transactions on Reliability.− 19 −
ISA-TR84.L. 29. R. New York. R.1. Ernest J. June 1998. 1992. Toolbox version 2. Some examples include control of an exothermic reaction. 33. Gulf Publishing Company.. (2) internal structure of a SIS subsystem.g.C. Henley. John Wiley and Sons. Also referred to as the Process Control System.1. Probabilistic Risk Assessment. Hiromitsu. 1990. John Wiley & Sons. Houston. its associated equipment. Addison-Wesley Pub Co.L. Montgomery D. (1) arrangement of safety instrumented system (SIS) subsystems.” 3. Brombacher. 1988. New York.4 availability: see “safety availability. “Learning From Disaster: How Organizations Have No Memory. Texas. Singh Soin.2 application software: see “software.. Special Issue.” 3. Vol. R.3 architecture: the arrangement of hardware and/or software elements in a system e. NY 10158. Eindhoven University of Technology. Gulf Publishing Company. Houston. IEEE Press.Part 1
26. 30." Trevor A. Tolerance Design of Electronic Circuits (Electronic Systems Engineering Series). A. (3) arrangement of software programs.” 3. New York. Applied Statistics and Probability for Engineers.1 application program: see “application software. 1992.. Harvill Pr. Spence. 35. 1992.
3. air) causes a trip action. 3.Part 1
− 20 −
3. Removal of the source of power (e. in systems with multiple channels to improve safety. 3.1.8. 3.e.1. logic system. sensors.ISA-TR84.8.” 3.1. which is the result of one or more events causing coincident failures of two or more separate channels in a multiple channel system.7. data acquisition systems. 3.
3. The elements within a channel could include input/output(I/O) modules.. sensors or final elements).02-2002 . leading to a system failure.13 decommissioning: the permanent removal of a complete SIS from active service.1. maintenance/engineering interfaces.1.8 communication: 3. a two channel) configuration is one with two channels that independently perform the same function.1. or a portion of a system (for example.1. These include bus backplane connections.1.2 common cause failure: a failure.. These include shared operator interfaces. a dangerous hardware failure is less likely to lead to the overall hazardous or fail-to-function state. common cause fault: a single fault that will cause failure in two or more channels of a multiple channel system.6 channel: a channel is an element or a group of elements that independently perform(s) a function.1. etc.1.
NOTE Whether or not the potential is realised may depend on the channel architecture of the system. The single source may be either internal or external to the system.2 internal communication: data exchange between the various devices within a given SIS." 3. electricity.
NOTE A dual channel (i.10 overt: see "undetected.1. 3.7 common cause: 3.1.1.00.1 external communication: data exchange between the SIS and a variety of systems or devices that are outside the SIS. the local or remote I/O bus. etc.7.g.12 dangerous failure: a failure which has the potential to put the safety instrumented function in a hazardous or fail-to-function state. The term can be used to describe a complete system. host computers.1.14 de-energize to trip: SIS circuits where the outputs and devices are energized under normal operation. from zero to infinity.9 coverage: see “diagnostic coverage.
. of the failure rate distribution and takes values between zero and one. and final elements.11 Cumulative Distribution Function (CDF): the integral.
(e. medical or other activities. machinery.23 Equipment Under Control (EUC): equipment.
3. 3. For example the diagnostic coverage is typically determined for a sensor. where λDD is the dangerous detected failure rates and λDT is the total dangerous failure rate. and programmable electronic system refers to logic performed by programmable or configurable devices [e.g..1. or a logic solver.1. electrical refers to logic functions performed by electromechanical techniques.15 demand: a condition or event that requires the SIS to take appropriate action to prevent a hazardous event from occurring or to mitigate the consequence of a hazardous event. etc.g.
NOTE 1 Diagnostic coverage factor is synonymous with diagnostic coverage.). operations or plant used for manufacturing. Application of power (e. electronic refers to logic functions performed by electronic techniques.Part 1
3.. etc.18 diverse: use of different technologies.16 detected: in relation to hardware and software.22 energize to trip: SIS circuits where the outputs and devices are de-energized under normal operation.1. 3.00.
NOTE 1 NOTE 2 NOTE 3 For example. In IEC 61511.]. physical inspection and manual tests. motor driven timers.21 embedded software: see “software. final element. equipment or design methods to perform a common function with the intent to minimize common cause faults.02-2002 . air) causes a trip action. For example the diagnostic coverage for the dangerous failures of a component or subsystem is DC = λDD/λDT .20 Electronic (/E): see “E/E/PES.” 3.− 21 −
ISA-TR84. transportation.
3. etc. 3.1.1. or through normal operation. (e. 3. NOTE 4 For safety applications the diagnostic coverage is typically applied to the safe and dangerous failures of a component or subsystem. Single Loop Digital Controller (SLDC). Field devices are not included in E/E/PES.g.). electricity. electromechanical relay.
.1. solid state relay. Synonyms include: revealed and overt.
NOTE 2 The diagnostic coverage is used to compute the detected (λD) and undetected failure rates (λU) from the total failure rate (λT) as follows: λD = DC x λT and λU = (1-DC) x λT NOTE 3 Diagnostic coverage is applied to components or subsystems of a safety instrumented system.” 3. These adjectives are used in detected fault and detected failure.17 diagnostic coverage: the diagnostic coverage of a component or subsystem is the ratio of the detected failure rates to the total failure rates of the component or subsystem as detected by automatic diagnostic tests. the term “process” is used instead of Equipment Under Control to reflect process sector usage.. Programmable Logic Controller (PLC).1.g.19 Electrical (E)/ Electronic (E)/ Programmable Electronic Systems (PES) [E/E/PES]: when used in this context.1. detected by the diagnostic tests..1. process. or through normal operation. solid state logic.
Such equipment includes field wiring.1.27 failure: the termination of the ability of a functional unit to perform a required function.34 functional safety: the ability of a safety instrumented system or other means of risk reduction to carry out the actions necessary to achieve or to maintain a safe state for the process and its associated equipment.00. This definition is from IEC 61511 and it deviates from the definition in IEC 61508-4 to reflect differences in the process
.1. 3.1.28 failure rate: the average rate at which a component could be expected to fail. 3.26 fail-safe: the capability to go to a predetermined safe state in the event of a specific malfunction. switch gear. NOTE 2 This definition is process sector specific only.30 fault tolerance: built-in capability of a system to provide continued correct execution of its assigned function in the presence of a limited number of hardware and software faults. and some functions may be specified in terms of behaviour to be avoided. 3. sensors.32 final element: the part of a safety instrumented system which implements the physical action necessary to achieve a safe state.
3. It is used in the IEC 61508 and IEC 61511 standards.
NOTE 1 Examples are valves.29 fault: an abnormal condition that may cause a reduction in. Fail-to-function is used in this document (see fail-to-function).1. 3.1.02-2002 . 3. 3. or loss of. 3.31 field devices: equipment connected to the field side of the SIS logic solver I/O terminals.ISA-TR84. motors including their auxiliary elements e. the capability of a functional unit to perform a required function.Part 1
NOTE 1 NOTE 2 sector. 3.
3.33 firmware: special purpose memory units containing embedded software in protected memory required for the operation of programmable electronics. final control elements and those operator interface devices hard-wired to SIS logic solver I/O terminals.g. The occurrence of such behaviour is a failure. NOTE 2 Failures are either random or systematic.24 fail-to-danger: the state of a SIF in which the SIF cannot respond to a demand.
NOTE 1 Performance of required functions necessarily excludes certain behaviour.1.01-1996.. This term is not used in ANSI/ISA-84.25 fail-to-function: the state of a SIF during which the SIF cannot respond to a demand.1. a solenoid valve and actuator if involved in the safety instrumented function.1.1.1.
This definition is from IEC 61511 and it deviates from the definition in IEC 61508-4 to reflect differences in the process
3.1.1. to judge the functional safety achieved by one or more protection layers.” 3. May also be called the proof testing or full function testing. A HAZOP is used to examine every part of the process to discover that deviations from the intention of the design can occur and what their causes and consequences may be.
NOTE 1 NOTE 2 sector.35 functional safety assessment: an investigation. 3.1. release of a toxic substance).Part 1
3.40 hazard: potential source of harm. This term is not used in ANSI/ISA-84. are implemented effectively and are suitable to achieve the specified objectives.1.39 harm: physical injury or damage to the health of people either directly.1. This is done systematically by applying suitable guidewords. 3.43 input/output modules: 3. This is a systematic detailed review technique for both batch or continuous plants which can be applied to new or existing process to identify hazards.00.1. or indirectly as a result of damage to property or to the environment.1.
NOTE The term includes danger to persons arising within a short time scale (for example.36 functional safety audit: a systematic and independent examination to determine whether the procedures specific to the functional safety requirements comply with the planned arrangements. based on evidence.1.
3.1 input module: E/E/PES or subsystem that acts as the interface to external devices and converts input signals into signals that the E/E/PES can utilize.1.37 functional testing: periodic activity to verify that the devices associated with the SIS are operating per the Safety Requirements Specification. fire and explosion) and also those that have a long term effect on a person’s health (for example.
3. It is used in the IEC 61508 and IEC 61511 standards.− 23 −
ISA-TR84. 3.41 Hazard and Operability Study (HAZOP): a systematic qualitative technique to identify process hazards and potential operating problems using a series of guide words to study process deviation.42 input function: a function which monitors the process and its associated equipment in order to provide input information for the logic solver
NOTE 1 NOTE 2 An input function could be a manual function.01-1996.38 hardware configuration: see “architecture.43.
NOTE A functional safety audit may be carried out as part of a functional safety assessment.02-2002 . This definition is process sector specific only.1.
1.2 output module: E/E/PES or subsystem that acts as the interface to external devices and converts output signals into signals that can actuate field devices. dictated by manufacturer’s recommendation or by accumulated data from operating experience.
NOTE This definition is process sector specific only.46 mean time to fail .Part 1
− 24 −
3.45 logic solver: that portion of either a BPCS or SIS that performs one or more logic function(s).
3.1. 3.ISA-TR84.51 overt: see "detected." 3.00. This mean time is measured from the time the failure occurs to the time the repair is completed and device returned to service (see MTTROT).1. NOTE 3 This term deviates from the definition in IEC 61508-4 to reflect differences in the process sector.44 logic function: a function which performs the transformations between input information (provided by one or more input functions) and output information (used by one or more output functions). is operating.1.1. 3. electronic logic systems for electronic technology.52 preventive maintenance: maintenance practice in which equipment is maintained on the basis of a fixed schedule.
.47 mean time to repair (MTTR): the mean time to repair a module or element of the SIS. etc. pneumatic systems. to which the SIS is connected.
NOTE 2 Examples are: electrical systems. 3. to which the SIS is connected. 3.1. 3.1. electronic systems.1. is shutdown. programmable electronic systems.1.1.48 off-line: process.49 on-line: process. Sensors and final elements are not part of the logic solver. Logic functions provide the transformation from one or more input functions to one or more output functions. PE logic systems for programmable electronic systems.43. 3.spurious (MTTF ): the mean time to a failure of the SIS which results in a spurious or false trip of the process or equipment under control (EUC).
In ANS/ISA-84.02-2002 .50 output function: function which controls the process and its associated equipment according to final actuator information from the logic function.01-1996 and IEC 61511 the following logic systems are used:
electrical logic systems for electro-mechanical technology. hydraulic systems.
and smart final elements.1.1).00. gas.1. Examples of process sector programmable electronics include:
NOTE 1 This term covers micro-electronic devices based on one or more central processing units (CPUs) together with associated memories. The average probability of a system failing to respond to a demand in a specified time interval is referred to as PFDavg. programmable electronic logic solvers including: programmable controllers. food. chemical.1.1. steam. manufacture. etc.54 Probability to Fail Safe (PFS): a value that looks at all failures and indicates the probability of those failures that are in a safe mode.55 process Industries: refers to those industries with processes involved in. This term differs from the definition in IEC 61508-4 to reflect differences in the process sector. pharmaceuticals and waste material(s).
. but not limited to. distributed control system (DCS). The various process industries together make up the process sector – a term used in IEC standards. It is also referred to as safety unavailability or fractional dead time.02-2002 . 3. generation. electric power. metals.− 25 −
ISA-TR84. 3. plastics petrochemicals. wood. 3.Part 1
3. programmable logic controllers (PLC) (see figure 3.53 Probability of Failure on Demand (PFD): a value that indicates the probability of a system failing to respond to a demand. the production. loop controllers.56 programmable electronics (PE): electronic component or device forming part of a PES and based on computer technology. and/or treatment of oil. The term encompasses both hardware and software and input and output units. PFD equals 1 minus Safety Availability.
debugging and testing functions
Figure 3.00.Part 1
MAN – MACHINE INTERFACE functions Communication functions Programming.ISA-TR84.1 – Structure and fun ction of PLC system (copied from IEC 61131)
.02-2002 .
− 27 −
Figure 3.2 – Programmable e lectronic system (PES): structure and terminology
3.1.58 proof testing: see “functional testing.” 3.1.59 protection layer: any independent mechanism that reduces risk by control, prevention or mitigation.
− 28 −
− 29 −
Figure 3.3 – Example SIS arc hitecture
NOTE 1 ANSI/ISA-84.79 safety requirements specification: the specification that contains all the requirements of the safety instrumented functions that have to be performed by the safety instrumented systems. but the adjective “functional” is not considered necessary in this case within the context of this technical report.78 safety lifecycle: the necessary activities involved in the implementation of safety instrumented function(s).1.00.
Table 3. NOTE Safety integrity comprises hardware safety integrity and systematic safety integrity.1.
3.1.01-1996 recognizes only three Safety Integrity Levels.ISA-TR84.
NOTE 3 It is possible to use several lower safety integrity level systems to satisfy the need for a higher level function (e.
NOTE The term “functional safety lifecycle “ is strictly more accurate. which measure the process condition (e. process switches.). which cannot be accurately quantified but can only be considered qualitatively.
