P14: Functional Safety in High Demand: IEC 62061 and Architectures, Part 2

This article is part of a series of articles written on Functional Safety of Machinery. We recently introduced one of the two standards used to design Safety Control Systems in High Demand: ISO 13849-1. We are now presenting the key aspects of IEC 62061. In the previous edition of TUTTOMISURE we presented Architecture A and B; we will now detail Architecture C: the equivalent of Category 2 of ISO 13849-1, in other terms a single cannel with diagnostics.

In this Architecture, single channel with diagnostic, any undetected dangerous fault of the subsystem element leads to a dangerous failure of the safety function. Where a fault of a subsystem element is detected, the diagnostic function initiates a fault reaction. This Architecture corresponds to a Hardware Fault Tolerance of 0.

This Architecture corresponds to the Category 2 of ISO 13849-1; in figure 2 there is a more precise representation.

You can notice that the TE (Test Equipment) of Category 2 in ISO 13849-1 is defined as Fault Diagnostic Function in IEC 62061. Likewise, the equivalent of the OTE is the Fault Reaction Function. The TE + OTE is defined as the Fault Handling Function in IEC 62061.

For Architecture C, the calculation of PFH assumes a time-optimal fault handling. Time optimal fault handling of a subsystem element can be assumed if one of the following conditions are satisfied:

• The diagnostic rate is at least a factor of 100 higher than the demand rate of the safety function and the time needed for the fault reaction is sufficiently short to bring the system to a safe state, before a hazardous event occurs; or
• The fault handling is performed immediately upon any potential demand of the safety function and the time needed to detect a detectable fault and to bring the system to a safe state is shorter than the process safety time; or
• The fault handling is performed continuously, and the time needed to detect a detectable fault and to bring the system to a safe state is shorter than the process safety time; or
• The fault handling is performed periodically and the sum of the test interval, the time needed to detect a detectable fault and time needed to bring the system to a safe state is shorter than the process safety time.

The table 1 summarises all possible conditions related to a correct implementation of a 1oo1D architecture.

• Situation 1 and 3. If no safe state is possible, regardless of the case if there is an optimal testing frequency or not, we cannot claim 1oo1D Architecture. Therefore, we fall back to a 1oo1 Architecture, where well-tried components must be used.

The reason for the difference with ISO 13849-1, in case of Situation 3, is due to the link of IEC 62061 to IEC 61508.

[IEC 61508-2] 7.4.8 Requirements for system behaviour on detection of a fault

7.4.8.3 The detection of a dangerous fault (by diagnostic tests, proof tests or by any other means) in any subsystem having a hardware fault tolerance of 0 shall, in the case of a subsystem that is implementing any safety function(s) operating in the high demand or the continuous mode, result in a specified action to achieve or maintain a safe state (see Note). 

NOTE: The specified action required to achieve or maintain a safe state will be specified in the E/E/PE system safety requirements (see IEC 61508-1, 7.10). It may consist, for example, of the safe shut-down of the EUC, or that part of the EUC that relies, for functional safety, on the faulty subsystem. 

• Situation 2. No Optimal testing is present; however, in case a fault is detected, we can bring the system to a safe state. We can claim a 1oo1D Basic Subsystem Architecture and we can reach SIL 2, if all other conditions exist. No need to use well-tried components.
• Situation 4. We have both optimal testing and, in case a fault is detected, we can bring the system to a safe state. We can claim a 1oo1D Basic Subsystem Architecture and we can reach SIL 2, if all other conditions exist. No need to use well-tried components.

This is a “delicate” Architecture, similarly to the Category 2. The issue is the failure of the Diagnostic Function, called Fault handling Function, while the Functional Channel is still working. The Fault Handling function includes both the Fault Diagnostics function and the Fault Reaction function.

As you can see, the reliability of the Fault Handling Function (or monitoring function) is not present in the formula. It is the same formula used in the first edition of the standard.

These are all cases where the reliability of the monitoring channel, or better, the Fault Handling function, is outside of the Safety Function. In order to calculate the PFH of this architecture, a new failure rate has to be introduced: it is called the failure rate of the Fault Handling Function, or λ_D-FH.

A Markov model was used to arrive to the different PFH formulas.

There are 3 possible situations:

1. The subsystem C has external Fault Diagnostics (TE), but the element performing the fault reaction (it would be the OTE in ISO 13849-1 Category 2) is internal to the subsystem.

In this case the fault handling failure rate includes the Fault Reaction function only.

That means λ_D-FH= λ_D-FR

The Failure Rate of the Fault Diagnostic function is not considered, since it is already taken care while calculating the reliability of the Functional Channel.

2. The Subsystem C has external Fault Reaction (OTE), while the Fault Diagnostic (TE) is done Internally to the subsystem.

In this case the fault handling failure rate includes the Fault Diagnostic function only.

That means λ_D-FH= λ_D-FD

The Failure Rate of the Fault Reaction function is not considered since it is already taken care while calculating the reliability of the Functional Channel.

3. The subsystem C has both Fault Diagnostics and Fault Reaction internal to the subsystem.

In this case the fault handling failure rate includes both the diagnostic function and the fault reaction function.

That means λ_D-FH = λ_D-FD + λ_D-FR

Where:

• T₁ is the Proof Test interval of the perfect Proof Test or useful lifetime whichever is the smaller;
• 𝜆_De is the dangerous failure rate of the single element of the functional channel;
• 𝜆_D-FH is the failure rate of the single element that realizes the fault handling function(s) within the subsystem;
• DC is the diagnostic coverage for the single element e of the functional channel;
• β is the susceptibility to common cause failures of the functional channel and the channel that realizes the fault handling function(s) within the subsystem.

The same equation can be used even in case all the 4 above conditions are satisfied: it is the general formula for Architecture C: it is always valid.

You may notice that, in case the dangerous failure rate(s) of the fault handling function(s) within the subsystem can be assumed to be zero (𝜆_D-FH = 0), the equation becomes the same as the one in § 7.2.6.1. The reason is obvious: the monitoring channel is assumed to have a very high reliability.

Please consider that the general formula can be used even if the reliability of the fault handling function is worse than that required by Table 2.

Let’s consider the output subsystem as shown in Figure 7. K_P has B₁₀ = 10⁶ with 73% as percentage of dangerous failures. U< is has a B₁₀ = 4·10⁵. The Mission Time of both the contactor and the undervoltage coil is 20 years.

K_P is supposed to open twice per minute while U< is supposed to open once per month.

Let’s now focus on the calculation of probability of random failures.

1. The first step is to calculate the 𝜆_D of the contactor K_P. We assume the machine is working 240 days per year and eight hours per day.

2. The second step is to calculate T₁ and β.

T₁=min (Useful Life; Proof Test);

Useful Life= min (Mission Time; T_10D);

Mission Time = 20 years;