Functional Safety of Machinery

Marco Tacchini is Technical Director and owner of the consulting company GT Engineering, based in Brescia, Italy, which specializes in CE Marking, risk assessment, and risk reduction of machineries. Marco is a member of several technical committees that define Functional Safety Standards, including: ISO/TC 199 WG 8 for ISO 13849-1: Safe Control SystemsTC 44/MT 62061 for IEC 62061: Safe control systems for machineryTC 65/SC 65A/MT 61511 for IEC 61511: Safety instrumented systems for the process industryTC 65/SC 65A/MT 61508-1-2 for IEC 61508: Maintenance of IEC 61508-1, -2, -3,-4, -5, -6 and 7 He leads short courses on functional safety at Brescia Engineering University and Milan Polytechnique.

• Preface xvAcknowledgments xixAbout the Author xxiBefore You Start Reading this Book xxiii1 The Basics of Reliability Engineering 11.1 The Birth of Reliability Engineering 11.1.1 Safety Critical Systems 21.2 Basic Definitions and Concepts of Reliability 21.3 Faults and Failures 21.3.1 Definitions 31.3.2 Random and Systematic Failures 31.3.2.1 How Random is a Random Failure? 41.4 Probability Elements Beyond Reliability Concepts 51.4.1 The Discrete Probability Distribution 51.4.1.1 Example: 10 Colored Balls 61.4.1.2 Example: 2 Dice 71.4.2 The Probability Density Function f (x) 71.4.2.1 Example 81.4.3 The Cumulative Distribution Function F(x) 91.4.4 The Reliability Function R(t) 101.5 Failure Rate λ 111.5.1 The Maclaurin Series 141.5.2 The Failure in Time or FIT 141.5.2.1 Example 141.6 Mean Time to Failure 141.6.1 Example of a Non-Constant Failure Rate 151.6.2 The Importance of the MTTF 161.6.3 The Median Life 161.6.4 The Mode 161.6.4.1 Example 171.6.4.2 Example 171.7 Mean Time Between Failures 181.8 Frequency Approach Example 191.8.1 Initial Data 191.8.2 Empirical Definition of Reliability and Unreliability 201.9 Reliability Evaluation of Series and Parallel Structures 221.9.1 The Reliability Block Diagrams 221.9.2 The Series Configuration 231.9.3 The Parallel Configuration 241.9.3.1 Two Equal and Independent Elements 241.9.4 M Out of N Functional Configurations 261.10 Reliability Functions in Low and High Demand Mode 271.10.1 The PFD 281.10.1.1 The Protection Layers 291.10.1.2 Testing of the Safety Instrumented System 301.10.2 The PFDavg 301.10.2.1 Dangerous Failures 311.10.2.2 How to Calculate the PFDavg 311.10.3 The PFH 321.10.3.1 Unconditional Failure Intensity w(t) vs Failure Density f (t) 321.10.3.2 Reliability Models Used to Estimate the PFH 341.11 Weibull Distribution 341.11.1 The Probability Density Function 341.11.2 The Cumulative Density Function 351.11.3 The Instantaneous Failure Rate 361.11.4 The Mean Time to Failure 371.11.4.1 Example 381.12 B10Dand the Importance of T10D391.12.1 The BX% Life Parameter and the B10D 391.12.1.1 Example 401.12.2 How λD and MTTFD are Derived from B10D401.12.3 The Importance of the Parameter T10D411.12.4 The Surrogate Failure Rate 431.12.5 Markov 431.13 Logical and Physical Representation of a Safety Function 451.13.1 De-energization of Solenoid Valves 451.13.2 Energization of Solenoid Valves 462 What is Functional Safety 472.1 A Brief History of Functional Safety Standards 472.1.1 IEC 61508 (All Parts) 482.1.1.1 HSE Study 492.1.1.2 Safety