BIF1307019R001
BIF1307019R001
BIF1307019R001
Project:
BXS Pilot & Mechanical Valve
Company:
Bifold Fluidpower Ltd.
Chadderton, Greater Manchester
United Kingdom
The document was prepared using best effort. The authors make no warranty of any kind and shall not be liable in any
event for incidental or consequential damages in connection with the application of the document.
© All rights reserved.
Management Summary
This report summarizes the results of the hardware assessment in the form of a Failure Modes,
Effects, and Diagnostic Analysis (FMEDA) of the BXS Pilot & Mechanical Valve. A Failure Modes,
Effects, and Diagnostic Analysis is one of the steps to be taken to achieve functional safety
certification per IEC 61508 of a device. From the FMEDA, failure rates are determined. The
FMEDA that is described in this report concerns only the hardware of the BXS Pilot & Mechanical
Valve. For full functional safety certification purposes all requirements of IEC 61508 must be
considered.
The BXS Pilot & Mechanical Valves analyzed include an Integrated Pilot Valve, 3/2 and 5/2 spool
valve bodies and 17 available operators. Operators are design to be used in either the primary
and/or secondary position. When the operator in the primary position is energized the pilot valve is
in its normal operating mode. The safe state is with the primary operator de-energized and the
secondary operator energized or providing mechanical return force.
The Integrated Pilot Valve (IPV) is the interface between the Solenoid and the Primary Operator. It
is designed to provide pressure to the Primary Operator when the associated solenoid is energized.
When the associated solenoid is de-energized the IPV vents the pressure in the Primary Operator.
The associated solenoid is not included in this analysis.
When used in a functional safety application, the complete valve assembly must be operated
automatically.
Note: the SIF designer is responsible for determining if the Latching and/or Override functions are
suitable for the application. The end user qualified personnel are responsible for determining if it is
safe to manually Latch/Unlatch or Override the Valves
Figure 1 in Section 3 shows the arrangement of the valve body and the two operator positions.
The failure rate data used for this analysis meets the exida criteria for Route 2H. See Section 0.
Therefore, the BXS Pilot & Mechanical Valve can be classified as a 2H device when the listed
failure rates are used. When 2H data is used for all of the devices in an element, then the element
meets the hardware architectural constraints up to SIL 2 at HFT=0 (or SIL 3 @ HFT=1) per Route
2H. If Route 2H is not applicable for the entire final element, the architectural constraints will need to
be evaluated per Route 1H.
The architectural constraints for the entire final element will need to be evaluated per Route 1H
The failure rates for the BXS Pilot & Mechanical Valve are listed in section 4.4.
These failure rates are valid for the useful lifetime of the product, see Appendix A.
The failure rates listed in this report do not include failures due to wear-out of any components.
They reflect random failures and include failures due to external events, such as unexpected use,
see section 4.2.2.
A user of the BXS Pilot & Mechanical Valve can utilize these failure rates in a probabilistic model of
a safety instrumented function (SIF) to determine suitability in part for safety instrumented system
Figure 1 BXS Pilot & Mechanical Valve arrangement showing the layout of valve body and operators.
Figure 2: #1 5/2 Valve Assembly; #2 SUB2 – E1 Int Pilot; #3 SUB3 – Spring; #4 Solenoid Operator; #6
IPV
The BXS Pilot & Mechanical Valve is classified as a component of a Type A 1 element according to
IEC 61508, having a hardware fault tolerance of 0.
1Type A element: “Non-Complex” element (using discrete components); for details see 7.4.4.1.2 of IEC
61508-2, ed2, 2010.
© exida BIF 13-07-019 R001 V3R1 BXS_FMEDA Report
T-126 V3,R5 exida 80 N. Main St, Sellersville, PA 18960 Page 13 of 34
4 Failure Modes, Effects, and Diagnostic Analysis
The Failure Modes, Effects, and Diagnostic Analysis as performed based on the documentation in
section 2.5.1and is documented in [R1].
4.2.1 FMEDA
A Failure Modes and Effects Analysis (FMEA) is a systematic way to identify and evaluate the
effects of different component failure modes, to determine what could eliminate or reduce the
chance of failure, and to document the system in consideration.
4.3 Assumptions
The following assumptions have been made during the Failure Modes, Effects, and Diagnostic
Analysis of the BXS Pilot & Mechanical Valve.
• Only a single component failure will fail the entire BXS Pilot & Mechanical Valve.
• Failure rates are constant; wear-out mechanisms are not included.
• Propagation of failures is not relevant.
• All components that are not part of the safety function and cannot influence the safety
function (feedback immune) are excluded.
• Failures caused by maintenance capability are site specific and therefore cannot be
included.
Table 3 Failure rates BXS Pilot & Mechanical Valve without PVST (FIT)
Table 4 Failure rates BXS Pilot & Mechanical Valve with PVST (FIT)
8It is important to realize that the No Effect failures are no longer included in the Safe Undetected failure
category according to IEC 61508, ed2, 2010.
