The optimal delay of the second test is therefore approximately 210 hours earlier than =2.

Transcription

1 THE IEC FORMULAS 223 The optmal delay of the second test s therefore approxmately 210 hours earler than = The IEC Formulas IEC provdes approxmaton formulas for the PF for smple confguratons wth no more than three channels. We refer to these formulas as the IEC formulas. The IEC formulas are presented n IEC wthout any dervaton or justfcaton and many relablty analysts fnd them confusng. The purpose of ths secton s to derve smlar PF formulas for koon confguratons and to try to make them understandable. The man dea of the IEC formulas s to calculate the PF of a voted group (G) of channels as f the group were a sngle tem. The calculaton s based on the average dangerous group falure frequency, ;G, and the group-equvalent mean downtme, t GE, and PF for the group s calculated as PF.G/ ;Gt GE (8.36) In the calculaton of PF, t s necessary to take the mean downtme, t CE, of a channel that has got a falure, nto account. The mean downtme, t CE, s called the channel-equvalent mean downtme. The IEC formulas take U and falures nto account, but safe falures are dsregarded n ths secton. Assumptons for the dervatons are gven n Secton PF for Independent Channels To determne the PF of a voted group, t s necessary to fnd 1. The average rate, ;G, of dangerous group falures (GFs). 2. The mean downtme of the voted group when a GF occurs. The man concepts related to rate of falures of an tem (e.g., a group) are dscussed n further detal n Secton 9.2. Frequency of angerous Group Falures. We start wth task 1 and consder two smple structures (1oo2 and 2oo3) before presentng the frequency of GFs of a koon voted group of dentcal channels. Average System Falure Rate for a 1oo2 Voted Group. Consder a 1oo2 voted group of ndependent and dentcal channels wth falure rate. Because the channels are ndependent, they wll not fal at exactly the same tme. A dangerous group falure must therefore start wth a falure of one of the two channels. The rate of ths event s 2, as both channels can fal. When one channel has faled,

2 224 AVERAGE PROBABILITY OF FAILURE ON EMAN t wll be down for a perod t CE. To have a dangerous group falure (GF), the remanng channel must fal wthn the downtme of the already faled channel, and ths falure occurs wth probablty Pr.T t CE /, where T s the tme to dangerous falure of a channel. The average system falure rate for the voted group wth respect to falures s therefore ;G 2 1 e t CE 2 t CE 2 2 t CE (8.37) Average System Falure Rate for a 2oo3 Voted Group. Consder a 2oo3 voted group of three ndependent and dentcal channels wth falure rate. Because the channels are ndependent, they wll not fal at exactly the same tme. As for the 1oo2 voted group, a GF must start wth a falure of one of the three channels. The rate of ths event s 3, because all the three channels can fal. When one channel has faled, t wll be down for a perod t CE. To have a dangerous group falure, at least one of the remanng two channels must fal wthn the downtme of the already-faled channel. The average system falure rate for the voted group wth respect to falures s therefore ;G 3 1 e 2 t CE 3 2 t CE 6 2 t CE (8.38) Average System Falure Rate for a koon Voted Group. Consder a koon voted group of n ndependent and dentcal channels wth falure rate. The group s functonng when at least k of the n channels are functonng and fals as soon as at least n k C 1 channels fal. When n k C 1 2, we can determne the PF by the same arguments as used above, but when n k C 1 3, we need addtonal parameters. We llustrate the approach by a 1oo3 voted group where all the three channels have to fal to gve a group falure. Snce the channels are ndependent they wll fal at dfferent tmes. The frst channel falure wll occur wth rate 3 and the assocated channel-equvalent downtme s t CE. One of the two remanng channels must get a falure whle the frst fault remans. The probablty of the second falure s, on the average, 1 e 2 t CE 2 t CE. The mean downtme of the double fault s denoted t 1 G2E and may be longer or shorter than t CE. To have a GF, the thrd channel has to have a falure whle the double falure perssts and the probablty of ths event s 1 e t G2E t G2E. The frequency of GFs of the 1oo3 voted group s therefore ;G 3 2 t CE t G2E / t CEt G2E The mean downtme after a falure wll generally depend on the multplcty of the faults. To smplfy the notaton, we ntroduce the symbol t G E for the mean 1 A smlar symbol (t G2E ) s ntroduced on page 35 n IEC , but s not dscussed or used any further n the standard.

