ISO 13849 – 1 Analysis — Part 8: Fault Exclusion

This entry is part of 9 in the series How to do a 13849 – 1 analysis

Fault Consideration & Fault Exclusion

ISO 13849 – 1, Chapter 7 [1, 7] discusses the need for fault consideration and fault exclusion. Fault consideration is the process of examining the components and sub-systems used in the safety-related part of the control system (SRP/CS) and making a list of all the faults that could occur in each one. This a definitely non-trivial exercise!

Thinking back to some of the earlier articles in this series where I mentioned the different types of faults, you may recall that there are detectable and undetectable faults, and there are safe and dangerous faults, leading us to four kinds of fault:

Safe undetectable faults
Dangerous undetectable faults
Safe detectable faults
Dangerous undetectable faults

For systems where no diagnostics are used, Category B and 1, faults need to be eliminated using inherently safe design techniques. Care needs to be taken when classifying components as “well-tried” versus using a fault exclusion, as components that might normally be considered “well-tried” might not meet those requirements in every application.

For systems where diagnostics are part of the design, i.e., Category 2, 3, and 4, the fault lists are used to evaluate the diagnostic coverage (DC) of the test systems. Depending on the architecture, certain levels of DC are required to meet the relevant PL, see [1, Fig. 5]. The fault lists are starting point for the determination of DC, and are an input into the hardware and software designs. All of the dangerous detectable faults must be covered by the diagnostics, and the DC must be high enough to meet the PL_r. for the safety function.

The fault lists and fault exclusions are used in the Validation portion of this process as well. At the start of the Validation process flow chart [2, Fig. 1], you can see how the fault lists and the criteria used for fault exclusion are used as inputs to the validation plan.

The diagram shows the first few stages in the ISO 13849-2 Validation process. See ISO 13849-2, Figure 1. — Start of ISO 13849 – 2 Fig. 1

Faults that can be excluded do not need to validated, saving time and effort during the system verification and validation (V & V). How is this done?

Fault Consideration

The first step is to develop a list of potential faults that could occur, based on the components and subsystems included in SRP/CS. ISO 13849 – 2 [2] includes lists of typical faults for various technologies. For example, [2, Table A.4] is the fault list for mechanical components.

Mechanical fault list from ISO 13849-2 — Table A.4 — Faults and fault exclusions — Mechanical devices, components and elements
(e.g. cam, follower, chain, clutch, brake, shaft, screw, pin, guide, bearing)

[2] contains tables similar to Table A.4 for:

Pressure-coil springs
Directional control valves
Stop (shut-off) valves/non-return (check) valves/quick-action venting valves/shuttle valves, etc.
Flow valves
Pressure valves
Pipework
Hose assemblies
Connectors
Pressure transmitters and pressure medium transducers
Compressed air treatment — Filters
Compressed-air treatment — Oilers
Compressed air treatment — Silencers
Accumulators and pressure vessels
Sensors
Fluidic Information processing — Logical elements
etc.

As you can see, there are many different types of faults that need to be considered. Keep in mind that I did not give you all of the different fault lists – this post would be a mile long if I did that! The point is that you need to develop a fault list for your system, and then consider the impact of each fault on the operation of the system. If you have components or subsystems that are not listed in the tables, then you need to develop your own fault lists for those items. Using Failure Modes and Effects Analysis (FMEA) techniques are usually the best approach for these components [23], [24].

When considering the faults to be included in the list there are a few things that should be considered [1, 7.2]:

if after the first fault occurs other faults develop due to the first fault, then you can group those faults together as a single fault
two or more single faults with a common cause can be considered as a single fault
multiple faults with different causes but occurring simultaneously is considered improbable and does not need to be considered

Examples

A voltage regulator fails in a system power supply so that the 24 Vdc output rises to an unregulated 36 Vdc (the internal power supply bus voltage), and after some time has passed, two sensors fail, then all three failures can be grouped and considered as a single fault.

If a lightning strike occurs on the power line and the resulting surge voltage on the 400 V mains causes an interposing contactor and the motor drive it controls to fail to danger, then these failures may be grouped and considered as one.

