ISO 13849-2:2012 Safety of machinery — Safety-related parts of control systems — Part 2: Validation

Foreword

ISO (the International Organization for Standardization) is a worldwide federation of national standards bodies (ISO member bodies). The work of preparing International Standards is normally carried out through ISO technical committees. Each member body interested in a subject for which a technical committee has been established has the right to be represented on that committee. International organizations, governmental and non-governmental, in liaison with ISO, also take part in the work. ISO collaborates closely with the International Electrotechnical Commission (IEC) on all matters of electrotechnical standardization.

International Standards are drafted in accordance with the rules given in the ISO/IEC Directives, Part 2.

The main task of technical committees is to prepare International Standards. Draft International Standards adopted by the technical committees are circulated to the member bodies for voting. Publication as an International Standard requires approval by at least 75 % of the member bodies casting a vote.

Attention is drawn to the possibility that some of the elements of this document may be the subject of patent rights. ISO shall not be held responsible for identifying any or all such patent rights.

ISO 13849-2 was prepared by Technical Committee ISO/TC 199, Safety of machinery.

This second edition cancels and replaces the first edition (ISO 13849-2:2003), which has been technically revised in order to adapt to ISO 13849-1:2006. In addition, the new Annex E provides an example for the validation of fault behaviour and diagnostic means.

ISO 13849 consists of the following parts, under the general title Safety of machinery — Safety-related parts of control systems:

Annexes A to D, which are informative, are structured according to Table 1.

Introduction

The structure of safety standards in the field of machinery is as follows:

1. a) type-A standards (basic safety standards) giving basic concepts, principles for design and general aspects that can be applied to machinery;
2. b) type-B standards (generic safety standards) dealing with one safety aspect or one type of safeguard that can be used across a wide range of machinery:

   — type-B1 standards on particular safety aspects (for example safety distances, surface temperature, noise);

   — type-B2 standards on safeguards (for example two-hand controls, interlocking devices, pressure-sensitive devices, guards);

3. c) type-C standards (machine safety standards) dealing with detailed safety requirements for a particular machine or group of machines.

This document is a type-B standard as stated in ISO 12100.

The requirements of this document can be supplemented or modified by a type-C standard.

For machines which are covered by the scope of a type-C standard and which have been designed and built according to the requirements of that standard, the requirements of that type-C standard take precedence.

This part of ISO 13849 specifies the validation process for the safety functions, categories and performance levels for the safety-related parts of control systems. It recognizes that the validation of safety-related parts of control systems can be achieved by a combination of analysis (see Clause 5) and testing (see Clause 6), and specifies the particular circumstances in which testing ought to be carried out.

Most of the procedures and conditions in this part of ISO 13849 are based on the assumption that the simplified procedure for estimating the performance level (PL) described in ISO 13849-1:2006, is used. This part of ISO 13849 does not provide guidance for situations when other procedures are used to estimate PL (e.g. Markov modelling), in which case some of its provisions will not apply and additional requirements can be necessary.

Guidance on the general principles for the design (see ISO 12100) of safety-related parts of control systems, regardless of the type of technology used (electrical, hydraulic, pneumatic, mechanical, etc.), is provided in ISO 13849-1. This includes descriptions of some typical safety functions, determination of their required performance levels, and general requirements of categories and performance levels.

Within this part of ISO 13849, some of the validation requirements are general, whereas others are specific to the type of technology used.

1 Scope

This part of ISO 13849 specifies the procedures and conditions to be followed for the validation by analysis and testing of

by the safety-related parts of a control system (SRP/CS) designed in accordance with ISO 13849-1.

NOTE

Additional requirements for programmable electronic systems, including embedded software, are given in ISO 13849-1:2006, and IEC 61508 .

2 Normative references

The following referenced documents are indispensable for the application of this document. For dated references, only the edition cited applies. For undated references, the latest edition of the referenced document (including any amendments) applies.

• ISO 12100:2010 Safety of machinery — General principles for design — Risk assessment and risk reduction
• ISO 13849-1:2006 Safety of machinery — Safety-related parts of control systems — Part 1: General principles for design

3 Terms and definitions

For the purposes of this document, the terms and definitions given in ISO 12100 and ISO 13849-1 apply.

4.1 Validation principles

The purpose of the validation process is to confirm that the design of the SRP/CS supports the overall safety requirements specification for the machinery.

The validation shall demonstrate that each SRP/CS meets the requirements of ISO 13849-1 and, in particular, the following:

1. a) the specified safety characteristics of the safety functions provided by that part, as set out in the design rationale;
2. b) the requirements of the specified performance level (see ISO 13849-1:2006):
   1. 1) the requirements of the specified category (see ISO 13849-1:2006),
   2. 2) the measures for control and avoidance of systematic failures (see ISO 13849-1:2006),
   3. 3) if applicable, the requirements of the software (see ISO 13849-1:2006), and
   4. 4) the ability to perform a safety function under expected environmental conditions;
3. c) the ergonomic design of the operator interface, e.g. so that the operator is not tempted to act in a hazardous manner, such as defeating the SRP/CS (see ISO 13849-1:2006).

Validation should be carried out by persons who are independent of the design of the SRP/CS.

NOTE

“Independent person” does not necessarily mean that a third-party test is required.

Validation consists of applying analysis (see Clause 5) and executing functional tests (see Clause 6) under foreseeable conditions in accordance with the validation plan. Figure 1 gives an overview of the validation process. The balance between the analysis and testing depends on the technology used for the safety-related parts and the required performance level. For Categories 2, 3 and 4 the validation of the safety function shall also include testing under fault conditions.

The analysis should be started as early as possible in, and in parallel with, the design process. Problems can then be corrected early while they are still relatively easy to correct, i.e. during steps “design and technical realization of the safety function” and “evaluate the performance level PL” [the fourth and fifth boxes down in in ISO 13849-1:2006]. It can be necessary for some parts of the analysis to be delayed until the design is well developed.

Where necessary due to the system's size, complexity or the effects of integrating it with the control system (of the machinery), special arrangements should be made for

Figure 1

“Modification of the design” in Figure 1 refers to the design process. If the validation cannot be successfully completed, changes in the design are necessary. The validation of the modified safety-related parts should then be repeated. This process should be iterated until all safety-related parts of the safety functions are successfully validated.

4.2 Validation plan

The validation plan shall identify and describe the requirements for carrying out the validation process for the specified safety functions, their categories and performance levels.

The validation plan shall also identify the means to be employed to validate the specified safety functions, categories and performance levels. It shall set out, where appropriate

1. a) the identity of the specification documents,
2. b) the operational and environmental conditions during testing,
3. c) the analyses and tests to be applied,
4. d) the reference to test standards to be applied, and
5. e) the persons or parties responsible for each step in the validation process.

Safety-related parts which have previously been validated to the same specification need only a reference to that previous validation.

4.3 Generic fault lists

The validation process involves consideration of the behaviour of the SRP/CS for all faults to be considered. A basis for fault consideration is given in the tables of fault lists in Annexes A to D, which are based on experience and which contain

Only permanent faults are taken into account in the fault lists.

4.4 Specific fault lists

If necessary, a specific product-related fault list shall be generated as a reference document for the validation process of the safety-related part(s). The list can be based on the appropriate generic list(s) found in the annexes.

