Failure Modes, Effects and Diagnostic Analysis

1 The document was prepared using best effort. The authors make no warranty of any kind and shall not be liable in any event for incidental or consequential damages in connection with the application of the document. All rights reserved. Failure Modes, Effects and Diagnostic Analysis Project: Emerson s Rosemount 3051S 4-20mA HART Pressure Transmitter Software Rev 7 and above Company: Rosemount, Inc. Shakopee, MN USA Contract Number: Q15/10-010 Report No.: ROS 05/05-05 R001 Version V2, Revision R3, October 14, 2016 Ted Stewart exida ROS 05-05-05 R001 V2 R3 FMEDA T-001 V9,R2 Page 2 of 27 Management Summary This report summarizes the results of the hardware assessment in the form of a Failure Modes, Effects , and Diagnostic Analysis (FMEDA) of the Rosemount 3051S 4-20mA HART Pressure Transmitter, Software Revision and Above. A Failure Modes, Effects , and Diagnostic Analysis is one of the steps to be taken to achieve functional safety certification per IEC 61508 of a device.

2 From the FMEDA, Failure rates are determined. The FMEDA that is described in this report concerns only the hardware of the Rosemount 3051S. For full functional safety certification purposes all requirements of IEC 61508 must be considered. The Rosemount 3051S is a two-wire 4 20 mA smart device. It contains self-diagnostics and is programmed to send its output to a specified Failure state, either high or low upon internal detection of a Failure . For safety instrumented systems usage, it is assumed that the 4 20 mA output is used as the primary safety variable. Below list the versions of the Rosemount 3051S that have been considered in the hardware assessment: Rosemount 3051S Coplanar Differential & Coplanar Gage Rosemount 3051S Coplanar Absolute, In-line Gage, & In-line Absolute The Rosemount 3051S is classified as a Type B1 element according to IEC 61508, having a hardware fault tolerance of 0.

3 The Failure rate data used for this Analysis meets the exida criteria for Route 2H. (See Section ). Therefore, the Rosemount 3051S meets the hardware architectural constraints for up to up to SIL 2 at HFT=0 (or SIL 3 @ HFT=1) as a single device when the listed Failure rates are used. If Route 2H is not applicable for the Rosemount 3051S, the architectural constraints will need to be evaluated per Route 1H. The Analysis shows that the Rosemount 3051S has a Safe Failure Fraction greater than 90% (assuming that the logic solver is programmed to detect over-scale and under-scale currents) and therefore meets hardware architectural constraints for up to SIL 2 as a single device. The Failure rates for the Rosemount 3051S are listed in Table 1. 1 Type B element: Complex element (using micro controllers or programmable logic); for details see of IEC 61508-2, ed2, 2010.

4 Exida ROS 05-05-05 R001 V2 R3 FMEDA T-001 V9,R2 Page 3 of 27 Table 1 Failure rates for the Rosemount 3051S, Coplanar Differential & Coplanar Gage Failure Category Failure Rate (FIT) Fail Safe Undetected 82 Fail Dangerous Detected 274 Fail Detected (detected by internal diagnostics) 182 Fail High (detected by logic solver) 59 Fail Low (detected by logic solver) 33 Fail Dangerous Undetected 40 No Effect 138 Annunciation Undetected 5 Table 2 Failure rates for the Rosemount 3051S, Coplanar Absolute, In-line Gage & In-line Absolute Failure Category Failure Rate (FIT) Fail Safe Undetected 80 Fail Dangerous Detected 260 Fail Detected (detected by internal diagnostics) 175 Fail High (detected by logic solver) 58 Fail Low (detected by logic solver) 26 Fail Dangerous Undetected 37 No Effect 115 Annunciation Undetected 7 These Failure rates are valid for the useful lifetime of the product, see Appendix A.

5 The Failure rates listed in this report do not include failures due to wear-out of any components. They reflect random failures and include failures due to external events, such as unexpected use, see section Table 3 lists the Failure rates for the Rosemount 3051S according to IEC 61508, ed2, 2010. exida ROS 05-05-05 R001 V2 R3 FMEDA T-001 V9,R2 Page 4 of 27 Table 3 Failure rates according to IEC 61508 in FIT Device SD SU2 DD DU SFF3 Rosemount 3051S_ Coplanar Differential & Coplanar Gage configuration - 82 274 40 90% Rosemount 3051S_ Coplanar Absolute, In-line Gage & In-line Absolute configuration - 80 260 37 90% Route 2H Table Device SD SU DD DU 3051S 4-20mA HART Pressure Transmitter: Coplanar Differential & Coplanar Gage - 82 274 40 - 3051S 4-20mA HART Pressure Transmitter: Coplanar Absolute, In-line Gage & In-line Absolute - 80 260 37 - 3051S Flowmeter based on 1195, 405, or 485 Primaries 3051S 4-20mA HART Flowmeter Series4 - 90 274 51 - 3051S Level Transmitter.

