Samskrivning af ISO 13849-1 og IEC 62061

 
 
 
Sammenskrivning af ISO 13849-1 og IEC 62061 
 
 Dette projekt har været undervej ad flere omgange, men kommer sandsynligvis aldrig til at lykkes - alene fordi de to tekniske komiteer bag dokumenterne var enige om at udforme dem så forskelligt, at sammenskrivningen ikke kan lade sig gøre.
Det har medført forskellige tiltag i standardiseringverdenen

Eksempler:

  • Elevatorbranchen har i EN 81 serien indført nogle tilpassede begreber
  • Landbrugets maskinfabrikanter har udført en fuld og færdig samskrivning af de to standarder i EN 16590 serien 
  • I skrivende stund foregår en nyskrivning af ISO 13849-1, som forventes færdig i 2020
  • I 2010 udgav ISO og IEC en rapport udført af en samlet gruppe om hvorledes man kan anvende de to standarder i forening og hver for sig

Indtil videre er det eneste faste holdepunkt rapporten fra fælleskommiteen og den systematiske risikovurdering på maskinen

Læs håndbogen: Systematisk risikovurdering og fastsættelse af krav til det sikkerhedsrelaterede styresystem -

Hvad er meningen?

Fællesrapporten gengives her i fuld længde

JOINT IEC/TC44 & ISO/TC199
TECHNICAL REPORT
2010
 
 
GUIDANCE ON THE APPLICATION OF ISO 13849-1 & IEC 62061 IN THE DESIGN OF SAFETY-RELATED CONTROL SYSTEMS
FOR MACHINERY
 



 
 
 
INTRODUCTORY NOTE
 
This technical report has been prepared by experts from both IEC/TC44/WG7 and ISO/TC199/WG8 in response to requests from their Technical Committees to explain the relationship between IEC 62061 and ISO 13849-1. In particular, it is intended to assist users of these standards in terms of the interaction(s) that can exist between the standards to ensure that confidence can be given to the design of safety-related systems made in accordance with either standard.
 
 
 

CONTENTS
 
1.     Objective
 
2.     Introduction
 
3.     Comparison of standards
 
4.     Risk estimation and performance assignment
 
5.     Safety requirements specification
 
6.     Assignment of performance targets: PL v SIL
 
7.     System design
7.1. General requirements for system design using IEC 62061 and ISO 13849-1
7.2. Estimation of PFHD and MTTFD for common system architectures using combinations of subsystems
7.3. System design using subsystems that conform to either IEC 62061 or ISO 13849-1
7.4. System design using subsystems that have been designed using other IEC or ISO standards
 
8.     Examples
8.1. General
8.2. Simplified example of the design and validation of a safety-related control system implementing a specified safety-related control function



JOINT IEC/TC44 & ISO/TC199
TECHNICAL REPORT
 
GUIDANCE ON THE APPLICATION OF ISO 13849-1 & IEC 62061 IN THE DESIGN OF SAFETY-RELATED CONTROL SYSTEMS
FOR MACHINERY
 
1. OBJECTIVE
 
1.1 This Technical Report is intended to explain the application of IEC 62061 and ISO 13849-1[1], respectively, in the design of safety-related control systems for machinery.
 
1.2 This Technical Report should be incorporated into both IEC 62061 and ISO 13849-1 by means of corrigenda that references the published version of this document. This corrigenda should also remove the information given in Table 1 “Recommended application of IEC 62061 and ISO 13849-1(under revision)” provided in the common introduction to both standards which is now recognised to be out-of-date.
 
2. INTRODUCTION
 
2.1 Both IEC 62061 and ISO 13849-1 specify requirements for the design and implementation of safety-related control systems of machinery[2]. The methods developed in both of these standards are different but, when correctly applied, can achieve the same risk reduction.
 
2.2 These standards classify safety-related control systems that implement safety functions into levels that are defined in terms of their probability of dangerous failure per hour. ISO 13849-1 has five Performance Levels (PLs) a, b, c, d, and e whilst IEC 62061 has three Safety Integrity Levels (SILs) 1, 2, and 3.
 
2.3 Product standards (“C” type) committees specify the safety requirements for safety-related control systems and it is recommended that these committees classify the “levels of confidence” required for them in terms of PLs and SILs.
 
2.4 Machinery designers can choose to use either IEC 62061 or ISO 13849-1.
 
2.5 The selection and use of either standard is likely to be determined by, for example:
-       Previous knowledge and experience in the design of machinery control systems based upon the concept of Categories described in ISO 13849-1:1999 may mean that the use of ISO 13849-1:2006 is more appropriate;
-       Control systems based upon media other than electrical may mean that the use of ISO 13849-1 is more appropriate;
-       Customer requirements to demonstrate the safety integrity of a machine control system in terms of a Safety Integrity Level (SIL) may mean that the use of IEC 62061 is more appropriate;
 
-       Control systems of machinery used in, for example, the process industries, where other safety-related systems (such as safety instrumented systems in accordance with IEC 61511) are characterised in terms of SILs may mean that the use of IEC 62061 is more appropriate.
 