Where the specific product-related fault list is based on the generic list(s) it shall state

1. a) the faults taken from the generic list(s) to be included,
2. b) any other relevant faults to be included but not given in the generic list (e.g. common-cause failures),
3. c) the faults taken from the generic list(s) which may be excluded on the basis that the criteria given in the generic list(s) (see ISO 13849-1:2006) are satisfied, andexceptionally
4. d) any other faults for which the generic list(s) do not permit an exclusion, but for which justification and rationale for an exclusion is presented (see ISO 13849-1:2006).

Where this list is not based on the generic list(s), the designer shall give the rationale for fault exclusions.

4.5 Information for validation

The information required for validation will vary with the technology used, the category or categories and performance level(s) to be demonstrated, the design rationale of the system, and the contribution of the SRP/CS to the reduction of the risk. Documents containing sufficient information from the following list shall be included in the validation process to demonstrate that the safety-related parts perform the specified safety functions to the required performance level or levels and category or categories:

1. a) specification of the required characteristics of each safety function, and its required category and performance level;
2. b) drawings and specifications, e.g. for mechanical, hydraulic and pneumatic parts, printed circuit boards, assembled boards, internal wiring, enclosure, materials, mounting;
3. c) block diagram(s) with a functional description of the blocks;
4. d) circuit diagram(s), including interfaces/connections;
5. e) functional description of the circuit diagram(s);
6. f) time sequence diagram(s) for switching components, signals relevant for safety;
7. g) description of the relevant characteristics of components previously validated;
8. h) for safety-related parts other than those listed in g), component lists with item designations, rated values, tolerances, relevant operating stresses, type designation, failure-rate data and component manufacturer, and any other data relevant to safety;
9. i) analysis of all relevant faults (see also 4.3 and 4.4), such as those listed in the tables of Annexes A to D, including the justification of any excluded faults;
10. j) an analysis of the influence of processed materials;
11. k) information for use, e.g. installation and operation manual/instruction handbook.

Where software is relevant to the safety function(s), the software documentation shall include

NOTE

See ISO 13849-1:2006, for requirements.

Information is required on how the performance level and average probability of a dangerous failure per hour is determined. The documentation of the quantifiable aspects shall include

Information is required for documentation on systematic aspects of the SRP/CS.

Information is required as to how the combination of several SRP/CS achieves a performance level in accordance with the performance level required.

4.6 Validation record

Validation by analysis and testing shall be recorded. The record shall demonstrate the validation process for each of the safety requirements. Cross-reference may be made to previous validation records, provided they are properly identified.

For any safety-related part which has failed an element of the validation process, the validation record shall describe which elements in the validation analysis/testing have been failed. It shall be ensured that all safety-related parts are successfully re-validated after modification.

5.1 General

Validation of the SRP/CS shall be carried out by analysis. Inputs to the analysis include the following:

Validation of the safety functions by analysis rather than testing requires the formulation of deterministic arguments.

NOTE 1

A deterministic argument is an argument based on qualitative aspects (e.g. quality of manufacture, experience of use). This consideration depends on the application, which, together with other factors, can affect the deterministic arguments.

NOTE 2

Deterministic arguments differ from other evidence in that they show that the required properties of the system follow logically from a model of the system. Such arguments can be constructed on the basis of simple, well-understood concepts.

5.2 Analysis techniques

The selection of an analysis technique depends upon the particular object. Two basic techniques exist, as follows.

1. a) Top-down (deductive) techniques are suitable for determining the initiating events that can lead to identified top events, and calculating the probability of top events from the probability of the initiating events. They can also be used to investigate the consequences of identified multiple faults.
   EXAMPLE

   Fault tree analysis (FTA, see IEC 61025), event tree analysis (ETA).

2. b) Bottom-up (inductive) techniques are suitable for investigating the consequence of identified single faults.
   EXAMPLE

   Failure modes and effects analysis (FMEA, see IEC 60812) and failure modes, effects and criticality analysis (FMECA).

6.1 General

When validation by analysis is not conclusive, testing shall be carried out to complete the validation. Testing is always complementary to analysis and is often necessary.

Validation tests shall be planned and implemented in a logical manner. In particular:

1. a) a test plan shall be produced before testing begins that shall include
   1. 1) the test specifications,
   2. 2) the required outcome of the tests for compliance, and
   3. 3) the chronology of the tests;
2. b) test records shall be produced that include
   1. 1) the name of the person carrying out the test,
   2. 2) the environmental conditions (see Clause 10),
   3. 3) the test procedures and equipment used,
   4. 4) the date of the test, and
   5. 5) the results of the test;
3. c) the test records shall be compared with the test plan to ensure that the specified functional and performance targets are achieved.

The test sample shall be operated as near as possible to its final operating configuration, i.e. with all peripheral devices and covers attached.

This testing may be applied manually or automatically, e.g. by computer.

Where applied, validation of the safety functions by testing shall be carried out by applying input signals, in various combinations, to the SRP/CS. The resultant response at the outputs shall be compared to the appropriate specified outputs.

It is recommended that the combination of these input signals be applied systematically to the control system and the machine. An example of this logic is power-on, start-up, operation, directional changes, restart-up. Where necessary, an expanded range of input data shall be applied to take into account anomalous or unusual situations, in order to see how the SRP/CS responds. Such combinations of input data shall take into account foreseeable incorrect operation(s).

The objectives of the test will determine the environmental condition for that test, which can be one or another of the following:

The range of conditions which is considered stable and over which the tests are valid should be agreed between the designer and the person(s) responsible for carrying out the tests and should be recorded.

6.2 Measurement accuracy

The accuracy of measurements during the validation by testing shall be appropriate for the test carried out. In general, these measurement accuracies shall be within 5 K for temperature measurements and 5 % for the following:

1. a) time measurements;
2. b) pressure measurements;
3. c) force measurements;
4. d) electrical measurements;
5. e) relative humidity measurements;
6. f) linear measurements.

Deviations from these measurement accuracies shall be justified.

6.3 More stringent requirements

If, according to its accompanying documentation, the requirements for the SRP/CS exceed those within this part of ISO 13849, the more stringent requirements shall apply.

NOTE

More stringent requirements can apply if the control system has to withstand particularly adverse service conditions, e.g. rough handling, humidity effects, hydrolysation, ambient temperature variations, effects of chemical agents, corrosion, high strength of electromagnetic fields — for example, due to close proximity of transmitters.

6.4 Number of test samples

Unless otherwise specified, the tests shall be made on a single production sample of the safety-related part being tested.

Safety-related part(s) under test shall not be modified during the course of the tests.

Certain tests can permanently change the performance of some components. Where a permanent change in a component causes the safety-related part to be incapable of meeting the requirements of further tests, a new sample or samples shall be used for subsequent tests.

Where a particular test is destructive and equivalent results can be obtained by testing part of the SRP/CS in isolation, a sample of that safety-related part may be used instead of the whole safety-related part(s) for the purpose of obtaining the results of the test. This approach shall only be applied where it has been shown by analysis that testing of a safety-related part(s) is sufficient to demonstrate the safety performance of the whole safety-related part that performs the safety function.

7 Validation of safety requirements specification for safety functions

Prior to the validation of the design of the SRP/CS, or the combination of SRP/CS providing the safety function, the requirements specification for the safety function shall be verified to ensure consistency and completeness for its intended use.

