SPECIFICATION OF THE SAFETY FUNCTION 4
7
H250 M40
www.krohne.com04/2013 - 4000904202 MA H250 M40 SIL R02 en
Specification of the safety function
4.1 Description of the failure categories
In order to judge the failure behaviour of the variable area flowmeters H250 M40, the following
definitions for the failure of the flowmeter were considered:
H250 M40 with inductive limit switch output
H250 M40 with 4…20mA output
In IEC 61508 edition 1 the “No Effect”failures were defined as safe undetected failures, even
though they would not cause the safety function to go to a safe state.
With edition 2 (IEC 61508:2010) the no effect failures are no longer considered as safe
undetected failures and must not contribute to the SFF calculation. Therefore the SFF values
have changed.
The PFD values remain as before.
The demand response time of H250 M40 is < 2s.
Fail - Safe Failure that causes the subsystem to go to the defined fail-safe state
without a demand from process.
Fail Dangerous Undetected Failure that is dangerous and that is not being diagnosed by internal
diagnostics.
Fail Dangerous Detected Failure that is dangerous but is detected by internal diagnostics (These
failures may be converted to the selected fail-safe state)
Fail No Effect Failure of a component that is part of the safety function but is neither a
safe failure nor a dangerous failure and has no effect on the safety
function.
Not part Failures of a component which is not part of the safety function but part of
the circuit diagram and is listed for completeness. When calculating the
SFF this failure mode is not taken into account. It is also not part of the
total failure rate.
Fail-Safe State The fail-safe state is defined as the output beeing de-energized
Fail Dangerous Failure that does not respond to a demand from the process (i.e. being
unable to go to the defined fail-safe state)
Fail-Safe State The fail-safe state is defined as the output exceeding the user defined
threshold
Fail Dangerous Failure that does not respond to a demand from the process (i.e. being
unable to go to the defined fail-safe state) or that deviates the output
current by more than 2.5% of full span.
Fail High Failure that causes the output signal to go to the maximum output current
(>21mA) according NAMUR NE43.
Fail Low Failure that causes the output signal to go to the minimum output current
(< 3.6 mA) according NAMUR NE43.
MA_H250_M40_SIL2_R02_en_904202_PRT.book Page 7 Monday, April 29, 2013 8:31 AM