.1. the safety integrity of a SIF also depends on many factors.80 sensor: a device or combination of devices. See IEC 61511-2 for guidance on how to apply this principle. Safety integrity level 4 has the highest level of safety integrity. transmitters.1... etc.g. NOTE 4 This term differs from the definition in IEC 61508-4 to reflect differences in the process sector.g. using a SIL 2 and a SIL 1 system together to satisfy the need for a SIL 3 function).02-2002 . The above definition is used in this document to provide compatibility with IEC 61508 and IEC 61511. position switches.1  Safety integrity level (SIL) target ranges
3. transducers.Part 1
However. NOTE 2 The target failure measures for the safety integrity levels are specified in Table 3.77 safety integrity level (SIL): discrete level (one out of four) for specifying the safety integrity requirements of the safety instrumented functions to be allocated to the safety instrumented systems. safety integrity level 1 has the lowest.
3. 3. occurring during a period of time that starts at the concept phase of a project and finishes when all of the safety instrumented functions are no longer available for use.
data. The user should be able to configure/program the required application functions according to the functional requirement specification.3 full variability language (FVL): this type of language is general-purpose computer-based.84.Part 1
3. input modules. range of the pressure transmitter). user manual or the like.− 31 −
ISA-TR84.g. procedures.
NOTE Software is independent of the medium on which it is recorded.1. small data logging systems.1. The functional specification of the FPL should be documented either in the suppliers’ data sheets.1.1 fixed program language (FPL): this type of language is represented by the many proprietary.. As a result most of the specification will be special-to-project.
NOTE Typical example of systems with FPL: smart sensor (e. dedicated-function systems which are available as standard process industry products.1. using high level languages. dedicated smart alarm box.02-2002 .
3. rules and any associated documentation pertaining to the operation of a data processing system.
.2 limited variability language (LVL): this type of language is a more flexible language which provides the user with some capability for adjusting it to his own specific requirements. function block diagram and sequential function chart.00. pressure transmitter).1. but limited to adjust a few parameters (e.82 SIS components: a constituent part of a SIS.84. 3.. The language is tailored for a specific application by computer specialists.1. sequence of events controller.
NOTE 1 Typical examples of LVL are ladder logic. Examples of SIS components are field devices. The documentation of the LVL should consist of a comprehensive specification which defines the basic functional components and the method of configuring them into an application program.1.84 software languages in SIS subsystems: 3. 3. and logic solvers. The user should be unable to alter the function of the product. The FVL application will often be unique for a specific application. equipped with an operating system which usually provides system resource allocation and a real-time multi-programming environment.81 separation: the use of multiple devices or systems to segregate control from safety instrumented functions.
3. The safety instrumented functions are configured by the use of an application-related language and the specialist skills of a computer programmer are not required.84. Separation can be implemented by identical elements (identical separation) or by diverse elements (diverse separation).g. In addition an engineering tool and a library of application specific functions should be given together with a user manual.
3.83 software: an intellectual creation comprising the programs.
In the process sector FVL is found in embedded software and rarely in application software. Example causes of systematic failures include human error in:
.1.1. rather. limits.
3.1. test phase.).
3.86 software lifecycle: the activities occurring during a period of time that starts when software is conceived and ends when the software is permanently disused. development phase. the trip resulted due to a hardware fault. This definition is process sector specific only. C. transient.85. it contains logic sequences.
3. Embedded software is also referred to as firmware or system software. etc.1. See fixed and limited variability software language. which can only be eliminated by a modification of the design or of the manufacturing process. In general. output.
NOTE 1 A software lifecycle typically includes a requirements phase. transient.85. ground plane interference . permissives.g. Pascal.
NOTE This definition is process sector specific only.88 Spurious Trip Rate (STR): the expected rate (number of trips per unit time) at which a trip of the SIF can occur for reasons not associated with a problem in the process that the SIF is designed to protect (e. decisions necessary to meet the safety instrumented functional requirements. 3. Other terms used include nuisance trip rate and false shutdown rate. operational procedures. These software tools are not required for the operation of the SIS. Other terms used include nuisance trip and false shutdown. calculations. it is modified. documentation or other relevant factors. and documentation of application programs. A systematic failure can be induced by simulating the failure cause.1..89 systematic failure: failure related in a deterministic way to a certain cause.. 3. software fault.1. 3.85 software program types: 3.3 utility software: software tools for the creation. installation phase and modification phase. etc.02-2002 .1.1. integration phase. software fault.2 system software: software that is part of the system supplied by the manufacturer and is not accessible for modification by the end user..). modification. FVL examples include: ADA. NOTE 2 Software cannot be maintained. etc. expressions.g. ground plane interference.1 application software: software specific to the user application in that it is the SIS functional description programmed in the PES to meet the overall Safety Requirement Specifications.ISA-TR84.85. the trip resulted due to (12) a hardware fault. electrical fault. 3.00.Part 1
Typical example of a system using FVL is a personal computer which performs supervisory control or process modeling.
NOTE 1 NOTE 2 NOTE 3 Corrective maintenance without modification should usually not eliminate the failure cause.87 spurious trip: refers to the shutdown of the process for reasons not associated with a problem in the process that the SIF is designed to protect (e. that control the appropriate input.
90 Test Interval (TI): time between functional tests. 3. NOTE 3 This definition is process sector specific only. implementation.
3.00.) which requires at least m of n channels to be in agreement before the SIS can take action. The watchdog is used to increase the on-line diagnostic coverage of the PE logic solver.
3.92 utility software: see “software. Synonyms include: unrevealed and covert. Hence two modules or circuits performing the same function fail.
. installation and operation of the hardware.95 watchdog: a combination of diagnostics and an output device (typically a switch) for monitoring the correct operation of the programmable electronic (PE) device and taking action upon detection of an incorrect operation. physical inspection and manual tests.− 33 −
ISA-TR84.93 verification: process of confirming for certain steps of the Safety Life Cycle that the objectives are met. 3.02-2002 .00.1. etc.. This term deviates from the definition in IEC 61508-4 to reflect differences in the process sector. not found by the diagnostic tests or during normal operation.
is the fraction of single module or circuit failures that result in the failure of an additional module or circuit. Test interval is the amount of time that lapses between functional tests performed on the SIS or a component of the SIS to validate its operation.Part 5. NOTE 2 The watchdog can be used to de-energize a group of safety outputs when dangerous failures are detected in order to put the process into a safe state.
NOTE 1 NOTE 2 NOTE 3 NOTE 4 For example.1. This parameter is used to model common cause failures that are related to hardware failures.g.1.1.91 undetected: in relation to hardware and software.g. one out of two [1oo2] to trip.2
Symbols specific to the analysis of the logic solver portion are included in ISA-TR84.” 3. m out of n. of the software.Part 1
the safety requirements specification.
3. or through normal operation.. 3. These adjectives are used in undetected fault and undetected failure. the design.1.
NOTE 1 The watchdog confirms that the software system is operating correctly by the regular resetting of an external device (e. the design.94 voting system: redundant system (e. manufacture.1. etc. two out of three [2oo3] to trip. hardware electronic watchdog timer) by an output device controlled by the software.02-2002 .
ISA-TR84.
is the fraction of safe output circuit failures that are detected by on-line diagnostics. It is the fraction of failures that are detected by on-line diagnostics.
is the fraction of safe failures that are detected by on-line diagnostics.00.
is the fraction of dangerous input circuit failures that are detected by on-line diagnostics.02-2002 .
is the fraction of safe input circuit failures that are detected by on-line diagnostics.Part 1
− 34 −
is the diagnostic coverage factor.
This is also referred to as the mean time to the occurrence of a safe system failure.− 35 −
ISA-TR84.00.
is the fraction of safe power supply failures that are detected by on-line diagnostics. Dimension (Time)
is the mean time to repair failures that are detected through on-line tests.
is the number of input circuits on an input module. Dimension (Time)
is the mean time to the occurrence of a spurious trip.
is the average number of output modules affected by the failure of the input processor on an input module (typically fIPO = m/n).02-2002 .
is the mean time to the occurrence of a dangerous event. This time is essentially equal to one half the time between the periodic off-line tests (TI/2) (see MTTROT).Part 1
is the number of watchdog circuit devices in one channel or leg of a PES. Dimension (Time)
is the number of input modules in one channel or leg of an E/E/PES. Dimension (Time)
is the mean time to repair failures that are detected through periodic testing off-line.
00. is the value of βD (for detected failures).
is conditional probability. (PFDAi is used to indicate PFDA for a final element configuration). is the value of β (for undetected failures).ISA-TR84.
is the number of time steps.
is the average probability of the power supply failing to respond to a process demand.02-2002 .
is the average probability of the sensor failing to respond to a process demand.Part 1
− 36 −
is the average probability of the logic solver failing to respond to a process demand. Dimensionless
is the average probability of the final elements failing to respond to a process demand.
is the average probability of the SIF failing to respond to a process demand.
Probability to Fail Safe.1).
is probability vector. It is also referred to as average safety unavailability or average fractional dead time.
. It is commonly referred to as the average probability of failure on demand. Dimensionless
is the probability of failure on demand (See definition in Clause 3.
is an input parameter used in the Monte Carlo Process. (STRAi is used to indicate STRA for a final element configuration).
is the scoring factor for programmable electronics from Table A. Dimension (Time)
is the number of successful fault simulation tests.1 that provides credit for automatic diagnostics that are in operation.
is the scoring factor for sensors and actuators from Table A.Part 1
is the safe failure rate for all final elements.1 that provides credit for automatic diagnostics that are in operation.− 37 −
is the time interval between periodic off-line testing of the system or an element of the system.
is the scoring factor for sensors and actuators from Table A.
is the safe failure rate for all power supplies.02-2002 .
is the rate of external system shocks.00.1 that corresponds to those measures whose contribution will not be improved by the use of automatic diagnostics.
is the Transition Matrix.1 that provides credit for automatic diagnostics that are in operation.
is the safe detected normal mode failure rate.Part 1 λ λ
− 38 −
is used to denote the common cause failure rate for a module or portion of a module.02-2002 . Dangerous undetected failures are failures that cannot be detected by on-line tests. fail in a direction that would defeat the purpose of the SIS) detected failure rate for a module or portion of a module.
is the safe detected common cause failure rate.ISA-TR84.
is used to denote the safe or false trip failure rate for a module or portion of a module.00.. is equal to λ • (1S
is the safe undetected failure rate for a module or portion of a module.
is the dangerous (e.
. These failures can result in a dangerous condition. λ S C ).g. DU D λ is computed by multiplying the dangerous failure rate for a module (λ ) by one minus the D diagnostic coverage for dangerous failures (1-C ). λ
is equal to λ • C .
is the dangerous undetected common cause failure rate. λ is computed by multiplying the dangerous failure rate for D D a module (λ ) by the diagnostic coverage for dangerous failures (C ).
is used to denote the dangerous failure rate for a module or portion of a module. Detected dangerous failures are failures that DD can be detected by on-line tests.
is used to denote the dangerous undetected (covert) failure rate for a module or portion of a module. These failures typically result in a safe shutdown or false trip.
is the failure rate for each individual input circuit on the input module. is the failure rate for an input module (λI = λIP + nIC λIC). is the failure rate of a device (λD= λ + λ ).
λIV λMP λOC λOP
is the failure rate for the input voter.Part 1
is the failure rate for physical failures.00.− 39 − λ λ
is the failure rate for an input module (λI = λIP + nIC λIC).
is the safe undetected normal mode failure rate.02-2002 .
λA λI λD λI λL λO λP λS λIC λIP
is the failure rate for an output module (λO = λOP + nOC λOC).
is the systematic failure rate that results in a dangerous state of a final element. wiring errors.
is the dangerous failure rate for an input module. human interaction errors. Examples include SIS design errors.
is the safe failure rate for the logic solver. etc.ISA-TR84.
is the safe failure rate for a sensor or other input field device. This is used to model systematic failures that affect the operation of all legs of a SIS configuration. etc. human interaction errors.
is the systematic failure rate that results in a dangerous state of the system.
is the safe failure rate for an output module. wiring errors. Examples include SIS design errors.
is the dangerous failure rate for a final element or other output field device.02-2002 .Part 1 λPS λ
is the systematic failure rate that results in a safe state of the system. where the cause cannot be related directly to hardware failures. This is used to model systematic failures that affect the operation of all legs of a SIS configuration. software implementation errors. software implementation errors.
is the safe failure rate for each individual input circuit.− 41 − λ
is the safe failure rate for a power supply.00.
is the safe failure rate for the input voter.Part 1
is the dangerous failure rate for the main processor.02-2002 .
is the effective repair rate for the safe failures of an individual input circuit.00.
µOT
is used to denote the repair rate for failures that are detected through on-line tests (µOT=1/MTTROT).Part 1 λ
is the effective repair rate for the dangerous failures of the sensor.02-2002 .
is the effective repair rate for the dangerous failures of the power supply.ISA-TR84.
It is the probability that the safety instrumented function will fail in a manner which will render it incapable of performing its intended safety function. enhancing the PFD of the logic solver (E/E/PES) of the SIF without corresponding enhancement of the field devices may not be effective in improving the SIF SIL.1). thereby.) The specific functionality (f) is an attribute of the system architecture selected for the SIS (E/E/PES and field devices). configured for high safety availability and with the same logic solver. Making a change to improve one
is the effective repair rate for the safe failures of an individual output circuit. The functional test interval is that period of time over which the SIF must operate within the PFD limits of the specified SIL.g. reducing the possibility of a dangerous undetected failure. we can state that in general: PFD = f (failure rate. as given in IEC 61508 and IEC 61511.
is the effective repair rate for the safe failures of the power supply. On DU the other hand. The distribution of SIF PFD will change as the number and type of system elements and the configuration vary.
The Probability of Failure on Demand is the measure of safety integrity for the SIF. As such. including the number and quality of field DU devices.Part 1
is the effective repair rate for the safe failures of the input processor and associated circuitry. has a major impact on the PFD for the SIF. common cause. which is the average value over the functional test interval and is used to define the limits of the three Safety Integrity Levels (SILs). It is important to recognize that the SIF configuration. repair rate. the SIF will be unable to respond to a demand and no safety action (e. If one assumes a single input with a MTTF DU DU of 30 years. about 85% of the SIF PFD will fall in the field devices and about 15% in the logic solver. etc. To satisfy the requirements of a given SIL. the PFDavg should be less than the upper limit as provided in ANSI/ISA-84. Given the above.00. the PFD for the field devices may account for only 30% and the logic solver may account for 70% of the SIF PFD.01-1996. shutdown) will be initiated. and consequently minimizing the PFD. PFD is usually expressed as PFDavg.
is the effective repair rate for the safe failures of the main processor. test interval. as given in ANSI/ISA-ISA-84. Therefore.01-1996 (Table 4.02-2002 . Comprehensive internal diagnostics dramatically improves the diagnostic coverage factor. a single output with a MTTF of 50 years. and a logic solver with a MTTF of 100 years.
is the effective repair rate for the safe failures of the output processor and associated circuitry. It could be equal to a “mission time” and should be as long as possible to reduce the possibility of human error associated with frequent functional testing of the SIS. using redundant inputs and outputs with similar MTTF .− 43 −
ISA-TR84. or four SILs. The dangerous undetected failure rate is strongly impacted by the diagnostic coverage factor of the system (for random hardware failures).