3. COMPARISON OF STANDARDS
 
3.1 A comparison of the technical requirements in ISO 13849-1 and IEC 62061 in the following areas has been carried out into the following aspects:
 
·       v
 
3.2 Additionally, an evaluation of the use of the simplified mathematical formulae to determine probability of dangerous failures (PFHD) and MTTFd according to both standards has been carried out.
 
3.3 The conclusions from this work were:
 
-       Safety-related control systems can be designed to achieve acceptable levels of “functional safety” using either of the two standards by integrating non-complex[3] SRECS subsystems or SRP/CS designed in accordance with IEC 62061 and ISO 13849-1, respectively;
-       Both standards can also be used to provide design solutions for complex SRECS and SRP/CS by integrating electrical/electronic/programmable electronic subsystems designed in accordance with IEC 61508;
-       Both standards currently have value to users in the Machinery Sector and benefits will be gained from experience in their use. Feedback over a reasonable period on their practical application is essential to support any future initiatives to move towards a standard that merges the contents of both IEC 62061 and ISO 13849-1;
-       Differences exist in detail and it is recognised that some concepts (e.g. functional safety management) will need further work to establish equivalence between respective design methodologies and some technical requirements;
-       Successful integration of these standards is dependent upon agreement between IEC and ISO to ensure that the work can proceed without difficulties, e.g. as a consequence of dual administrative processes.
 
4. Risk estimation and ASSIGNMENT OF ReQUIRED PERFORMANCE
 
4.1 A comparison has been carried out on the use of the methods to assign a SIL and/or PLr to a specific safety function. This has established that there is broadly a good level of correspondence between the respective methods provided in Annex A of each standard.
 
4.2 It is important, regardless of which method is used, that attention is given to ensure that appropriate judgements are made on the risk parameters to determine the SIL and/or PLr that is likely to apply to a specific safety function. These judgements can often be best made by bringing together a range of personnel (e.g. design, maintenance, operators) to ensure that the hazards that may present at machinery are properly understood.
 
4.3 Further information on the process of risk estimation and the assignment of performance targets can be found in ISO 14121 and IEC 61508-6.
 
5. SAFETY REQUIREMENTS SPECIFICATION
 
5.1 A first stage in the respective methodologies of both ISO 13849-1 and IEC 62061 requires that the safety function(s) to be implemented by the safety-related control system are specified.
 
5.2 An assessment should have been performed relevant to each safety function that is to be implemented by a control circuitby, for example, using ISO 13849-1, Annex A (Determination of the required performance level (PLr)) and IEC 62061, Annex A (SIL Assignment). This should have determined what risk reduction needs to be provided by each particular safety function at a machine and, in turn, what "level of confidence" is required for the control circuit that performs this safety function.
 
5.3 The "level of confidence" specified as a PL and a SIL is relevant to a specific safety function.
 
5.4 The following shows the information that should be provided in relation to safety functions by a product (“C” type) standard:
 
Safety function(s) to be implemented by a control circuit:
 
Name of safety function
 
Description of the function
 
Required level of performance according to ISO 13849-1: PLra to e
And
Required safety integrity according to IEC 62061: SIL1 to 3.
 
6. Assignment of performance targets: PL versus SIL
 
6.1 Table 1 below gives the relationship between PL and SIL based on the average probability of a dangerous failure per hour. However, both standards have additional requirements (e.g. systematic safety integrity) to these probabilistic targets that are also to be applied to a safety-related control system. The rigour of these requirements is related to the respective PL and SIL.
 
 
 
Performance level (PL)
Average probability of a dangerous failure per hour [1/h]
 
Safety Integrity Level (SIL)

a
³ 10-5 to < 10-4
no special safety requirements
b
³ 3 x10-6 to < 10-5
1
c
³ 10-6 to < 3 x10-6
1
d
³ 10-7 to < 10-6
2
e
³ 10-8 to < 10-7
3
 
