e ida.

com
excellence in dependable automation

More accurate failure metrics

FMEDA Techniques for
Mechanical Instrumentation
Dr. William M. Goble, P.E., CFSE
exida.com
+215-453-1720
wgoble@exida.com

e ida.com
excellence in dependable automation

Safety Life Cycle - IEC61508

1

Concept

Overall Scope
Definition

Hazard & Risk

Analysis

Overall Safety
Requirements

Safety Requirements
Allocation

Overall Planning
Operation &
Installation &
9
Validation
6 Maintenance 7 Planning 8 Commissioning
Planning
Planning

Safety-related
systems :
E/E/PES

ANALYSIS
Phase
(End User / Consultant)

10

Safety-related
systems : other
Technology

Realisation

11

Realisation

Overall Installation
12
& Commissioning
13

Overall Safety
Validation

14

Overall Operation &

Maintenance

16 Decommissioning

External Risk
Reduction
Facilities
Realisation

REALIZATION
(Vendor / Contractor /
End User)

15

Overall Modification
& Retrofit

OPERATION
(End User / Contractor)

Safety Integrity Levels

Safety Integrity
Level

Probability of failure
on demand
(Demand mode of operation)

Risk Reduction
Factor

SIL 4

>=10-5 to <10-4

100000 to 10000

SIL 3

>=10-4 to <10-3

10000 to 1000

SIL 2

>=10-3 to <10-2

1000 to 100

SIL 1

>=10-2 to <10-1

100 to 10

IEC61508 Safe Failure Fraction

TYPE B

Safe Failure
Fraction

Hardware Fault Tolerance

< 60 %

Not Allowed

SIL1

SIL2

60 % < 90 %

SIL1

SIL2

SIL3

90 % < 99 %

SIL2

SIL3

SIL4

< 99 %

SIL3

SIL4

SIL4

SLC Realization Phase

Safety Requirements Specification Functional Description of each Safety
Instrumented Function, Target SIL,
Mitigated Hazards, Process parameters,
Logic, Bypass/Maintenance
requirements, Response time, etc

7. SIS Conceptual
Design
Manufacturers
Failure Data
Failure Data
Database

Choose sensor, logic solver

and final element technology

7b. Select
Architecture

Redundancy: 1oo1,1oo2,
2oo3, 1oo2D

7c. Determine
Test Philosophy
No

Manufacturers
Safety Manual

Manufacturers
Installation
Instructions

7a. Select
Technology

e ida.com

SIL
Achieved?
Yes

excellence in dependable automation

SILver Tool

7d. Reliability,
Safety Evaluation

DD DOCUMENT Template

8. SIS Detailed
Design

9. Installation
& Commission
Planning

SILs Achieved

10. SIS Installation,

Commissioning
and Pre-startup
Acceptance Test

Detailed Design Documentation Loop Diagrams, Wiring Diagrams, Logic

Diagrams, Panel Layout, PLC
Programming, Installation
Requirements, Commissioning
Requirements, etc.

SIF Verification Task

Safety Requirements
Specification - Safety
Function Requirements
including target SIL

Manufacturers
Failure Data

7d. Reliability and

Safety Evaluation

Failure Data
Database

PFDavg, RRF
MTTFS,
SIL achieved

IEC61508 part 6 - ISATR84.02 Method

Divide failure rate into failure modes

= S + D

60.0%
SAFE

DANGEROUS

40.0%

SD/SU/DD/DU
Divide each failure rate into detected and
undetected (by on-line tests)
SAFE DETECTED
SAFE UNDETECTED
60%

SD

DANGEROUS
UNDETECTED

SU

D = DD + DU

40%

DANGEROUS DETECTED

Create Safety
Specification

SIF Verification Example

Select Technology

Example: High Pressure Protection Loop

1. Pressure Switch - Solenoid
Lambda DU

Select Architecture

Solenoid
2.40 x 10-6 failures per hour
Pressure switch 4.55 x 10-6 failures per hour
Determine Test
Philosophy

No Diagnostics, Test Interval 1 year, SIL2

Reliability
Evaluation

Performance
Target Met?

