Marco Tacchini is Technical Director and owner of the consulting company GT Engineering, based in Brescia, Italy, which specializes in CE Marking, risk assessment, and risk reduction of machineries. Marco is a member of several technical committees that define Functional Safety Standards, including:

• ISO/TC 199 WG 8 for ISO 13849-1 Safe Control Systems
• TC 44/MT 62061 for IEC 62061 Safe control systems for machinery
• TC 65/SC 65A/MT 61511 for IEC 61511 Safety instrumented systems for the process industry
• TC 65/SC 65A/MT 61508-1-2 for IEC 61508 Maintenance of IEC 61508-1, -2, -3, -4, -5, -6 and 7

He leads short courses on functional safety at Brescia Engineering University and Milan Polytechnique.

Preface xv

Acknowledgments xix

About the Author xxi

Before You Start Reading this Book xxiii

1 The Basics of Reliability Engineering 1

1.1 The Birth of Reliability Engineering 1

1.1.1 Safety Critical Systems 2

1.2 Basic Definitions and Concepts of Reliability 2

1.3 Faults and Failures 2

1.3.1 Definitions 3

1.3.2 Random and Systematic Failures 3

1.3.2.1 How Random is a Random Failure? 4

1.4 Probability Elements Beyond Reliability Concepts 5

1.4.1 The Discrete Probability Distribution 5

1.4.1.1 Example: 10 Colored Balls 6

1.4.1.2 Example: 2 Dice 7

1.4.2 The Probability Density Function f (x) 7

1.4.2.1 Example 8

1.4.3 The Cumulative Distribution Function F(x) 9

1.4.4 The Reliability Function R(t) 10

1.5 Failure Rate lambda 11

1.5.1 The Maclaurin Series 14

1.5.2 The Failure in Time or FIT 14

1.5.2.1 Example 14

1.6 Mean Time to Failure 14

1.6.1 Example of a Non-Constant Failure Rate 15

1.6.2 The Importance of the MTTF 16

1.6.3 The Median Life 16

1.6.4 The Mode 16

1.6.4.1 Example 17

1.6.4.2 Example 17

1.7 Mean Time Between Failures 18

1.8 Frequency Approach Example 19

1.8.1 Initial Data 19

1.8.2 Empirical Definition of Reliability and Unreliability 20

1.9 Reliability Evaluation of Series and Parallel Structures 22

1.9.1 The Reliability Block Diagrams 22

1.9.2 The Series Configuration 23

1.9.3 The Parallel Configuration 24

1.9.3.1 Two Equal and Independent Elements 24

1.9.4 M Out of N Functional Configurations 26

1.10 Reliability Functions in Low and High Demand Mode 27

1.10.1 The PFD 28

1.10.1.1 The Protection Layers 29

1.10.1.2 Testing of the Safety Instrumented System 30

1.10.2 The PFDavg 30

1.10.2.1 Dangerous Failures 31

1.10.2.2 How to Calculate the PFDavg 31

1.10.3 The PFH 32

1.10.3.1 Unconditional Failure Intensity w(t) vs Failure Density f (t) 32

1.10.3.2 Reliability Models Used to Estimate the PFH 34

1.11 Weibull Distribution 34

1.11.1 The Probability Density Function 34

1.11.2 The Cumulative Density Function 35

1.11.3 The Instantaneous Failure Rate 36

1.11.4 The Mean Time to Failure 37

1.11.4.1 Example 38

1.12 B10Dand the Importance of T10D39

1.12.1 The BX% Life Parameter and the B10D 39

1.12.1.1 Example 40

1.12.2 How lambdaD and MTTFD are Derived from B10D40

1.12.3 The Importance of the Parameter T10D41

1.12.4 The Surrogate Failure Rate 43

1.12.5 Markov 43

1.13 Logical and Physical Representation of a Safety Function 45

1.13.1 De-energization of Solenoid Valves 45

1.13.2 Energization of Solenoid Valves 46

2 What is Functional Safety 47

2.1 A Brief History of Functional Safety Standards 47

2.1.1 IEC 61508 (All Parts) 48

2.1.1.1 HSE Study 49

2.1.1.2 Safety Integrity Levels 50

2.1.1.3 FMEDA 51

2.1.1.4 High and Low Demand Mode of Operation 52

2.1.1.5 Safety Functions and Safety-Related Systems 53

2.1.1.6 An Example of Risk Reduction Through Functional Safety 54

