Marco Tacchini is Technical Director and owner of the consulting company GT Engineering, based in Brescia, Italy, which specializes in CE Marking, risk assessment, and risk reduction of machineries. Marco is a member of several technical committees that define Functional Safety Standards, including:

• ISO/TC 199 WG 8 for ISO 13849-1: Safe Control Systems
• TC 44/MT 62061 for IEC 62061: Safe control systems for machinery
• TC 65/SC 65A/MT 61511 for IEC 61511: Safety instrumented systems for the process industry
• TC 65/SC 65A/MT 61508-1-2 for IEC 61508: Maintenance of IEC 61508-1, -2, -3,-4, -5, -6 and 7

He leads short courses on functional safety at Brescia Engineering University and Milan Polytechnique.

Preface xv

Acknowledgments xix

About the Author xxi

Before You Start Reading this Book xxiii

1 The Basics of Reliability Engineering 1

1.1 The Birth of Reliability Engineering 1

1.1.1 Safety Critical Systems 2

1.2 Basic Definitions and Concepts of Reliability 2

1.3 Faults and Failures 2

1.3.1 Definitions 3

1.3.2 Random and Systematic Failures 3

1.3.2.1 How Random is a Random Failure? 4

1.4 Probability Elements Beyond Reliability Concepts 5

1.4.1 The Discrete Probability Distribution 5

1.4.1.1 Example: 10 Colored Balls 6

1.4.1.2 Example: 2 Dice 7

1.4.2 The Probability Density Function f (x) 7

1.4.2.1 Example 8

1.4.3 The Cumulative Distribution Function F(x) 9

1.4.4 The Reliability Function R(t) 10

1.5 Failure Rate ¿ 11

1.5.1 The Maclaurin Series 14

1.5.2 The Failure in Time or FIT 14

1.5.2.1 Example 14

1.6 Mean Time to Failure 14

1.6.1 Example of a Non-Constant Failure Rate 15

1.6.2 The Importance of the MTTF 16

1.6.3 The Median Life 16

1.6.4 The Mode 16

1.6.4.1 Example 17

1.6.4.2 Example 17

1.7 Mean Time Between Failures 18

1.8 Frequency Approach Example 19

1.8.1 Initial Data 19

1.8.2 Empirical Definition of Reliability and Unreliability 20

1.9 Reliability Evaluation of Series and Parallel Structures 22

1.9.1 The Reliability Block Diagrams 22

1.9.2 The Series Configuration 23

1.9.3 The Parallel Configuration 24

1.9.3.1 Two Equal and Independent Elements 24

1.9.4 M Out of N Functional Configurations 26

1.10 Reliability Functions in Low and High Demand Mode 27

1.10.1 The PFD 28

1.10.1.1 The Protection Layers 29

1.10.1.2 Testing of the Safety Instrumented System 30

1.10.2 The PFDavg 30

1.10.2.1 Dangerous Failures 31

1.10.2.2 How to Calculate the PFDavg 31

1.10.3 The PFH 32

1.10.3.1 Unconditional Failure Intensity w(t) vs Failure Density f (t) 32

1.10.3.2 Reliability Models Used to Estimate the PFH 34

1.11 Weibull Distribution 34

1.11.1 The Probability Density Function 34

1.11.2 The Cumulative Density Function 35

1.11.3 The Instantaneous Failure Rate 36

1.11.4 The Mean Time to Failure 37

1.11.4.1 Example 38

1.12 B10Dand the Importance of T10D39

1.12.1 The BX% Life Parameter and the B10D 39

1.12.1.1 Example 40

1.12.2 How ¿D and MTTFD are Derived from B10D40

1.12.3 The Importance of the Parameter T10D41

1.12.4 The Surrogate Failure Rate 43

1.12.5 Markov 43