No

Yes

SIF Verification Example

Example: High Pressure Protection Loop
1. Pressure Switch - Solenoid
Lambda DU
Solenoid
2.40 x 10-6 failures per hour
Pressure switch 4.55 x 10-6 failures per hour
No Diagnostics, Test Interval 1 year, SIL2

PFDavg = DU TI / 2
PFDavg = (0.00000695 * 8760) / 2
PFDavg = 0.03
RRF = 1/PFDavg = 33

Safety Integrity Levels

Safety Integrity
Level

Probability of failure
on demand
(Demand mode of operation)

Risk Reduction
Factor

SIL 4

>=10-5 to <10-4

100000 to 10000

SIL 3

>=10-4 to <10-3

10000 to 1000

SIL 2

>=10-3 to <10-2

1000 to 100

SIL 1

>=10-2 to <10-1

100 to 10

exida SILver Tool

Tools are
often used
to do these
calculations.

Often the results show that the final element

contributes the majority of the probability of
failure. This is primarily due to the relatively high
failure rate data found in industry databases
combined with conservative estimates of failure
modes.
Sensor Logic
10.04% Solver
0.44%

SIF Verification Task

Safety Requirements
Specification - Safety
Function Requirements
including target SIL

Manufacturers
Failure Data

Where does the

data come from?
7d. Reliability and
Safety Evaluation

Failure Data
Database

PFDavg, RRF
MTTFS,
SIL achieved

Failure Rate Data Models

1. Industry Databases NOT Application Specific,
NOT Product Specific
2. Manufacturer FMEDA, Field Failure Study
Product Specific
NOT Application Specific
3. Detail Field Failure Study Application model.
Product Specific
Application Specific

Solenoid Failure Data

Industry Database
exida.com estimate

Generic 2-way solenoid (DTT)

5.00E-06

75%

0%

0%

mean

dTR84.02

Solenoid (DTT)

7.75E-06

77%

0%

0%

mean

SINTEF

Pilot valve

4.20E-06

59.5%

30%

20%

mean

Smith

CCPS-89
CCPS-89
CCPS-89
Ility Engineering
Ility Engineering
Ility Engineering
Ility Engineering
NPRD-95
NPRD-95
NPRD-95

Valve - Solenoid (DTT)

Valve - Solenoid (DTT)
Valves-Operated-Solenoid
Valves-Operated-Solenoid
Valves-Operated-Solenoid
Combination spurious and demand failure rate
Combination spurious and demand failure rate
Combination spurious and demand failure rate
Solenoid Valves
Solenoid Valves
Solenoid Valves
Solenoid Valves
Valve - Solenoid
Valve, Pneumatic Solenoid
Valve, Solenoid Operator

1.00E-06
8.00E-06
6.79E-07
4.87E-05
1.89E-04
7.32E-07
1.06E-06
5.71E-07
2.97E-05
4.79E-05
3.00E-05
3.40E-05
6.15E-06
1.67E-05
1.11E-05

56.00%
38.76%
71.69%
-

low
high
low
mean
high
mean
mean
mean
mean
mean
mean
mean
mean
mean
mean

IEEE Std. 500-1984

Solenoid Valve

1.32E-06

mean

CCPS-89

Ball Valve Failure Data

Industry Database
Ball valve example
Source
ISA - DTR84.02 Draft (average)
Smith
RAC-Non electronic parts 1995 [x]
OREDA

Description
Air operated ball
valve
Valves - Ball
Valve, Pneumatic,
Ball
Valves, Ball,
Pneumatic

Failure rate
5.23E-06
2.00E-07 (low)
3.00E-06 (mean)
1.00E-05 (high)
7.14E-05
1.51E-06 (low)
2.92E-06 (mean)
5.64E-06 (high)

Source

Component

Total
Failure
Rate

exida.com estimate

Generic air operated ball valve

3.00E-06 55.00%

% safe

Safe
Dangerous
coverage coverage Range
0.00%

0.00%

Notes

mean

Manufacturers FMEDA
Mechanical Components
Field Return Reports
Average Stress
Conditions

Mechanical FMEDA
Mechanical Component
Failure Rate Database

Mechanical Component
Failure Mode Database

IEC 61508 Qualification

Parameters
S, DU, DD
SFF

These are needed by

end users to do SIL
Verification!