.ISA-TR84.. the systematic failures are separated into safe failures and dangerous failures. 5.Part 1
− 44 −
portion of the system (e. The modeling of the system includes all possible types of failures.
The objective of this section is to define the terminology and symbols for the different types of SIF element failures to be used by the safety integrity evaluation techniques that are discussed in the following sections. logic solvers. Common cause failures are the direct result of a shared root cause. Failures can be grouped into 2 major categories: a) Physical Failures
(11. and output field devices (e.g. Electrical (E). A partial list of causes is as follows:
. electronic (E). adding a redundant PES) may not have significant impact on the overall SIF. In a similar D manner. they are shown in the models of the overall system architecture. 5. as an additional failure rate. Annex A discusses a technique to evaluate the β factor and proposes a methodology to apply it to the reliability models. the overall SIF must be evaluated.g. will have the potential to result in a spurious trip.02-2002 .3 Systematic failures
Systematic failures occur when the physical hardware is operating but unable to perform the specified function due to errors of omission or errors of commission. and programmable electronic (PE) technology elements are modeled for the logic solver functions. valves). The SIF elements include input field devices (e.. The estimation of the systematic failure rate must consider many possible causes.g.1 Physical failures
A failure is classified as physical when some physical stress (or combination of stressors) exceeds the capability of the installed components (e.g. λ F. simultaneously.
Since systematic failures are in addition to the physical failures. Common cause susceptibility is an important characteristic in the safety rating of a SIF. Systematic failures may impact single and/or multiple system elements. associated susceptibility). In the models. sensors). An example is radio frequency interference that causes simultaneous failure of multiple modules. λ F will have the potential to result in a fail-to-function state of the SIF. Thus. It is S assumed that a systematic safe failure.15)
NOTE Systematic failures may be separated into independent and common cause failures.00.2 Hardware common cause failures
Hardware common cause failures must be modeled differently since multiple failures occur simultaneously. The Beta model (Annex A) partitions the failure rate into those failures due to stress events high enough to fail multiple units if they are exposed to the same stress. a systematic dangerous failure. 5.
d) Human interaction errors These errors include errors in the operation of the man machine interface to the SIF. setup (calibration. and user interface routines (display systems. set-point settings). diagnostics.e.02-2002 . initialization. The vendor software typically includes the operating system. 2) function properly in the installed environment (atmospheric temperature/humidity. e) Hardware design errors These errors include errors in the manufacturer’s design or construction of selected SIF components which prevent proper functionality and failure of component to meet specified conditions. 2) They may be subtle. and errors in the design of the interface between the E/E/PES and sensors and actuators. I/O routines. and utility software.− 45 −
ISA-TR84..). 2) inadequate electrical/pneumatic power supply. etc.
. hardware implementation. SIF design. etc. incorrect selections of sensors and final elements. and 4) installation of wrong sensor or final control component. b) Hardware implementation errors These errors include errors in the installation. 3) improper or blocked-in connections to the process (impulse lines). application oriented functions and programming languages. hardware design).). c) Software errors These errors include errors in vendor written and user written embedded. f) Modification errors These errors occur when altering any or all of the five categories mentioned in this clause (i. and 3) the wrong selection of type or rating for components. errors during periodic testing of the SIF and during the repair of failed modules in the SIF.Part 1
a) SIF design errors These errors include errors in the safety logic specification. application. human interaction. Failure due to errors of this type will likely fail an entire redundant architecture. software. and start-up of SIS components which are not detected and resolved during functional testing of SIS. Examples of such errors are 1) wiring/tubing errors. These errors have three common characteristics: 1) They may occur during maintenance activities. etc. vibration. diagnostics.). Examples of such errors are failure of a component to 1) meet specified process conditions (pressure. temperature. User written software errors include errors in the application program.00.
5.DD d) Dangerous/ Undetected .” Safe (spurious trip) failure rates are denoted by D S a superscript “S.SU c) Dangerous/ Detected . All failures that have the potential to cause the SIF to shut down the process without a process demand present are categorized as “Safe.DU These four categories are shown in Figure 5. every element failure rate can be split into four mutually exclusive failure rates: a) Safe/ Detected . Examples of such errors are: 1) Inability to replace a component with an identical component (e.Part 1
− 46 −
3) They may impact an adjacent area.g.02-2002 ." Hence for a device. Those failures not detected on-line are classified as undetected (covert) failures. 2) Modification reduces the load on the power source. all Since the object of safety integrity evaluation techniques is to calculate the PFDavg and MTTF SIF element failures are partitioned into “Safe” failures and “Dangerous” failures.4 Partitioning of SIF element failures
.SD b) Safe/ Undetected .1 below. All failures detected on-line while the SIS is operating are classified as detected (overt) failures. thus raising the voltage level and causing problems with other existing non-modified components." All failures that have the potential to cause the SIF to fail to respond to a process demand are categorized as “Dangerous. due to discontinued support) and the replacement component does not fully function with adjacent components." Dangerous failure rates are denoted by a superscript “D.00. As a result of this additional partitioning. the dangerous and safe failure rates are λ and λ .ISA-TR84.
. a superscript “S” is used on the diagnostic coverage factor “C” to denote the diagnostic coverage for safe failures.. Hence.dangerous detected failure rate. In a similar manner. The four failure rates for an element are computed as follows: λ λ λ λ
=λ •C
= λ • (1 . The diagnostic coverage factors D S for dangerous and safe failures are C and C . Normally the diagnostic coverage for dangerous failures is lower than the diagnostic coverage for safe failures since dangerous failures cause the state of the element to remain unchanged. a different diagnostic coverage factor for safe and dangerous failures is assumed.e.safe undetected failure rate.Part 1
Figure 5. the Beta factor (see ISA-TR84. Safe failures result in a change of state of the element and hence are easier to diagnose. a superscript “D” is used on the diagnostic coverage factor “C” to denote the diagnostic coverage for dangerous failures. As in the case of failure rates.safe detected failure rate.
The detected and undetected failure rates are computed by determining the diagnostic coverage factor for each element of the system. random) versus common cause.Part 1. Refer to Annex E for guidance in determining the split ratio.00.00. Annex A) is used to partition the failure rates into independent (i.1  Safe and dange rous-detected and undetected failure rate diagram
The superscript SD. The four failure rates are denoted as follows: 1) λ 2) λ 3) λ 4) λ
. .02-2002 .02-2002 .dangerous undetected failure rate. DD. and DU are used on the element failure rate to denote the category of failure.C )
= λ • (1 . SU.− 47 −
ISA-TR84. .C )
In the Beta model.
− 48 −
NOTE There are other common cause models available. as follows:
λSD = λSDN + λSDC where
λSDC = βλSD and λSDN = (1 − β)λSD
λSU = λSUN + λSUC where
λSUC = βλSU and λSUN = (1 − β)λSU
λDD = λDDN + λDDC where
λDDC = βλDD and λDDN = (1 − β)λDD
Divide each failure rate into “dependent (common cause) and independent failure rates.ISA-TR84. The Beta model was chosen because it is simple and sufficient to model configurations covered by this document.02-2002 .2 shows the four primary failure rate categories.00.”
Figure 5.2  Failure rate cate gories
The four primary failure rates categories are divided into eight.
and/or redundant sensors to achieve the desired safety integrity level. however.5 5.C
In many cases.00. The A subscript indicates a final element. 5.Part 1
λDU = λDUN + λDUC where
λDUC = βλDU and λDUN = (1 − β)λDU
5.C S)
= λ S• C =λ
• (1 .− 49 −
ISA-TR84. however. most of these devices interface to the SIF logic solver through analog input boards.λ
b) Safe/Undetected . where the S subscript indicates a sensor.λ
c) Dangerous/Detected . digital output boards and serial communication links.02-2002 . The sensor failure rate must be split into four mutually exclusive failure rates: a) Safe/Detected . the sensor diagnostic coverage factors are low.
and λ S) and the sensor
The equations used to compute the four failure rates are as follows: λ λ λ λ
= λ S• (1 .
A large variety of input devices are available for use in safety applications.λ
d) Dangerous/Undetected . most of these devices interface to the SIF logic solver through analog output boards. This requires off-line functional testing of the sensors at frequent intervals.λ
These failure rates are computed using the safe and dangerous failure rates (λ diagnostic coverage factors (C
and C S). The overall failure rate of a sensor is given by λS.5. The overall failure rate of a final element or output device is given by λA. digital input boards and serial communication links.2 Modeling of final elements (output field devices)
A large variety of output devices are available for use in safety applications. and hence the undetected failure rates are large.
nIC is the number of input circuits per input processor.02-2002 .ISA-TR84.5) Since there are many different kinds of I/O modules (i.4) c) Multiboard PES with main processor module. This requires functional testing of the final elements at frequent intervals. and I/O chassis with I/O processor module and non intelligent I/O modules (Figure 5. analog inputs.2 shows that the I/O modules can be modeled using individual input and output circuits that connect field devices to the main processor. digital outputs. As a result of these differences the I/O is modeled using input processors. Figures 5. and λIC is the failure rate of the individual input circuits. 5. while the failure of an I/O processor may only affect those I/O circuits attached to it.6 Modeling of elements in PES arithmetic/logic solvers
Programmable electronic systems (PESs) can vary significantly in architecture. An examination of the PES architecture in Figure 5.00. the final element failure rate must be split into four mutually exclusive failure rates: a) Safe/Detected . output processors and individual output circuits. For example. λI.Part 1
− 50 −
As with the sensors.λ
d) Dangerous/Undetected . and/or redundant final elements to achieve the desired safety integrity level.λ
b) Safe/Undetected .λ
These failure rates are computed using the following equations: λ λ λ λ
=λ =λ =λ
• (1 .C A)
In many cases. Hence the overall failure rate of an input module.4 contain PES architectures with I/O processors that process the data from the input and output circuits which are connected to the field devices. is as follows: λI = λIP + nIC λIC where λIP is the failure rate of the input processor.3) b) Multiboard PES with main processor module and processor based I/O modules (Figure 5.C A) •C
• (1 . However. etc. digital inputs.. the failure of a main processor affects the operation of all I/O modules.λ
c) Dangerous/Detected .e. the PES is broken into blocks.
. and hence.) and different ways of connecting them to the main processor. the undetected failure rates are large. The blocks used in the basic architectural model must be carefully chosen so that interactions between modules in the PES can be described. Three typical architectures for a single PES are: a) Small single board PES with integral I/O (Figure 5. the final element diagnostic coverage factor is typically low.3 and 5. individual input circuits.
and λOC is the failure rate of the individual output circuits.
. noc is the number of output circuits per output processor.Part 1
In a similar manner the failure rate of an output module.00.− 51 −
ISA-TR84. is as follows: λO= λOP + nOCλΟC where λOP is the failure rate of the output processor. λO.02-2002 .
− 52 −
Figure 5.4  PES architectur e with processor-based I/O modules
.ISA-TR84.02-2002 .3  Single board PE S architecture
Figure 5.00.
02-2002 .5  PES architectur e with I/O processor boards & I/O boards
.00.− 53 −
ISA-TR84.Part 1
λMP b) Input Processor . . nIC and nOC are the total number of input and output circuits serviced by a single I/O processor.8 Failure rate data for commonly used field instrumentation
and PFDavg of a SIS.λPS
These PES element failure rates can be partitioned into “Safe/ Detected” failures. it is important that these assumptions be conservative. such as public databases. “Safe/ Undetected” failures.λIC d) Output Processor . λIP and λOP are set to zero. “Dangerous/ Detected” failures.02-2002 .4.main processor dangerous detected failure rate. Hence. fault tree analysis. user compiled maintenance records. Failure rate data may come from a variety of different sources. and final elements. Using the same notation as in Section 4. a value of 10% is conservative (see Annex A). one must have failure rate data of the different In order to predict the MTTF components.λOP e) Individual Output Circuit .7
. When it is impractical to do this level of analysis. This failure rate classification depends on an accurate and detailed Failure Modes. .main processor safe undetected failure rate. simplifying assumptions can be made.main processor safe detected failure rate. vendor (13-18) calculations or operating experience. it must be assumed that no failures are detected. reliability THE NUMBERS IN TABLE 5.ISA-TR84. and nIC and nOC are the total number of input and output circuits on the single board. If diagnostic coverage capability is not known. logic solver. The rest of the modules that make up the PES are not split into sections like the I/O modules. such as the sensor. THE DIFFERENT FAILURE MODES OF THE ACTUAL
. the elements used in the models and their respective failure rates are as follows: a) Main Processor . the failure rates for the main processor are as follows: a) λ b) λ c) λ d) λ 5.
System modeling of any fault tolerant E/E/PES architecture can be done using simplified equations. Markov analysis or other technique using the failure rate categories described above.00.λOC f) Power Supplies . THEY DO NOT REFLECT THE VARIABILITY OF FAILURE RATES DUE TO THE SEVERITY OF DIFFERENT PROCESSES. however.λIP c) Individual Input Circuit . . it must be assumed that all failures are dangerous. compiled field returns.Part 1
− 54 −
If the PES is a single board with integral I/O. and “Dangerous/ Undetected” failures.5. If beta factors (common cause) are not known. If the PES is like the system illustrated in Figure 5. 5. If failure modes are not known.1 WERE COMPILED FROM USER DATA AND ARE IN NO WAY ENDORSED BY ISA. Effects and Diagnostic Analysis (FMEA).main processor dangerous undetected failure rate.
02-2002 . Reliability practitioners usually work with failure rates expressed as failures per million hours. Failure rates may be inverted and expressed as mean time to failure (MTTF) and may be expressed in years.00. NOR HOW THE DATA WAS ACTUALLY COLLECTED BY EACH COMPANY.− 55 −
. Note that MTTF and component life are not the same. THE USER IS CAUTIONED IN THEIR USE AND SHOULD TRY TO COMPILE THEIR OWN DATA.
