I was once almost thrown out of a standards meeting for suggesting it wasn’t right to do complex product development to ISO 13849 and that people should be using IEC 61508 instead. Luckily, I survived. For me, ISO 13849 is at its strongest as a system integration standard, allowing proven subsystems and components to be combined into a complete machinery control system. I become less comfortable when it is used as the sole development standard for highly complex electronic hardware and software.
In this blog, I will cover the integration of components developed to IEC 61508 into systems designed to ISO 13849. This could include, for instance, a complex system such as a DSIMR (dynamically stable industrial mobile robot). Designing the final control system to ISO 13849 is useful when you need to comply with something like the EU’s machinery directive because ISO 13849 is a harmonized standard giving a presumption of conformity with the machinery directive. There is an EN version of the 61508 series, but it doesn’t come with a presumption of conformity to any directive or regulation.
ISO 13849 explicitly permits you to incorporate technology developed to IEC 61508 into a system according to ISO 13849; see ISO 13849-1:2023 4.6
Figure 1: An extract from ISO 13849-1:2023
Both ISO 13849 and IEC 61508 use PFH (average dangerous failure rate per hour) to express the failure rate. Low demand and its metric, PFD, are also found in IEC 61508 but are not relevant for machinery.
ISO 13849 indicates the level of safety achieved, or required, using five PL (performance level) “a” to “e”. In safety, according to IEC 61508, there are four SIL (safety integrity levels): 1 through 4. PL a has a failure rate per hour in a range that IEC 61508 doesn’t deem safety-related, and machinery doesn’t have anything like SIL 4, which IEC 61508 provides for things like trains, which can kill or hurt tens or hundreds of people.
In general, IEC 61508 is a more onerous standard, but one area where meeting the ISO 13849 requirements is more difficult is in the measure of diagnostic coverage. DC (diagnostic coverage), as used in ISO 13849, only considers the percentage of dangerous failures detected, whereas SFF (safe failure fraction) from IEC 61508 gives credit for failures in a safety direction. The results of both measures are included in the PFH calculation, so when combining based on PFH, all is taken care of.
ISO 13849-1:2023 tables 2 and 4 summarize the comparison of PL and SIL, and I have combined them in the table below.
Table 1 – Comparing PL to SIL in terms of the PFH metric
|
PL |
|
SIL |
PFH failure rate per hour |
|
|
a |
Not applicable |
1e-4/h to 1e-5/h |
|
b |
1 |
PL b occupies the less reliable part of the SIL 1 range from 1e-5/h to 3e-6/h |
|
c |
1 |
PL c occupies the more reliable part of the SIL 1 range from 3e-6/h to 1e-6 / h |
|
d |
2 |
1e-6/h to 1e-7/h |
|
e |
3 |
1e-7/h to 1e-8/h |
|
Not applicable |
4 |
1e-8/ to 1e-9/h |
For the hardware metrics, a PL is a combination of diagnostic coverage (DC), reliability expressed as an MTTFD (mean time to a dangerous failure), and a CAT (category – an expression of architecture with 5 options described). DC is limited to 60%, 90%, and 99%; reliability to low (3 to 10 years), medium (10 to 30 years), and high (30 to 100 years). Various combinations of these can be used to target a required PL.
IEC 61508 is far more flexible in the values allowed, with no limit on the MTTFd. For hardware metrics, it allows a trade-off between diagnostic coverage, expressed by an SFF, and redundancy, expressed by HFT. HFT=0 is a CAT 2 architecture, and HFT=1 meets the architectural requirements for both CAT 3 and CAT 4.
Table 2 – Comparing solutions to hardware metrics
|
PL / SIL required |
Typical options to achieve this required PL |
Typical options to achieve this SIL |
|
a |
Low MTTFD, no DC, single channel |
Not applicable |
|
b – SIL 1 |
High MTTFD, no DC, single channel High MTTFD, DC=low, single channel Low MTTFD, DC=low, two channels |
Single channel – SFF = 60% |
|
c – SIL 1 |
High MTTFD, no DC, single channel Medium MTTFD, DC = medium, single channel Medium MTTFD, DC = low, two channels |
Single channel – SFF = 60% |
|
d – SIL 2 |
High MTTFD, DC=medium, single channel High MTTFD, DC=low, two channels |
Single channel – SFF = 90% |
|
e – SIL 3 |
High MTTFD, DC=high, two channels |
Two-channel – SFF per channel = 90% |
In general, machine safety is heavily biased towards two-channel architectures, and designs to ISO 13849 follow this pattern. In theory, the designer is free to choose trade-offs between DC, MTTFd, and CAT, but often in the past a specific CAT was mandated; e.g., ISO 10218:2011 mandated CAT 3 or HFT=1. IEC 61508 is far more flexible, and if your reliability is good enough and your diagnostic test rate sufficiently high, it will allow a single channel even for SIL 3/PL e. However, while allowed by the standard, achieving an SFF/DC of 99% is difficult; for SIL 2, HFT=0 is common, but for SIL 3, HFT=1 is typical.
Going forward, I think the use of IEC 61508 will become more important for machinery. This is especially true when people try to design complex machinery such as humanoid robots. These will benefit from things like 3D TOF cameras (ADTF3175), short-range communication (ADMV9615), and multi-turn encoders, including the ADMT4000. Designing modules containing technologies such as these to IEC 61508 makes far more sense to me than using ISO 13849.
ISO 13849-1:2023 6.2 includes some very relevant additions to facilitate this.
Figure 2: An excerpt from ISO 13849-1:2023 6.2
I haven’t really gone into systematic failures today, but this is an area where IEC 61508 has a more comprehensive set of techniques. For instance, ISO 13849 has a reduced set of requirements for software implemented up to PL d, but for PL e, it defers to IEC 61508.
Related Blogs
- Safety Rated Data Communications for Humanoid Robots
- Does Reliability Prediction Uncertainty Justify using Two-Channel Safety
- HFT vs Two-Channel Safety – The Same or Different
- An Introduction to ISO 13849
- xMR Sensors and Functional Safety
- An Introduction to the IEC 61496 Series
For all previous blogs in this series, see here.
For the full suite of ADI blogs on the EngineerZone platform, see here.
For the full range of ADI products, see here.