FMEDA Procedure
Extension of FMEA Technique
Add diagnostic capability column
When component / failure mode is
detectable, indicate detection mechanism
(and error code).
Fault Injection results documented in chart

10

e ida.com
excellence in dependable automation

Four categories of failure rates

SD = CS*S
SU = (1-CS)*S
DD = CD*D
DU = (1-CD)*D
CS Coverage factor for safe failures
CD Coverage factor for dangerous
failures

e ida.com
excellence in dependable automation

Manufacturers FMEDA Report

FMEDA Reports many
manufacturers are
supplying such reports,
primarily for electronic and
electro-mechanical
equipment.
Metso Automation
Fisher Controls
Bettis
Rosemount

11

FMEDA Analysis to date

Manufacturer
Det-tronics
ABB
Honeywell
Moore Industries
Rosemount

Yokogawa
WIKA
Elcon

Pepperl+Fuchs

MTL
Magnetrol
Endress & Houser
Fisher Controls
Metso Automation
Bettis Corpration
Mokveld

Product
Pointwatch Eclipse IR
X3301 multi-spectrum IR
600T
ST3000
STT250
TRY
SPA
3051C
3051T
3144P
3051S
8800C
EJA
YTA
T32
HD 2026 (SK)
HD 2030 (SK)
HD 2842
ED2-STC***
KFA*-S***-Ex*
MUX 2700
MTL 5042
Eclipse Model 705
Eclipse Model 708
Fieldgate FXA 520
DVC6000
VG800
G series
CB series
RXD series

Description
Hydrocarbon Gas detector
Flame Detector (fire detection)
Pressure Transmitter
Pressure Transmitter
Temperature Transmitter
Temperature Transmitter
Site Programmable Alarm
Pressure Transmitter
Pressure Transmitter
Temperature Transmitter
Pressure Transmitter
Vortex Flowmeter
Pressure Transmitter
Temperature Transmitter
Temperature Transmitter
Smart isolator
Smart isolator
Switch/Proximity Detector
Smart isolator
Isolated Barrier
HART Gateway
Repeating Power Supply
Guided Wave Radar Level Transmitter
Guided Wave Radar Level Transmitter
HART Gateway
Valve controller
Valve controller
Pneumatic Valve actuator
Pneumatic Valve actuator
Valve

FMEDA Report
exida
exida
TUV
exida
exida
exida
exida
FM
exida
exida
exida
exida
exida
exida
exida
exida
exida
exida
exida
exida
exida
BASEEFA
exida
exida
exida
exida
exida
exida
exida
AEA

61508 Certification
None
None
TUV
None
None
None
None
None
None
None
None
None
None
None
None
None
None
None
None
None
None
BASEEFA
None
None
None
TUV
TUV
None
None
TUV

