Post updated 2019-07-24. Ed.
You have completed the risk assessment, assigned required Performance Levels to each safety function, and developed the Safety Requirement Specification for each safety function. Next, you need to consider three aspects of the system design: Architectural Category, Channel Mean Time to Dangerous Failure (MTTFD), and Diagnostic Coverage (DCavg). I will discuss selecting the system’s architectural category in this part of the series.
If you missed the second instalment in this series, read it here.
Understanding Performance Levels
It helps to know a little about where ISO 13849-1 originated. ISO 13849-1 is a simplified method for determining the reliability of safety-related controls for machinery. The basic ideas came from IEC 61508 [7], a seven-part standard originally published in 1998. IEC 61508 introduced the average probability of dangerous failure per Hour, PFHD (1/h). Dangerous failures are those failures that result in non-performance of the safety function and which cannot be detected by diagnostics. Here’s the formal definition from [1]:
3.1.5
dangerous failure
failure which has the potential to put the SRP/CS in a hazardous or fail-to-function stateNote 1 to entry: Whether or not the potential is realised can depend on the channel architecture of the system; in redundant systems a dangerous hardware failure is less likely to lead to the overall dangerous or fail-to-function state.
Note 2 to entry: [SOURCE: IEC 61508-4, 3.6.7, modified.]
The Performance Levels are simply bands of probabilities of Dangerous Failures, as shown in [1, Table 2] below.
The ranges shown in [1, Table 2] are approximate. If you need to see the specific limits of the bands for any reason, see [1, Annex K] describes the full span of PFHD in table format.
There is another way to describe the same characteristics of a system, this one from IEC. Instead of using the PL system, IEC uses Safety Integrity Levels (SILs). [1, Table 3] shows the correspondence between PLs and SILs. Note that the correspondence is not exact. Where the calculated PFHd is close to either end of one of the PL or SIL bands, use the table in [1, Annex K] or in [9] to determine to which band(s) the performance should be assigned.
IEC produced a Technical Report [10] that guides the use of ISO 13849-1 or IEC 62061. The following table shows the relationship between PLs, PFHd and SILs.
IEC 61508 includes SIL 4, which is not shown in [10, Table 1] because this level of performance exceeds the range of PFHD possible using ISO 13849-1. Also, you may have noticed that PLb and PLc are both within SIL1. This was done to accommodate the five architectural categories from EN 954-1 [12].
Why PL and not just PFHD? One of the odd things humans do, when we can calculate things is to develop what has been called “precision bias” [12]. Precision bias occurs when we can compute a number that appears very precise, e.g., 3.2 x 10-6, making us feel like we have a precise concept of the quantity. The problem, at least, in this case, is that we are dealing with probabilities and minuscule probabilities at that. Using bands, like the PLs, forces us to “bin” these precise numbers into larger groups, eliminating the effects of precision bias in evaluating the systems. Eliminating precision bias is the same reason IEC 61508 uses SILs – binning the calculated values helps reduce our tendency to develop a precision bias. The reality is that we just can’t predict the behaviour of these systems with as much precision as we would like to believe.
Getting to Performance Levels: MTTFD, Architectural Category and DC
Some aspects of the system design need to be considered to arrive at a Performance Level or make a prediction about failure rates in terms of PFHd.
First is the system architecture: Fundamentally, single channel or two-channel. As a side note, if your system uses more than two channels, there are ways to handle this in ISO 13849-1 that are workarounds, or you can also use IEC 62061 or IEC 61508, which will handle these more complex systems more easily. Remember, ISO 13849-1 is intended for relatively simple systems.
When we get into the analysis in a later article, we will calculate or estimate each channel’s Mean Time to Dangerous Failure, MTTFD, and the entire system. MTTFD is expressed in years, unlike PFHd, which is expressed in fractional hours (1/h). I have yet to hear why this is the case, as it seems rather confusing. However, that is current practice.
Architectural Categories
Once the required PL is known, the next step is the selection of the architectural category. The basic architectural categories were introduced initially in EN 954-1:1996 [12]. The Categories were carried forward unchanged into the first edition of ISO 13849-1 in 1999. The Categories were maintained and expanded to include additional requirements in the second and third editions in 2005, 2015, and soon in the 2022 or 2023 edition, whenever the current draft is published.