The safety requirements specification should be analysed before starting the design, since every other activity is based on these requirements.

It shall be ensured that requirements for all safety functions of the machine control system are documented.

In order to validate the specification, appropriate measures to detect systematic faults (errors, omissions or inconsistencies) shall be applied.

Validation may be performed by reviews and inspections of the SRP/CS safety requirements and design specification(s), in particular to prove that all aspects of

have been considered.

Where a product standard specifies the safety requirements for the design of a SRP/CS (e.g. ISO 11161 for integrated manufacturing systems or ISO 13851 for two-hand control devices), these shall be taken into account.

8 Validation of safety functions

The validation of safety functions shall demonstrate that the SRP/CS, or combination of SRP/CSs, provides the safety function(s) in accordance with their specified characteristics.

NOTE 1

A loss of the safety function in the absence of a hardware fault is due to a systematic fault, which can be caused by errors made during the design and integration stages (a misinterpretation of the safety function characteristics, an error in the logic design, an error in hardware assembly, an error in typing the code of software, etc.). Some of these systematic faults will be revealed during the design process, while others will be revealed during the validation process or will remain unnoticed. In addition, it is also possible for an error to be made (e.g. failure to check a characteristic) during the validation process.

Validation of the specified characteristics of the safety functions shall be achieved by the application of appropriate measures from the following list.

NOTE 3

Other measures against systematic failures mentioned in 9.4 (e.g. diversity, failure detection by automatic tests) can also contribute in the detection of functional faults.

9.1 Analysis and testing

For the SRP/CS or combination of SRP/CSs that provides the safety function(s), validation shall demonstrate that the required performance levels (PL_r) and categories in the safety requirements specification are fulfilled. Principally, this will require failure analysis using circuit diagrams (see Clause 5) and, where the failure analysis is inconclusive:

In some applications it may be necessary to divide the connected safety-related parts into several functional groups and to subject these groups and their interfaces to fault simulation tests.

When validating by testing, the tests should include, as appropriate,

The precise instant at which a fault is injected into a system can be critical. The worst-case effect of a fault injection shall be determined by analysis and by injecting the fault at this appropriate critical time.

9.2.1 Category B

SRP/CSs to Category B shall be validated in accordance with basic safety principles (see Tables A.1, B.1, C.1 and D.1) by demonstrating that the specification, design, construction and choice of components are in accordance with ISO 13849-1:2006. The MTTF_d of the channel shall be demonstrated to be at least 3 years. This shall be achieved by checking that the SRP/CS is in accordance with its specification as provided in the documents for validation (see 4.5). For the validation of environmental conditions, see 6.1.

NOTE

In particular cases, higher values of MTTF_d can be required - for example, when PL_r = b.

9.2.2 Category 1

SRP/CSs to Category 1 shall be validated by demonstrating the following:

1. a) they meet the requirements of Category B;
2. b) components are well-tried (see Tables A.3 and D.3), meeting at least one of the following conditions:
   1. 1) they have been widely used in the past with successful results in similar applications;
   2. 2) they have been made and verified using principles which demonstrate their suitability and reliability for safety-related applications;
3. c) well-tried safety principles (where applicable, see Tables A.2, B.2, C.2 and D.2) have been implemented correctly, and, where newly developed principles have been used, validation has been made of
   1. 1) how the expected modes of failure have been avoided, and
   2. 2) how faults have been avoided or their probability reduced to a suitable level.

Relevant component standards may be used to demonstrate compliance with this subclause (see Tables A.3 and D.3). The MTTF_d of the channel shall be demonstrated to be at least 30 years.

9.2.3 Category 2

SRP/CSs to Category 2 shall be validated by demonstrating the following:

1. a) they meet the requirements of Category B;
2. b) the well-tried safety principles used (if applicable) are in accordance with 9.2.2 c);
3. c) the checking equipment detects all relevant faults applied, one at a time, during the checking process and generates an appropriate control action which
   1. 1) initiates a safe state or, when this is not possible,
   2. 2) provides a warning of the hazard;
4. d) the check(s) provided by the checking equipment do not introduce an unsafe state;
5. e) the initiation of the check is carried out
   1. 1) at the machine start-up and prior to the initiation of a hazardous situation, and
   2. 2) periodically, during operation in accordance with the design specification and if the risk assessment and kind of operations show that it is necessary;

   NOTE 1

   The need for, and extent of, checks during operation are determined by the designer's risk assessment and the kind of operation necessary.

6. f) the MTTF_d of the functional channel (MTTF_d,L) is at least 3 years;
7. g) the MTTF_d,TE is larger than half of MTTF_d,L;
8. h) the test rate ≥ 100 × expected demand rate;
9. i) the DC_avg is at least 60 %;
10. j) common-cause failures are sufficiently reduced (see ISO 13849-1:2006).

NOTE 2

In particular cases, higher values of MTTF_d and/or DC_avg can be required — for example, owing to high PL_r.

9.2.4 Category 3

SRP/CSs to Category 3 shall be validated by demonstrating the following:

1. a) they meet the requirements of Category B;
2. b) the well-tried safety principles (if applicable) meet the requirements of 9.2.2 c);
3. c) a single fault does not lead to the loss of the safety function;
4. d) single faults (including common cause faults) are detected in accordance with the design rationale and the technology applied;
5. e) the MTTF_d of each channel is at least 3 years;
6. f) the DC_avg is at least 60 %;
7. g) common-cause failures are sufficiently reduced (see ISO 13849-1:2006).

NOTE

In particular cases, higher values of MTTF_d and/or DC_avg can be required - for example, due to high PL_r.

9.2.5 Category 4

SRP/CSs to Category 4 shall be validated by demonstrating the following:

1. a) they meet the requirements of Category B;
2. b) the well-tried safety principles (if applicable) are in accordance with 9.2.2 c);
3. c) a single fault (including common-mode faults) does not lead to the loss of the safety function;
4. d) single faults are detected at or before the next demand on the safety function, this being achieved with a DC_avg of at least 99 %;
5. e) if a single fault is not detected with a DC_avg of at least 99 %, an accumulation of faults does not lead to the loss of the safety function(s), and the extent of the accumulation of faults considered is in accordance with the design rationale;
6. f) the MTTF_d of each channel is at least 30 years;
7. g) common-cause failures are sufficiently reduced (see ISO 13849-1:2006).

9.3 Validation of MTTFd, DCavg and CCF

The validation of MTTF_d, DC_avg and CCF is typically performed by analysis and visual inspection.

The MTTF_d values for components (including B_10d, T_10d and n_op values) shall be checked for plausibility (e.g. against ISO 13849-1:2006). For example, the value given on the supplier datasheet is to be compared with ISO 13849-1:2006. Where fault exclusion claims mean that particular components do not contribute to the channel MTTF_d, the plausibility of the fault exclusion shall be checked.

NOTE 1

A fault exclusion implies infinite MTTF_d; therefore, the component will not contribute to the calculation of channel MTTF_d.

NOTE 2

For the determination of the B_10d value, see e.g. IEC 60947-4-1:2010.

The MTTF_d of each channel of the SRP/CS, including application of the symmetrisation formula (see ISO 13849-1:2006) to dissimilar redundant channels, shall be checked for correct calculation. It shall be ensured that the MTTF_d of individual channels has been restricted to no greater than 100 years before the symmetrisation formula is applied.