A pneumatic lubricator runs out of lubricant and is not refilled, depriving downstream pneumatic components of lubrication. The spool on the system dump valve sticks open because it is not cycled often enough. Neither of these failures has the same cause, so there is no need to consider them as occurring simultaneously because the probability of both happening concurrently is extremely small. One caution: These two faults MAY have a common cause – poor maintenance. Even if this is true and you decide to consider them to be two faults with a common cause, they could then be grouped as a single fault.

Fault Exclusion

Once you have your well-considered fault lists together, the next question is “Can any of the listed faults be excluded?” This is a tricky question! There are a few points to consider:

Does the system architecture allow for fault exclusion?
Is the fault technically improbable, even if it is possible?
Does experience show that the fault is unlikely to occur?*
Are there technical requirements related to the application and the hazard that might support fault exclusion?

* BE CAREFUL with this one!

Whenever faults are excluded, a detailed justification for the exclusion needs to be included in the system design documentation. Simply deciding that the fault can be excluded is NOT ENOUGH! Consider the risk a person will be exposed to in the event the fault occurs. If the severity is very high, i.e., severe permanent injury or death, you may not want to exclude the fault even if you think you could. Careful consideration of the resulting injury scenario is needed.

Basing a fault exclusion on personal experience is seldom considered adequate, which is why I added the asterisk (*) above. Look for good statistical data to support any decision to use a fault exclusion.

There is much more information available in IEC 61508 – 2 on the subject of fault exclusion, and there is good information in some of the books mentioned below [0.2], [0.3], and [0.4]. If you know of additional resources you would like to share, please post the information in the comments!

Definitions

3.1.3 fault: state of an item characterized by the inability to perform a required function, excluding the inability during preventive maintenance or other planned actions, or due to lack of external resources; Note 1 to entry: A fault is often the result of a failure of the item itself, but may exist without prior failure.; Note 2 to entry: In this part of ISO 13849, “fault” means random fault. [SOURCE: IEC 60050?191:1990, 05 – 01.]

Book List

Here are some books that I think you may find helpful on this journey:

[0] B. Main, Risk Assessment: Basics and Benchmarks, 1^st ed. Ann Arbor, MI USA: DSE, 2004.

[0.1] D. Smith and K. Simpson, Safety critical systems handbook. Amsterdam: Elsevier/Butterworth-Heinemann, 2011.

[0.2] Electromagnetic Compatibility for Functional Safety, 1^st ed. Stevenage, UK: The Institution of Engineering and Technology, 2008.

[0.3] Overview of techniques and measures related to EMC for Functional Safety, 1^st ed. Stevenage, UK: Overview of techniques and measures related to EMC for Functional Safety, 2013.

References

Note: This reference list starts in Part 1 of the series, so “missing” references may show in other parts of the series. Included in the last post of the series is the complete reference list.

[1] Safety of machinery — Safety-related parts of control systems — Part 1: General principles for design. 3^rd Edition. ISO Standard 13849 – 1. 2015.

[2] Safety of machinery – Safety-related parts of control systems – Part 2: Validation. 2^nd Edition. ISO Standard 13849 – 2. 2012.

[3] Safety of machinery – General principles for design – Risk assessment and risk reduction. ISO Standard 12100. 2010.

[4] Safeguarding of Machinery. 2^nd Edition. CSA Standard Z432. 2004.

[5] Risk Assessment and Risk Reduction- A Guideline to Estimate, Evaluate and Reduce Risks Associated with Machine Tools. ANSI Technical Report B11.TR3. 2000.

[6] Safety of machinery – Emergency stop function – Principles for design. ISO Standard 13850. 2015.

[7] Functional safety of electrical/electronic/programmable electronic safety-related systems. 7 parts. IEC Standard 61508. Edition 2. 2010.

[8] S. Jocelyn, J. Baudoin, Y. Chinniah, and P. Charpentier, “Feasibility study and uncertainties in the validation of an existing safety-related control circuit with the ISO 13849 – 1:2006 design standard,” Reliab. Eng. Syst. Saf., vol. 121, pp. 104 – 112, Jan. 2014.