Since I have explored the details of the architectures in a previous series, I will not repeat that here. Instead, I will refer you to that series. The architectural Categories come in five flavours:
ISO 13849-1 Category specifications
| Category | Structure | Basic Requirements | Safety Principles |
|---|---|---|---|
B | Single channel | Basic circuit conditions are met (i.e., components are rated for the circuit voltage and current, etc.) Use of components that are designed and built to the relevant component standards. [1, 6.2.3] | Component selection |
1 | Single channel | Category B plus the use of "well-tried components" and "well-tried safety principles" [1, 6.2.4] | Component selection |
2 | Single channel | Category B plus the use of "well-tried safety principles" and periodic testing [1, 4.5.4] of the safety function by the machine control system. [1, 6.2.5] | System Structure |
3 | Dual channel | Category B plus the use of "well-tried safety principles" and no single fault shall lead to the loss of the safety function. Where practicable, single faults shall be detected. [1, 6.2.6] | System Structure |
4 | Dual channel | Category B plus the use of "well-tried safety principles" and no single fault shall lead to the loss of the safety function. Single faults are detected at or before the next demand on the safety system, but where this is not possible an accumulation of undetected faults will not lead to the loss of the safety function. [1, 6.2.7] | System Structure |
| For full requirements, see [1, Cl. 6] | |||
[1, Table 10] provides a more detailed summary of the requirements than the table above.
Since all the Categories cannot achieve the same reliability, the PL and the Categories are linked, as shown in [1, Fig. 5]. This diagram summarises the relationship of the three central parameters in ISO 13849-1 in one illustration.
Starting with the PLr from the Safety Requirement Specification for the first safety function, you can use Fig. 5 to help you select the Category and other parameters necessary for the design. For example, suppose that the risk assessment indicates that an emergency stop system is needed. ISO 13850 requires that emergency stop functions provide a minimum of PLc, so using this as the basis, you can look at the vertical axis in the diagram to find PLc and then read across the figure. You will see that PLc can be achieved using Category 1, 2, or 3 architecture, each with corresponding differences in MTTFD and DCavg. For example:
- Cat. 1, MTTFD = high and DCavg = none, or
- Cat. 2, MTTFD = Medium to High and DCavg = Low to Medium, or
- Cat. 3, MTTFD = Low to High and DCavg = Low to Medium.
As you can see, the MTTFD in the channels decreases as the diagnostic coverage increases. The design compensates for lower reliability in the components by increasing the diagnostic coverage and adding redundancy. Using [1, Fig. 5], you can pin down any parameters and select the others as appropriate.
One additional point regarding Categories 3 and 4: The difference between these Categories is increased Diagnostic Coverage. While Category 3 is Single Fault Tolerant, Category 4 has additional diagnostic capabilities so that additional faults cannot lead to the loss of the safety function. This is not the same as being multiple fault-tolerant. The system is still designed to operate in the presence of only a single fault; it is simply enhanced diagnostic capability.
It is worth noting that ISO 13849 only recognizes structures with single or dual channel configurations. Suppose you need to develop a system with more than single redundancy (i.e., more than two channels). In that case, you can analyze each pair of channels as a dual channel architecture, or you can use IEC 62061 or IEC 61508, either of which permits any level of redundancy.
The next step in this process is evaluating the component and channel MTTFD and then determining the complete system MTTFD. Part 4 of this series publishes on 13-Feb-17.
If you missed the first part of the series, read it here.
Book List
Here are some books that I think you may find helpful on this journey:
[0] B. Main, Risk Assessment: Basics and Benchmarks, 1st ed. Ann Arbor, MI USA: DSE, 2004.
[0.2] Electromagnetic Compatibility for Functional Safety, 1st ed. Stevenage, UK: The Institution of Engineering and Technology, 2008.
[0.3] Overview of techniques and measures related to EMC for Functional Safety, 1st ed. Stevenage, UK: Overview of techniques and measures related to EMC for Functional Safety, 2013.
[0.5] “Code of Practice: Competence for Safety Related Systems Practitioners, 1st ed. Stevenage, UK: The Institution of Engineering and Technology, 2016.
References
Note: This reference list starts in Part 1 of the series, so “missing” references may show in other parts of the series. Included in the last post of the series is the complete reference list.
[1] Safety of machinery — Safety-related parts of control systems — Part 1: General principles for design. ISO Standard 13849-1. 2015.
[7] Functional safety of electrical/electronic/programmable electronic safety-related systems. IEC Standard 61508. 2nd Edition. Seven Parts. 2010.
© 2017 – 2022, Compliance inSight Consulting Inc. 
This work is licensed under a Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License.