A dangerous failure that the diagnostics detect (λDD) is not hidden, but it still matters: until it is repaired, the channel is not available. What happens on detection is a design decision that must be written in the SRS.
Two options
- Trip (or vote as tripped): a detected failure drives the channel to its safe state. In a 2oo3 group one failed transmitter makes the group 1oo2. The function stays safe; the spurious trip rate rises slightly.
- Alarm and repair: the channel stays in service as failed while maintenance repairs it within the MTTR. During that time the group has less fault tolerance, and compensating measures (operator watch, temporary procedure) should be defined.
How it enters the calculation
For a single channel, a detected failure that does not trip adds about λDD · MTTR to PFDavg. In redundant groups, the detected failures change the voting for the repair time; the common cause share βD of detected failures matters too.
Diagnostic coverage
DC = λDD / (λDD + λDU). It depends on the logic solver actually acting on the diagnostic: a transmitter's out-of-range alarm is only "detected" if the safety PLC monitors the current and responds.
MTTR is a commitment
The calculation uses MTTR as an input; the site must achieve it. If spare parts, permits and staff mean a realistic repair takes 72 hours, enter 72, not the default 8.
In First Out AI
Each group has λDD, MTTR, MRT and the option "Detected failure trips the function". The SRS draft writes the response to detected failures and the repair time assumed; fill "Response to detected failures" in the specification details.
Written for First Out AI as engineering guidance. It supports engineering work and does not replace it; check every value against your standards, certificates and company rules with a competent functional safety engineer.