Integrity Levels 502.1.1.3 FMEDA 512.1.1.4 High and Low Demand Mode of Operation 522.1.1.5 Safety Functions and Safety-Related Systems 532.1.1.6 An Example of Risk Reduction Through Functional Safety 542.1.1.7 Why IEC 61508 was Written 542.1.2 ISO 13849-1 552.1.3 IEC 62061 562.1.4 IEC 61511 562.1.4.1 Introduction 562.1.4.2 The Second Edition 572.1.4.3 Designing a SIS 582.1.4.4 Three Methods 582.1.4.5 The Concept of Protection Layers 592.1.4.6 The Different Types of Risk 602.1.4.7 The Tolerable Risk 602.1.4.8 The ALARP Principle 622.1.4.9 Hazard and Operability Studies (HAZOP) 642.1.4.10 Layer of Protection Analysis (LOPA) 642.1.5 PFDavg for Different Architectures 652.1.5.1 1oo1 Architecture in Low Demand Mode 652.1.5.2 Series of 1oo1 Architecture in Low Demand Mode 662.1.5.3 1oo2 Architecture in Low Demand Mode 662.1.5.4 1oo3 Architecture in Low Demand Mode 672.1.5.5 2oo3 Architecture in Low Demand Mode 672.1.5.6 Summary Table 682.1.5.7 Example of PFDAvg Calculation 692.1.6 Reliability of a Safety Function in Low Demand Mode 702.1.7 A Timeline 722.2 Safety Systems in High and Low Demand Mode 732.2.1 Structure of the Control System in High and Low Demand Mode 732.2.1.1 Structure in Low Demand Mode, Process Industry 732.2.1.2 Structure in High Demand Mode, Machinery 742.2.1.3 Continuous Mode of Operation 742.2.2 The Border Line Between High and Low Demand Mode 742.2.2.1 Considerations in High Demand Mode 742.2.2.2 Considerations in Low Demand Mode 752.2.2.3 The Intermediate Region 752.3 What is a Safety Control System 762.3.1 Control System and Safety System 762.3.2 What is Part of a Safety Control System 782.3.3 Implication of Implementing an Emergency Start Function 792.4 CE Marking, OSHA Compliance, and Functional Safety 802.4.1 CE Marking 802.4.2 The European Standardization Organizations (ESOs) 812.4.3 Harmonized Standards 822.4.4 Functional Safety in North America 842.4.4.1 The Concept of Control Reliable 852.4.4.2 Functional Safety in the United States 863 Main Parameters 873.1 Failure Rate (λ) 873.1.1 Definition 873.1.2 Detected and Undetected Failures 883.1.3 Failure Rate for Electromechanical Components 893.1.3.1 Input Subsystem: Interlocking Device 893.1.3.2 Input Subsystem: Pressure Switch 893.1.3.3 Output Subsystem: Solenoid Valve 903.1.3.4 Output Subsystem: Power Contactor 903.2 Safe Failure Fraction 913.2.1 SFF in Low Demand Mode: Pneumatic Solenoid Valve 923.2.1.1 Example 933.2.2 SFF in High Demand Mode: Pneumatic Solenoid Valve 943.2.2.1 Example for a 1oo1 Architecture 943.2.2.2 Example for a 1oo2D Architecture 953.2.3 SFF and Electromechanical Components 963.2.3.1 The Advantage of Electronic Sensors 973.2.3.2 SFF and DC for Electromechanical Components 973.2.4 SFF in Low Demand Mode: Analog Input 983.2.5 SFF and DC in High Demand Mode: The Dynamic Test and Namur Circuits 1003.2.5.1 Namur Type Circuits 1013.2.5.2 Three Wire Digital Input 1023.2.6 Limits of the SFF Parameter 1023.2.6.1 Example 1033.3 Diagnostic Coverage (DC) 1033.3.1 Levels of Diagnostic 1053.3.2 How to Estimate the DC Value 1053.3.3 Frequency of the Test 1063.3.4 Direct and Indirect Testing 1063.3.4.1 DC for the Component and for the Channel 1073.3.5 Testing by the Process 1083.3.6 Examples of DC Values 1093.3.7 Estimation of the