6 (w/o additional Seal) 3051S 4-20mA HART Pressure Transmitter - 82 274 74 - 3051S Transmitter with Remote Seals5 A user of the Rosemount 3051S can utilize these Failure rates in a probabilistic model of a safety instrumented function (SIF) to determine suitability in part for safety instrumented system (SIS) usage in a particular safety integrity level (SIL). A full table of Failure rates is presented in section along with all assumptions. 2 It is important to realize that the No Effect failures are no longer included in the Safe Undetected Failure category according to IEC 61508, ed2, 2010. 3 SFF not required for devices certified using Route 2H data. For information detailing the Route 2H approach as defined by IEC 61508-2, see Technical Document entitled "Route 2H SIL Verification for Rosemount Type B Transmitters with Type A Components".

7 4 Refer to ROS 13/04-008 R001 V1R0 for the Flowmeter FMEDA report for models that are excluded. 5 Refer to the Remote Seal (ROS 1105075 R001 V2R1) FMEDA report for the additional Failure rates to use when using with attached Remote Seals, or use exSILentia. exida ROS 05-05-05 R001 V2 R3 FMEDA T-001 V9,R2 Page 5 of 27 Table of Contents Management Summary .. 2 1 Purpose and Scope .. 6 2 Project Management .. 7 exida .. 7 Roles of the parties involved .. 7 Standards and literature used .. 7 Reference documents .. 8 Documentation provided by Rosemount, Inc.. 8 Documentation generated by exida .. 8 3 Product Description .. 9 4 Failure Modes, Effects , and Diagnostic Analysis .. 10 Failure categories description .. 10 Methodology FMEDA, Failure rates .. 11 FMEDA .. 11 Failure rates .. 11 Assumptions .. 12 Results .. 13 5 Using the FMEDA Results.

8 15 Impulse line clogging .. 15 PFDAVG calculation Rosemount 3051S .. 15 exida Route 2H 15 6 Terms and Definitions .. 17 7 Status of the Document .. 18 Liability .. 18 Releases .. 18 Future enhancements .. 18 Release signatures .. 19 Appendix A Lifetime of Critical Components .. 20 Appendix B Proof Tests to Reveal Dangerous Undetected Faults .. 21 Partial Proof Test .. 21 Comprehensive Proof Test .. 21 Proof Test Coverage .. 22 Appendix C exida Environmental Profiles .. 23 Appendix D Determining Safety Integrity Level .. 24 exida ROS 05-05-05 R001 V2 R3 FMEDA T-001 V9,R2 Page 6 of 27 1 Purpose and Scope This document shall describe the results of the hardware assessment in the form of the Failure Modes, Effects and Diagnostic Analysis carried out on the Rosemount 3051S. From this, Failure rates and example PFDAVG values may be calculated.

9 The information in this report can be used to evaluate whether an element meets the average Probability of Failure on Demand (PFDAVG) requirements and if applicable, the architectural constraints / minimum hardware fault tolerance requirements per IEC 61508 / IEC 61511. An FMEDA is part of the effort needed to achieve full certification per IEC 61508 or other relevant functional safety standard. exida ROS 05-05-05 R001 V2 R3 FMEDA T-001 V9,R2 Page 7 of 27 2 Project Management exida exida is one of the world s leading accredited Certification Bodies and knowledge companies specializing in automation system safety and availability with over 300 years of cumulative experience in functional safety. Founded by several of the world s top reliability and safety experts from assessment organizations and manufacturers, exida is a global company with offices around the world.

10 Exida offers training, coaching, project oriented system consulting services, safety lifecycle engineering tools, detailed product assurance, cyber-security and functional safety certification, and a collection of on-line safety and reliability resources. exida maintains the largest process equipment database of Failure rates and Failure modes with over 100 billion unit operating hours. Roles of the parties involved Rosemount, Inc. Manufacturer of the Rosemount 3051S exida Performed the hardware assessment Rosemount, Inc. contracted exida with the hardware assessment of the above-mentioned element. Standards and literature used The services delivered by exida were performed based on the following standards / literature. [N1] IEC 61508-2: ed2, 2010 Functional Safety of Electrical/Electronic/Programmable Electronic Safety-Related Systems [N2] Electrical Component Reliability Handbook, 3rd Edition, 2012 exida LLC, Electrical Component Reliability Handbook, Third Edition, 2012, ISBN 978-1-934977-04-0 [N3] Mechanical Component Reliability Handbook, 3rd Edition, 2012 exida LLC, Electrical & Mechanical Component Reliability Handbook, Third Edition, 2012, ISBN 978-1-934977-05-7 [N4] Safety Equipment Reliability Handbook, 3rd Edition, 2007 exida LLC, Safety Equipment Reliability Handbook, Third Edition, 2007, ISBN 978-0-9727234-9-7 [N5] Goble, 2010 Control Systems Safety Evaluation and Reliability, 3rd edition, ISA, ISBN 97B-1-934394-80-9.