[9] Guidance on the application of ISO 13849 – 1 and IEC 62061 in the design of safety-related control systems for machinery. IEC Technical Report TR 62061 – 1. 2010.

[10] Safety of machinery – Functional safety of safety-related electrical, electronic and programmable electronic control systems. IEC Standard 62061. 2005.

[11] Guidance on the application of ISO 13849 – 1 and IEC 62061 in the design of safety-related control systems for machinery. IEC Technical Report 62061 – 1. 2010.

[12] D. S. G. Nix, Y. Chinniah, F. Dosio, M. Fessler, F. Eng, and F. Schrever, “Linking Risk and Reliability — Mapping the output of risk assessment tools to functional safety requirements for safety related control systems,” 2015.

[13] Safety of machinery. Safety related parts of control systems. General principles for design. CEN Standard EN 954 – 1. 1996.

[14] Functional safety of electrical/electronic/programmable electronic safety-related systems – Part 2: Requirements for electrical/electronic/programmable electronic safety-related systems. IEC Standard 61508 – 2. 2010.

[15] Reliability Prediction of Electronic Equipment. Military Handbook MIL-HDBK-217F. 1991.

[16] “IFA – Practical aids: Software-Assistent SISTEMA: Safety Integrity – Software Tool for the Evaluation of Machine Applications”, Dguv.de, 2017. [Online]. Available: http://www.dguv.de/ifa/praxishilfen/practical-solutions-machine-safety/software-sistema/index.jsp. [Accessed: 30- Jan- 2017].

[17] “failure mode”, 192−03−17, International Electrotechnical Vocabulary. IEC International Electrotechnical Commission, Geneva, 2015.

[18] M. Gentile and A. E. Summers, “Common Cause Failure: How Do You Manage Them?,” Process Saf. Prog., vol. 25, no. 4, pp. 331 – 338, 2006.

[19] Out of Control — Why control systems go wrong and how to prevent failure, 2^nd ed. Richmond, Surrey, UK: HSE Health and Safety Executive, 2003.

[20] Safeguarding of Machinery. 3^rd Edition. CSA Standard Z432. 2016.

[21] O. Reg. 851, INDUSTRIAL ESTABLISHMENTS. Ontario, Canada, 1990.

[22] “Field-programmable gate array”, En.wikipedia.org, 2017. [Online]. Available: https://en.wikipedia.org/wiki/Field-programmable_gate_array. [Accessed: 16-Jun-2017].

[23] Analysis techniques for system reliability – Procedure for failure mode and effects analysis (FMEA). 2^nd Ed. IEC Standard 60812. 2006.

[24] “Failure mode and effects analysis”, En.wikipedia.org, 2017. [Online]. Available: https://en.wikipedia.org/wiki/Failure_mode_and_effects_analysis. [Accessed: 16-Jun-2017].

Acknowledgements: As cited.

Some Rights Reserved

CSA Z432 Safeguarding of Machinery – 3^rd Edition

If you build machinery for the Canadian market, or if you modify equipment in Canadian workplaces, you will be familiar with CSA Z432, Safeguarding of Machinery. This standard has been around since 1992, with the last major revision published in 2004. CSA has reconvened the Technical Committee responsible for this important standard to revise the document to reflect the current practices in the machinery market, and to bring in new ideas that are developing internationally that affect what Canadian machine builders are doing.

If you have interest in this standard and would like to have your thoughts and concerns communicated to the Technical Committee, please feel free to contact me with your suggestions. Work starts on 28-Jan-14. Your input is welcomed!

Why YOU need a Certification Strategy

How compliance efforts go wrong

Clients call when they have problems. They sent some product to a certification body, some tests were done and the product failed. Now what? Usually the delivery date for the certified product is approaching quickly, and no time is available to react. Delivery is delayed and the customer is upset. The business may even be lost.