© exida BIF 13-07-019 R001 V3R1 BXS_FMEDA Report
T-126 V3,R5 exida 80 N. Main St, Sellersville, PA 18960 Page 18 of 34
External leakage failure rates do not directly contribute to the reliability of the valve but should be
reviewed for secondary safety and environmental issues.
These failure rates are valid for the useful lifetime of the product, see Appendix A.
According to IEC 61508 the architectural constraints of an element must be determined. This can
be done by following the 1H approach according to 7.4.4.2 of IEC 61508 or the 2H approach
according to 7.4.4.3 of IEC 61508.
The 1H approach involves calculating the Safe Failure Fraction for the entire element.
The 2H approach involves assessment of the reliability data for the entire element according to
7.4.4.3.3 of IEC 61508.
The failure rate data used for this analysis meets the exida criteria for Route 2H. Therefore, the
BXS Pilot & Mechanical Valve meets the hardware architectural constraints Route 2H when used
with other Route 2H devices in an element for up to SIL 2 at HFT=0 (or SIL 3 @ HFT=1) when the
listed failure rates are used. If Route 2H is not applicable for the entire final element, the
architectural constraints will need to be evaluated per Route 1H
As the BXS Pilot & Mechanical Valve is only one part of an element, the architectural constraints
should be determined for the entire final element using either Route 1H or Route 2H.
11Useful lifetime is a reliability engineering term that describes the operational time interval where the failure
rate of a device is relatively constant. It is not a term which covers product obsolescence, warranty, or other
commercial issues.
© exida BIF 13-07-019 R001 V3R1 BXS_FMEDA Report
T-126 V3,R5 exida 80 N. Main St, Sellersville, PA 18960 Page 25 of 34
Appendix B Proof Tests to Reveal Dangerous Undetected Faults
According to section 7.4.5.2 f) of IEC 61508-2 proof tests shall be undertaken to reveal dangerous
faults which are undetected by automatic diagnostic tests. This means that it is necessary to
specify how dangerous undetected faults which have been noted during the Failure Modes, Effects,
and Diagnostic Analysis can be detected during proof testing.
Step Action
1. Bypass the safety function and take appropriate action to avoid a false trip.
2. De-energize the BXS Pilot & Mechanical Valve to force the actuator and valve to the
Fail-Safe state and confirm that the Safe State was achieved and within the correct
time.
3. Return the BXS Pilot & Mechanical Valve to the energized state and inspect the final
element for any leaks, visible damage or contamination and confirm that the normal
operating state was achieved.
4. Remove the bypass and otherwise restore normal operation.
For the test to be effective the movement of the valve must be confirmed. To confirm the
effectiveness of the test both the travel of the valve and slew rate must be monitored and
compared to expected results to validate the testing.
3.50E-02
3.00E-02
2.50E-02
2.00E-02
PFDavg
Series1
Sensor
1.50E-02
Final
Series2
1.00E-02 Element
5.00E-03
0.00E+00
1 2 3 4 5
Proof Test Interval (Years)
with all other variables remaining the same, the PFDavg for the SIF equals 5.76E-02 which barely
meets SIL 1 with a risk reduction factor of 17. The subsystem PFDavg contributions are Sensor
PFDavg = 2.77E-03, Logic Solver PFDavg = 1.14E-05, and Final Element PFDavg = 5.49E-02 (Figure
5).
Level Description
Perfect - Repairs are always correctly performed, Testing is always done correctly and on
schedule, equipment is always replaced before end of useful life, equipment is always selected
according to the specified environmental limits and process compatible materials, electrical
SSI 4
power supplies are clean of transients and isolated, pneumatic supplies and hydraulic fluids are
always kept clean, etc. This level is generally considered not possible but retained in the model
for comparison purposes.
Almost perfect - Repairs are correctly performed, Testing is done correctly and on schedule,
equipment is normally selected based on the specified environmental limits and a good analysis
SSI 3 of the process chemistry and compatible materials. electrical power supplies are normally clean
of transients and isolated, pneumatic supplies and hydraulic fluids are mostly kept clean, etc.
Equipment is replaced before end of useful life, etc.
Good - Repairs are usually correctly performed, Testing is done correctly and mostly on
SSI 2
schedule, most equipment is replaced before end of useful life, etc.
Medium – Many repairs are correctly performed, Testing is done and mostly on schedule, some
SSI 1
equipment is replaced before end of useful life, etc.
None - Repairs are not always done, Testing is not done, equipment is not replaced until failure,
SSI 0
etc.
Table 9 Failure rates with Ideal Maintenance Assumption (SSI=4), without PVST in FIT
Table 10 Failure rates for with Ideal Maintenance Assumption (SSI=4), with PVST in FIT