1.13 Logical and Physical Representation of a Safety Function 45

1.13.1 De-energization of Solenoid Valves 45

1.13.2 Energization of Solenoid Valves 46

2 What is Functional Safety 47

2.1 A Brief History of Functional Safety Standards 47

2.1.1 IEC 61508 (All Parts) 48

2.1.1.1 HSE Study 49

2.1.1.2 Safety Integrity Levels 50

2.1.1.3 FMEDA 51

2.1.1.4 High and Low Demand Mode of Operation 52

2.1.1.5 Safety Functions and Safety-Related Systems 53

2.1.1.6 An Example of Risk Reduction Through Functional Safety 54

2.1.1.7 Why IEC 61508 was Written 54

2.1.2 ISO 13849-1 55

2.1.3 IEC 62061 56

2.1.4 IEC 61511 56

2.1.4.1 Introduction 56

2.1.4.2 The Second Edition 57

2.1.4.3 Designing a SIS 58

2.1.4.4 Three Methods 58

2.1.4.5 The Concept of Protection Layers 59

2.1.4.6 The Different Types of Risk 60

2.1.4.7 The Tolerable Risk 60

2.1.4.8 The ALARP Principle 62

2.1.4.9 Hazard and Operability Studies (HAZOP) 64

2.1.4.10 Layer of Protection Analysis (LOPA) 64

2.1.5 PFDavg for Different Architectures 65

2.1.5.1 1oo1 Architecture in Low Demand Mode 65

2.1.5.2 Series of 1oo1 Architecture in Low Demand Mode 66

2.1.5.3 1oo2 Architecture in Low Demand Mode 66

2.1.5.4 1oo3 Architecture in Low Demand Mode 67

2.1.5.5 2oo3 Architecture in Low Demand Mode 67

2.1.5.6 Summary Table 68

2.1.5.7 Example of PFDAvg Calculation 69

2.1.6 Reliability of a Safety Function in Low Demand Mode 70

2.1.7 A Timeline 72

2.2 Safety Systems in High and Low Demand Mode 73

2.2.1 Structure of the Control System in High and Low Demand Mode 73

2.2.1.1 Structure in Low Demand Mode, Process Industry 73

2.2.1.2 Structure in High Demand Mode, Machinery 74

2.2.1.3 Continuous Mode of Operation 74

2.2.2 The Border Line Between High and Low Demand Mode 74

2.2.2.1 Considerations in High Demand Mode 74

2.2.2.2 Considerations in Low Demand Mode 75

2.2.2.3 The Intermediate Region 75

2.3 What is a Safety Control System 76

2.3.1 Control System and Safety System 76

2.3.2 What is Part of a Safety Control System 78

2.3.3 Implication of Implementing an Emergency Start Function 79

2.4 CE Marking, OSHA Compliance, and Functional Safety 80

2.4.1 CE Marking 80

2.4.2 The European Standardization Organizations (ESOs) 81

2.4.3 Harmonized Standards 82

2.4.4 Functional Safety in North America 84

2.4.4.1 The Concept of Control Reliable 85

2.4.4.2 Functional Safety in the United States 86

3 Main Parameters 87

3.1 Failure Rate (¿) 87

3.1.1 Definition 87

3.1.2 Detected and Undetected Failures 88

3.1.3 Failure Rate for Electromechanical Components 89

3.1.3.1 Input Subsystem: Interlocking Device 89

3.1.3.2 Input Subsystem: Pressure Switch 89

3.1.3.3 Output Subsystem: Solenoid Valve 90

3.1.3.4 Output Subsystem: Power Contactor 90

3.2 Safe Failure Fraction 91

3.2.1 SFF in Low Demand Mode: Pneumatic Solenoid Valve 92

3.2.1.1 Example 93

3.2.2 SFF in High Demand Mode: Pneumatic Solenoid Valve 94

3.2.2.1 Example for a 1oo1 Architecture 94

3.2.2.2 Example for a 1oo2D Architecture 95

3.2.3 SFF and Electromechanical Components 96