2.1.1.7 Why IEC 61508 was Written 54

2.1.2 ISO 13849-1 55

2.1.3 IEC 62061 56

2.1.4 IEC 61511 56

2.1.4.1 Introduction 56

2.1.4.2 The Second Edition 57

2.1.4.3 Designing a SIS 58

2.1.4.4 Three Methods 58

2.1.4.5 The Concept of Protection Layers 59

2.1.4.6 The Different Types of Risk 60

2.1.4.7 The Tolerable Risk 60

2.1.4.8 The ALARP Principle 62

2.1.4.9 Hazard and Operability Studies (HAZOP) 64

2.1.4.10 Layer of Protection Analysis (LOPA) 64

2.1.5 PFDavg for Different Architectures 65

2.1.5.1 1oo1 Architecture in Low Demand Mode 65

2.1.5.2 Series of 1oo1 Architecture in Low Demand Mode 66

2.1.5.3 1oo2 Architecture in Low Demand Mode 66

2.1.5.4 1oo3 Architecture in Low Demand Mode 67

2.1.5.5 2oo3 Architecture in Low Demand Mode 67

2.1.5.6 Summary Table 68

2.1.5.7 Example of PFDAvg Calculation 69

2.1.6 Reliability of a Safety Function in Low Demand Mode 70

2.1.7 A Timeline 72

2.2 Safety Systems in High and Low Demand Mode 73

2.2.1 Structure of the Control System in High and Low Demand Mode 73

2.2.1.1 Structure in Low Demand Mode, Process Industry 73

2.2.1.2 Structure in High Demand Mode, Machinery 74

2.2.1.3 Continuous Mode of Operation 74

2.2.2 The Border Line Between High and Low Demand Mode 74

2.2.2.1 Considerations in High Demand Mode 74

2.2.2.2 Considerations in Low Demand Mode 75

2.2.2.3 The Intermediate Region 75

2.3 What is a Safety Control System 76

2.3.1 Control System and Safety System 76

2.3.2 What is Part of a Safety Control System 78

2.3.3 Implication of Implementing an Emergency Start Function 79

2.4 CE Marking, OSHA Compliance, and Functional Safety 80

2.4.1 CE Marking 80

2.4.2 The European Standardization Organizations (ESOs) 81

2.4.3 Harmonized Standards 82

2.4.4 Functional Safety in North America 84

2.4.4.1 The Concept of Control Reliable 85

2.4.4.2 Functional Safety in the United States 86

3 Main Parameters 87

3.1 Failure Rate (lambda) 87

3.1.1 Definition 87

3.1.2 Detected and Undetected Failures 88

3.1.3 Failure Rate for Electromechanical Components 89

3.1.3.1 Input Subsystem: Interlocking Device 89

3.1.3.2 Input Subsystem: Pressure Switch 89

3.1.3.3 Output Subsystem: Solenoid Valve 90

3.1.3.4 Output Subsystem: Power Contactor 90

3.2 Safe Failure Fraction 91

3.2.1 SFF in Low Demand Mode: Pneumatic Solenoid Valve 92

3.2.1.1 Example 93

3.2.2 SFF in High Demand Mode: Pneumatic Solenoid Valve 94

3.2.2.1 Example for a 1oo1 Architecture 94

3.2.2.2 Example for a 1oo2D Architecture 95

3.2.3 SFF and Electromechanical Components 96

3.2.3.1 The Advantage of Electronic Sensors 97

3.2.3.2 SFF and DC for Electromechanical Components 97

3.2.4 SFF in Low Demand Mode: Analog Input 98

3.2.5 SFF and DC in High Demand Mode: The Dynamic Test and Namur Circuits 100

3.2.5.1 Namur Type Circuits 101

3.2.5.2 Three Wire Digital Input 102

3.2.6 Limits of the SFF Parameter 102

3.2.6.1 Example 103

3.3 Diagnostic Coverage (DC) 103

3.3.1 Levels of Diagnostic 105

3.3.2 How to Estimate the DC Value 105

3.3.3 Frequency of the Test 106

3.3.4 Direct and Indirect Testing 106

3.3.4.1 DC for the Component and for the Channel 107

3.3.5 Testing by the Process 108

3.3.6 Examples of DC Values 109

3.3.7 Estimation of the Average DC 111

3.4 Safety Integrity and Architectural Constraints 112

3.4.1 The Starting Point 112

3.4.2 The Systematic Capability 113

3.4.2.1 Systematic Safety Integrity 113

3.4.3 Confusion Generated by the Concept of Systematic Capability 114

3.4.3.1 Random Capability 114

3.4.3.2 Systematic Capability 115

