Uni-Probe LB 490
BERTHOLD TECHNOLOGIES GmbH & Co. KG
1 – 81
Volume 1 9 Functional Safety
1
© exida.com GmbH berthold 0408-10 r003 v1r3.doc, Apr. 12, 2007
Rainer Faller Page 17 of 18
Appendix 1: Possibilities to reveal dangerous undetected faults during
proof test
According to section 7.4.3.2.2 f) of IEC 61508-2 proof tests shall be undertaken to reveal
dangerous faults which are undetected by diagnostic tests.
This means that it is necessary to specify how dangerous undetected faults which have been
noted during the FMEDA can be detected during proof testing.
Table 3 shows an sensitivity analysis of the most critical dangerous undetected faults and
indicates how these faults can be detected during proof testing.
Table 3: Sensitivity Analysis of dangerous undetected faults of the evaluation unit
Component
% of total O
du
Detection through
IC1 – CPU 21% Functional test by closing the radiation source
IC31 – EEPROM 13% Functional test by closing the radiation source
IC2 – OpAmp 11% Functional test by closing the radiation source
Q1 7% Calibration
IC32 3% Functional test by comparing the measured pulse
rate with the expected “empty” pulse rate.
IC39 – Pulse shaping 3% Empty tank calibration
IC43 3% Empty tank calibration
Table 4: Sensitivity Analysis of dangerous undetected faults of the 4..20mA process output
Component
% of total O
du
Detection through
IC19 – Opto-coupler 35% Functional test by comparing the measured pulse
rate with the expected “empty” pulse rate.
IC32 – OpAmp 23% Functional test, see above
IC14 – DAC 17% Functional test, see above
IC23 – DAC driver 15% Functional test, see above
R112 – Measurement 5% Functional test, see above
The proof tests referenced in table 3 and 4 are described in detailed in the Safety Manual.
© exida.com GmbH berthold 0408-10 r003 v1r3.doc, Apr. 12, 2007
Rainer Faller Page 18 of 18
Appendix 2: Impact of lifetime of critical components on the failure rate
Although a constant failure rate is assumed by the probabilistic estimation method (see section
4.2.3) this only applies provided that the useful lifetime of components is not exceeded. Beyond
their useful lifetime (i.e. as the probability of failure significantly increases with time) the results
of the probabilistic calculation method is therefore meaningless. The useful lifetime is highly
dependent on the component itself and its operating conditions – temperature in particular (for
example, electrolyte capacitors can be very sensitive).
This assumption is based on the bathtub curve, which shows the typical behavior for electronic
components.
Therefore it is obvious that the PFD
AVG
calculation is only valid for components which have this
constant domain and that the validity of the calculation is limited to the useful lifetime of each
component.
It is assumed that early failures are detected to a huge percentage during the installation period
and therefore the assumption of a constant failure rate during the useful lifetime is valid.
The circuits of the Level Transmitter LB490 Uni-Probe evaluation unit do not contain any
components with limited useful lifetime which are contributing to the dangerous undetected
failure rate. For typical applications, the photomultiplier has a useful lifetime of more than 7,5
years with 60Co radiation source and more than 21 years with 137Cs radiation source.
When plant conditions and experience indicate a shorter useful lifetime than indicated in this
appendix, the number based on plant experience shall be used.
To Next Page