3.2.3.1 The Advantage of Electronic Sensors 97

3.2.3.2 SFF and DC for Electromechanical Components 97

3.2.4 SFF in Low Demand Mode: Analog Input 98

3.2.5 SFF and DC in High Demand Mode: The Dynamic Test and Namur Circuits 100

3.2.5.1 Namur Type Circuits 101

3.2.5.2 Three Wire Digital Input 102

3.2.6 Limits of the SFF Parameter 102

3.2.6.1 Example 103

3.3 Diagnostic Coverage (DC) 103

3.3.1 Levels of Diagnostic 105

3.3.2 How to Estimate the DC Value 105

3.3.3 Frequency of the Test 106

3.3.4 Direct and Indirect Testing 106

3.3.4.1 DC for the Component and for the Channel 107

3.3.5 Testing by the Process 108

3.3.6 Examples of DC Values 109

3.3.7 Estimation of the Average DC 111

3.4 Safety Integrity and Architectural Constraints 112

3.4.1 The Starting Point 112

3.4.2 The Systematic Capability 113

3.4.2.1 Systematic Safety Integrity 113

3.4.3 Confusion Generated by the Concept of Systematic Capability 114

3.4.3.1 Random Capability 114

3.4.3.2 Systematic Capability 115

3.4.3.3 ISO 13849-1 115

3.4.4 The Safety Lifecycle 115

3.4.5 The Software Safety Lifecycle 115

3.4.6 Hardware Fault Tolerance 117

3.4.7 The Hardware Safety Integrity 118

3.4.7.1 Type A and Type B Components 118

3.4.8 Route 1H 119

3.4.8.1 Route 1H and Type A Component: Example 119

3.4.8.2 Route 1H and Type B Component: Example 120

3.4.9 High Demand Mode Safety-Related Control Systems 120

3.4.9.1 Example 121

3.4.10 Route 2H 122

3.5 Mean Time to Failure (MTTF) 123

3.5.1 Examples of MTTF Values 123

3.5.2 Calculation of MTTFD and ¿D for Components from B10D 125

3.5.3 Estimation of MTTFD for a Combination of Systems 125

3.5.3.1 Example for Channels in Series 126

3.5.3.2 Example for Redundant Channels 126

3.6 Common Cause Failure (CCF) 127

3.6.1 Introduction to CCF and the Beta-Factor 127

3.6.2 How IEC 62061 Handles the CCF 128

3.6.3 How ISO 13849-1 Handles the CCF 129

3.7 Proof Test 130

3.7.1 Proof Test Procedures 131

3.7.1.1 Example of a Proof Test Procedure for a Pressure Transmitter 131

3.7.1.2 Example of a Proof Test Procedure for a Solenoid Valve 132

3.7.2 How the Proof Test Interval Affects the System Reliability 133

3.7.2.1 Example 133

3.7.3 Proof Test in Low Demand Mode 134

3.7.3.1 Imperfect Proof Testing and the Proof Test Coverage (PTC) 135

3.7.3.2 Partial Proof Test (PPT) 136

3.7.3.3 Example for a Partial Valve Stroke Test 137

3.7.4 Proof Test in High Demand Mode 138

3.8 Mission Time and Useful Lifetime 139

3.8.1 Mission Time Longer than 20 Years 140

4 Introduction to ISO 13849-1 and IEC 62061 141

4.1 Risk Assessment and Risk Reduction 141

4.1.1 Cybersecurity 141

4.1.2 Protective and Preventive Measures 143

4.1.3 Functional Safety as Part of the Risk Reduction Measures 144

4.1.4 The Naked Machinery 146

4.2 SRP/CS, SCS, and the Safety Functions 146

4.2.1 SRP/CS and SCS 146

4.2.2 The Safety Function and Its Subsystems 147

4.2.3 The Physical and the Functional Level 147

4.3 Examples of Safety Functions 149

4.3.1 Safety-Related Stop 149

4.3.2 Safety Sub-Functions Related to Power Drive Systems...