硬件的设计-HW_Design

Part05HardwareDesign HeidiFuglumCertifiedFunctionalsafetyengineer 1dayintrotraininginFunctionalsafety Hardwaredesign InthismoduleHardwarelifecycleHardwareconceptArchitecturalconstraintsMeasurestocontrolandavoidfailuresReliabilityanalysis SafetyLifecycle wherearewe SILDetermination HazardIdentification Hardwaredesign OverallOperation Maintenance OverallModification Retrofit SafetyLifecycle wherearewe ImportantHardwareConcepts HardwaredesignisdeterminedbyEnergizevsde energizedRedundancyvsdiversitySubsystemsLowvshighvscontinousmodeTypeAorBcomponentsHardwarefaulttoleranceSafeFailureFractionArchitecturalconstraintsTheprobabilityoffailureondemand De energizedorEnergizedtoTrip WhatisthedifferenceAde energizedtotripsub systemdoesnotneedenergytoperformthesafetyfunctionExamplesFailsafeLogicsolverFailsafelogicsolverisalwaysthe0 ZerostateOnlyelectricalpowerwillresultin1stateSpringreturnactuatorEnergizedspringtoopenDe energizespringtocloseAnenergizedtotripneedenergytoperformitssafetyfunctionSpinklersystemPumps electricity waterFireandgassystemDetectionandalarmmanagement Reliability WhatisredundancyDefinitionTheuseofmultipleelementsorsystemstoachievethesame orpartofthe safetysystemHowcanredundancybeachievedBysamehardwareand orsoftwareBydiversityDoesnotnecessarilyhelpagainstcommoncausefailure Diversity WhatisDiversityDefinitionExistenceofdifferentmeanstoperformthesame orpartofthe safetyfunctionCanbeachievedbyDifferentphysicalmethodsDifferentdesignphilosophiesOnemeasureagainstcommoncausefailure butdoesnotnecessarilyhelpagainstallcommoncausefailures LowDemandvsHighDemand IEC61508defineslowandhighdemandmodeDemandfromtheprotectedprocessLessthanonedemandperyear lowEmergencyshutdownfunctionEmergencystopofatrainMorethanonedemandperyear highMachinerypresswithtwohandcontrol DemandvsContinuousMode IEC61511definesdemandandcontinuousmodeDemandmodeFailureofthesafetyfunctionhasnoimmediateeffectontheprocessTheprocessisindangeridThesafetyfunctionhasfailedAMDAdemandoccurContinuousmodeAfailureofthesafetyfunctionitselfhasanimmediateeffectontheprocessTheprocessisindangerbecausethesafetyfunctionhasfaileddangerous Subsystem SystemRequirements AsafetyfunctionconsistofsubsystemsEachsubsystemCanconsistofseveralcomponentsCanhaveinternalredundancy LogicSolver Sensors Actuators HardwareFaultTolerance HFT HardwareFaultToleranceofNmeansThatN 1faultscouldcausealossofthesafetyfunctionIsameasureofredundancyNeedtobedeterminedpersubsystemWeakestlinkwithinasubsystemdeterminesfaulttolerance Voting VotingisdefinedasThenumberofpaths N requiredoutofthetotalnumberofredundantpaths M onordertocarryourthesafetyfunctionOftenexpressedasNooMorXooYEx 1oo2 2oo3 HardwareFaultToleranceExample HardwareFaultToleranceExample SubsystemsFailureModes SafefailureTheSubsystemfailedsafeofitcarriesoutthesafetyfunctionwithoutademandoftheprocessDangerousfailureThesubsystemfaileddangerousifitcannotcarryoutitssafetyfunctionupondemandDetectedfailureAfailureisdetectedifbuild indiagnosticsrevealsthefailure RevealingFailures Failurescanberevealedinthreeways ThroughnormaloperationShutdownofapartoftheprocessduetoasafefailureofthesafetysystemUnwantedshutdown interruptionintheprocessThroughperiodicprooftestingIsinitiatedbyhumanaction notbuiltintheequipmentPartialstrokeinitiatedbyoperatorThroughbuilt indiagnosticTestifcarriedoutautomatically nohumaninteractions ANDTestiscarriedoutfrequentlyANDTestisusedtorevealfailuresthatcanpreventthesystemfromcarryingoutthesafetyfunctionANDThetestresultisautomaticallyacteduponwithanappropriateaction SafeFailureFraction TotalfailureSafefailure SSafeDetected SDSafeUndetected SUDangerousfailuresDangerousDetected DDDangerousUndetected DU IEC61508SafetyIntegrityrequirements Initiatorsubsystem Safetyfunction Logicsolver Finalelement 35 15 50 1oo11oo1D 1oo21oo2D 2oo3 SIL 1 2 3 Lowdemand Highdemand 1x10 1 1x10 2 4 PFD ldangerous 1x10 2 1x10 3 1x10 3 1x10 4 1x10 4 1x10 5 1x10 5 1x10 6 1x10 6 1x10 7 1x10 7 1x10 8 1x10 8 1x10 9 SIL 99 90 60 0 0 SFF SIL3 SIL2 SIL1 1 2 SIL1 SIL2 SIL3 SIL4 SIL2 SIL3 SIL4 SIL4 Faulttolerance dangerousundetectedfailures 1oo3 ReliabilityAnalysis Whyareliabilityanalysis AccordingtothestandardweneedtoDocumentthefailurebehaviorofthesafetyfunctionDeterminetheSFFpersubsystemDeterminetheProbabilityoffailureondemand PDF Enduseralsowanttoknowthespurioustriprateofthesafetyfunction Availablevsreliability Theavailabilityofasystemistheprobabilitythatthesystemwillbefunctioningcorrectlyatanygiventime Availabilityexample ThesameSIFasmentionedinthereliabilityexamplealsohaveanavailabilityfigure TheavailabilityforthisSIFistheprobabilitythattheSIFisoperational OperationalmeanthattheSIFcontinuouslyperformsitsintendedfunctionality i e supervisingthepressureincludingreliefofthepressureuponahighpressuredemand ThisisnotpossiblewhentheSIFisinthefailsafemode Asystemorcomponentisreliableevenifithashadeasafeshutdown PFS orspurioustrip Butasystemisonlyavailableifitisupandrunningandperformsthetasksitisintendedtodo Therelationbetweenavailabilityandreliabilityisasfollow Reliabilityistheprobabilityofacomponent orsystem functioningcorrectlyoveragivenperiodoftimeunderagivensetofoperatingconditions Reliabilityexample ASIFisoperatinginaPSDsystemonanoilinstallation ThisSIFiscontrollingapressurereliefvalveonagasvessel ItiscriticalthatthisSIFisabletorespondonanaction Itisonlypossibletodomaintenanceonceayear Thentheprooftestintervalis1year ThereliabilityforthisSIFistheprobabilitythattheSIFwillreliefthepressureifahighpressureshouldoccur orthattheSIFisinafailsafemode A Availability R Reliability PFS ProbabilityofFailingSafely spurioustrio A R PFS ReliabilityDataRequirement Areliabilitymodeisnicebutwithoutdatewecannotperfo