Average DC 1113.4 Safety Integrity and Architectural Constraints 1123.4.1 The Starting Point 1123.4.2 The Systematic Capability 1133.4.2.1 Systematic Safety Integrity 1133.4.3 Confusion Generated by the Concept of Systematic Capability 1143.4.3.1 Random Capability 1143.4.3.2 Systematic Capability 1153.4.3.3 ISO 13849-1 1153.4.4 The Safety Lifecycle 1153.4.5 The Software Safety Lifecycle 1153.4.6 Hardware Fault Tolerance 1173.4.7 The Hardware Safety Integrity 1183.4.7.1 Type A and Type B Components 1183.4.8 Route 1H 1193.4.8.1 Route 1H and Type A Component: Example 1193.4.8.2 Route 1H and Type B Component: Example 1203.4.9 High Demand Mode Safety-Related Control Systems 1203.4.9.1 Example 1213.4.10 Route 2H 1223.5 Mean Time to Failure (MTTF) 1233.5.1 Examples of MTTF Values 1233.5.2 Calculation of MTTFD and λD for Components from B10D 1253.5.3 Estimation of MTTFD for a Combination of Systems 1253.5.3.1 Example for Channels in Series 1263.5.3.2 Example for Redundant Channels 1263.6 Common Cause Failure (CCF) 1273.6.1 Introduction to CCF and the Beta-Factor 1273.6.2 How IEC 62061 Handles the CCF 1283.6.3 How ISO 13849-1 Handles the CCF 1293.7 Proof Test 1303.7.1 Proof Test Procedures 1313.7.1.1 Example of a Proof Test Procedure for a Pressure Transmitter 1313.7.1.2 Example of a Proof Test Procedure for a Solenoid Valve 1323.7.2 How the Proof Test Interval Affects the System Reliability 1333.7.2.1 Example 1333.7.3 Proof Test in Low Demand Mode 1343.7.3.1 Imperfect Proof Testing and the Proof Test Coverage (PTC) 1353.7.3.2 Partial Proof Test (PPT) 1363.7.3.3 Example for a Partial Valve Stroke Test 1373.7.4 Proof Test in High Demand Mode 1383.8 Mission Time and Useful Lifetime 1393.8.1 Mission Time Longer than 20 Years 1404 Introduction to ISO 13849-1 and IEC 62061 1414.1 Risk Assessment and Risk Reduction 1414.1.1 Cybersecurity 1414.1.2 Protective and Preventive Measures 1434.1.3 Functional Safety as Part of the Risk Reduction Measures 1444.1.4 The Naked Machinery 1464.2 SRP/CS, SCS, and the Safety Functions 1464.2.1 SRP/CS and SCS 1464.2.2 The Safety Function and Its Subsystems 1474.2.3 The Physical and the Functional Level 1474.3 Examples of Safety Functions 1494.3.1 Safety-Related Stop 1494.3.2 Safety Sub-Functions Related to Power Drive Systems 1494.3.2.1 Stopping Functions 1494.3.2.2 Monitoring Functions 1514.3.2.3 Information to be Provided by the PDS Manufacturer 1524.3.3 Manual Reset 1524.3.3.1 Multiple Sequential Reset 1544.3.3.2 How to Implement the Reset Electrical Architecture 1544.3.4 Restart Function 1544.3.5 Local Control Function 1544.3.6 Muting Function 1544.3.7 Operating Mode Selection 1554.4 The Emergency Stop Function 1564.5 The Reliability of a Safety Function in High Demand Mode 1574.5.1 PFHD and PFH 1574.5.2 The Performance Level 1574.5.3 The Safety Integrity Level 1584.5.4 Relationship Between SIL and PL 1584.5.5 Definition of Harm 1594.6 Determination of the Required PL (PLr) According to ISO 13849-1 1594.6.1 Risk Parameters 1604.6.1.1 S: Severity of Injury 1604.6.1.2 F: Frequency and/or Exposure Time to Hazard 1604.6.1.3 P: Possibility of Avoiding Hazard or Limiting Harm 1604.6.1.4 An Example on How to Use the Graph 1614.7 Rapex Directive 1624.8 Determination of the Required SIL (SILr) According to IEC 62061 1634.8.1 Risk Elements and SIL Assignment 1644.8.2 Severity (Se) 1654.8.3 Probability of Occurrence of Harm 1654.8.3.1 Frequency and Duration of Exposure (Fr) 1654.8.3.2 Probability of Occurrence of a Hazardous Event (Pr) 1664.8.3.3 Probability of Avoiding or Limiting the Harm (Av) 1664.8.3.4 Example of the Table Use 1674.9 The Requirements Specification 1674.9.1 Information Needed to Prepare the SRS or the FRS 1674.9.2 The Specifications of All Safety Functions 1684.10 Iterative Process to Reach the Required Reliability Level 1694.11 Fault Considerations and Fault Exclusion 1704.11.1 How Many Faults Should be Considered? 1704.11.2 Fault Exclusion and Interlocking Devices 1704.11.2.1 Fault Exclusion Applied to Interlocking Devices 1704.11.2.2 Fault Exclusion on Pre-defined Subsystems 1724.11.2.3 Fault Exclusion Made by the Machinery Manufacturer 1724.11.2.4 Types of Guard Locking Mechanism 1734.11.2.5 What Are the Safety Signals in an Interlocking Device with Guard Lock? 1744.11.2.6 What Safety Functions are Associated to a Guard Interlock 1744.11.3 Other Examples of Fault Exclusions 1754.11.3.1 Short Circuit Between any Two Conductors 1754.11.3.2 Welding of Contact Elements in Contactors 1764.12 International Standards for Control Circuit Devices 1774.12.1 Direct Opening Action 1774.12.1.1 Direct and Non-Direct Opening Action 1794.12.2 Contactors Used in Safety Applications 1794.12.2.1 Power Contactors 1794.12.2.2 Auxiliary Contactors 1804.12.2.3 Electromechanical Elementary Relays 1814.12.3 How to Avoid Systematic Failures in Motor Branch Circuits 1824.12.3.1 How to Protect Contactors from Overload and Short Circuit 1824.12.3.2 Contactor Reliability Data 1834.12.4 Implications Coming from IEC 60204-1 and NFPA 79 1844.12.4.1 Wrong Connection of the Emergency Stop Button 1854.12.4.2 Situation in Case of Two Faults: Again a Wrong Connection! 1854.12.4.3 Correct Wiring and Bonding in a Control Circuit 1864.12.5 Enabling and Hold to Run Devices 1864.12.5.1 Enabling Devices 1864.12.5.2 Hold to Run Device 1894.12.6 Current Sinking and Sourcing Digital I/O 1904.13 Measures for the Avoidance of Systematic Failures 1924.13.1 The Functional Safety Plan 1924.13.2 Basic Safety Principles 1934.13.2.1 Application of Good Engineering Practices 1934.13.2.2 Use of De-energization Principles 1934.13.2.3 Correct Protective Bonding (Electrical Basic Safety Principle) 1934.13.3 Well-Tried Safety Principles 1944.13.3.1 Positively Mechanically Linked Contacts 1944.13.3.2 Fault Avoidance in Cables 1944.14 Fault Masking 1954.14.1 Introduction to the Methodology 1954.14.1.1 Redundant Arrangement with Star Cabling 1954.14.1.2 Redundant Arrangement with Branch Cabling 1964.14.1.3 Redundant Arrangement with Loop Cabling 1964.14.1.4 Single Arrangement with Star Cabling 1974.14.1.5 Single Arrangement with Branch Cabling 1984.14.1.6 Single Arrangement with Loop Cabling 1984.14.2 Fault Masking Example: Unintended Reset 1994.14.3 Methodology for DC Evaluation 2004.14.3.1 The Simplified Method 2004.14.3.2 Regular Method 2014.14.3.3 Example 2015 Design and Evaluation of Safety Functions 2055.1 Subsystems, Subsystem Elements, and Channels 2055.1.1 Subsystems 2055.1.2 Subsystem Element and Channel 2055.1.3 Decomposition