The DC values for components and/or logic blocks shall be checked for plausibility (e.g. against measures in ISO 13849-1:2006). The correct implementation (hardware and software) of checks and diagnostics, including appropriate fault reaction, shall be validated by testing under typical environmental conditions in use.

The DC_avg of the SRP/CS shall be checked for correct calculation.

The correct implementation of sufficient measures against common-cause failures shall be validated (e.g. against ISO 13849-1:2006). Typical validation measures are static hardware analysis and functional testing under environmental conditions.

NOTE 3

For the calculation of the MTTF_d values of electronic components, an ambient temperature of +40 °C is taken as a basis. During validation, it is important to ensure that, for MTTF_d values, the environmental and functional conditions (in particular temperature) taken as basis are met. Where a device, or component, is operated significantly above (e.g. more than 15 °C) the specified temperature of +40 °C, it will be necessary to use MTTF_d values for the increased ambient temperature.

9.4 Validation of measures against systematic failures related to performance level and category of SRP/CS

The validation of measures against systematic failures (defined in ISO 13849-1:2006) related to performance levels and categories of each SRP/CS can typically be provided by

1. a) inspections of design documents which confirm the application of
   1. 1) basic and well-tried safety principles (see Annexes A to D),
   2. 2) further measures for avoidance of systematic failures (see ISO 13849-1:2006), and
   3. 3) further measures for the control of systematic failures such as hardware diversity (see ISO 13849-1:2006), modification protection or failure assertion programming;
2. b) failure analysis (e.g. FMEA);
3. c) fault injection tests/fault initiation;
4. d) inspection and testing of data communication, where used;
5. e) checking that a quality management system avoids the causes of systematic failures in the manufacturing process.

9.5 Validation of safety-related software

The validation of both safety-related embedded software (SRESW) and safety-related application software (SRASW) shall include

As a first step, check that there is documentation for the specification and design of the safety-related software. This documentation shall be reviewed for completeness and absence of erroneous interpretations, omissions or inconsistencies.

NOTE

In the case of small programs, an analysis of the program by means of reviews or walk-through of control flow, procedures, etc. using the software documentation (control flow chart, source code of modules or blocks, I/O and variable allocation lists, cross-reference lists) can be sufficient.

In general, software can be considered a “black box” or “grey box” (see ISO 13849-1:2006), and validated by the black- or grey-box test, respectively.

Depending on the PL_r [ISO 13849-1:2006], the tests should include

Individual software functions which have already been validated do not need to be validated again. Where a number of such safety function blocks are combined for a specific project, however, the resulting total safety function shall be validated.

Software documentation shall be checked to confirm that sufficient measures and activities have been implemented against systematic software faults in accordance with the simplified V-model (ISO 13849-1:2006).

The measures for software implementation according to ISO 13849-1:2006, which depend on the PL to be attained, shall be examined with regard to their proper implementation.

Should the safety-related software be subsequently modified, it shall be revalidated on an appropriate scale.

9.6 Validation and verification of performance level

For the simplified procedure for estimating PL of the SRP/CS according to ISO 13849-1:2006, and ISO 13849-1:2006, the following verification and validation steps shall be performed:

Where other methods are used to evaluate the achieved PL, based on the estimated average probability of a dangerous failure per hour, validation shall consider

9.7 Validation of combination of safety-related parts

Where the safety function is implemented by two or more safety-related parts, validation of the combination — by analysis and, if necessary, by testing - shall be undertaken to establish that the combination achieves the performance level specified in the design. Existing recorded validation results of safety-related parts can be taken into account. The following validation steps shall be performed:

10 Validation of environmental requirements

The performance specified in the design of the SRP/CS shall be validated with respect to the environmental conditions specified for the control system.

Validation shall be carried out by analysis and, if necessary, by testing. The extent of the analysis and of the testing will depend upon the safety-related parts, the system in which they are installed, the technology used, and the environmental condition(s) being validated. The use of operational reliability data on the system or its components, or the confirmation of compliance to appropriate environmental standards (e.g. for waterproofing, vibration protection) can assist this validation process.

Where applicable, validation shall address

When testing is needed to determine compliance with the environmental requirements, the procedures outlined in the relevant standards shall be followed as far as required for the application.

After the completion of validation by testing, the safety functions shall continue to be in accordance with the specifications for the safety requirements, or the SRP/CS shall provide output(s) for a safe state.

11 Validation of maintenance requirements

The validation process shall demonstrate that the provisions for maintenance requirements specified in ISO 13849-1:2006, have been implemented.

Validation of maintenance requirements shall include the following, as applicable:

1. a) a review of the information for use confirming that
   1. 1) maintenance instructions are complete [including procedures, required tools, frequency of inspections, time interval for changing components subjected to wear (T_10d) etc.] and understandable,
   2. 2) if appropriate, there are provisions for the maintenance to be performed only by skilled maintenance personnel;
2. b) a check that measures for ease of maintainability (e.g. provision of diagnostic tools to aid fault-finding and repair) have been applied.

In addition, the following measures shall be included when applied:

12 Validation of technical documentation and information for use

The validation process shall demonstrate that the requirements for technical documentation specified in ISO 13849-1:2006, and for information for use specified in ISO 13849-1:2006, have been implemented.

Annex A Validation tools for mechanical systems

When mechanical systems are used in conjunction with other technologies, Annex A should also be taken into account.

Tables A.1 and A.2 list basic and well-tried safety principles.

Table A.3 lists well-tried components for a safety-related application based on the application of well-tried safety principles and/or a standard for their particular applications. A well-tried component for some applications could be inappropriate for others.

Tables A.4 and A.5 list fault exclusions and their rationale. For further exclusions, see 4.4.

The precise instant at which the fault occurs can be critical (see 9.1).

Annex B Validation tools for pneumatic systems

When pneumatic systems are used in conjunction with other technologies, Annex B should also be taken into account. Where pneumatic components are electrically connected/controlled, the appropriate fault lists in Annex D should be considered.

NOTE

Additional requirements can exist in national legislation.

Tables B.1 and B.2 list basic and well-tried safety principles.

A list of well-tried components is not given in Annex B of this edition. The status of "well-tried" is mainly application-specific. Components can be described as "well-tried" if they are in accordance with ISO 13849-1:2006 and ISO 4414:2010. A well-tried component for some applications could be inappropriate for other applications.

Tables B.3 to B.18 list fault exclusions and their rationale. For further exclusions, see 4.4.

The precise instant at which the fault occurs can be critical (see 9.1).

Annex C Validation tools for hydraulic systems

When hydraulic systems are used in conjunction with other technologies, Annex C should also be taken into account. Where hydraulic components are electrically connected/controlled, the appropriate fault lists in Annex D should be considered.

NOTE

Additional requirements can exist in national legislation.

Tables C.1 and C.2 list basic and well-tried safety principles. Air bubbles and cavitation in the hydraulic fluid should be avoided because they can create additional hazards, e.g. unintended movements.

A list of well-tried components is not given in Annex C of this edition. The status of "well-tried" is mainly application-specific. Components can be described as "well-tried" if they are in accordance with ISO 13849-1:2006 and ISO 4414:2010. A well-tried component for some applications could be inappropriate for other applications.

Tables C.3 to C.12 list fault exclusions and their rationale. For further exclusions, see 4.4.