Detect.1  MTTFD and MTT F spurious values (expressed in years) for common field instrumentation
Company A MTTF Sensors Flow Switch Pressure Switch Level Switch Temp.ISA-TR84.000 75 1 75 75 30-50 40-50 40-60 40-60 40-60 15-30 60-80 15-25 20-25 20-30 20-30 20-30 5-15 30-40 40 20 20 10 100 20 40 100 40 50 40 20 25 15 10 20 160 100 65 50 20 150 76. Transmitter Flame Detector Thermo couple RTD (Resistance Temp.02-2002 .) Vibration Proximitor Combustible Gas Detector Final Elements (See Next Page) 20 20 60-80 30-40 30 15 75 10.1 2 150 35 15 100 100 20-30 20-30 20-30 20-30 40-60 10-15 10-15 10-15 10-15 20-30 10 35 25 15 50 5 15 5-10 5 25 7 16 80 10 60 8 20 60 20 60 25 35 30 10 55 20 60 12 55
5 2.Part 1
− 56 −
. Switch Pressure Transmitter (service < 1500 psig) Pressure Transmitter (service ≥ 1500 psig) Level Transmitter Flow Transmitter Orifice Meter Mag Meter Coriolis Meter Vortex Shedding Temp.00.
the PFD and PFS.
. affects the usefulness of the PFD and PFS values calculated by the model. good data might be unavailable. The background of the data may be unclear.02-2002 . For any reliability technique. no data may be available because equipment might be new. i. and Correlation Analysis (clause 5. Sensitivity (clause 5. taking into account the uncertainties associated with the model and the data.9. the PFD and the PFS are based on a reliability model of the SIF application and reliability data for parameters like the failure rates and the repair rates of the different elements.3).1  MTTFD and MTT F spurious values (expressed in years) for common field instrumentation
5.2).e. In such cases.− 57 −
ISA-TR84. for many reasons. how good (or how bad) the model is.00. It is impossible to model every single aspect of real life.Part 1
Table 5. The failure and repair rate data used in reliability models are uncertain.9
This clause outlines three statistical analysis methods that are useful in analyzing the performance of a SIF.9. using a single or point value for the failure and repair rates might give very misleading results. assumptions need to be made to simplify the modeling effort whenever a model is created.1). The methods are statistical Uncertainty (clause 5. Any model is just an approximation of the real world. therefore..9. Of course. There is uncertainty associated with each model that is created. and how good (or how bad) the failure and repair rate data used in that model is.
Before attempting to apply these tools. although in principle. The following two statistical techniques provide the tools to do this investigation. In practice it is th th possible to represent any level of confidence (e. These simulations are usually done by specialized software (Annex C) number of SIF applications. the PFD or PFS. b) propagates this uncertainty through the model.g. When uncertainty analysis is applied the results are often presented as in Figure 5.02-2002 .ISA-TR84. repair rates) to a reliability model. 25. A range of values (e. In order to understand the theory and implement the different methods.02-2002 . and c) (22. This range can be based. They are very useful during the architecture design of SIF. In the case of Figure 5.1 Uncertainty analysis
Uncertainty analysis is a method that a) takes the uncertainty associated with the input parameters (i.02-2002 .Part 2 and ISA-TR84. The plots represent th th th (26) three levels of confidence in the results: the so-called 10 . and.Part 1
− 58 −
The theory behind the methods is not explained.02-2002 . 5.e. The result of the uncertainty analysis is a number of values for the PFD and PFS..00. These techniques are based on statistics.e. on such factors as: the manufacturing quality.6.
. 50% of the cases the PFD value would be below the 50 percentile line. the reader is referred to the references as presented in the different sections.Part 4 uses uncertainty and sensitivity analysis. or other factors.00. it is possible to do so. instead of a single value.00. for example. 95 and so on). The reader is cautioned however that the following discussions are only brief overviews of these tools. i. ISA-TR84. 50 and 90 percentiles . minimum through maximum likely creates a range of values for the outputs values).9.Part 5 uses all three methods..g..6. which means that the results are based on simulating a significant (24. Using a range of values as input means that a range of values is created for the output. the reader should refer to the references cited in each section.00.02-2002 – Part 3 do not use these techniques. 90% of the cases the PFD value would be below the 90 percentile line. 23) . 5 .00. ISA-TR84. The reader should interpret the graphs as follows: Given this input data and reliability model. is used for failure and repair rates. ISA-TR84. the specific application. The use of these uncertainty graphs is based on good engineering judgment. 10% of the cases the PFD value would be below the 10 percentile line. it would be worth investigating the cause of the wide range of PFD values (it covers all three SIL levels) as seen in the graph on the right. the size of the sample used to determine the failure rate. the environment of the component. 27) . failure rates.
The reader should interpret the graph as follows.. Zero means that the output is not sensitive to the input while two can vary between zero and two means that the output is very sensitive to the input.1 90% 0. On the vertical axis the input parameters are listed in order of their statistical sensitivity (most sensitive highest.2 Statistical sensitivity analysis
Statistical sensitivity analysis is a method which quantifies the effect of the uncertainty associated with an input parameter (e.00. the PFD or PFS) .. then the statistical sensitivity analysis would show how this range propagates through the reliability model and how much influence it has on the range of PFD. 30) . The horizontal axis gives a range for the statistical sensitivity.001 10% 0. the failure and repair rates) to the uncertainty associated with the output parameter (28) (e.Part 1
0.7. which (29. That is.1 SIL 1 0. for example.g. In other words. the variation in the specified values of valve failure rate cause more variation in the PFD value than variation in any other input parameter.− 59 −
ISA-TR84.g. and least sensitive lowest).0001 SIL 3
Figure 5. In this case the PFD value is most sensitive to the failure rate of the valve.01 0. as presented in Figure 5.001 0.02-2002 .01
0. if there is a range of input values for the failure rate of a valve.0001 90%
0.6  Two examples o f uncertainty plots
.6.9. The results of a statistical sensitivity analysis are presented in a Pareto plot as in Figure 5.
0 Medium 1. e. the PFD ..Part 1
− 60 −
Failure Rate Valve Failure Rate Flow Sensor Failure Rate Power Supply Failure Rate Input Module Failure Rate Main Processor 0. e..00. The correlation coefficient can vary between -1 and +1.g. It turns out that there is not enough data available for the valve and input module failure rates. From the sensitivity plot the conclusion can be drawn that the PFD of the SIF is robust against failures of the input module. A value of -1 indicates a strong negative correlation meaning that the output decreases as the input parameter increases. then there are two possibilities: a) The architecture design or set-up (represented by the reliability model) is the cause of this high sensitivity of the input parameter. 5. Thus if the correlation is strong (negative or positive) then it is more likely that the architecture design is the dominant factor.0 Low 0. the range of the PFD values is not influenced much by the input module.9.
. A value of +1 indicates a strong positive correlation meaning that the output (PFD) increases as the input parameter (failure rate) increases. On the other hand. and the output. Even though a wide range of failure data is used.ISA-TR84. A statistical correlation analysis helps to answer the question: Is it the architecture design or the range of data for a particular input parameter that causes the variation in output? A typical correlation result is presented in Figure 5. a failure (31) rate. A conservative approach is to apply a wide range of data based on experience and carry out the uncertainty and sensitivity analysis.02-2002 .0 High
Figure 5. If the correlation is zero the range in input parameters is more likely to be the dominant factor. the output is much influenced by the failure data of the valve. The PFD is very sensitive to valve failures.7  Example plot st atistical sensitivity results
How can the reader use this kind of information while examining a SIF architecture? Suppose that reliability data is collected for all the input parameters of the reliability model. it indicates the degree or strength of the linear relation between the input parameter.8. The results of the Uncertainty Analysis are presented in the right graph of Figure 5. The next step can be a) to get better failure data for the valve and see how that affects the PFD values or b) to change the SIF architecture and make the design more robust against valve failures. A value of zero means that the input parameter has no linear effect on the output.g.6.5 1.3 Statistical correlation analysis
When a certain input parameter has a high sensitivity factor and the cause for this high factor is unknown. b) The spread between the Minimum and Maximum failure rate is very wide and caused the high sensitivity of the input parameter.5 2.
0 Correlation Coefficient +0. then it is necessary to generate the best guess of the expected minimum and maximum range of values. after the sensitivity and correlation analysis. or else the SIF configuration has to be examined. and justified.00.02-2002 .− 61 −
ISA-TR84.8  Example statist ical correlation results
. Experienced technicians know that accurate single value failure and repair rate data are seldom available for all the elements in a SIF. logic solver or final element types (with different failure and repair rate data). Three remedies can be considered (stand-alone or in combination): a) Change the SIF architecture to meet the objectives. this estimation proves to be important in the results (PFD or PFS). adjusted.
Failure Rate Valve Failure Rate Flow Sensor Failure Rate Power Supply Failure Rate Input Module Failure Rate Main Processor -1.Part 1
The particular advantage in applying the sensitivity and correlation analysis will be the ability to use less accurate input data. b) Attempt to acquire more accurate and justifiable input data.5 +1. If this is the case. When.0 Strong Negative -0. then either the failure rate estimation range has to be very closely examined.0 Strong Positive
Figure 5. c) Choose alternative sensor.5 0.
and for logic solvers only.02-2002 to evaluate the PFDavg and the MTTF for Safety Instrumented Functions are simplified equations (Part 2).Part 1
− 62 −
The modeling techniques discussed in ISA-TR84. or PE logic solvers Yes
A more detailed discussion on the three techniques is provided in Reference 11. Table 6.1  Comparison of system analysis techniques presented in ISATR84.00. The presentation of the techniques provided in ISA-TR84.02-2002 does not illustrate their full capability.02-2002 .00. To use any of these techniques requires a thorough understanding of the modeling technique being used.
. Markov Analysis (Part 4).00. 4 and 5
Simplified Equations Fault Tree Analysis SIF with complex relationships Markov Analysis SIF with complex relationships. 3.1 is included to help guide users as to which method may be most appropriate for their particular application. fault tree analysis (Part 3).Parts 2.ISA-TR84. time dependent requirements.02-2002 . Markov Analysis (Part 5).00.
02-2002 .3 E-3 1. all three methods give similar values (Figure 6.
For the Base Case PFDavg.5 yr 7.00.2). and 4
Case Part 2 Simplified Equations Part 3 Fault Tree Analysis Clause 6 Base Case Clause 7 Base Case Average Before Logic (ABL) Clause 7 Base Case Average After Logic (AAL) Part 4 Markov Model Clause 14 and 15 Base Case 8. 3. and 4. 3.2  Summary of SIF base case example problems presented in ISATR84.Part 1
Table 6.5 yr PFDavg 8.3 E-3 MTTFspurious 1.3 E-3 1.02-2002 .Parts 2.1).
Table 6. all three methods give essentially the same value (Figure 6.4 E-03 1.− 63 −
ISA-TR84.0 yr
.2 summarizes the calculation results for PFDavg and MTTF problems presented in Parts 2.7 yr 8.00. For the Base Case MTTF
00E-03 5.1  PFDavg for SIS b ase case example problems presented in ISATR84.02-2002 .00E-03 8. 3.00E-03
6.02-2002 . and 4
.00.00E-03 3.Parts 2.ISA-TR84.00E-03 7.00.Part 1
− 64 −
1.00E-02 PVDavg 9.00E-03 2.00E-03 4.00E-03 1.00E-03 Part 2 Simplified Equations Part 3 Fault Tree Analysis ABL Part 3 Fault Tree Analysis AAL Part 4 Markov Model
00.− 65 −
2.5 Part 2 Simplified Equations Part 3 Fault Tree Analysis Part 4 Markov Model
MTTF.02-2002 . 3.Parts 3 and 4 to illustrate features of the calculation methods. the methods may give different values and one method may be more appropriate as suggested in Table 6.2  MTTFspurious for SIS base case example problems presented in ISATR84.5 1 0. For a different SIF configuration with different assumptions. and 4
All three methods give similar results for this SIF Base Case example based on the configuration and assumptions used in the Base Case.02-2002 . yr
. Additional examples are given in ISA-TR84.00.00.Parts 2.02-2002 .
Because common cause failures affect more than one channel in a multi-channel system. i. Therefore. It has been modified to harmonize with ISA-TR84.g. There is a finite probability that independent Random Hardware Failures could occur in all channels of a multi-channel system such that all of the channels were simultaneously in a failed state. the potential for failures which may affect more than one channel in a multichannel system.− 67 −
ISA-TR84. the rate of single-channel faults which can ultimately contribute to common cause failures will be significantly reduced. will result in substantial errors when reliability calculations are applied to multi-channel systems. the probability of common cause failures is likely to be the dominant factor in determining the overall probability of a failure of a multi-channel system and this must be taken into account if a realistic estimate of the SIL of the combined system is to obtained.00. Part 6. a combination of both.00.e. If 99% of internal faults are revealed before they can result in a failure.02-2002 .02-2002. Common cause failures may result from a systematic fault (e. for example. each channel in a PES can monitor the outputs of other channels in multichannel PES (or each PES can monitor another PES in a multi-PES). These can be employed in a number of ways.. Annex A. The use of the methodology will give a more accurate estimation of the integrity of such a system than if the potential for common cause failures were ignored. Programmable electronic systems may provide the ability to carry out diagnostic functions during their online operation. for example: a) a single channel PES can continuously be checking its internal operation together with the functionality of the input and output devices. where a more accurate β-factor can be proven as a result of the availability of data on Common cause failures. However. This informative annex describes a methodology which will allow common cause failures to be taken into account in the safety assessment of a multi-channel SIS. no matter how well these measures are applied. and b) Systematic failures The former are assumed to occur randomly in time for any component and will result in a failure of one or more channels within a system of which the component forms part. an excessive temperature. if a failure occurs in
A. Alternative methodologies may be preferred in some cases. possibly. Although this will not have a significant effect on the reliability calculations for single-channel systems.2 Brief overview
The failures of a system are considered to arise from two causes: a) Random hardware failures... which accelerates the life of the components or takes them outside their specified environment) or.g.1 Introduction
Technical Report 84.
