【正文】 (allows for past failures) ? UNAVAILABILITY ? The probability of failure at a moment in time ? A = 1 U 169。 ABB Page 47 Functional safety Availability vs reliability ? Availability – the probability of success at a moment of time ? Reliability – the probability of success for an interval of time (no failure and repair during interval) 0 or 1 169。 ABB Page 48 Functional safety Reliability / Safety engineering terms ? Reliability ? the probability of success during an interval of time ? Example ? The probability of successful operation for 1 hour =0,999 ? What is the probability of successful operation in 1 day ? ? PS (24) = PS (1hour)*PS(1hour)….24 ? PS(24) = (1 hour)24 = (0,999)24 = 0,976 169。 ABB Page 49 Functional safety Available vs reliabilty(Safety reliable) ? A system or ponent is reliable even if it has hade a safe shutdown (PFS) or spurious trip. But a system is only available if it is up and running and performs the tasks it is intended to do. The relation between availability and reliability is as follow: ? Reliability is the probability of a ponent, or system, functioning correctly over a given period of time under a given set of operating conditions. ? Reliability example: A SIF is operating in a PSD system on an oil installation. This SIF is controlling a pressure relief valve on a gas vessel. It is critical that this SIF is able to respond on an action. It is only possible to do maintenance once a year. Then the proof test interval is 1 year. The reliability for this SIF is the probability that the SIF will relief the pressure if a high pressure should occur, or that the SIF is in a failsafe mode. ? The availability of a system is the probability that the system will be functioning correctly at any given time. ? Availability example: The same SIF as mentioned in the reliability example also have an availability figure. The availability for this SIF is the probability that the SIF is operational. Operational mean that the SIF continuously performs its intended functionality, . supervising the pressure including relief of the pressure upon a high pressure demand. This is not possible when the SIF is in the fail safe mode. ? A: Availability, R: Reliability(0 or 1), PFS: Probability of Failing Safely (spurious trio)。 ? A = R – PFS(0 amp。1) 169。 ABB Page 50 Functional safety 169。 ABB Page 51 Functional safety IEC61508 Part 6舉了好幾個系統(tǒng)結(jié)構(gòu)例子。但描述得很粗略和含糊，加上其名字和體系結(jié)構(gòu)圖非常相近，所以很多人沒法理解其區(qū)別。個人認為，其用意不在系統(tǒng)結(jié)構(gòu)設(shè)計，而是在于突出不同的硬件體系結(jié)構(gòu)設(shè)計會有不同的系統(tǒng)可靠性結(jié)果，但似乎很多人把它們作為安全相關(guān)系統(tǒng)設(shè)計的典范。以下我按 IEC原文意思解釋一下這三個體系結(jié)構(gòu)： 1oo2結(jié)構(gòu)包含了兩個并聯(lián)通道，每個通道都可以處理同一個安全功能，很明顯這兩個通道是冗余設(shè)計（盡管 IEC原文沒有說），一通道可以看作是另外一通道的備份。當這雙通道均失效，其安全功能便失效。該結(jié)構(gòu)還含有在線診斷，但其診斷只作檢測錯誤和記錄，不能改變系統(tǒng)狀態(tài)和輸出，所以對系統(tǒng)可靠性和安全都沒有幫助。 2oo2結(jié)構(gòu)和 1oo2相似，都含有兩個并聯(lián)通道和在線診斷，但不同的是 2oo2的雙通道是一起合作完成一個安全功能，所以如果其中一個通道失效會導致整個安全功能失效。我理解，其并聯(lián)結(jié)構(gòu)安排是因為該兩通道都需要同一輸入數(shù)據(jù)，但負責安全功能的不同部分，因此每個通道的輸出結(jié)果需要‘捆綁’在一起，才算完成其安全功能。很明顯， 2oo2的可靠性肯定遠低于 1oo2，因為前者是單點失效模型。 IEC原文沒有提到這雙通道是否冗余，照理應(yīng)該不是，既然每個通道負責不同的功能。當然也可以有冗余部分，只能看具體應(yīng)用。 1oo2D結(jié)構(gòu)和 2oo2幾乎一樣，但不同的是 1oo2D的在線診斷在必要時可以改變系統(tǒng)狀態(tài)：一旦發(fā)現(xiàn)其一通道有問題，可以把系統(tǒng)輸出轉(zhuǎn)換為以另一通道的輸出為準，或者如果該雙通道都失效，把系統(tǒng)轉(zhuǎn)換為安全模式 （ fail safety）。另外 IEC原文暗示其在線診斷是通過互相比較這雙通道的狀態(tài)來檢測是否雙通道均失效。如果這樣話，該雙通道應(yīng)該是冗余，這樣卻跟 2oo2有點矛盾，況且 1oo2D這個名字應(yīng)該是基于 1oo2而不是 2oo2，真是想不明白。 IEC原文也沒有交待如何檢測單一通道錯誤，我估計應(yīng)該是 sanity checking/consistency checking/etc。 169。 ABB Page 52 Functional safety 169。 ABB Page 53 Functional safety