The precise instant at which the fault occurs can be critical (see 9.1).

D.1 General

When electrical systems are used in conjunction with other technologies, Annex D should also be taken into account.

The environmental conditions of IEC 60204-1 apply to the validation process. If other environmental conditions are specified, they should also be taken into account.

Tables D.1 and D.2 list basic and well-tried safety principles.

The components listed in Table D.3 are considered to be "well-tried" when they comply with the description given in ISO 13849-1:2006. The standards listed in Table D.3 can be used to demonstrate their suitability and reliability for a particular application. A well-tried component for some applications could be inappropriate for other applications.

NOTE

Complex electronic components, such as programmable logic controllers (PLCs), microprocessors and application-specific integrated circuits, cannot be considered equivalent to the “well-tried” components.

Clause D.2 and Tables D.4 to D.18 list fault exclusions and their rationale. For further exclusions, see 4.4.

For validation, both permanent faults and transient disturbances should be considered.

The precise instant at which the fault occurs can be critical (see 9.1).

D.2.1 General

A fault exclusion is valid only if the parts operate within their specified ratings.

D.2.2 "Tin whiskers"

If lead-free processes and products are applied, electrical short circuits due to the growth of "tin whiskers" can occur. This possibility should be evaluated and considered when applying the fault exclusion “short circuit…” of any component. For example, if the risk of tin whisker growth is considered high, the fault exclusion "short circuit of a resistor" is useless, since a short between the contacts of this component has to be considered.

NOTE 1

Tin whisker growth is a phenomenon related mainly to pure bright tin finishes. The needle-like protrusions can grow to several hundred micrometres in length and can cause electrical short circuits. The prevailing theory is that the whiskers are caused by compressive stress build-up in tin plating.

NOTE 2

References [34] and [35] can be helpful for evaluation of the phenomenon.

NOTE 3

Whiskers on printed circuit boards have not so far been reported. Tracks usually consist of copper without tin coating. Pads can be coated with tin alloy, but the production process seems not to stimulate the susceptibility to whisker growing.

D.2.3 Short circuits on PCB-mounted parts

Short circuits for parts which are mounted on a printed circuit board (PCB) can only be excluded if the fault exclusion “short circuit between two adjacent tracks/pads”, described in Table D.5, is made.

D.2.4 Fault exclusions and integrated circuits

As it is not possible to exclude faults that can cause the malfunction of an integrated circuit (see Tables D.20 and D.21), a single fault can lead to loss of a safety function (including its check/test) implemented in a single integrated circuit. Consequently, it is highly unlikely that the multi-channel functionality necessary for the fault tolerance and/or detection requirements of category 2, 3 or 4 can be achieved using a single integrated circuit, unless it satisfies the special architecture requirements of IEC 61508-2:2010.

E.1 General

This example considers the validation of the PL of a safety function (SF 1), with the exception of requirements relating to the following aspects of the PL:

The example does not cover the validation of

Three safety functions, SF 1, SF 2 and SF 3, are considered in the example.

SF 1 is a safety-related stopping function of four individual machine actuators initiated by the opening of one interlocking guard, and this is treated as a separate safety function for each actuator (SF 1.0, SF 1.1, SF 1.2 and SF 1.3). In order to reduce the extent of the example, the validation has been limited to SF 1.0 and SF 1.3.

Annex A provides guidance on how to examine the fault behaviour and diagnostic coverage of a given circuit is provided. The methods used for determination of the diagnostic coverage are based on failure mode and effects analysis (FMEA), taking into account ISO 13849-1:2006.

NOTE

This example does not cover the complete validation process of SRP/CS. In particular, the necessary validation of the PLC software has not been considered. For the validation of safety-related software, see 9.5.

E.2 Description of machine

The example is based upon an automatic assembly machine, with manual loading and unloading of workpieces. The machine is intended to perform two sequential operations: ball insertion and screw fixing on each workpiece.

There are four stations on the machine: the loading and unloading stations and two workstations (see Figure E.1). The first workstation is the pneumatically driven ball-insertion stage, and the second the pneumatically driven screw-fixing stage.

An electrically-driven rotary table moves workpieces around each of the four stations. The workpieces are manually placed on, and removed from, workpiece holders mounted on the rotary table. An inverter-controlled electric motor drives a planetary gear and drive-belt system which moves the rotary table.

At the first workstation a ball is inserted into the workpiece by a horizontally mounted pneumatic cylinder, which is controlled by a monostable 5/2 port directional control valve (1V1, see Figure E.3). The basic position (valve de-energized) of this cylinder is the retracted position. The depth of the inserted ball is checked by monitoring a limit switch at the fully extended position of the cylinder, and the applied pressing pressure is monitored by a pressure sensor in the air supply line for cylinder extension.

The screw-fixing workstation consists of a vertically mounted, rodless pneumatic cylinder carrying a pneumatically driven rotary screwdriver unit. The screwdriver unit is raised and lowered by the pneumatic cylinder, which is controlled by a monostable 5/2 port directional control valve (2V1). The basic position (valve de-energized) of this cylinder is the upper position, with the screwdriver unit raised. Additionally, a pilot-controlled check valve (2V2) is provided in the lower connection of the pneumatic cylinder.

Rotary motion of the screwdriver unit is provided by a pneumatic motor, controlled by a monostable 5/2 port directional control valve (3V1). The basic position (valve de-energized) of this pneumatic motor is the OFF state. The torque provided by the screwdriver unit is monitored by a pressure sensor in its air supply line.

A single cycle of the machine in automatic mode of operation is initiated by actuating the start push-button. At the beginning of a cycle, the rotary table holds three workpieces: (i) a newly loaded workpiece, (ii) a partially finished workpiece (ball inserted), and (iii) a finished workpiece (ball inserted and screw fixed). Each cycle of the machine consists of the rotary table moving through 90°, followed by simultaneous ball-insertion and screw-fixing operations on the newly loaded and partially finished workpieces. The machine then comes to an operational stop, after which the operator opens the interlocking guard to unload the finished workpiece and load a new workpiece. The completion of a workpiece requires three machine cycles to rotate the workpiece by 270° from the loading station through to the unloading station.

The following modes of operation are provided:

The machine presents mechanical hazards arising out of movements of the pneumatically driven machine actuators (at the ball-insertion and screw-fixing workstations) and the electrically driven rotary table. It is for this reason protected by mechanical guards, all of which are fixed, except for an interlocking guard that provides access to the loading and unloading stations (the hazard zone).

Figure E.1

1	loading station	8	workpiece
2	ball-insertion workstation	9	rotary table
3	ball-insertion cylinder (A1)	10	pulse sensor (G2)
4	screw-fixing workstation	11	drive belt
5	unloading station	12	planetary gear
6	screwdriver unit (A3)	13	electric motor (M1)
7	screw insertion (vertical-drive) cylinder (A2)	14	rotation sensor (G1)

E.3 Specification of safety function requirements

In the automatic mode of operation, protection against hazardous movements is provided by the following safety function:

For the purposes of the example, this can be considered a separate safety function for each of the four individual machine actuators:

NOTE 1

For the example, safety-related stop and protection against unexpected start-up are considered a single safety function because they are implemented in the same combination of SRP/CS.