of a Safety Function 2075.1.4 Definition of Device Types 2085.1.4.1 Device Type 1 2085.1.4.2 Device Type 2 2085.1.4.3 Device Type 3 2085.1.4.4 Device Type 4 2085.1.4.5 Implication for General Purpose PLCs 2095.2 Well-Tried Components 2105.2.1 List of Well-Tried Components 2115.2.1.1 Mechanical Systems 2115.2.1.2 Pneumatic Systems 2115.2.1.3 Hydraulic Systems 2125.2.1.4 Electrical Systems 2125.3 Proven in Use and Prior Use Devices 2145.3.1 Proven in Use 2145.3.2 Prior Use Devices 2155.3.3 Prior Use vs Proven in Use 2155.4 Use of Process Control Systems as Protection Layers 2155.5 Information for Use 2165.5.1 Span of Control 2165.5.2 Information for the Machinery Manufacturer 2175.5.3 Information for the User 2175.6 Safety Software Development 2185.6.1 Limited and Full Variability Language 2185.6.2 The V-Model 2195.6.3 Software Classifications According to IEC 62061 2205.6.3.1 Software Level 1 2215.6.3.2 Software Safety Requirements for Level 1 2225.6.3.3 Software Design Specifications for Level 1 2225.6.3.4 Software Testing for Level 1 2235.6.3.5 Validation of Safety-Related Software 2235.6.4 Software Safety Requirements According to ISO 13849-1 2235.6.4.1 Requirements When SRASW is Developed with LVL 2245.6.4.2 Software-Based Manual Parameterization 2255.7 Low Demand Mode Applications in Machinery 2265.7.1 How to Understand if a Safety System is in High or in Low Demand Mode 2265.7.1.1 Milling Machine 2265.7.1.2 Industrial Furnaces 2265.7.2 Subsystems in Both High and Low Demand Mode 2275.7.3 How to Address Low Demand Mode in Machinery 2305.7.4 Subsystems Used in Both High and Low Demand Mode 2305.7.5 How to Assess “Mixed” Safety Systems: Method 1 2315.7.5.1 How to Estimate the Failure Rate of the Shared Subsystem 2315.7.5.2 Relationship Between PFDavg and PFHD 2315.7.5.3 Safety Functions 1 with a Shared Subsystem: Method 1 2325.7.5.4 Safety Functions 2 with a Shared Subsystem: Method 1 2335.7.6 How to Assess “Mixed” Safety Systems: Method 2 2355.7.6.1 How the Method Works 2355.7.6.2 Safety Function 2 with a Shared Subsystem: Method 2 2366 The Categories of ISO 13849-1 2376.1 Introduction 2376.1.1 Introduction to the Simplified Approach 2386.1.2 Physical and Logical Representation of the Architectures 2396.1.3 The Steps to be Followed 2406.2 The Five Categories 2416.2.1 Introduction 2416.2.2 Category B 2416.2.3 Category 1 2426.2.3.1 Example of a Category 1 Input Subsystem: Interlocking Device 2426.2.4 Category 2 2436.2.5 Markov Modelling of Category 2 2456.2.5.1 The OK State 2456.2.5.2 From the OK State to the Failure State 2466.2.5.3 From the Failure State to the Hazardous Event 2476.2.5.4 Other States in the Transition Model 2486.2.5.5 The Simplified Graph of the Markov Modelling 2486.2.5.6 The Importance of the Time-Optimal Testing 2496.2.5.7 1oo1D in Case of Time-Optimal Testing 2496.2.6 Conditions for the Correct Implementation of a Category 2 Subsystem 2506.2.7 Examples of Category 2 Circuits 2516.2.7.1 Example of Category 2 – PL c 2516.2.7.2 Example of Category 2 – PL d 2526.2.7.3 Example of a Category 2 with Undervoltage Coil 2536.2.8 Category 3 2546.2.8.1 Diagnostic Coverage in Category 3 2556.2.8.2 Example of Category 3 for Input Subsystem: Interlocking Device 2566.2.8.3 Example of Category 3 for