This article was updated on 2019-07-24. Ed.
Developing the Safety Requirement Specification
The Safety Requirement Specification sounds pretty heavy, but actually, it is just a big name for a way to organize the information you need to analyze and design the safety systems for your machinery. Note that I am assuming that you are doing this in the “right” order, meaning that you are planning the design rather than trying to back-fill the documentation after completing the design. In either case, the process is the same, but getting the information you need can be much harder after the fact than before doing the design work. Doing some aspects in a review mode is impossible, especially if a third party to whom you have no access did the design work [8].
If you missed the first instalment in this series, read it here.
What goes into the Safety Requirement Specifications?
For reference, chapter 5 of ISO 13849-1 [1] covers safety requirement specifications to some degree, but it needs some clarification, I think. First of all, what is a safety function?
Safety functions include any machine function directly affecting the worker’s safety. However, it is possible to ignore some important functions using this definition. Complementary protective measures, like emergency stops, can be missed because they are usually “after the fact,” i.e., the injury occurs. Then the E-stop is pressed, so you cannot say it has a “direct protective effect.” If we look at the definitions in [1], we find:
3.1.20
safety function
function of the machine whose failure can result in an immediate increase of the risk(s)
ISO 13849-1:2015
[SOURCE: ISO 12100:2010, 3.30.]
I added the bolding to the text in the definition because this is the important part. If the failure of the control function does not increase the risk to the user, then the control function is NOT a safety function!
Linking Risk to Functional Safety
Referring to the risk assessment, any risk control that protects workers from some aspect of the machine operation using a control function like an interlocked gate or maintaining a temperature below a critical level or speed at a safe level is a safety function. For example: if the temperature in a process rises too high, an explosion is likely to occur; or if a shaft speed is too high (or too low), the tool may shatter and eject broken pieces at high speed. Therefore, the temperature control and speed control functions are safety functions. These functions may also be process control functions, but the potential for an immediate increase in risk due to a failure makes them safety functions no matter what else they may do.
[1, Table 8] gives examples of various safety functions found on machines. The table is not inclusive – meaning there are many more safety functions than listed. Your job is to figure out which ones live in your machine. It is a bit like Pokemon – ya gotta catch ’em all! 😀
Basic Safety Requirement Specification
Each safety function must have a Performance Level or a Safety Integrity Level assigned as part of the risk assessment. For each safety function, you need to develop the following information:
| Item | Description |
|---|---|
| Safety Function Identification | Name or other references, e.g. “Access Gate Interlock” or “Hazard Zone 2.” |
| Functional Characteristics |
|
| Emergency Operation | Is this an emergency operation function? If yes, what types of emergencies might be mitigated by this function? |
| Interactions | What operating modes require this function to be operational? Are there modes where this function requires deliberate bypass? These could include normal working modes (automatic, manual, set-up, changeover), and fault-finding or maintenance modes. |
| Behaviour | How you want the system to behave when the safety function is triggered, i.e., Power is immediately removed from the MIG welder using an IEC 60204-1?Category 0 stop function, and robot motions are stopped using?IEC 60204-1 Category 1 stop?function through the robot safety stop input.
or All horizontal pneumatic motions stop in their current positions. Vertical motions return to the raised or retracted positions. Also to be considered is a power loss condition. Should the system behave in the same way as if the safety function was triggered, not react at all, or do something else? Consider vertical axes that might require holding brakes or other mechanisms to prevent power loss causing unexpected motion. |
| Machine State after triggering | What is the expected state of the machine after triggering the safety function? What is the recovery process? |
| Frequency of Operation | How often do you expect this safety function to be used? A reasonable estimate is needed. More on this below. |
| Priority of Operation | If simultaneous triggering of multiple safety functions is possible, which function(s) takes precedence? E.g., Emergency Stop always takes precedence over everything else. What happens if you have a safe speed function and a guard interlock that are associated because the interlock is part of a guarding function covering a shaft, and you need to troubleshoot the safe speed function, so you need access to the shaft where the encoders are mounted? |
| Required Performance Level | I suggest recording the S, F, and P values selected as well as the PLr value selected for later reference. |
Here’s an example table in MS Word format that you can use as a starting point for your SRS documents. Note that SRS can be much more detailed than this. If you want more information on this, read IEC 61508-1, 7.10.2.
So, that is the minimum. You can add lots more information to the minimum requirements, but this will get you started. If you want more information on developing the SRS, you will need to get a copy of IEC 61508 [7].
What’s Next?
Next, you need to be able to make some design decisions about system architecture and components. Circuit architectures have been discussed on the MS101 blog, so I will not go through them again in this series. Instead, I will show you how to choose an architecture based on your design goals in the next instalment. If you missed the first part of the series, read it here.
Book List
Here are some books that I think you may find helpful on this journey:
[0] B. Main, Risk Assessment: Basics and Benchmarks, 1st ed. Ann Arbor, MI USA: DSE, 2004.
[0.2] Electromagnetic Compatibility for Functional Safety, 1st ed. Stevenage, UK: The Institution of Engineering and Technology, 2008.
[0.3] Overview of techniques and measures related to EMC for Functional Safety, 1st ed. Stevenage, UK: Overview of techniques and measures related to EMC for Functional Safety, 2013.
[0.5] “Code of Practice: Competence for Safety Related Systems Practitioners, 1st ed. Stevenage, UK: The Institution of Engineering and Technology, 2016.
References
Note: This reference list starts in Part 1 of the series, so “missing” references may show in other parts of the series. Included in the last post of the series is the complete reference list.
© 2017 – 2022, Compliance inSight Consulting Inc. 
This work is licensed under a Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License.