During the set-up mode for the rotary table with the interlocking guard open (pneumatically driven machine actuators disabled by SF 1.1, SF 1.2 and SF 1.3), the safe condition of the rotary table movement is achieved by a combination of the following safety functions:

After performing a risk assessment, the following values of PL_r were assigned to the safety functions:

PL_r d for SF 1 (safety-related stopping and prevention of unexpected start-up);

PL_r d for SF 2 (safely-limited speed);

PL_r c for SF 3 (hold-to-run mode).

NOTE 2

The selection of PL_r c for SF 3 takes account of its use in combination with SF 2, for which PL d is achieved.

When SF 1 is demanded, it initiates the following actions:

NOTE 3

For the example, the risk assessment determined that loss of controlled deceleration of the rotary table as a result of an inverter malfunction was acceptable, and movement of pneumatic cylinders A1 and A2 to their basic positions non-hazardous.

The minimum distance between the interlocking guard and these moving parts of the machine was determined according to ISO 13855, based on the machine stopping performance.

The machine is provided with other safety functions, such as an emergency stop, restart interlock, reset, and selection of modes for operation, but these are not considered in the example and, consequently, relevant components are not shown in the circuit diagrams of Figures E.2 and E.3.

Figure E.2

Figure E.3

E.4.1 General

The control system for the example has been implemented using a combination of electromechanical, electronic and pneumatic technologies.

In order to achieve the PL_r for SF 1 and SF 2, Category 3 has been selected. A diverse redundant and monitored structure has therefore been adopted for all electrical and pneumatic parts associated with these safety functions (see Figures E.2 and E.3).

To achieve the PL_r for SF 3, a combination of Category 2 and Category 3 has been selected.

The signals from the sensors and control actuators (interlocking guard position switches, hold-to-run push-button) have been duplicated and connected into two diverse PLCs (different types of hardware for PLC A and PLC B), which process them using specific software function blocks (SRASW). Each PLC also controls both the rotary table inverter and the pneumatically driven machine actuators via switching paths that are independent of the other PLCs' switching paths.

For diagnostic (cross-monitoring) and synchronization purposes, the two PLCs communicate with each other via a standard data-bus.

The particular inverter in this example has an additional facility (internal relay) to disable its power semiconductor control signals (pulse-blocking), which can be considered a second shutdown path [Safe Torque Off (STO) according to IEC 61800-5-2].

This pulse-blocking feature will not bring a rotating motor to a rapid stop, because disabling the inverter control of the motor causes an uncontrolled deceleration. However, in this example pulse-blocking would still cause the rotary table to stop before an operator can access the hazard zone, and so the controlled deceleration to a standstill that normally precedes pulse-blocking is not a required characteristic of SF 1.0.

In the pneumatic circuit, the supply of air to each of the machine actuators (A1, A2 and A3) is controlled by a monostable 5/2 port directional control valve (1V1, 2V1 and 3V1) of the pilot-controlled solenoid type. The control air for all three valves is switched by an additional valve (1V0) of the same type, which provides a redundant channel of control. The status of this release valve is monitored by a pressure switch (1S0).The air supply for A2 is taken from the main air supply, whereas for A1 and A3 it is taken from the control air supply (1V0).

De-energizing of the driving chamber from moving cylinder A1 during penetration of the workspace is provided by two channels too:

The status of 1V1 is monitored by a limit switch (1S2).

A pilot-controlled check valve (2V2), which also takes its control air from 1V0, is provided in the lower connection of A2 (vertically mounted rodless pneumatic cylinder). This provides a redundant channel for stopping the downward motion and retaining the machine actuator in its basic (upper) position.

The status of 2V1 is monitored by a limit switch (2S2).

The air supply for pneumatic motor A3 (screwdriver unit) is taken from the control air supply (1V0) rather than the main air supply. This use of 1V0 in addition to 3V1 to switch off the air supply to A3 provides a redundant channel of control, which ensures that A3 will not continue to rotate if 3V1 were to fail in the energized position. The status of 3V1 is monitored by a pressure sensor (3S1) that provides an analogue output signal.

In accordance with Category 3, basic and well-tried safety principles are taken into account, and the requirements of Category B are also satisfied. In particular, the requirements of the standards IEC 60204-1 and ISO 4414 have been applied.

The attributes of components implementing SRP/CS are explained in detail in Table E.2.

E.4.2 Safety function SF 1 — Safety-related stopping initiated by the opening of the interlocking guard and prevention of unexpected start-up whenever the interlocking guard is open

According to the machine specification, opening of the interlocking guard has to initiate the stopping of four machine actuators: (i) the rotary table (driven by inverter-controlled motor), (ii) the ball-insertion cylinder, (iii) the screw-insertion cylinder, and (iv) the screwdriver unit. This function can therefore be represented as shown in Figure E.4.

Figure E.4

When the interlocking guard is opened, PLC A initiates a stop of the rotary table by providing a stop signal to the inverter (T1a). PLC B monitors the resulting deceleration of the rotary table via G2, and when it detects that this has reached a standstill it de-energizes K1 to initiate pulse-blocking at the inverter (T1b). If the rotary table does not stop due to a fault in T1a or PLC A, then PLC B will detect this fault and still provide its own stop signal to the inverter (T1b). This is the second independent channel for the stopping function. The part of the safety function relating to prevention of unexpected start-up is performed in the same way.

Opening the interlocking guard also causes PLC A to initiate a first stop of the ball-insertion cylinder, the screw-insertion cylinder and the screwdriver unit by de-energizing 1V1, 2V1 and 3V1. PLC B initiates a second stop of these three actuators by de-energizing 1V0.

If the rotary table is already stopped, but the ball-insertion and screw-fixing workstations are in operation when the interlocking guard is opened, then PLC A will immediately de-energize 1V1, 2V1 and 3V1, and PLC B will immediately de-energize K1. PLC B will also de-energize 1V0 after a delay, to allow for the ball-insertion cylinder (A1) to complete its travel to the retracted position.

While the interlocking guard is in the open position, it needs to be ensured that a fault in the enabling path of PLC A does not lead to an uncontrolled start-up. This is achieved by the action of PLC B de-energizing K1 as soon as the rotary table motor has reached a standstill, and also de-energizing 1V0 to prevent a start-up of the ball-insertion cylinder or the screw-insertion cylinder.

The evaluation of the PL for the SRP/CS performing SF 1 has been carried out as follows:

1. a) Identification of safety-related partsThe safety-related parts of stopping function SF 1.0 and their division into channels can be illustrated by the safety-related block diagram shown in Figure E.5.

   Figure E.5

   Similarly, the safety-related parts of stopping functions SF 1.1, SF 1.2 and SF 1.3 and their division into channels can be illustrated by the safety-related block diagram shown in Figure E.6.

   Figure E.6

   * SF 1.1 ** SF 1.2 *** SF 1.3

   The two parts of the diagrams in Figures E.5 and E.6 can each be mapped to the designated architecture for Category 3, so the diagrams can be simplified as the two SRP/CS (input, logic/output) shown in Figure E.7.