3.4.3.3 ISO 13849-1 115

3.4.4 The Safety Lifecycle 115

3.4.5 The Software Safety Lifecycle 115

3.4.6 Hardware Fault Tolerance 117

3.4.7 The Hardware Safety Integrity 118

3.4.7.1 Type A and Type B Components 118

3.4.8 Route 1H 119

3.4.8.1 Route 1H and Type A Component: Example 119

3.4.8.2 Route 1H and Type B Component: Example 120

3.4.9 High Demand Mode Safety-Related Control Systems 120

3.4.9.1 Example 121

3.4.10 Route 2H 122

3.5 Mean Time to Failure (MTTF) 123

3.5.1 Examples of MTTF Values 123

3.5.2 Calculation of MTTFD and lambdaD for Components from B10D 125

3.5.3 Estimation of MTTFD for a Combination of Systems 125

3.5.3.1 Example for Channels in Series 126

3.5.3.2 Example for Redundant Channels 126

3.6 Common Cause Failure (CCF) 127

3.6.1 Introduction to CCF and the Beta-Factor 127

3.6.2 How IEC 62061 Handles the CCF 128

3.6.3 How ISO 13849-1 Handles the CCF 129

3.7 Proof Test 130

3.7.1 Proof Test Procedures 131

3.7.1.1 Example of a Proof Test Procedure for a Pressure Transmitter 131

3.7.1.2 Example of a Proof Test Procedure for a Solenoid Valve 132

3.7.2 How the Proof Test Interval Affects the System Reliability 133

3.7.2.1 Example 133

3.7.3 Proof Test in Low Demand Mode 134

3.7.3.1 Imperfect Proof Testing and the Proof Test Coverage (PTC) 135

3.7.3.2 Partial Proof Test (PPT) 136

3.7.3.3 Example for a Partial Valve Stroke Test 137

3.7.4 Proof Test in High Demand Mode 138

3.8 Mission Time and Useful Lifetime 139

3.8.1 Mission Time Longer than 20 Years 140

4 Introduction to ISO 13849-1 and IEC 62061 141

4.1 Risk Assessment and Risk Reduction 141

4.1.1 Cybersecurity 141

4.1.2 Protective and Preventive Measures 143

4.1.3 Functional Safety as Part of the Risk Reduction Measures 144

4.1.4 The Naked Machinery 146

4.2 SRP/CS, SCS, and the Safety Functions 146

4.2.1 SRP/CS and SCS 146

4.2.2 The Safety Function and Its Subsystems 147

4.2.3 The Physical and the Functional Level 147

4.3 Examples of Safety Functions 149

4.3.1 Safety-Related Stop 149

4.3.2 Safety Sub-Functions Related to Power Drive Systems 149

4.3.2.1 Stopping Functions 149

4.3.2.2 Monitoring Functions 151

4.3.2.3 Information to be Provided by the PDS Manufacturer 152

4.3.3 Manual Reset 152

4.3.3.1 Multiple Sequential Reset 154

4.3.3.2 How to Implement the Reset Electrical Architecture 154

4.3.4 Restart Function 154

4.3.5 Local Control Function 154

4.3.6 Muting Function 154

4.3.7 Operating Mode Selection 155

4.4 The Emergency Stop Function 156

4.5 The Reliability of a Safety Function in High Demand Mode 157

4.5.1 PFHD and PFH 157

4.5.2 The Performance Level 157

4.5.3 The Safety Integrity Level 158

4.5.4 Relationship Between SIL and PL 158

4.5.5 Definition of Harm 159

4.6 Determination of the Required PL (PLr) According to ISO 13849-1 159

4.6.1 Risk Parameters 160

4.6.1.1 S: Severity of Injury 160

4.6.1.2 F: Frequency and/or Exposure Time to Hazard 160

4.6.1.3 P: Possibility of Avoiding Hazard or Limiting Harm 160

4.6.1.4 An Example on How to Use the Graph 161

4.7 Rapex Directive 162

4.8 Determination of the Required SIL (SILr) According to IEC 62061 163

4.8.1 Risk Elements and SIL Assignment 164

4.8.2 Severity (Se) 165

4.8.3 Probability of Occurrence of Harm 165

4.8.3.1 Frequency and Duration of Exposure (Fr) 165

4.8.3.2 Probability of Occurrence of a Hazardous Event (Pr) 166

4.8.3.3 Probability of Avoiding or Limiting the Harm (Av) 166

4.8.3.4 Example of the Table Use 167

4.9 The Requirements Specification 167

4.9.1 Information Needed to Prepare the SRS or the...