A. common cause failures.00. there will be a residual probability of systematic failures occurring.Part 1
Annex A (informative)  Metho d ology for quantifying the effect of hardwarerelated common cause failures in Safety Instrumented Functions
NOTE The source of this document is IEC 61508. A diagnostic coverage in the region of 99% is often (19) achievable . b) In addition to self-testing. a design or specification error) or an external stress leading to an early random hardware failure (e.02 incorporates a number of measures that deal with systematic failures.
β-factor estimates based on historical data may be invalid.
.ISA-TR84. use automatic diagnostics. As a result of the above: a) PE-based systems may have the potential to incorporate defenses against common cause failures.. this can be detected and an appropriate action initiated by the non-failed channel(s) which is executing the cross-monitoring test. b) A different β-factor may be applicable to PES-based systems when compared to other technologies.) c) Reveal the initial failure before a second channel has been affected. Following are three avenues that can be taken to reduce the rate at which common cause failures are likely to manifest themselves: a) 1) Reduce the number of overall systematic failures. Therefore.00.02-2002 . (This will reduce the amount of overlap between the ellipses in Figure A. (This will reduce the areas of the ellipses in Figure A. such failures may not be recognized/reported as being common cause failures.e.) c) Common cause failures that are distributed in time may be revealed by the automatic diagnostics before they affect all channels.1 leading to a reduction in the area of overlap.Part 1
− 68 −
one channel.) b) 2) Maximize the independence and diversity of the channels. i.1 while maintaining their area. (None of the identified models used for estimating the rate of common cause failures allow for the effect of automatic crossmonitoring and none of the identified models have the ability to house so many safety instrumented functions in one logic solver.
00.Part 1
Figure A.− 69 −
ISA-TR84.1  Relationship of CCF to the systematic failures of individual channels
b) the more complex will be the system. it is believed that they represent the best way forward at the present time for providing an estimate of the probability of common cause failure of a multi-channel system.. a factor relating the rate of common cause failures of the hardware to the rate of random hardware failures. 2) For a given SIL. b) The β-factor model does not take into account the sophisticated diagnostic capabilities of modern PES. the justification for any direct relationship between these probabilities is tenuous. and.g.e. this will lead to a relationship between the probability of random hardware failures and the probability of common cause failures. The probability of random hardware failure will depend on the number of components. To overcome this problem. such a correlation has been found in practice and probably results from second-order effects. In addition. hence. subsequently. a system with a higher probability of random hardware failure will require proof tests to be carried out more frequently.. so will the rate of common cause failures. the complexity will make it difficult to identify the faults. possibly. To overcome this deficiency. c) Derive. followed by testing and. b) Quantify those factors that can be quantified. i. by what is considered at the present time to be the best practicable means. the methodology is based on the system originally described in Reference 20 and recently refined in Reference 21. Reference 19) suggest ranges within which the value of β is likely to occur. nevertheless. This will lead to a relationship between the probability of random hardware failures and the probability of common cause failures. Clearly. by either analysis or test. leading to additional human interference. The methodology described in this annex uses an approach similar to the well-established βfactor model as the third part of the three-pronged approach already described. A complex system will be less easily understood. There are two difficulties faced when using the β-factor model on a PES: a) What value should be chosen for β? Many sources (e. and could lead to parts of the logic of a system not being exercised except in infrequent circumstances. the complexity of a system. Despite the limitations of the current models. however.00. For example. so will be more prone to the introduction of systematic faults. no actual value is given.
. Most methodologies for estimating the probability of common cause failures attempt to make their predictions from the probability of random hardware failure. the approach described in References 20 and 21 have been modified to reflect the effect of diagnostics in the estimation of the likely value of β. The probability of a systematic fault being introduced during maintenance will depend on the number of times maintenance is carried out and. the higher the random hardware failure rate of a system: a) the higher will be the amount of maintenance required of the system. Again. For example: 1) A repair.02-2002 .01-1996 to reduce the overall rate of systematic failures to a level commensurate with the random hardware failure rate. recalibration will be required each time a random hardware failure occurs. take into account the rate of random hardware failures. the user being left to make a subjective choice.ISA-TR84. The methodology described in this annex relates to the derivation of this factor. which can be used to identify a non-simultaneous common cause failure before it has had sufficient time to manifest itself fully.Part 1
− 70 −
The methodology to be described is based on these avenues and has a three-pronged approach: a) Apply the techniques described in ANSI/ISA-84.
avoided before they affect all available channels. that will have a bearing on its immunity to common cause failures. different environmental conditions and diagnostics with varying levels of capability. However. Any feature which is likely to increase the time between channel failures in a non-simultaneous common cause failure (or reduce the fraction of simultaneous common cause failures)
. d) the measures described in the SRS and software design in ANSI/ISA-84.4 Points taken into account in the methodology
Because the sensors. Therefore. The probability of common cause failures which involve the system as a whole will depend on the complexity of the system (possibly dominated by the user software) and not on the hardware alone. b) monitor additional redundancy channels. Therefore. if the repetition frequency of the diagnostic checks is sufficiently high. b) reporting of common cause failures will generally be limited to hardware failures .3 Scope of the methodology
The scope of the methodology is limited to common cause failures within the hardware.the area of most concern to the manufacturers of the hardware. Not all features of a multi-channel system. The reasons for this include: a) the β-factor model relates the probability of common cause failure to the random hardware failure rate. any calculations based on the rate of random hardware failures cannot take into account the complexity of the software. for example. c) it is not considered practicable to model common cause failures (for example.01-1996 are intended to reduce the rate of software-related common cause failures to an acceptable level for the target SIL.
A. These states can be predefined in software or in hardware (e. a large fraction of common cause failures can be revealed and. A large fraction of common cause failures do not occur concurrently in all of the affected channels. It should NOT be assumed that the methodology can be used to obtain an overall failure rate which takes the probability of software-related failures into account.g. by a watchdog circuit). the logic systems are more likely to be in a controlled environment.Part 1
The diagnostic testing functions running within a PES are continuously comparing the operation of the PES with predefined states. These can a) have a high fault coverage within the channels. Clearly. (programmable) electronics and actuators will be subject to.
A. c) have a high repetition rate.. Programmable electronics channels have the potential for carrying out sophisticated diagnostic functions. will be affected by diagnostics. hence. those features relating to diversity or independence will be made more effective.− 71 −
ISA-TR84. For example.02-2002 . software failures). the methodology must be applied to each of these subsystems separately.00. and d) in an increasing number of cases. also monitor sensors and/or actuators. whereas the sensors may be mounted outside on pipework that is exposed to the elements. the estimate of the probability of common cause failures derived by this methodology relates to only those failures associated with the hardware.
i.e. the fraction of single-channel failures that will affect both channels. i.Part 1
− 72 −
will increase the probability of the automatic diagnostics identifying the failure and putting the plant into a safe state.5 Using β to calculate the failure rate of a system
Consider the effect of common cause failures on a multi-channel system with automatic diagnostics running within each of its channels. Therefore. Clearly.e. respectively in Table A. it is assumed that the rate is independent of the number of affected channels.. the rate of dangerous common cause failures is (Eq. it is assumed that. Using the β-factor model. The overall failure rate due to Common Cause dangerous failures is then given by λ
(β) + λ
(β D). i. the tables associated with this β methodology have been based on engineering judgement.e. λ LEG is the overt failure rate of a single channel. such that the span of time between the first and all channels being affected is small compared to the time interval between Common cause failures. any software-based diagnostic routines should be developed using techniques appropriate to the target SIL. the rate of failures which lie outside the coverage of the diagnostics. Therefore. it will affect all channels.
A.. we can divide the failures into two: those that lie outside the coverage of the diagnostics (and so can never be detected) and those that lie within the coverage (so would eventually be detected by the diagnostics).. Diagnostic routines are sometimes not regarded as having a direct safety role so may not receive the same level of quality assurance as the routines providing the main control functions. if the repetition rate of the diagnostics is high. Therefore.. the features relating to immunity to common cause failures have been divided into those whose effect is thought would be increased by the use of automatic diagnostics and those whose effect would not.. We shall assume that Common cause failures affect all channels.1. A. a fraction of the failures will be revealed leading to a reduction in the value of β. the rate of failures of a single channel that lie within the coverage of the diagnostics. Therefore. There is no known data on hardware-related common cause failures available for the calibration of the methodology. λ LEG is the rate of dangerous random hardware failures for each individual leg or channel and β is the β-factor in the absence of diagnostics. Here. and. Suppose that there are diagnostics running in each channel. This leads to the two columns X and Y. βD.
λ LEG is the covert failure rate of a single channel. in order to simplify the methodology.e. a fraction C of the failures will be detected and revealed by the diagnostics.
. i.02-2002 .00. The methodology was developed on the presumption that the diagnostics have an integrity commensurate with the target SIL. Although the probability of common cause failures for “N” channels which will affect all “N” channels is likely to be slightly lower than the probability of affecting “N-1” channels.ISA-TR84. i.1)
λDLEG (β)
Here. if a common cause failure occurs. any reduction in the β-factor resulting from the repetition rate of the diagnostics cannot affect this fraction of the failures.e.
using a score. in the column labeled Y. one must first establish which measures will lead to an efficient defense against their occurrence. SD = X(Z + 1) + Y. Because sensors and actuators must be treated differently to the programmable electronics. two sets of values are incorporated into the tables. The other.− 73 −
ISA-TR84.6).4. Here S or SD is a score which is used in Table A. or XSA and YSA. taking into account the important note below Table A.4 to determine the appropriate β-factor. the sums being referred to as X and Y. Extensive diagnostics may be incorporated into programmable electronic systems which allow the detection of non-simultaneous common cause failures. βD is obtained from Table A.00.1 must ascertain which measures apply to the system in question and sum the corresponding values shown in each of columns XPE & YPE. The implementation of the appropriate measures in the system will lead to a reduction in the value of β used in estimating the failure rate due to common cause failures. in the column labeled X. Tables A.Part 1
β is obtained from Table A.
. and SD = X(1 + Z) + Y to obtain the value of β D (for detected failures). separate columns are used in Table A. for the sensors or actuators. the methodology uses tables which list the measures and contain an associated value representing the contribution of each.4. The user of Table A. In order to minimize the probability of occurrence of common cause failures. In order to take the contribution of each of these measures into account. Z.2. The score S is then calculated using the following equations. respectively.6 Using the tables to estimate β
β should be calculated for the sensors. To allow for these to be taken into account in the estimation of β. using a score.1 for scoring the programmable electronics and the sensors or actuators. for the programmable electronics. the programmable electronics and the actuators separately.02-2002 . as appropriate (see previous section): S = X + Y to obtain the value of β (for undetected failures). One of these sets of values. is thought to lead to an improvement when automatic diagnostics are in operation. S = X + Y (see Section A.
A.1 and A.2 may be used to determine a factor from the frequency and coverage of the diagnostics. corresponds to those measures whose contribution will not be improved by the use of automatic diagnostics.
0 0.5 1.0 1.0
0.g.0 1.0 2.0 7.5 3. is the electronics for each channel on separate printed-circuit boards? If the sensors/actuators have dedicated control electronics.g.0 3.5 2. e.02-2002 .5 1. hardware watchdog same technology Is partial diversity used.1  Scoring progra mmable electronics or sensors/actuators
Item Separation/segregation: Are all signal cables for the channels routed separately at all positions? Are the PE channels on separate printed-circuit boards? Are the PE channels in separate cabinets? If the sensors/actuators have dedicated control electronics.0 0.0 0.5 1.. e.5 0.5 2.00. hardware watchdog other technology Were the channels designed by different designers with no communication between them during the design process? Are separate test methods and people used for each channel during commissioning? Is maintenance on each channel carried out by different people at different times? Complexity/design/application/maturity/experience: Does cross-connection between channels preclude the exchange of any information other than that used for diagnostic or voting purposes? Is the design based on techniques used in equipment that has been used successfully in the field for > 5 years? Is there more than 5 years experience with the same hardware used in similar environments? Is the system simple.5 1.0 2.5 2.5
Are inputs and outputs protected from potential levels of over-voltage and over-current? Are all devices/components conservatively rated? (e. e.0 1.0 0. no more than 10 inputs or outputs per channel? 0.0 0. etc.0
0.5 1. different manufacturer (not rebadged) or different technology Do the channels employ enhanced redundancy: e..0 1.Part 1
− 74 −
Table A. MooN N=M+2 Is partial diversity used.g.5 1. is the electronics for each channel indoors and in separate cabinets? Diversity/Redundancy: Do the channels employ different electrical technologies? e.g.0 1. MooN N>M+2 Do the channels employ enhanced redundancy: e.0 1. pressure and temperature..5 1.g.5 5.5 2..0 XPE YPE XSA YSA
1. one electronic or PE and the other relay Do the channels employ different electronic technologies? e.5 1.ISA-TR84.5 2.5 7..5 5. Do the devices employ different electrical principles/designs e.g.5 1.0 0.5 2.0
2.g.0 0.5
.0 1.5 1.g.g. the other PE Do the devices employ different physical principles for the sensing elements e.5 1.0 2..1 continued on next page
1.5 0.5 1.0 0. one electronic. by a factor of 2 or more) Table A.. digital and analogue.g. vane anemometer and Doppler transducer.5 1.0 1.5 2.5 0.
and.5 0. in addition to the manual checks carried out following maintenance.0 2. the automatic diagnostic checks are allowed to run satisfactorily between the completion of maintenance on one channel and the start of maintenance on another? Do the documented maintenance procedures specify that all parts of redundant systems (e. the root causes established and other similar items are inspected for similar potential causes of failure? Are procedures in place to ensure that: maintenance (including adjustment or calibration) of any part of the independent channels is staggered.0 3. inaccessible position)? Will the system be operating within the range of temperature.5 0.0 3.g. humidity. vibration.5 1. locked cabinets. etc.02-2002 .5 1. etc.0 4.5 1. carried out off-site at a qualified repair center and have all the repaired items gone through a full pre-installation testing? Do the system have low diagnostics coverage (60% to 90%) and report failures to the level of a field-replaceable module? Do the system have medium diagnostics coverage (90% to 99%) and report failures to the level of a field-replaceable module? Do the system have high diagnostics coverage (>99%) and report failures to the level of a field-replaceable module? Do the system diagnostics report failures to the level of a field-replaceable module? Competence/ training/ safety culture: Have designers been trained (with training record) to understand the causes and consequences of Common cause failures Have maintainers been trained (with training record) to understand the causes and consequences of Common cause failures Environmental control: Is personnel access limited (e.5
0.5 3.0 1.5
0. intended to be independent of each other.00.5 2.3. dust.0
1.50 1.5 YSA 1.0 0.5 1.0 3. etc..5 0.0 0.. shock.0
Continued from Table A.) Procedures/ human interface: Is there a written system of work which will ensure that all component failures (or degradations) are identified. temperature.5
0. over which it has been tested.0
0.). vibration.0 2.5 0. humidity) to an appropriate level as defined in recognized standards? 10.5 1.5 1. must not be relocated? Is all maintenance of printed-circuit boards.5 2.5 XSA 0.0 0.− 75 −
ISA-TR84.0
2.0 4.5 3. without the use of external environmental control? Are all signal and power cables separate at all positions? Environmental testing: Has a system been tested for immunity to all relevant environmental influences (e.0
See applicable notes after Table A.0
1.5 3. corrosion.) Are all field failures fully analyzed with feedback into the design? (Documentary evidence of the procedure is required.1 on previous page Assessment/analysis and feedback of data: Have the results of the FMEA or FTA been examined to establish sources of CCF and have identified sources of CCF been eliminated by design? Were CCFs addressed in design reviews with the results fed back into the design? (Documentary evidence of the design review process is required.0 10.0 2.g.g.5 0.0
2. EMC.
0.0 1.5 3.0 3.5
1.5 XPE 3.0 10.0 10.5 3. cables.5 YPE 1.
5 0 Greater than 1 week 0 0 0
Notes to Tables A.3.0 0.00.1.ISA-TR84. take account of the scores for all items that apply .
