D5231 - SIL 2 Switch/Proximity Detector Repeater, O.C. OutputG.M. International ISM0527-1 3
Failure category Failure rates (FIT)
λdd = Total Dangerous Detected failures 108.78
λdu = Total Dangerous Undetected failures 23.35
λsd = Total Safe Detected failures 0.00
λsu = Total Safe Undetected failures 131.48
λtot safe = Total Failure Rate (Safety Function) = λdd + λdu + λsd + λsu 263.61
MTBF (safety function, each channel) = (1 / λtot safe) + MTTR (8 hours) 433 years
λno effect = “No effect” failures 218.07
λnot part = “Not Part” failures 393.90
λtot device = Total Failure Rate (Device) = λtot safe + λno effect + λnot part 875.58
MTBF (device) = (1 / λtot device) + MTTR (8 hours) 130 years
λsd λsu λdd λdu DC
0.00 FIT 131.48 FIT 108.78 FIT 23.35 FIT 82.33%
SFF
91.14%
T[Proof] = 1 year T[Proof] = 9 years
PFDavg = 1.03 E-04 Valid for SIL 2 PFDavg = 9.30 E-04 Valid for SIL 2
PFDavg vs T[Proof] table (assuming Proof Test coverage of 99%), with determination of SIL supposing module contributes >10% of total SIF dangerous failures:
PFDavg vs T[Proof] table (assuming Proof Test coverage of 99%), with determination of SIL supposing module contributes ≤10% of total SIF dangerous failures:
Failure rates table according to IEC 61508:2010 Ed.2 :
Failure rate table:
Safety Function and Failure behavior:
D5231E is considered to be operating in Low Demand mode, as a Type B module, having Hardware Fault Tolerance (HFT) = 0.
For each channel, the failure behaviour is described from the following definitions :
□fail-Safe State: it is defined as the output transistor being de-energized or open;
□fail Safe: failure mode that causes the module / (sub)system to go to the defined Fail-Safe state without a demand from the process;
□fail Dangerous: failure mode that does not respond to a demand from the process (i.e. being unable to go to the defined Fail-Safe state), so that the output transistor remains
closed;
□fail Dangerous Detected: a dangerous failure which has been detected from module internal diagnostic so that output transistor is forced to be de-energized (that is to Fail-Safe
state), so that it goes open;
□fail “No Effect”: failure mode of a component that plays a part in implementing the Safety Function but that is neither a safe failure nor a dangerous failure.
When calculating the SFF, this failure mode is not taken into account.
□fail “Not part”: failure mode of a component which is not part of the Safety Function but is part of the circuit diagram and is listed for completeness.
When calculating the SFF this failure mode is not taken into account.
As the module has been evaluated in accordance with Route 2H (proven-in-use) of the IEC 61508:2010, Diagnostic Coverage DC ≥60% is required for Type B elements.
Being HFT = 0, in Low Demand mode the maximum achievable functional safety level is SIL 2.
Failure rate data: taken from Siemens Standard SN29500.
T[Proof] = 20 years
PFDavg = 2.07 E-03 Valid for SIL 2
where DC means the diagnostic coverage for the input sensor by module internal diagnostic circuits. This type “B” system, operating in Low Demand mode with HFT = 0,
has got DC = 82.33 % ≥60 % as required by Route 2H evaluation (proven-in-use) of the IEC 61508:2010.
Testing procedure at T-proof
The proof test shall be performed to reveal dangerous faults which are undetected by diagnostic.
This means that it is necessary to specify how dangerous undetected fault, which have been noted during the FMEDA, can be revealed during proof test.
Note for switch input: to detect a broken wire, or a short circuit condition, in the input connections it is necessary to mount, close to the switches, the end of line resistors:
R1=1 KΩtypical (470 Ωto 2 KΩrange) resistor in series and R2=10 kΩtypical (5 KΩto 15 KΩrange) resistor in parallel to the contacts.
The Proof test consists of the following steps:
Steps Action
1 Bypass the Safety PLC or take any other appropriate action to avoid a false trip.
2 Vary the state condition of the input switches/proximity detectors coming from field and verify that the related transistor outputs change from de-energized to
energized and vice versa; then, check that the de-energized state condition corresponds to the required Safety Function.
3 If input line fault detection is enabled for each channel by means of the configuration software, disconnect the input wiring coming from the field sensor/contact
and check that the corresponding transistor output is de-energized. Then, put in short circuit condition the input connections and verify that the same output
remains de-energized.
4 Restore the loop to full operation.
5 Remove the bypass from the Safety-related PLC or restore normal operation.
This test will reveal approximately 99 % of possible Dangerous Undetected failures in the switch/proximity repeater.
SC 3: Systematic capability SIL 3.