This process goes wrong for a number of reasons:

The end goal for the certification and the intermediate requirements were not considered
The certification body chose the standard, and the manufacturer had no idea what the standard required
The samples were not carefully prepared for the certification body
Information was missing or partially missing

Certification Motivation

What motivates a manufacturer to certify a product? The decision to certify comes about for a variety of reasons, including:

Legal requirement for the market
Customer request
Liability limitation
Marketing advantage over competitor’s offerings

I’ve talked about the differences between CE Marking and traditional Certification processes in a number of articles, including this one recently, so I won’t repeat myself here. In Canada, Federal [1, 125(m)(iii)] and Provincial law [2, 113] requires anyone selling an electrical product to ensure that it bears an electrical safety mark, and this is supported in the Canadian Electrical Code [3, 2 – 024]. This requirement is often overlooked in the industrial / commercial market where post-installation equipment inspection, called “Field Evaluation”, is common.

In the US, each State has a slightly different approach, so you will need to check out the requirements in the states where your product is sold so that you can ensure compliance with the local requirements. From a workplace perspective, the US OSHA requires that all electrical products used in the workplace bear a mark from a Nationally Recognized Testing Laboratory (NRTL) [5].

Certifying your product provides some degree of liability limitation, in that it shows that you met the minimum legal requirements for your marketplace. To really limit your liability effectively, you will need to do more than just meet the minimum requirements, and you will need documentation of everything done to meet or exceed those requirements.

If you offer certified products in a market where this is uncommon, you have a marketing advantage as long as your customers understand the advantages certified product brings. If certification is rare in your markets, you may need to undertake some educational marketing to help customers “get it”.

Another key point needs to be considered: Product volume. Certification costs money and takes time. If you are selling less than 200 units per year of a given product in your line, certification for that product is unlikely to be feasible. For product volumes from one to 200 units per year, Field Evaluation provides a much more time and cost effective way to get your product marked.

The diagram shows the general process flow for this activity. If you are choosing to use Field Evaluation instead of Certification, substitute “Field Evaluation” wherever you see “Certification” in the diagram.

Flow chart showing certification process flow. — Certification Process Flow

Selecting standards

Selecting the “right” standard for your product can be a challenge, especially in the industrial market where products are often highly specialized, “one-off” products. In many of these cases, no standard that specifically covers the product may exist. For relatively simple products, or for products that are very common, like TV’s, computers, and audio-video equipment, there are “Product Family” standards that specifically cover these types products.

Not every standard is a certification standard. Most of the certification standards are focused on electrical and fire safety. The concerns are the prevention of electrical shock, arc flash, and fire. Certification standards will typically include specific tests that must be passed to show compliance with the requirements. Design standards, on the other hand, will provide general performance requirements and sometimes prescriptive feature requirements, but no test requirements. This is typical in the industrial machinery sector where standards like CSA Z432 [6] and the ANSI B11 family [7] of standards apply. In these cases, you may be able to have the product certified for electrical safety, but not for machinery safety. This does not eliminate corporate liability for the machinery hazards, requiring manufacturers to be knowledgeable and diligent in applying design standards.

Developing a Certification Strategy

To develop a sound strategy, I recommend a “bottom-up” approach. To apply this idea, start with the bill of materials for the product. Look first at the purchased products: How many of these items are either already certified by their manufacturer? All of the certified items can be eliminated from further consideration for the moment. Next, consider the purchased but un-certified products. Contact all of your suppliers to determine which of these products can be purchased certified, and adjust the bill of materials to reflect the part numbers for the certified versions.

Now, the harder part. All of the remaining items on the bill of materials need to be looked at for certification. Anything that cannot or need not be certified, e.g., nuts and bolts, other mechanical parts that are not pressure bearing, can be excluded from consideration. You now have a short list of uncertified components that require certification.

For each item on the short list, research the standards available. The Scope of the standards will help guide you regarding their applicability. Once you have a matched list of components and standards, you can extend that research to include the top level product.

Now you have the beginning of a compliance strategy. The next piece of the puzzle involves the internal evaluation of each component against the standards chosen. This give you the ability to revise your thinking, either of the standard you chose or of the design and construction of the component. Making good choices at this stage to either correct issues found in the design or construction of the component, or in the selection of the standard, can save you huge amounts of time and effort once the certification body gets involved.