Output Subsystem: Pneumatic Actuator 2586.2.9 Category 4 2606.2.9.1 Category 4 When the Demand Rate is Relatively Low 2606.2.9.2 Example of a Category 4 Input Subsystem: Emergency Stop 2616.2.9.3 Example of Category 4 for Output Subsystems: Electric Motor 2626.3 Simplified Approach for Estimating the Performance Level 2636.3.1 Conditions for the Simplified Approach 2636.3.2 How to Calculate MTTFD of a Subsystem 2646.3.3 Estimation of the Performance Level 2646.3.3.1 The Simplified Graph 2656.3.3.2 Table K.1 in Annex K 2656.3.3.3 The Extended Graph 2706.4 Determination of the Reliability of a Safety Function 2707 The Architectures of IEC 62061 2737.1 Introduction 2737.1.1 The Architectural Constraints 2737.1.2 The Simplified Approach 2757.1.2.1 Differences with ISO 13849-1 2757.1.2.2 How to Calculate the PFHD of a Basic Subsystem Architecture 2757.1.3 The Avoidance of Systematic Failures 2757.1.4 Relationship Between λD and MTTFD 2767.2 The Four Subsystem Architectures 2777.2.1 Repairable vs Non-Repairable Systems 2777.2.2 Basic Subsystem Architecture A: 1oo1 2777.2.2.1 Implications of the Architectural Constraints in Basic Subsystem Architecture A 2777.2.2.2 Example of a Basic Subsystem Architecture A 2787.2.3 Basic Subsystem Architecture B: 1oo2 2787.2.3.1 Implications of Architectural Constraints in Basic Subsystem Architecture B 2797.2.3.2 Example of a Basic Output Subsystem Architecture B: Electric Motor 2797.2.4 Basic Subsystem Architecture C: 1oo1D 2817.2.4.1 Conditions for a Correct Implementation of Basic Subsystem Architecture C 2827.2.4.2 Basic Subsystem Architecture C with Fault Handling Done by the SCS 2837.2.5 Basic Subsystem Architecture C with Mixed Fault Handling 2837.2.5.1 PFHD in Case of Four Conditions Satisfied 2857.2.5.2 PFHD in Case One of the Four Conditions is Not Satisfied 2867.2.5.3 Implications of the Architectural Constraints in Basic Subsystem Architecture C 2867.2.6 Example of a Basic Subsystem Architecture C 2877.2.7 Alternative Formula for the Basic Subsystem Architecture C 2897.2.8 Basic Subsystem Architecture D: 1oo2D 2907.2.8.1 Implications of the Architectural Constraints in Basic Subsystem Architecture D 2917.2.8.2 Example of Input Basic Subsystem Architecture D: Emergency Stop 2917.2.8.3 Example of Input Basic Subsystem Architecture D: Interlocking Device 2927.2.8.4 Example of a Basic Subsystem Architecture D Output 2937.3 Determination of the Reliability of a Safety Function 2958 Validation 2978.1 Introduction 2978.1.1 Level of Independence of People Doing the Validation 2988.1.2 Flow Chart of the Validation Process 2998.2 The Validation Plan 2998.2.1 Fault List 2998.2.2 Validation Measures Against Systematic Failures 3018.2.3 Information Needed for the Validation 3018.2.4 Analysis and Testing 3018.2.4.1 Analysis 3018.2.4.2 Testing 3028.2.4.3 Validation of the Safety Integrity of Subsystems 3038.2.4.4 Validation of the Safety-related Software 3048.2.4.5 Software-based Manual Parameterization 3049 Some Final Considerations 3079.1 ISO 13849-1 vs IEC 62061 3079.2 High vs Low-Demand Mode Applications 3089.3 The Importance of Risk Assessment 3099.3.1 Principles of Safety Integration 3109.3.1.1 The Glass Dome 3119.3.2 How to Run a Risk Assessment 311Bibliography 313Index 317