   Figure E.7

   For each SRP/CS, a PL has been estimated by applying the simplified procedure from ISO 13849-1:2006.
2. b) Estimation of MTTF_d of each channelFor the estimation of component MTTF_d values, reliability data provided by the manufacturers has been used.For the estimation of the MTTF_d of a channel, the parts count method has been applied (see ISO 13849-1:2006; Annex D). The diverse redundant structure leads to dissimilar MTTF_d values for each channel, so that application of the symmetrisation equation provides an average result of 25 years (medium) for the MTTF_d of each channel of both SRP/CS_I and SRP/CS_L/O of SF 1.0, SF 1.1, SF 1.2, and SF 1.3 (see ISO 13849-1:2006).
3. c) Estimation of DC_avgThe DC_avg has been calculated for both SRP/CS from the DC of the internal test and monitoring measures applied to the different components.A plausibility check of the guard interlocking switches B1 and B2 by PLC A and PLC B according to ISO 13849-1:2006, results in a DC_avg high (99 %) for the SRP/CS_I of SF 1.0, SF 1.1, SF 1.2 and SF 1.3.The following diagnostic measures are provided in the SRP/CS_L/O of SF 1.0, SF 1.1, SF 1.2 and SF 1.3:

   — monitoring of the relay contactor, K1, by PLC A through the position of K1 contacts;

   — cross-monitoring between PLC A and PLC B;

   — indirect monitoring of T1a and PLC A by PLC B through G2;

   — indirect monitoring of the PLC A output card by itself through 1S2, 2S2, 3S1 and G1;

   — program sequence monitoring by an internal watchdog in PLC A and in PLC B;

   — indirect monitoring of T1a by PLC A through G1;

   — monitoring of T1b by PLC A through the position of pulse-blocking relay contact;

   — indirect monitoring of the PLC B by PLC A through the position of K1 contacts;

   — indirect monitoring of the PLC B output card by itself through 1S0;

   — indirect monitoring of 1V1 by the PLC A through 1S2;

   — indirect monitoring of 2V1 by the PLC A through 2S2;

   — indirect monitoring of 3V1 by the PLC A through 3S1;

   — indirect monitoring of 1V0 by the PLC B through 1S0;

   — fault detection of PLC A, T1a and 1V1, 2V1 and 3V1 through process observation.

   According to ISO 13849-1:2006, these diagnostic measures provide a DC_avg result of medium (90 %) for the SRP/CS_L/O of SF 1.0, SF 1.1, SF 1.2 and SF 1.3.
4. d) Estimation of measures against common-cause failure (CCF)It is estimated that adequate measures against common-cause failure (separation, diversity, protection against over-pressure, environmental) have been taken for both SRP/CS of SF 1.0, SF 1.1, SF 1.2 and SF 1.3, which, according to ISO 13849-1:2006, results in a score of 75 points for each SRP/CS.
5. e) Determination of PL for each SRP/CSThe PL for each SRP/CS is determined as follows:

   — SRP/CS_I of SF 1.0, SF 1.1, SF 1.2 and SF 1.3:

   — Category 3;

   — medium MTTF_d of each channel;

   — high DC_avg;

   — 75 points for measures against CCF.

   Applying these values to ISO 13849-1:2006, but with DC_avg restricted to medium (Category 3), gives a result of PL d.

   — SRP/CS_L/O of SF 1.0, SF 1.1, SF 1.2 and SF 1.3:

   — Category 3;

   — medium MTTF_d of each channel;

   — medium DC_avg;

   — 75 points for measures against CCF.

   Applying these values to ISO 13849-1:2006, gives a result of PL d.
6. f) Determination of the PL for the combination of SRP/CS performing SF 1.0, SF 1.1, SF 1.2 and SF 1.3According to ISO 13849-1:2006, and taking into account that the individual SRP/CS for SF 1.0, SF 1.1, SF 1.2 and SF 1.3 have the same values of PL, the PL of the overall combination of SRP/CS for SF 1.0, SF 1.1, SF 1.2 and SF 1.3 is determined as follows:

   — PL_low = d

   — N_low = 2

   The PL for the combination of SRP/CS for each of SF 1.0, SF 1.1, SF 1.2 and SF 1.3 is therefore PL d.

   NOTE

   Calculation of the resulting PL by adding the PFH values of all subsystems will lead to a more precise result.

7. g) Systematic failuresIt is estimated that the adequate measures against systematic failure have been applied to the SRP/CS for SF 1.0, SF 1.1, SF 1.2 and SF 1.3 according to ISO 13849-1:2006.

E.4.3 Safety function SF 2 — Safely-limited speed (SLS)

When the machine is in the set-up mode and the interlocking guard is in the open position, the rotary table can only move at a safely limited speed (SLS), which is measured by both G1 and G2. PLC A monitors the signal from G1 and PLC B monitors the signal from G2, with both PLCs performing the desired/actual speed comparisons independently. If the speed is not successfully reduced to the limited value by the inverter T1a, then PLC A can react by providing a stop signal to the inverter (T1a), and PLC B can react by activating a delayed pulse-blocking on the inverter (T1b) via K1.

1. a) Identification of safety-related partsThe safety-related parts of safety function SF 2 and its division into channels can be illustrated by the safety-related block diagram shown in Figure E.8.

   Figure E.8

   For the SRP/CS, a PL has been estimated by applying the simplified procedure in ISO 13849-1:2006.The diagram can be mapped to the designated architecture for Category 3, so the safety function is performed by one SRP/CS, as shown in Figure E.9.

   Figure E.9

   For the SRP/CS, a PL has been estimated by applying the simplified procedure in ISO 13849-1:2006.
2. b) Estimation of MTTFd of each channelFor the estimation of component MTTF_d values, reliability data provided by the manufacturers has been used.For the estimation of the MTTF_d of a channel, the parts count method has been applied (see ISO 13849-1:2006; Annex D). The diverse redundant structure leads to dissimilar MTTF_d values for each channel, so application of the symmetrisation equation provides an average result of medium MTTF_d (more than 25 years) for each channel of the SRP/CS.
3. c) Estimation of DC_avgThe DC_avg has been calculated for the SRP/CS from the DC of the internal test and monitoring measures applied to the different components.The following diagnostic measures are provided:

   — monitoring of the relay contactor, K1, by PLC A through the position of K1 contacts;

   — cross-monitoring between PLC A and PLC B;

   — indirect monitoring of G1, T1a and PLC A by PLC B through G2;

   — monitoring of T1b by PLC A through the position of pulse-blocking relay contact;

   — program sequence monitoring by an internal watchdog in PLC A and in PLC B;

   — indirect monitoring of G2 and PLC B by PLC A through the position of K1 contacts;

   — monitoring of G1 by PLC A;

   — monitoring of G1 and T1a (plausibility of sin/cos information);

   — monitoring of G2 by PLC B (after pushing S4, PLC B checks for pulses from G2; if there are none, PLC B stops T1b).

   According to ISO 13849-1:2006, these diagnostic measures provide a DC_avg result of medium (90 %) for the SRP/CS.
4. d) Estimation of measures against common-cause failure (CCF)It is estimated that the adequate measures against common-cause failure (separation, diversity, protection against over-pressure, environmental) have been taken for the SRP/CS, which according to ISO 13849-1:2006, results in a score of 75 points for the SRP/CS.
5. e) Determination of the PL for the SRP/CSThe PL for the SRP/CS is determined as follows:

   — Category 3;

   — medium MTTF_d of each channel;

   — medium DC_avg;

   — 75 points for measures against CCF.