Table A.0 0.3 NOTE 1 If sensors or actuators are PE-based.0 Between 2 hours & 2 days 1.0 Between 1 and 5 mins 1. If a safe shut-down is not initiated after a first fault then the following requirements will apply: • • The diagnostics shall determine the locality of the fault and be capable of localizing the fault.02-2002 ." NOTE 3 For a non-zero value of Z to be used. or.0 1.1.Part 1
− 76 −
Table A.2  Level of diagno stics: Programmable electronics
Level of coverage of the automatic diagnostics Value of Z to be used when the automatic diagnostic tests are repeated at intervals of: Less than 1 minute > 99% > 90% > 60% 2.2 & A. if they are not. See applicable notes after Table A.5 1.
Only if the above criteria apply. they should be treated as PE if they are enclosed within the same building (or vehicle) as the PE that is used as the logic solver. For example. A non-zero value for Z can be used only if: • the system initiates an automatic shut-down on the identification of a fault. can be assured before a non-simultaneous common cause failure would prevent a safe shut-down being implemented. a system with PE channels in separate racks is entitled to both the score for "Are the PE channels in separate cabinets" and that for "Are the PE channels on separate printed-circuit boards.5 Between 2 days & 1 week 1. The time taken to assure this safe state must be less than the claimed repetition time of the automatic diagnostics.5 1.the scoring has been designed to allow for items which are not mutually exclusive. and as sensors/actuators. initiated by the diagnostics on the detection of a fault. A.0 0.
. The diagnostic tests shall continue to be capable of placing the process in the safe state after the detection of any subsequent faults.5 0 Greater than 5 minutes 0 0 0
NOTE Diagnostic tests are effective against common cause failures only if an automatic shut-down.5 1. NOTE 2 When using Table A. it must be ensured that the equipment under control is put into a safe state before a non-simultaneous Common cause failure can affect the all channels. can a non-zero value be used for Z.3  Level of diagno stics: Sensors or actuators
Level of coverage of the automatic diagnostics Value of Z to be used when the automatic diagnostic tests are repeated at intervals of: Less than 2 hours > 99% > 90% > 60% 2.0 1.
4  Calculation of β or β D
Corresponding value of β or β for the:
PES 0. some simple examples (Table A. reduces to one. following a fault.
A. If this is not done. In some industries.00. that are capable of ensuring a safe shut-down. NOTE 6 Where diagnostics are carried out in a modular way.2.2 or A. a non-zero value of Z may be used.3. The diagnostic coverage is the total coverage provided by all of the modules. reflecting the use of the techniques described elsewhere in this technical report for the reduction in the probability of systematic failures as a whole.2 or A. However.
NOTE 4 The operation of the system on the identification of a fault must be taken into account. a simple 2oo3 system must be shutdown (or be repaired) within the times quoted in Tables A. the plant will be immediately shut-down. For example. NOTE 5 In the process industries. the repetition time used in Tables A. a formal system of work is in place to ensure that the cause of any revealed fault will be fully investigated within the claimed period between the automatic diagnostic tests and: • • if the fault has the potential for leading to a common cause failure. and which will automatically shutdown on the occurrence of a second failure.Part 1
the system continues to run on a reduced number of channels and. following the identification of a single failure.7 Examples of the use of the methodology
In order to demonstrate the effect of using the methodology.− 77 −
ISA-TR84. a shutdown may be feasible within the specified time. if a shutdown is not implemented. Values of βD lower than 0. automatic shut-down will be assured immediately that the number of operating channels.5% for the PES and 1% for the sensors would be difficult to justify. This methodology should not be interpreted as a requirement for process plants to be shutdown when such faults are detected. no reduction in the βfactor can be gained by the use of automatic diagnostics for the programmable electronics. or. it is unlikely to be feasible to shutdown the EUC when a fault is detected within the repetition period for the automatic diagnostics as specified in Table A. In these cases. These are: Example 1: A diverse system with good diagnostics Example 2: A diverse system with poor diagnostics
.3 is the time between the successive completions of the full set of diagnostic modules.5% 1% 2% 5%
NOTE The maximum levels of β D shown in this table are lower than would normally be used. the faulty channel will be repaired within the claimed period between the automatic diagnostic tests. has an increased probability of revealing the fault in the second channel and so a non-zero value for Z may be claimed. A system which automatically reconfigures itself to 1oo2 voting when one channel fails.5) have been worked through for the Programmable Electronics. a failure of a second channel could result in the two failed channels outvoting the remaining (good) channel.02-2002 . and of Common cause failures as a result of this. or.
50 7.00 1.25 56..25 24.25 7.5 1% Example 4 3.75 2.50 7.5  Examples
Category Separation/segregation X Y Diversity/redundancy X Y Complexity/design/..75 3.25 42 5% 42 5%
.00 1.Part 1
− 78 −
Example 3: A redundancy system with good diagnostics Example 4: A redundancy system with poor diagnostics For categories not relating to diagnostics nor diversity..25 7.25 7.00 32.50 14.25 0.50 1.5 2% 56. half the maximum score for a category was used. no such subdivision of scores is allowed.25 3.75 2.75 2. X Y Environmental control X Y Environmental test X Y Level of diagnostics Total X Total Y Score S β Score SD βD Z Example 1 3.50 1.75 3.50 3.50 1.50 3.25 3.75 2.75 2.00 1.50 2.00 2.50 7.1 is used in practice. X Y Assessment/analysis.75 2.50 0.75 22.5 2% Example 3 3.00 32.25 4.25 0..75 22..25 0.25 24.25 4.02-2002 .00 1.50 1. X Y Procedures/human interface X Y Competence/training/.75 2.00 2.5 2% 121 0.75 2.5% Example 2 3.75 2.75 3..75 2.50 3.50 7.25 42 5% 81.50 2..50 14. It should be noted that when Table A. this being the same for each of the examples.50 2.00.00 2.75 2.25 56.50 0.00 2.00 1.25 3.50 3.00 1.50 3.00 19.75 2.00 19.25 7..50 3.75 3..ISA-TR84.25 0.50 2.25 4.25 4.25 3.
4 Fault models
Each fault included in the test should simulate a potential real-world fault in an on-line SIS. or have served as an apprentice to a qualified person for two previous fault simulation test programs.1 Objective
Fault simulation testing is a verification method to determine the safety integrity and diagnostic coverage of the SIS by purposely introducing faults that simulate those that could occur in an on-line SIS.02-2002 . under specified environmental conditions. and the ability of the SIS to correctly detect.1. The fault model is determined by identifying the failure modes and mechanisms for each type of component.
. Estimate the diagnostic coverage of the SIS from the test results. Simulate only single faults unless this fault is covert.3 Qualification of test personnel
“Qualified personnel” performing the fault simulation test are those persons who have previously performed a fault simulation test program.2 Scope
This test procedure applies to SIS elements in the process industries. in which case a second fault may be simulated. Determine the fault simulation test success/failure criteria based on the failure mode of the SIS.
B.00. diagnose and annunciate the fault. Perform fault simulation testing of the SIS elements by independent third parties.Part 1
Annex B (informative)  Fault s imulation test procedure B.
B. Some examples of fault models are found in Table B.
B. A fault model is to be developed for each type of component used in the SIS.− 79 −
− 80 −
.1  Fault model exa mples
Component Resistor Open Short Drift Capacitor Open Short Leakage Relay Open Contact Shorted Contact High Contact Resistance Open Coil Closed Coil Connectors Open Short Integrated Circuits Open of pins Short of pins Stuck at “0” of all pins Stuck at “1” of all pins Directed shorts between pins Functional failures Corrosion Misalignment Failure Mode Fault Mechanism
B. Every address line used for memory-mapped input/output. or to decode external logic. shall be faulted. b) Address lines Several address lines of each and every address bus in the SIS shall be faulted.ISA-TR84.02-2002 . Fault each CPU interrupt.5.5 Fault simulation tests
B.00.1 Required faults
The following fault simulations are required to be performed in each fault simulation test program: a) Data lines Fault several data lines of each and every data bus in the SIS. c) Control lines Fault every control line of each and every control bus.
h) Input/output voting logic Fault each and every independent channel of a typical voting scheme for each type of input and output. g) Memory Simulate several single bit memory errors for each memory device type.Part 1
d) Error detection circuitry (e.5. f) Bus arbitration logic Fault the bus arbitration logic in such a way as to attempt to allow simultaneous access to the bus. f) Selection logic Fault any logic which selects or decodes among a number of channels in such a way as to attempt to select the wrong channel.
. If this condition is not covered. Utilize a photographic flash for SIS which use EPROM’s to simulate a temporary change in memory contents. then introduce a second fault simulating an error. e) Watchdog circuit Fault each watchdog circuit (internal or external to the SIS) in such a way as to attempt to disable the time-out function. e) Power fail Detection Vary the input and output of power supplies to ensure that the SIS operates properly both inside and outside the specified voltage limits.g.02-2002 .2 Randomly selected faults
Select additional faults at random so that the total number of tests allows a statistically significant determination of the diagnostic coverage. B.− 81 −
ISA-TR84. and to allow no access to the bus. parity) Fault each error detection circuit in such a way as to attempt to disable error detection. g) Communications misaddressing Fault serial or parallel type communications in such a way as to attempt to select more than one subsystem.00.
. assumptions. and cautions associated with these packages are presented below. disadvantages.
C.3 The packages are often easy to use.2 Advantages
C. redundancy.2. the user may be confused by the results obtained.4.2 The user must be aware of and assume the responsibility for the sufficiency and applicability of the modeling technique.00. C. Without this understanding.Part 1
Annex C (informative)  SIL qu a ntification of SIS – Advisory software packages C.
C. The relevant information may not be readily apparent to the user or well documented by the supplier. the most complex techniques are not very practical without some type of computer assistance.2 These packages may not have been verified for accuracy by the supplier or by a third party. C.
C.3.3 Disadvantages
C. Some of the advantages. C. and the supplier validation activities before using one of these software packages for calculation of the SIL of a SIS.− 83 −
ISA-TR84. and limitations used in the package. etc).2.4.02-2002 .1 Advisory software
Advisory software packages may be used to assist in the types of calculation presented in this technical report.3. the assumptions. the limitations. C. This capability allows comparison of a number of test cases to illustrate the relative effect of varying individual input parameters (functional test interval.1 The user must make some effort to understand the modeling technique.1 Some of the advisory software packages are so easy to use and contain enough hidden assumptions that a user with insufficient skill may calculate an incorrect SIL for a SIS.2.2 These packages make the more complex calculations less prone to random calculation errors than hand calculations.4 Cautions
C. In addition. The user must be aware that the ease of use does not dictate the skill required to perform these calculations.1 Advisory software packages generally speed the quantification and presentation of specific cases of interest.
The standard reference for this method is US MIL-STD-1629 [MIL1629] which describes the Failure Mode and Effect Analysis (FMEA).
D. quantitative or as a combination of both and is very effective in identifying critical failures of the system in consideration.Part 1
Annex D (informative)  Failur e mode effect. A FMEHCrA can be described as a systematic way
to identify and evaluate the different failure modes and effects of the system in consideration. Very often the FMEHCrA technique is adjusted to the company strategy or ideas about this technique. hazard and criticality analysis D. safe undetected. A FMEDA (Failure Mode Effect and Diagnostic Analysis) is a FMEA variation.1. to document the system in consideration. The following will explain the different columns of the worksheet. Hazard and Criticality Analysis (FMEHCrA) is a widely used and effective safety analysis technique.
As part of the safety analysis process.1 Introduction
The Failure Mode Effect. but the first formal applications of the FMEHCrA can be found in the mid-1960 in the American aerospace industry. At the system level a FMEA is used to document system behavior under failure conditions. It combines standard FMEA techniques with extensions to identify on-line diagnostic techniques.
. 1) Failure Mode and Effect Analysis 2) Fault Hazard Analysis 3) Criticality analysis FMEHCrA is a bottom up technique that is used qualitative.02-2002 . to determine the actions to be taken which could eliminate or reduce the chance of the different failure modes occurring. It is a technique recommended to generate failure rates for each important category (safe detected.00.2 Failure mode and effect analysis
The information needed for a FMEA is typically stored in a worksheet.
This column describes the name of the component in consideration (definition of module/component). The FMEHCrA consists of three different analysis techniques. dangerous detected. Engineers have always performed a FMEA type of analysis on their design and manufacturing processes. the FMEA technique is used for two purposes. The first nine columns of the worksheet represent the Failure Mode and Effect Analysis.− 85 −
ISA-TR84. see Table D. dangerous undetected) in the safety models. A variation of the FMEA technique is recommended at the electronic module level to establish diagnostic capability and failure rates for each failure mode.
leakage. This gives a good insight in how the system works. change the design. A number between 0 and 1 may be entered to indicate the probability of detection. misuse.