Mechanical FMEDA
Item
1-10
1-20
1-30

1-50
1-60
1-70

1-80
2-20

2-25

2-30
2-40

2-50
2-80
2-90
3-10
3-20

3-30

Part Description
Housing

Failure Mode
Effect
Fracture
Torque transmission failure
Deflection
No effect
Housing cover
Fracture
Valve will not move
Deflection
No effect
Guide block assembly
Fracture - piston side power swivel
Springforce will cause shut down
Fracture - spring side power swivel
Valve will not move
Fracture - middle
Valve will not move
Deflection
No effect
Extension rod assembly
Fracture
Springforce will cause shut down
Deflection
No effect
Extension retainer nut assembly Loss of Thread
Springforce will cause shut down
Loosen
Springforce will cause shut down
Yoke
Fracture
Valve will not move
Deflection
Valve not fully seated
Wear
Valve not fully seated
Yoke pin
Fracture
Valve will not move
Deflection
Valve not fully seated
Guide bar bearing
Excessive friction
No effect
Excessive play
No effect
Seized
Valve will not move
Yoke pin bearing
Excessive friction
No effect
Excessive play
No effect
Seized
No effect
Yoke/Guide block bushing
Tear
No effect
Yoke bearing
Excessive friction
No effect
Excessive play
No effect
Seized
No effect
O-ring seal
Leak
N/A
Complete failure
N/A
Rod wiper
N/A
N/A
O-ring seal
Leak
N/A
Complete failure
N/A
Inner end cap
Fracture
Air leak
Deflection
Air leak
Tie bar
Fracture
Valve will not move
Fracture
Release of pressure
Deflection
Valve will not move
Deflection
Release of pressure
Piston
Fracture
Springforce will cause shut down
Deflection
Valve not fully seated

Mode
D
#
D
#
S
D
D
#
S
#
S
S
D
D
D
D
D
#
#
D
#
#
#
#
#
#
#
#
#
#
#
#
S
S
D
S
D
S
S
D

Qty.
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
2
2
2
2
2
2
1
2
2
1
1
2
2
2
2
1
1

Lambda
% distr.
5.00E-09
95%
5.00E-09
5%
5.00E-09
95%
5.00E-09
5%
3.00E-08
32%
3.00E-08
32%
3.00E-08
32%
3.00E-08
5%
5.00E-08
95%
5.00E-08
5%
5.00E-08
20%
5.00E-08
80%
1.00E-07
75%
1.00E-07
20%
1.00E-07
5%
6.00E-08
95%
6.00E-08
5%
3.00E-08
40%
3.00E-08
10%
3.00E-08
50%
3.00E-08
40%
3.00E-08
10%
3.00E-08
50%
3.00E-08
100%
3.00E-08
40%
3.00E-08
10%
3.00E-08
50%
99%
1%
100%
99%
1%
2.50E-08
95%
2.50E-08
5%
2.50E-08
5%
2.50E-08
90%
2.50E-08
1%
2.50E-08
4%
2.50E-08
95%
2.50E-08
5%

12

Mechanical FMEDA Results

for air operated actuator
Total failure rate

1.38E-06

Safe failure rate

Dangerous failure rate
NoEffect failure rate
PVST - dangerous detected
PVST - dangerous undetected

9.19E-07
4.60E-07
4.26E-07
4.26E-07
3.40E-08

% safe failures

66.64%

SFF no PVST
74.51%
SFF with PVST 98.12%

Mechanical FMEDA Problems

1. Component data sources still limited:
further correlation with field failure data
2. Stress - Strength Analysis needed for
more accuracy: tools available
3. Application Stress levels needed for
further accuracy: tools available

13

Mechanical FMEDA Problems

1. Component data sources still limited:
further correlation with field failure data
in progress now
2. Stress - Strength Analysis needed for
more accuracy: tools available
3. Application Stress levels needed for
further accuracy: tools available

Future
Debate on probabilistic methods design value will be even more
recognized and methods will become more widespread.
Failure Data manufacturers are responding to their customers
are supplying data, this will continue.
Mechanical Equipment
IEC61508 probabilistic
methods will show their value
even for mechanical equipment
used in functional safety
applications and data available
for that purpose will become
more accurate.

Concept

Overall Scope
Definition

Hazard & Risk

Analysis

Overall Safety
Requirements

Safety Requirements
Allocation

Overall Planning
Operation & Validation
Installation & 9
6 Maintenance 7
8 Commissioning
Planning
Planning
Planning

Safety-related
systems :
E/E/PES
Realisation

Safety-related
External Risk
systems : other
Reduction
Facilities
1 0 Technology
11
Realisation

Realisation

Overall Installation
1 2 & Commissioning
13

Overall Safety
Validation

1 4Overall Operation &

Maintenance

1 5 Overall Modification
& Retrofit

1 6 Decommissioning

14

e ida.com
excellence in dependable automation

15