20
17-
03
10
Functional Safety HiC2027**, KCD2-STC-(Ex)1.2O.**
Planning
3.2
Assumptions
The following assumptions have been made during the FMEDA:
• Failure rate based on the Siemens standard SN29500.
• Failure rates are constant, wear is not considered.
• External power supply failure rates are not included.
• The safety-related device is considered to be of type
A
device with a hardware
fault tolerance of
0
.
• The device will be used under average industrial ambient conditions, which
are comparable with the classification "stationary mounted" in MIL-HDBK-
217F. Alternatively, the following ambient conditions are assumed:
• IEC/EN 60654-1 Class C (sheltered location) with temperature limits in the
range of the manufacturer's specifications and an average temperature of
40
º
C over a long period. The humidity level is within manufacturer's rating.
For a higher average temperature of 60
º
C, the failure rates must be
multiplied by a factor of 2.5 based on experience. A similar factor must be
used if frequent temperature fluctuations are expected.
• Any safe failures that occur (e. g. output in safe state) will be corrected within
24 hours (e. g. remove sensor fault).
• While the device is being repaired, measures must be taken to maintain the
safety function (e. g. substitution by a replacement device).
• The HART function is only used for configuration, calibration and diagnostics,
not during operation.
• The application program in the programmable logic controller (PLC) is
configured to detect underrange and overrange failures.
SIL 2 application
• The device shall claim less than 10 % of the total failure budget for a SIL 2
safety loop.
• For a SIL 2 application operating in low demand mode the total PFD
avg
value
of the SIF (
S
afety
I
nstrumented
F
unction) should be smaller than 10
-2
, hence
the maximum allowable PFD
avg
value would then be 10
-3
.
• For a SIL 2 application operating in high demand mode the total PFH value of
the SIF should be smaller than 10
-6
per hour, hence the maximum allowable
PFH value would then be 10
-7
per hour.
• Since the safety loop has a hardware fault tolerance of
0
and it is a type
A
device, the SFF must be > 60 % according to table 2 of IEC/EN 61508-2 for a
SIL 2 (sub) system.