This column describes the function of the component. better education of employees. wear out. overload.ISA-TR84.
This column describes the effect of the failure on function level of the component.02-2002 . For example.
This column describes the cause of the failure mode of column four. etc.
.3 Failure mode effect and diagnostic analysis
The following additional columns are added to a FMEA to analyze the diagnostic capability of the equipment. etc. For example the action to be taken to prevent a failure mode like this.
Column 8 Failure rate λ
In this column the failure rate of the current failure mode is given. It is an easy way to get a good understanding of how the different components work and how eventually the system works.
This column is reserved for any comment that is of importance.
Column 7 Failure effect on next sub level. The number must be in the range of 0 to 1. usually in failures per unit time. The component failure mode is simulated on actual E/E/PES equipment and the diagnostic capability of the E/E/PES is verified. Criticality
This column describes the effect of the failure one level higher than in column six. fracture. If no failure rates are available it is possible to use the information of standards or databases. Depending on the complexity of the system it is possible to consider more levels. aging. condition monitoring.Part 1
This column describes the code number or reference of the component. For example. this may be verified with a fault simulation test in some cases (see Annex B).
NOTE Whenever a component failure mode is claimed detectable.
This column describes the failure modes of the component. etc.00. This is important for anybody who writes or reads the document to understand the way in which the system works.
This column is an extension to the standard for the purpose of identifying that this component failure is detectable by on-line diagnostics. fail open or close for valves.
This column is used to numerically identify failure mode.
This column contains the calculated failure rate of safe detected failures.02-2002 .00.− 87 −
ISA-TR84. A "1" is entered for safe failure modes.
This column contains the calculated failure rate of safe undetected failures.
This column contains the calculated failure rate of dangerous undetected failures.1 is an example of a FMEDA applied to an input circuit for a PES.
Table D. It is obtained by multiplying the failure rate (Column 8) by the failure mode number (Column 12) and the detectability (Column 10). It is obtained by multiplying the failure rate (Column 8) by one minus the failure mode number (Column 12) and one minus the detectability (Column 10).Part 1
This column is an extension to the standard used to identify the diagnostic used to detect the failure. It is obtained by multiplying the failure rate (Column 8) by the failure mode number (Column 12) and one minus the detectability (Column 10). The number is used in spreadsheets to calculate the various failure categories. A "0" is entered for dangerous failure modes.
mismatch 0 0 0 0. mismatch 1 0.ISA-TR84. mismatch 1 1.8 32.95 comp.95 comp.0% 6.3 0.00625 0.25 1.2 30.4 Conclusions FMEHCrA analysis
The FMEHCrA is a bottom-up procedure.5 0 0 9.95 comp. mismatch 0 0 0 0. Some remarks on the FMEHCrA analysis:
Omission of important failure modes is always possible (for example omission of possible human failure causes) and leads to a totally unreliable FMEHCrA.4 0. mismatch 1 26.5 0 0 0.125 0.9 0.0 82.7 0.9 0.75 0.5 0. Diagnostics Mod SD SU 0 1 0 0.00625 0.5 0 0 0.125 0.95 comp.025 0 0.5 5 5 120.11875 0.475 0 0.95 loose input pulse 1 1.125 0.4 0. Operational and maintenance failures are likely to be missed unless the team of reviewers is skilled in human reliability analysis The technique can best be used to find that small failures that may not seem important at first but that eventually.02-2002 .9 0.125 0.1 0.75 30.95 loose input pulse 1 4.95 0 0 82.25 0.95 comp.5 0.025 0. The FMEHCrA technique is poor at identifying combinations of failures that cause critical problems. mismatch 0 0 0 0 1 0 0. More important it can lead to misleading results due to the human selection and interpretation of failure modes and their consequences.5 0 0 0.95 comp.Part 1
− 88 −
Table D.95 comp. but only a comparison of the effects of different failure modes within one system or a comparison between systems. mismatch 1 26.00625 0 1 0 0.11875 0.5 2 5 2 5 28 10 6 28 10 6 0.2
15 DD 0 0 0 0 0 0 0 0 0 9.95 comp. combinations are not addressed. mismatch 0 0 0 0. mismatch 1 5.125 0. mismatch 0 0 0 0.95 comp.3 0 1 0 0. The FMEHCrA cannot give an accurate quantification of the safety of a system.95 comp. Common cause failures are not taken into account.025 0 0. mismatch 1 5.5 0.5 2 0. can lead to critical system failures.6 1.475 0 0.6
D.025 0 0.
. mismatch 1 1.4 1. starting from failures at component or subsystem level and evaluating their consequences on system level.95 loose input pulse 1 0.95 comp.475 0 0.95 comp.475 0 0 0 0 4.8 121 88.6 1. mismatch 1 0.125 0.4
16 DU 0 0 0 0 0 0 0 0 0 0.7 0.125 0.025 0 0 0 0 0.5 0.0% 95.1 0 1 0 0.5 2 0. I short open D1 4200-7 Drop volts short open D2 4200-7 Drop volts short open OC1 4805-25 Isolate led dim tran. The primary objectives of the analysis are to document system operation at the system level and to determine failure modes and coverage factors at the module level. The FMEHCrA approach is recommended primarily as a qualitative method at the system level.5 0.00.6 Safe Coverage Dangerous Coverage Failures/billion hours = 10 failures / hour 10 11 12 13 14 Det.5 0.25 0.5 93.95 comp.1  Example FMED A table
Failure Modes and Effects Analysis 1 2 3 4 Name Code Function Mode R1-10K 4555-10 Input short Threshold open R2-100K 4555-100 Min.5 0.95 comp.25 0.125 0.5 6. Each component is reviewed individually.1 0 1 0 0.95 loose input pulse 1 1.75 4.95 loose input pulse 1 4.9 0.475 0.95 loose input pulse 1 0. open OC2 4805-25 Isolate led dim short open R3-100K 4555-100 Filter short open R4-10K 4555-10 short open R5-100K 4555-100 Filter short open R6-10K 4555-10 short open C1 4350-32 Filter short open C2 4350-32 Filter short open IC1 4017BT Buffer short open Total Total Failure Rate Total Safe Failure Rate Total Dangerous Failure Rate Safe Detected Failure Rate Safe Undetected Failure Rate Dangerous Detected Failure Rate Dangerous Undetected Failure Rate 5 Cause 6 Effect Threshold shift open circuit short circuit Threshold shift overvoltage open circuit overvoltage open circuit no light read logic 1 read logic 0 no light read logic 1 read logic 0 loose filter input float high read logic 0 read logic 1 loose filter input float high read logic 0 read logic 1 read logic 0 loose filter read logic 0 loose filter cross talk read logic 0 7 Criticallity Safe Safe Safe Safe Safe Safe Safe Safe Safe Dangerous Safe Safe Dangerous Safe Safe Dangerous Safe Dangerous Safe Dangerous Safe Dangerous Safe Safe Safe Safe Dangerous Safe 8 9 λ Remarks 0.11875 0.95 0 0 0. mismatch 0 0 0 0.75 0.125 0.1 0. short tran.
02-2002 .− 89 −
The outputs of the FMEHCrA and FMEDA can be very well used as input values for extended techniques like Markov. FTA and RBD to make an accurate qualitative analysis on system level.
plugging and erosion
.g. incorrect procedures or procedures not followed Maintenance.00.02-2002 . incorrect procedures or procedures not followed Management of change Improper bypassing
Vibration Uninhibited monomer Solids...00. and 5.02-2002 .. the following:
Installation Operation. and/or poor operation/ maintenance practices. These common cause failures and systematic failures can include. common cause failure. e.Part 1
Annex E (informative)  Comm on cause failures and systematic failure checklist
This includes a checklist of common cause failure and systematic failure events that may be modeled during SIS evaluation using the techniques described in ISA-TR84.g.Parts 2.− 91 −
ISA-TR84. e. poor design practices. Note that common cause failures and systematic failures can be due to a single failure event or to a combination of systematic failure.g. 3. but are not limited to. 4. e.
) installed. Rather. industry and that have played a critical part in the PFD or real systems Some specific examples of common cause failures and systematic failures are as follows:
Process chemistry disables safety function of final element (valve plugs or valve corroded). Wrong specification device (transmitter.ISA-TR84.
Dirt daubers – other common names: mud dauber or mud wasp. etc.00. solenoid valve. shutdown valve.Part 1
RFI/ESD Temperature Freezing. technician makes a mistake). bad calibration standard. and Black and white mud dauber (Sceliphron caementarium). Blue mud dauber (Chalybion californicum). Solenoid vent port is plugged by dirt daubers or plugged by insulation AND is not detected by testing.02-2002 . it is a partial list of common cause failures and systematic failures that have been observed by (11. Transmitter calibrated incorrectly (wrong specification. Poor communication of the safety requirements specification (SRS) to SIS designer and installer. 35) . User application logic errors. failed heat tracing Humidity Corrosion Flood susceptibility Seismic susceptibility
This list is not an exhaustive catalogue of the potential common cause failures and systematic failures. Valve leaks due to corrosion AND this leak is not detected by mechanical integrity inspection. icing. Solenoid valve fails due to incorrect installation AND this is not detected by testing.
. there are three types (scientific names): Organ pipe mud dauber (Trypoxylon politum). 34.
66. 51. 10. 36 9. 20. 85. 72 9. 55. 87. 90 11. 71. 86. 89. 40. 34. 54. 61 21 20. 73. 53. 78 46. 106 22 22. 84. 85. 55. 89. 105 22. 85. 55 20. 78 21 12 29 105 86. 82. 90. 78. 95 105
. 86. 54. 34. 14. 65.00.02-2002 . 83. 82.− 93 −
ISA-TR84. 35. 86. 43. 69.Part 1
Annex F — Index
access accuracy actuator(s) actuator(s)s advisory software package(s) air alarm analog(s) anti-surge control application program(s) application software architecture architecture(s) assessment automatic availability Basic Process Control System(s) (BPCS) boundary(ies) BPCS bypassing cabinet(s) calculation(s) calibration(s) channel channel(s) checklist 88. 97 46. 44. 76. 83. 90 97 21. 60. 87. 84. 83. 61. 83. 89. 80. 87. 90 15. 79. 25 38 59. 88. 82. 95 15. 55. 78. 90 46. 83. 84. 79. 19. 23. 97 55.
83. 84. 83. 54. 41. 71 27 31 88. 85. 31 21 22 9. 40. 66. 57. 84. 85. 90. 84. 61. 81. 18. 106 15 10. 18. 53. 58. 58. 15. 87. 44. 47. 73. 90. 86. 97 24. 102 66. 89. 45. 106
. 78. 84. 93. 59. 89. 82. 24. 16. 102 18. 85. 79. 72. 68 33 22. 79. 93 99. 106 22. 83. 82. 61. 27. 60. 102. 27.Part 1
− 94 −
common cause11. 46. 106 14. 16. 106 common cause failure(s) common cause fault(s) common field instrumentation communication communication(s) complex component compressor(s) configuration configuration(s) configuring consequence(s) conservative continuous control system corrosion cost coverage coverage factor covert covert failure(s) covert fault(s) criteria critical 15. 81. 47. 105. 58. 53. 11. 24. 15. 105. 103.02-2002 . 95. 78. 89.ISA-TR84. 47. 66. 95. 49. 24. 90. 24 67. 19. 54. 46. 46. 22. 60. 41. 58. 53. 93 84 18 89. 102 41. 41. 81. 16.00. 87. 79. 22. 76 38 24. 16. 60.
33. 95. 65. 60. 53. 93. 15 9. 34 61 59. 47. 66. 41. 61. 42.02-2002 . 58. 16. 89. 90. 35. 65 22. 11. 100. 58. 86. 53. 86 106 55 34. 16. 82. 66. 58. 83. 65 51. 89. 26. 44. 101 25 15. 100 34. 95. 100 46. 18. 61. 46. 79. 60. 105 9. 18. 56 11. 18. 41. 37 10. 51. 95 82
diagnostic(s)10. 85. 93. 90. 58. 41 51. 73. 91 34 38
. 78. 41 85. 24. 84. 53. 87. 101 diagram differences digital dirt display(s) diverse diverse redundancy diverse separation 14. 38. 24. 53. 31. 92. 60.Part 1
81. 101 31. 99. 15.00. 91.− 95 −
ISA-TR84. 106 101 101 24. 15. 46. 58. 47. 55.
26. 14. 58. 55. 55. Hazard and Criticality Analysis (FMEHCrA) failure mode(s) failure rate failure rate data
10. 68. 35. 46. 66. 54.ISA-TR84.02-2002 . 40. 97. 59. 101. 11. 66
failure rate(s)15. 45. 84.00. 26. 14. 55 99 99 18. 47 39. 48. 15. 95. 71. 99. 12. 29. 12. 100. 102 38.Part 1
− 96 −
diversity document(s) documentation documents E/E/PE electrical fault electromechanical electromechanical relay Electronic (/E) embedded software Emergency Shutdown System environment equipment under control error errors external risk reduction facilities fail-to-function Failure Mode and Effect Analysis (FMEA) Failure Mode Effect. 86. 49. 91 9. 82. 90 40 49. 102 24. 106 35 26. 93. 51. 38 29. 78. 36 15. 72. 99. 100. 18. 60. 47. 40 11. 22. 39. 40 99
. 56. 61. 39. 99. 39 35 27. 69. 100. 34. 57. 40 24. 15. 100. 101 false false shutdown fault fault hazard analysis 15. 58. 26. 102 35 39 24 24 24 26. 53. 81. 58. 50. 99. 65. 15. 46. 62. 83. 78. 66. 70.
40. 54. 41. 53. 24. 94. 49. 95. 60. 48. 56. 95. 44. 15. 14. 55.− 97 −
ISA-TR84. 14. 53. 50. 24. 56. 10. 22. 44. 38. 83. 53. 60. 83. 100. 36 26 22. 61 26
. 61. 61. 18. 45. 106 38 34 38 9. 36. 55. 45. 61 26 31 33 35. 14. 51. 47. 41. 27. 100. 24. 82. 66. 12. 34. 55. 45. 79. 29. 16. 22. 22.00. 41. 31. 93. 29. 106 functional safety functional safety assessment functional safety audit functional test interval functional test(s) functional testing functional unit 26. 11. 54. 54. 34. 49. 37 27 27 18. 53. 78. 26. 78.Part 1
45. 38. 101 65. 54. 33. 85 21 38
11. 106
function(s)9. 44. 36. 26. 16. 83. 53. 50. 53. 55.02-2002 . 12. 47. 18. 65. 82. 38. 97 18. 35 11. 26. 97 33. 72. 52. 73 14. 60. 55. 73 87 10.
