2
018-
06
10
Functional Safety KCD2-SON-Ex*(.R*)(.SP)
Planning
3.2
Assumptions
The following assumptions have been made during the FMEDA:
•
The device shall claim less than 10 % of the total failure budget for a SIL 2 safety loop.
•
For a SIL 2 application operating in low demand mode the total PFD
avg
value of the
SIF (
S
afety
I
nstrumented
F
unction) should be smaller than 10
-2
, hence the maximum
allowable PFD
avg
value would then be 10
-3
.
•
For a SIL 2 application operating in high demand mode the total PFH value of the
SIF should be smaller than 10
-6
per hour, hence the maximum allowable PFH value would
then be 10
-7
per hour.
•
The safety-related device is considered to be of type
A
device with a hardware fault
tolerance of
0
.
•
Since the safety loop has a hardware fault tolerance of
0
and it is a type
A
device,
the SFF must be > 60 % according to table 2 of IEC/EN 61508-2 for a SIL 2 (sub) system.
•
Failure rate based on the Siemens standard SN29500.
•
Failure rates are constant, wear is not considered.
•
External power supply failure rates are not included.
•
The stress levels are average for an industrial environment and the environment is similar
to IEC/EN 60654-1 Class C (sheltered location) with temperature limits in the range
of the manufacturer's specifications and an average temperature of 40
º
C over a long
period. The humidity level is within manufacturer's rating.
•
The listed failure rates are valid for operating stress conditions typical of an industrial field
environment similar to IEC/EN 60654-1 Class C with an average temperature over a long
period of time of 40
º
C. For a higher average temperature of 60
º
C, the failure rates must
be multiplied by a factor of 2.5 based on experience. A similar factor must be used
if frequent temperature fluctuations are expected.
•
Since the outputs of the device use common components, these outputs must not be used
in the same safety function.
•
The indication of a dangerous failure (via fault bus) is detected within 1 hour
by the programmable logic controller (PLC).
•
The collective error message output is not considered in the FMEDA and
in the calculations.