Once the components have successfully passed the internal “pre-compliance” evaluation, you can get the certification body involved, and start the formal compliance process for each component. As this part of the process progresses, the certification body may have additional questions or requests for information. To reduce these in-process questions, make sure that each component is clearly identified, that you have unique part numbers for each part, and that you have provided information on the materials used in the construction of the component, as well as detailed engineering drawings.

As the component certification work progresses, you can start on the top level product certification work. The top level product needs to go through the same sort of internal pre-compliance process as the components so that you can be as certain as possible that the product will meet the requirements when it gets to the certification lab.

Preparation of the data package and the sample(s) of the top-level product that will be submitted must be done carefully. Construction of the samples must match the manufacturing drawings and instructions as closely as possible. Once everything is ready, the samples can be submitted for evaluation.

Working with your Certifier

Dealing with a Certification Body can be very challenging. Much of the experience will be based on the project engineer that is responsible for your product’s evaluation. It’s important to set up a good relationship with this person at the beginning, because once problems start to crop up in the lab you will need to be able to talk to this person. Making sure that you have the “right” standards selected for your product is really important, and the project engineer must agree with you. They can refuse to certify a product if they feel that the standard chosen is incorrect, and since they have the final word, there is no arguing with them. An open discussion at the beginning of the project to discuss the standards selected is a good place to start. If your ideas and theirs deviate in a big way, you may have to compromise on their selection, or worse, stop the project and review the problems encountered.

Once the product is certified, the Certification Body will conduct regular audits on the manufacturing facility(ies) to make sure that the production testing is being done, production records are kept, and that the QA programs are ensuring that only good product leaves the plant.

An important part of the QA process is the Customer Complaints Program. Manufacturers must have a program in place to record customer complaints, and to respond to those complaints. A decision tree that helps customer service representatives differentiate between safety-related and non-safety related complaints should be developed. Safety related complaints should result in engineering review of the problems and determinations about the cause of the problems. If these are related to manufacturing or design issues, and especially if these are related to compliance with the requirements of the certification standard, a recall of the product may be needed. If this is the case, get the Certifier involved as soon as possible. Failure to act, and failure to inform the certifier can result in the certification being revoked.

References

[1] Canada Labour Code, [online]. Available: http://canlii.ca/t/522fd. Accessed: 2014-01-27.

[2] Ontario Electricity Act – Marking requirements Avaialble:Ontario Electricity Act. Accessed: 2014-01-27.

[3] Canadian Electrical Code, CSA C22.1. 2012.

[4] National Electrical Code, NFPA 70. 2014.

[5] Occupational Safety and Health Standards, 1910 Subpart S, Electrical, Installatin and Use. 29 CFR 1910.303(b)(2), [online]. Available: https://www.osha.gov/pls/oshaweb/owadisp.show_document?p_table=STANDARDS&p_id=9880. Accessed: 2014-01-27.

[6] Safeguarding of Machinery. CSA Z432. 2004.

[7] Safety of Machines. B11.org, [online]. Available: http://b11standards.org/standards/. Accessed: 2014-01-27.

Original content here is published under these license terms:		X

License Type:	Non-commercial, Attribution, Share Alike

License Summary:	You may copy this content, create derivative work from it, and re-publish it for non-commercial purposes, provided you include an overt attribution to the author(s) and the re-publication must itself be under the terms of this license or similar.

License URL:	http://creativecommons.org/licenses/by-nc-sa/3.0/

Original content here is published under these license terms:		X

License Type:	Non-commercial, Attribution, Share Alike

License Summary:	You may copy this content, create derivative work from it, and re-publish it for non-commercial purposes, provided you include an overt attribution to the author(s) and the re-publication must itself be under the terms of this license or similar.

License URL:	http://creativecommons.org/licenses/by-nc-sa/3.0/

Original content here is published under these license terms:		X

License Type:	Non-commercial, Attribution, Share Alike

License Summary:	You may copy this content, create derivative work from it, and re-publish it for non-commercial purposes, provided you include an overt attribution to the author(s) and the re-publication must itself be under the terms of this license or similar.

License URL:	http://creativecommons.org/licenses/by-nc-sa/3.0/