78 27. 28
. 33. 106 21. 49. 81. 26. 22. 86. 39 39 39 27 19 9. 38 9. 38.00.Part 1
− 98 −
38. 56. 11. 90. 39 27. 88 34. 24 27 21 79 22 49 56.ISA-TR84. 29. 27. 41. 31. 93. 79 34 38 15. 34. 55. 10. 82. 24 15. 33. 78. 33 9. 39. 87 39 36 26 27. 84. 14. 28. 34 27. 99.02-2002 . 15. 27 15.
47. 29 38 9. 66. 59. 84. 79.02-2002 . 26. 29. 79.− 99 −
ISA-TR84. 14. 105 87 22 31 30. 44. 106 106 22.00. 87. 43. 10.Part 1
38. 26. 55. 87. 15. 49. 95 100 11 37 38 29 24 11. 89 22. 72. 14. 45. 29. 103. 24. 106 14. 87. 15. 40. 53. 44. 16. 56. 60. 85
. 56. 73 73 31 34 37 11. 49. 82. 48. 56. 29. 46. 53. 86 10. 55. 38. 22. 11. 26. 61. 91 20. 106 11. 59. 22. 66. 71 9. 16. 28. 82. 48. 91 22. 28. 86. 15. 53. 41. 55. 60. 81. 73. 78. 78. 54.
95 24 33 11. 54. 97 56 15. 26 16. 25. 42. 60 41. 70. 99. 47. 94. 66. 54. 23. 50. 54. 29. 40 34 15. 26 29
output(s) [See input/output devices and input/output modules]22. 102 15. 65. 15. 42. 101. 52. 52. 69. 47. 31. 51. 45. 18. 39. 15. 28.02-2002 . 25 9. 103 overload 100
. 46. 53. 43. 87. 18.00. 99. 66 55 22. 34. 22. 101 100 30. 18. 57. 40. 53. 65. 43. 45. 62. 46. 93.ISA-TR84. 102 43. 48. 79. 73. 49.Part 1
− 100 −
87 26. 47. 72. 61. 68. 106 23. 95. 71. 100. 44. 60. 56 100 24 24 10 100. 93. 78. 16.
18. 53. 51. 83. 88. 81. 85. 50. 41. 91. 11. 56. 52. 93 20. 86 54 25. 42. 90. 43. 39 10 31 54. 94 29.− 101 −
ISA-TR84. 53. 57. 33. 79. 90 31.02-2002 . 32 106 55 55 23. 45. 55. 16. 55. 10. 44. 45. 44. 45. 86 38 33 31. 56. 50. 15.Part 1
24. 63. 95 56 42. 53. 44. 34. 48. 52. 15. 101
. 31. 69. 55. 84 9 9. 97 14. 33
Programmable Electronic System(s) (PES)10. 56. 71. 24. 51. 93. 90 31. 54. 25. 68. 48. 53 21 27 9. 43. 90. 43. 15.00. 55. 95 38. 70. 65. 28. 29. 55. 78. 82. 36. 61. 44. 53.
69. 54.02-2002 . 27
. 102.00. 53. 29. 52. 14. 73. 86. 33. 103 102 9. 99. 43. 51.Part 1
− 102 −
31. 103 22 16. 70. 18. 60. 33 31 24 55 55 27. 33 9. 71. 69. 33 27. 53. 72. 68. 35 9 34 11. 99. 69. 87 82 24 27. 36 9. 69. 14. 34. 83 81 15. 101 99. 26. 97 12. 14. 55. 56. 61. 68. 83. 100 24. 91. 10. 34. 10. 86 9. 18. 99 34. 70. 78. 66. 87 60 12. 73.ISA-TR84. 55. 81. 86.
− 103 −
− 104 −
− 105 −
− 106 −
24.00.02-2002 . 66 106 18. 95 20. 100. 55 100
. 40 55 39. 82. 55 40 97 33 70. 71. 82. 95 26. 95 40. 88 56. 43. 93 27 56. 95 43. 56. 41. 86.ISA-TR84. 86. 106 55. 90. 49.
and technical reports is one of ISA’s primary goals. ISA is an American National Standards Institute (ANSI) accredited organization. recommended practices. please write: ISA Attn: Standards Department 67 Alexander Drive P.O. NC 27709 ISBN: 1-55617-802-6
. chairmen and reviewers. ISA administers United States Technical Advisory Groups (USTAGs) and provides secretariat support for International Electrotechnical Commission (IEC) and International Organization for Standardization (ISO) committees that develop process measurement and control standards.Developing and promulgating sound consensus standards. To achieve this goal the Standards and Practices Department relies on the technical expertise and efforts of volunteer committee members. To obtain additional information on the Society’s standards program. Box 12277 Research Triangle Park.
Documents similar to SIF SIL part ISIL_SIFISA TR 84.00.03113761314-Sfety-Integrity-LevelSil Manual Gmi209217952 SIL Working Method ReportSIS Engineering HandbookInstrumentation and Control SystemsCookbook Versus Performance SIS Practices7499010121A (RJ 45 THRU-HOLE)Isa s84.01 Application of Safety Instrumented Systems for Process IndustriesSpecification SheetISA AlarmsESFR Sprinklers the Perfect Solution to Warehousing - UpdatedSafety Critical 08.01.29Valve OnLine TestISA Certified Automation Professional CAPFunctional Safety HandbookConstruction Fall ProtectionMarine - Alternative design & arrangements for fire safetyData Para El ManteimientoSafety F F-H Conf ProgrAMSSA RELIABILITY GROWTH1-s2.0-S2214398X13000022-main1-s2.0-S2214398X15000035-mainFunctional Safety for MachineryEquipment Reliability AnalysisSIL and ExidaConsumer Product SafetyISO26262 Product Development System LevelHse PrinciplesBooks similar to SIF SIL part IWoodhead Publishing Series in Electronic and Optical MaterialsSafety Essentials For Working At HeightAn Elementary Guide To ReliabilityFundamental Studies in EngineeringGas and Oil Reliability EngineeringChemical Process SafetyHandbook of Offshore Helicopter Transport SafetySpace Safety Regulations and StandardsEmbedded Mechatronic Systems, Volume 2A Campfire Girl's First Council Fire
The Camp Fire Girls In the WoodsPractical Machinery SafetyAngels with AttitudeThe Nuclear EnterpriseInternational Space Station (ISS)Laboratory ManagementEnvironmental and Health and Safety ManagementNuclear War Survival SkillsSecurity Electronics Circuits ManualHigh Tech TrashCoating Materials for Electronic ApplicationsPower Electronics Applied to Industrial Systems and Transports Volume 5Protect Your Business from OSHAPermanent EmergencyPower Electronics HandbookFacility Integrity ManagementFermilab Radiological Control Program ManualUnderstand ElectronicsTaking Medicines in PregnancyWoodhead Publishing Series in Food Science, Technology and NutritionBooks about ElectronicsI, JustineSimulation of Digital Communication Systems Using MatlabUnderstanding AudioC Programming for ArduinoThe Electrical Engineering HandbookA Level Physics MCQsProcess ControlAndroid Studio Development EssentialsHTML5 GamesElectrical Engineer's Reference BookBasic ElectronicsLTE-AdvancedProgramming Arduino with LabVIEWDigital Logic Design MCQsRaspberry Pi For DummiesIntroduction to Power ElectronicsEngineering Materials SciencePower Electronics HandbookiPhone Application Development For DummiesEPC and 4G Packet NetworksJava for AndroidPractical Electric Motor Handbook4GUnderstanding Automotive ElectronicsElectrical Engineering 101Build a Whatsapp Like App in 24 HoursPractical Electronics HandbookRevise for MRCP part 2 (written) in 5 daysCollege Physics MCQsAndroid Programming For BeginnersAudiobooks about ElectronicsVoices of Famous InventorsInsanely SimpleNinja InnovationThe Victorian InternetThe Ultimate History of Video GamesNature's Miracles Volume 3Appetite for Self-DestructionJony IveDogfightWizardChet Gecko, Private Eye Volume 2Perfect EnoughiWozHedy's FollyThe Mobile Mind ShiftRecordings on MP3 players and other portable devices (Written in March)George's Marvelous MedicineDocuments about ElectronicsSV150 doubletruck 0424162008 Lincoln MKZ Owners ManualiPhone lawsuitHarris CorporationKPCB Internet Trends 2012Ford SYNC With MyFord Touch HandbookTrucking ContractSNEAK PEEKMemorandum of UnderstandingKPCB Internet Trends (2011)Multiscreenworld FinalThe Radio JournalDRAFT NATIONAL ENCRYPTION POLICY Utility Scale Solar Power PlantsGlenview Q4 14Sean Parker 's Email to Spotify's Daniel EkMechatronics2016 Engineering Catalog Consulting ContractNon Disclosure Agreementcbs_sjSCRIBD LAUNCHES NEW TRAVEL E-BOOKS CATEGORY WITH LONELY PLANET PARTNERSHIPCompany Cell Phone PolicyBlackBerry Q10 keyboard shortcutsBeyond Privacy and SecurityBurr-Feinstein Encryption BillAir Force Recon HistoryCellular Communications Equipment v. Apple et. al.Samsung opening brief in Apple case at US Supreme CourtWWII Radar & Comm EquipmentBooks about Reliability EngineeringReliability, Maintainability and RiskMarine Structural DesignMaintenance FundamentalsReliability Centered MaintenanceRules of Thumb for Maintenance and Reliability EngineersBasic Reliability Engineering AnalysisManaging Risk and Reliability of Process PlantsAn Introduction to Predictive MaintenancePractical Industrial Safety, Risk Assessment and Shutdown SystemsForsthoffer's Best Practice Handbook for Rotating MachineryMechanical SealsFacility Integrity ManagementLubrication and Reliability HandbookFluid Catalytic Cracking Handbook2. Forsthoffer's Rotating Equipment HandbooksAdvances in Safety and ReliabilityProbabilistic Safety Assessment in the Chemical and Nuclear IndustriesThe Circuit Designer's CompanionReliability Prediction from Burn-In Data Fit to Reliability ModelsOffshore PipelinesAgile Systems EngineeringFitness-for-Service Fracture Assessment of Structures Containing CracksReliability and Failure of Electronic Materials and DevicesReliability Analysis of Dynamic SystemsApplication Specific Integrated Circuit (ASIC) TechnologyHuman ReliabilityLearning from FailuresPractical Guidance for Defining a Smart Grid Modernization StrategyDocuments about Reliability EngineeringBriefing Memo16th Street NW Transit Priority Planning Study, Final Report 2016WMATA Report by McKinsey & CompanyCurtiss D-12 Aero EngineTen Steps to a Results-Based Monitoring and Evaluation SystemDesigning Low Carbon Electricity Futures for African and Other Developing CountriesCloud Computing for LibrariesElaine Miller vs. ToyotaAircraft Powerplants ~ Volume 1Manitou Electric Aerial Work Platforms (EN)As NZS 1668.1-1998 the Use of Ventilation and Airconditioning in Buildings Fire and Smoke Control in Multi-coElection IntegrityArmy Aviation Digest - May 1975SAFC Supply Solutions - Proligo® Reagents CatalogPG&E CORP 10-K (Annual Reports) 2009-02-24Armalite AR-10 Rifle ManualAs 2118.1-2006 Automatic Fire Sprinkler Systems General SystemsDGA Energy White Paper The Apollo Spacecraft Volume 3 a ChronologyManitou MI 15 -> 35 (EN)Materials and Engineering CatalogTOPdesk Magazine March 2016Study into the business of sustaining Australia's strategic Collins Class submarine capabilityPSEG LIPA Resource Study2016 J.D. Power Dependability Study"Smart Grid" preview (ISBN 1587331624)SaturnProject Gemini - Extravehicular Life Support System ELSS Final Report, 30 Jan. 1964 - 31 Mar. 1967Financial Management Information SystemsPowering the Armed ForcesBooks about SafetyHAZOPPractical Power System ProtectionChemical Engineering DesignThe Safety Relief Valve HandbookHighway EngineeringHuman Resource Management (HRMS) MCQsElectrical Safety Code ManualOHSAS 18001 Step by StepSafety Critical Systems HandbookLees' Process Safety EssentialsMachinery Failure Analysis HandbookOccupational Safety and Health ManagementDeveloping The Internal Audit PlanWhat Went Wrong?Practical Guide to Occupational Health and SafetyRisk Analysis and the Security SurveyPractical Hazops, Trips and AlarmsRisk-Based Internal AuditElectrical Safety EngineeringFood Safety ManagementLees' Loss Prevention in the Process IndustriesHandbook of Fire and Explosion Protection Engineering PrinciplesPurification of Laboratory ChemicalsPractical Industrial Safety, Risk Assessment and Shutdown SystemsLaboratory ManagementSafety at WorkIndustrial Hazard and Safety HandbookAudiobooks about SafetyThe Healthy HomeLeaders Eat LastProtecting the GiftSafety Yells BackDot the Fire DogWin at Life - Stay SafeDocuments about SafetyUC San Francisco's Public Health Analysis of Proposed Marijuana LegalizationEmployee ManualHarris Letter & ResponseCode of EthicsAn Introduction to High-Potent API ClassificationChild-Friendly Schools ManualReport in BriefDay-to-Day Situation GuideFall 2008 DePauw MagazineHonest Company LawsuitTrustees Report and Accounts 2015Udall-Vitter Fact Sheet on Frank R. Lautenberg Chemical Safety for the 21st Century Act2015 Textbooks CatalogRuger 10/22 Rifle Instruction ManualBaylor Pepper Hamilton ReportInfection Prevention and ControlNu Skin Catalog 2012/2013Ferguson Police Department ReportApollo 8 Mission Operation ReportUtility Scale Solar Power PlantsHow to Speak Up for LifeCDC proposal on male circumcisionVoter ID Opinion 5th Circuit JulyAugust 2016As 3745-2010 Planning for Emergencies in FacilitiesBLM VisionAs NZS 3000-2007 Electrical Installations (Known as the Australian New Zealand Wiring Rules)Manitou Diesel Aerial Work Platforms (EN)