🎓 Lesson 10
D5
Fail-Safe Design Patterns for Critical Loops
Fail-safe design patterns ensure that if any part of a critical control loop fails, the system automatically goes to a safe state—like stopping blasting or venting pressure—instead of causing harm.
🎯 Learning Objectives
- ✓ Analyze a PLC-based blast initiation loop to identify single-point failure modes
- ✓ Design a dual-channel, voted fail-safe interlock for a detonator charging station
- ✓ Explain how de-energize-to-trip logic reduces common-cause failure risk in hazardous zones
- ✓ Calculate required diagnostic coverage (DC) and safe failure fraction (SFF) for SIL 2 compliance
📖 Why This Matters
In mining and blasting operations, a single undetected fault—a stuck relay, corrupted PLC memory, or miswired sensor—can trigger unintended detonation, catastrophic equipment failure, or toxic gas release. Fail-safe design isn’t optional: it’s the engineering backbone of lives saved. Consider the 2014 Mount Polley tailings dam breach—root cause included inadequate fail-safe monitoring of level sensors. This lesson equips you to build control loops that *fail gracefully*, not catastrophically.
📘 Core Principles
Fail-safe design rests on three foundational layers: (1) *Fault detection*—using diagnostics (e.g., watchdog timers, loop current verification, cross-checking redundant sensors); (2) *Safe state definition*—explicitly specifying what ‘safe’ means per function (e.g., ‘detonator circuit open’, ‘ventilation fans at 100%’, ‘conveyor stopped and locked out’); and (3) *Architectural integrity*—applying principles like de-energize-to-trip (where loss of power = safe action), diversity (e.g., analog + digital sensors), and hardware fault tolerance (HFT ≥ 1 for SIL 2). Crucially, fail-safety is verified—not assumed—through systematic safety integrity verification (SIL verification) and proof testing.
📐 Safe Failure Fraction (SFF) Calculation
SFF quantifies the proportion of dangerous failures that result in a safe shutdown rather than a hazardous event. It is a key metric used in SIL determination per IEC 61508. A higher SFF enables higher achievable SIL ratings for a given architecture.
Safe Failure Fraction (SFF)
SFF = (λ_S + λ_DD) / (λ_S + λ_DD + λ_DU + λ_DDU)Measures the fraction of total failures that result in a safe or detected dangerous state, used to determine achievable SIL.
Variables:
| Symbol | Name | Unit | Description |
|---|---|---|---|
| λ_S | Safe failure rate | FIT | Failures that do not impede safety function and leave system operable |
| λ_DD | Dangerous detected failure rate | FIT | Failures that impair safety function but are detected by diagnostics |
| λ_DU | Dangerous undetected failure rate | FIT | Failures that impair safety function and remain undetected until proof test |
| λ_DDU | Dangerous no-effect failure rate | FIT | Rare failures that impair safety function but have no observable effect (often excluded in practice) |
Typical Ranges:
SIL 2 compliant relay module: 90% – 99%
SIL 3 compliant TMR PLC: 99% – 99.9%
💡 Worked Example
Problem: A dual-redundant detonator isolation relay module has the following FIT (failures in time) data: total dangerous failures = 42 FIT, dangerous detected failures = 28 FIT, dangerous undetected failures = 14 FIT, safe failures = 110 FIT.
1.
Step 1: Calculate total failures = dangerous detected + dangerous undetected + safe = 28 + 14 + 110 = 152 FIT
2.
Step 2: Apply SFF formula: SFF = (safe failures + dangerous detected failures) / total failures = (110 + 28) / 152 = 138 / 152
3.
Step 3: Compute SFF = 0.908 → 90.8%. Per IEC 61508 Table 2-6, this supports SIL 2 for HFT=1 architecture.
Answer:
The SFF is 90.8%, which falls within the SIL 2 range (≥ 90% for HFT=1).
🏗️ Real-World Application
At Newmont’s Boddington Gold Mine (Western Australia), the blast initiation PLC system uses a triple-modular redundant (TMR) architecture with diverse input channels (2-out-of-3 voting on arming switches) and de-energize-to-trip detonator relays. Each relay coil is powered only during the final arming phase—and powered *off* by default. If PLC firmware crashes, power drops, or wiring shorts, all relays de-energize, physically breaking the firing circuit. Independent third-party verification confirmed >99.99% probability of dangerous failure being safe, meeting SIL 3 requirements per AS IEC 61508.
🔧 Interactive Calculator
🔧 Open PLC-Based Process Control Calculator📋 Case Connection
📋 Pharmaceutical Sterile Fill Line Batch Control Upgrade
Legacy DCS lacked ISA-88 compliance; audit trails incomplete and recipe changes required manual revalidation
📋 Refinery Distillation Column Temperature Cascade Control
Single-loop temperature control caused overshoot and energy waste during feedstock transitions
📋 Beverage Plant CIP System Automation Modernization
Manual CIP cycles led to inconsistent sanitation, product cross-contamination, and downtime due to human error
📋 Chemical Plant Reactor Pressure Safety Interlock Retrofit
Electro-mechanical interlocks failed twice in 3 years, risking runaway reaction and BLEVE