   Applying these values to ISO 13849-1:2006, but with DC_avg restricted to medium (Category 3), gives a result of PL d.
6. f) Systematic failuresIt is estimated that adequate measures against systematic failures have been applied to the SRP/CS according to ISO 13849-1:2006.

E.4.4 Safety function SF 3 — Hold-to-run mode

Movement of the rotary table (at a safely limited speed) with the interlocking guard open is initiated and continues while the push-button S4 is actuated, and stops when the push-button is released. When the push-button is in the released position, unexpected start-up has to be prevented. The signal from the push-button S4 is processed by both PLCs.

1. a) Identification of safety-related partsThe safety-related parts of safety function SF 3 and their division into channels can be illustrated by the safety-related block diagram shown in Figure E.10.

   Figure E.10

   The two parts of the diagram can each be mapped to the designated architecture for Category 1 and Category 3, so the diagram can be simplified as the two SRP/CS (input, logic/output) shown in Figure E.11.

   Figure E.11

   For each SRP/CS, a PL has been estimated by applying the simplified procedure in ISO 13849-1:2006.
2. b) Estimation of MTTF_d of each channelThe MTTF_d for the SRP/CS_I (hold-to-run push-button) is calculated using the manufacturer's B_10d value to give a result of high MTTF_d.The estimation of the MTTF_d of SRP/CS_L/O provides, as in SRP/CS_L/O of SF 1.0, an average result of 25 years (medium) for the MTTF_d (more than 25 years) of each channel.
3. c) Estimation of DC_avgThe DC_avg has been calculated for both SRP/CS from the DC of the internal test and monitoring measures executed on the different components.Time monitoring of hold-to-run push-button S4 (low-high alternation in a time frame window) by PLC A and PLC B according to ISO 13849-1:2006, results in a DC_avg low (75 %) for the SRP/CS_I.The monitoring measures as per SRP/CS_L/O of SF 1.0 are provided in the SRP/CS_L/O of SF 3, resulting in a DC_avg medium (90 %) for the SRP/CS_L/O.
4. d) Estimation of measures against common-cause failure (CCF)It is estimated that adequate measures against common-cause failure (separation, diversity, protection against over-voltage, environmental) have been taken for each SRP/CS, which, according to ISO 13849-1:2006, results in a score of 75 points for both SRP/CS.
5. e) Determination of PL for each SRP/CSThe PL for each SRP/CS is determined as follows.

   — SRP/CS_I:

   — Category 1;

   — High MTTF_d of the channel.

   Applying these values to ISO 13849-1:2006, gives a result of PL c.

   — SRP/CS_L/O:

   — Category 3;

   — Medium MTTF_d of each channel;

   — Medium DC_avg;

   — 75 points for measures against CCF.

   Applying these values to ISO 13849-1:2006, gives a result of PL d.
6. f) Determination of the PL of the combination of SRP/CS performing SF 3According to ISO 13849-1:2006, and taking into account both SRP/CS of SF 3, the PL of the overall combination of SRP/CS is determined as follows:

   — PL_low = c;

   — N_low = 1.

   The PL for the combination of SRP/CS of SF 3 is therefore PL c.
7. g) Systematic failuresIt is estimated that the adequate measures against systematic failures have been taken for both SRP/CS of SF 3 according to ISO 13849-1:2006.

E.5.1 General

As stated in E.1, the example has been reduced to the validation of fault behaviour and diagnostic means of safety functions SF 1.0 and SF 1.3.

According to 9.2 and 9.3, validation of fault behaviour and diagnostic means are performed by a review of design documentation, a failure analysis and complementary fault injection tests.

The following steps are carried out.

1. a) Identify the diagnostic measures and the units (components, blocks) that they test/monitor.
2. b) Verify the DC value assigned to each diagnostic measure (DC) for a particular unit.
3. c) Analyse the fault behaviour of the system and define the test cases.
4. d) Check for correct calculation of the DC_avg for each SRP/CS.
5. e) Carry out required tests to confirm the DC values.

E.5.2 Validation of fault behaviour and DCavg

A check of the design documentation (safety-related block diagram and list of diagnostic measures for the SRP/CS) confirms that

assumed in the design rationale are correct for all safety functions.

A FMEA is used to check the values of DC assigned to each monitored unit of each SRP/CS, and also the fault behaviour of the system.

As safety function SF 1 has to fulfil both safety-related stopping and subsequent prevention of unexpected start-up, the failure analysis for each associated component is considered in a separate row for each of these requirements.

For the analysis, the appropriate fault lists given in Annexes A, B, C and D have been used.

The FMEA for safety functions SF 1.0 and SF 1.3, including test cases, are now considered.

E.5.3.1 SF 1.0

In order to facilitate the analysis of SF 1.0, its safety-related block diagram is reproduced in Figure E.12.

Figure E.12

See Tables E.3 and E.4.

From the analysis it can be deduced that any single faults in the SRP/CS_I will be detected either immediately, or at the next demand upon the safety function. When a single fault occurs, the safety function is always performed and re-start is prevented.

As a result of the analysis, it is considered that the assumed values of DC (high) during the design for B1 and B2 are adequate. As the DC of both components is equal (99 %), the DC_avg of SRP/CS_I is high (99 %), as was estimated during the design.

These characteristics are typical for Category 3, selected in the design (see E.4.1) in order to comply with the safety requirement specification given in E.3 (PL_r).

In order to check the correct implementation of the diagnostic measures, the tests described in the final column of Table E.3 could be applied.

From the analysis, it can be deduced that single faults in the SRP/CS will be detected either immediately, or at an operational stop of electric motor M1, or at the next demand upon the safety function. When a single fault occurs, the safety function is always performed. Re-start is possible with only one channel in the case of undetected faults in PLC A and PLC B.

The analysis determines that values of DC assumed during the design of the SRP/CS_L/O are adequate. Taking into account the estimated MTTF_d values and the DC values for the various components used in SRP/CS_L/O, a DC_avg result of medium (90 %) is achieved, as was estimated during the design.

These characteristics are typical for Category 3, selected in the design (see E.4.1) in order to comply with the safety requirement specification given in E.3 (PL_r).

To check the correct implementation of the diagnostic measures, the tests described in the final column of Table E.4 could be applied.

E.5.3.2 SF 1.3

In order to facilitate the analysis of SF 1.3, its safety-related block diagram is reproduced in Figure E.13.

Figure E.13

For SRP/CS_I of SF 1.3, the diagnostic measures and the tested/monitored units are identical to those for SF 1.0 and therefore the DC_avg of SRP/CS_I is also high (99 %).

See Table E.5.

From the analysis, it can be deduced that most single faults in the SRP/CS will be detected either immediately, or at an operational stop of the pneumatic motor, A3, or at the next demand upon the safety function. When a single fault occurs, the safety function is always performed. Re-start is possible with only one channel in the case of undetected faults in PLC A and PLC B.

The analysis determines that values of DC assumed during the design of the SRP/CS_L/O are adequate. Taking into account the estimated MTTF_d values and the DC values for the various components used in SRP/CS_L/O, a DC_avg result of medium (90 %) is achieved, as was estimated during the design.

These characteristics are typical for Category 3, selected in the design (see E.4.1) in order to comply with the safety requirement specification given in E.3 (PL_r).

To check the correct implementation of the diagnostic measures, the tests described in the final column of Table E.5 could be applied.

Bibliography

Footnotes