3 THE IEC FORMULAS 225 downtme of smultaneous faults. The downtme starts when the th channel fals and lasts untl the channels have been restored, rrespectve of whether other channels fal after the th falure. Wth ths notaton, the correspondng symbols n IEC are t CE t G1E and t GE t Gn-k+1 E, whle t G2E s the same symbol as used (once) n IEC The symbols t G E for 3 do not have any counterpart n IEC Now, consder a general koon voted group of ndependent and dentcal channels. A GF must start wth a falure of one of the n channels. The frequency of the frst falure s n, because n ndependent channels can fal. When the frst channel has faled, t wll be down for a perod t G1E. To get a dangerous group falure, n k of the remanng n 1 channels must fal. A second falure occurs durng the downtme t CE wth probablty approxmately.n 1/ t G1E, because there are n 1 channels that can fal. There are now two channels that are down and the mean dangerous downtme of these s denoted t G2E. A thrd falure occurs durng t G2E wth probablty approxmately.n 2/ t G2E, because there are now n 2 channels that can fal. Ths process s contnued untl we come to a total of n kc1 falures. To llustrate the procedure, consder, for example, a 1oo5 voted group where fve channels must have falures to gve a dangerous group falure. 1oo5 voted group. The frequency of GFs of a 1oo5 voted group s ;G 5 4 t G1E 3 t G2E 2 t G3E t G4E / t G1Et G2E t G3E t G4E koon voted group. The approach above can be easly extended to a general koon voted group where n k C 1 channels must fal to gve a GF. ;G n kc1 ny k k.n C 1/ t G E (8.39) 1 The downtme t GE may depend on the physcal and operatonal condtons of the plant. As a default, we may use the analogy to (8.42) t G E U n C 2 C MRT C MTTR (8.40)

4 226 AVERAGE PROBABILITY OF FAILURE ON EMAN λ λ t CE,2 = MTTR λ U t CE,1 = τ/2 + MRT t CE Fgure 8.11 Relablty block dagram of a sngle channel regarded as a seres system of two vrtual elements. Equvalent Mean owntme. The next man task s to determne the mean downtme of the group when a GF occurs. Inasmuch as the downtme followng a falure s dfferent from the downtme followng a U falure, we need to wegh the two downtmes. The weghng process s llustrated frst for a sngle channel. Thereafter, the mean downtme for a group of two ndependent and dentcal channels voted 1oo2 s determned before we determne the mean downtme for a koon voted group of n ndependent and dentcal channels. Equvalent Mean owntme for a Sngle Channel. Consder a sngle channel that can have both U and falures. The channel can be regarded as a seres structure of two vrtual elements, one element that can have only U falures and one element that can have only falures, as llustrated n Fgure If a falure occurs, the probablty that ths falure s a U falure s Pr.U falure j falure/ and the probablty that t s a falure s Pr. falure j falure/ U U C U U C If the falure s a U falure, the mean downtme assocated wth ths falure s E. U / 2 C MRT A U fault s revealed only n a proof test and has, on the average, been present for a perod =2 (see Table 8.3). When the U fault has been revealed n the proof test, the channel has to be repared/restored and the assocated downtme s the mean repar tme (MRT). If the falure s a falure, the fault s revealed by the dagnostc system and the mean downtme untl the channel s restored n MTTR, whch has two parts () the tme from the falure untl t s revealed and () the tme requred to repar/restore the channel. Part () s equal to the half of the dagnostc test nterval (usually less than some few mnutes). The channel-equvalent mean downtme (t CE ) for the channel s therefore t CE U 2 C MRT C MTTR (8.41)

5 THE IEC FORMULAS 227 Equvalent Mean owntme for a 1oo2 Voted Group. Consder a 1oo2 voted group wth two ndependent and dentcal channels that can have both U and falures. Because the channels are ndependent, they cannot fal at the same tme. To have a dangerous group falure, one of the channels must frst get a falure, and when ths channel s down wth a fault, the other channel must get a falure. If the second falure s a U falure, the downtme of the 1oo2 group wll, from Table 8.3, be approxmately =3 C MRT. If the second falure s a falure, the downtme wll be MTTR. The group-equvalent mean downtme for the 1oo2 voted group s therefore t GE U 3 C MRT C MTTR Equvalent Mean owntme for a koon Voted Group. Consder a koon voted group of n ndependent and dentcal channels that can have both U and falures. Wth the same argument as above and by usng (8.26), the group-equvalent mean downtme s t GE U n k C 2 C MRT C MTTR (8.42) Probablty of Falure on emand By the IEC formulas, the PF of a voted group (G) s from (8.36) determned by PF.G/ ;G t GE Another Argument. Equaton (8.36) may also be justfed by the followng arguments: The frequency of falures, ;G s constant such that the up-tme (wth respect to falures) s exponentally dstrbuted wth mean up-tme (MUT) equal to 1= ;G. Each tme the group fals, the group wll be down wth a mean downtme (MT) equal to t GE. Because the PF denotes the average safety unavalablty of the group, we may use the well-known formula for unavalablty PF.G/ MT MUT C MT t GE 1 ;G C t GE ;G t GE 1 C ;G t GE ;G t GE (8.43) The approxmaton s adequate when ;G t GE s small, that s, when t GE MUT, whch s fulflled for all relevant SIFs.

6 228 AVERAGE PROBABILITY OF FAILURE ON EMAN EXAMPLE 8.15 Sngle channel For a sngle channel, t GE t CE, and the PF.G/ s PF.1oo1/ t GE. U C /t GE U 2 C MRT C MTTR (8.44) Numercal Example. The data n Table 7.2 gves The smplfed formula gves PF.1oo1/ 4: PF.smpl:/ U 2 4: The smplfed formula gves a lower value because falures are dsregarded n ths formula. EXAMPLE oo2 voted group By combnng (8.36) and (8.40), the PF.G/ for a 1oo2 voted group becomes PF.1oo2/ ;G t GE 2 2 t CE t GE 2 h U 2 C MRT C MTTR h U 3 C MRT C MTTR (8.45) Numercal Example. The data n Table 7.2 gves The smplfed formula gves PF.1oo2/ 2: PF.smpl:/. U/ 2 2: The smplfed formula agan gves a lower value because falures are dsregarded n ths formula.

7 THE IEC FORMULAS 229 EXAMPLE oo2 voted group A 2oo2 voted group s a seres structure that fals when the frst channel fals. The average group falure rate s here ;G 2 and the group-equvalent mean downtme t GE s the same as the channel mean downtme t CE. The of ths group s therefore PF.G/ PF.2oo2/ 2 t CE 2 h U 2 C MRT C MTTR (8.46) EXAMPLE oo3 voted group A 2oo3 group fals when at least two of ts three channels fal. The average system falure rate s from (8.38) ;G 6 2 t CE The group-equvalent mean downtme s the same as for the 1oo2 group (8.42). The PF.G/ for the 2oo3 group s therefore PF.2oo3/ 6 2 t CE t GE 6 h U 2 C MRT C MTTR h U 3 C MRT C MTTR (8.47) PF for a koon Voted Group. The PF.G/ for a koon voted group of ndependent and dentcal channels s determned from (8.36), where the frequency of dangerous group falures ;G s gven by (8.39) and the group-equvalent mean downtme, t GE s gven by (8.42). PF.koon/ ;G t GE n n kc1 ny k k.n C 1/ t GE t GE 1 Y n kc1 kc1 1 where we have used that t Gn-k+1 E t GE..n C 1/ t GE (8.48)

8 230 AVERAGE PROBABILITY OF FAILURE ON EMAN EXAMPLE oo5 voted group Consder a 3oo5 voted group of ndependent and dentcal channels. Wth n 5 and k 3, (8.48) becomes PF.3oo5/ / t GE1t GE2 t GE3 By usng the data set n Table 7.2, we obtan PF.3oo5/ 1: I Remark: It s not straghtforward to see how the IEC formulas can be adapted to voted groups wth ndependent and nondentcal channels. It may be possble, but wll be rather cumbersome PF wth Common-Cause Falures The beta-factor model for common-cause falures (CCFs) was ntroduced n Secton 5.4 and s thoroughly dscussed n Chapter 10. In Secton 8.3, the beta-factor model was used together wth the smplfed formulas. Ths secton shows how the beta-factor model can be used together wth the IEC formulas. IEC apples two beta-factors, ˇ for U falures and ˇ for falures. It s generally acknowledged that ˇ < ˇ. The ratonale for ths dfference s dscussed n Chapter 10. In Secton 8.3, a channel was represented as a seres structure of an ndependent part and a vrtual common-cause element. Further, Secton shows that a channel can be splt nto a vrtual part that s only exposed to U falures and another vrtual part that s only exposed to falures. By combnng these approaches, a channel can be splt nto four vrtual parts: An ndependent part that s exposed only to U falures An ndependent part that s exposed only to falures A common-cause element for U falures (U-CCFs) A common-cause element for falures (-CCFs) The channel can be represented as a seres structure of these four parts, as llustrated n Fgure Followng the approach n Secton 8.3, a voted group of channels can be represented as a seres structure of three parts: (a) an ndependent part comprsng a number of ndependent and dentcal channels wth falure rates.1 ˇ/ U and.1 ˇ/, wth respect to U and falures, respectvely; (b) a vrtual CCF element representng U falures, wth falure rate ˇ U ; and (c) a