Table 1: Relationship between PL and SIL
 
7. SYSTEM DESIGN
 
7.1 General requirements for system design using IEC 62061 and ISO 13849-1
 
7.1.1 The following aspects should be taken into account when designing a SRECS/SRP/CS:
 
-       When applied within the limitations of their respective scopes either of the two standards can be used to design safety-related control systems with acceptable “functional safety”, as indicated by the achieved SIL or PL.
-       Non-complex safety-related parts that are designed to the relevant PL in accordance with ISO 13849-1 can be integrated as subsystems into a safety-related electrical control system (SRECS) designed in accordance with IEC 62061. Any complex safety-related parts that are designed to the relevant PL in accordance with ISO 13849-1 can be integrated into safety-related parts of a control system (SRP/CS) designed in accordance with ISO 13849-1.
-       Any non-complex subsystem that is designed in accordance with IEC 62061 to the relevant SIL can be integrated as a safety-related part(s) into a combination of SRP/CS designed in accordance with ISO 13849-1.
-       Any complex subsystem that is designed in accordance with IEC 61508 to the relevant SIL can be integrated as a safety-related part(s) into a combination of SRP/CS designed in accordance with ISO 13849-1 or as subsystems into a SRECS designed in accordance with IEC 62061.
 
 
7.2 ESTIMATION OF PFHd and MTTFd & THE USE OF FAULT EXCLUSIONS
 
7.2.1 PFHD and MTTFd
 
7.2.1.1 The value of MTTFd in the context of ISO 13849-1 relates to a single channel SRP/CS without diagnostics and, only in this case, is the reciprocal of PFHD in IEC 62061.
 
7.2.1.2 MTTFd is a parameter of a component(s) and/or single channel without any consideration being given to factors such as diagnostics and architecture whilst PFHD is a parameter of a subsystem that takes into account the contribution of factors such as diagnostics and architecture.
 
7.2.1.3 Annex K of ISO 13849-1 describes the relationship between MTTFd, diagnostic coverage (DC), and Category and the PFHD of a SRP/CS.
 
7.2.1.4 The estimation of PFHD for a series connected combination of SRP/CS in accordance with ISO 13849-1 can also be performed by adding PFHD values (e.g. derived from Annex K of ISO 13849-1) of each SRP/CS in a similar manner to that used with subsystems in IEC 62061.  
 
7.2.2 Use of fault exclusions
 
7.2.2.1 Both standards permit the use of fault exclusions, see 6.7.7 of IEC 62061 and 7.3 of ISO 13849-1. IEC 62061 does not permit the use of fault exclusions for a SRECS that is required to achieve SIL3 without hardware fault tolerance.
 
7.2.2.2 It is important that where fault exclusions are used that they are properly justified and valid for the intended lifetime of a SRP/CS or SRECS.
 
7.2.2.3 In general, where PLe or SIL3 is specified for a safety function to be implemented by a SRP/CS or SRECS it is not normal to rely upon fault exclusions alone to achieve this level of performance. This is dependent upon the technology used and the intended operating environment. Therefore it is essential that designer takes additional care on the use of fault exclusions as that PL or SIL increases.
 
7.2.2.4 In general the use of fault exclusions is not applicable to the mechanical aspects of electromechanical position switches and manually operated switches (e.g. an emergency stop device) in order to achieve PLe or SIL3 in the design of a SRP/CS or SRECS. Those fault exclusions that can be applied to specific mechanical fault conditions (e.g. wear/corrosion, fracture) are described in Table A.4 of ISO 13849-2.
 
7.2.2.5 For example, a door interlocking system that has to achieve PLe or SIL3 will need to incorporate a minimum fault tolerance of 1 (e.g. two conventional mechanical position switches) in order to achieve this level of performance since it is not normally justifiable to exclude faults, such as, broken switch actuators. However, it may be acceptable to exclude faults, such as short circuit of wiring within a control panel designed in accordance with relevant standards.
 
7.2.2.6 Further information on the use of fault exclusions is to be provided in the forthcoming revision of ISO 13849-2 that is currently being developed by ISO/TC199/WG8.
 
 
 
7.3.1 In all cases where subsystems or safety-related parts of control systems are designed to either ISO 13849-1 or IEC 62061 conformance to the system level standard can only be claimed if the requirements of each standard (as relevant) are satisfied.
 
7.3.2 For the design of a subsystem or a part of safety-related parts of control systems either IEC 62061 or ISO 13849-1, respectively, must be satisfied. It is permissible to satisfy more than one of these standards provided that those standards used are fully complied with.
 
7.3.3 It is not permissible to mix requirements of the standards when designing a subsystem or part of safety-related parts of control system.
 
7.4 SYSTEM DESIGN USING SUBSYSTEMS THAT HAVE BEEN DESIGNED USING OTHER IEC OR ISO STANDARDS
 
7.4.1 It may be possible to select subsystems, for example, electrosensitive protective equipment, that comply with relevant IEC or ISO product standards and either IEC 61508, IEC 62061 or ISO 13849-1 in their design. The vendor(s) of these types of subsystems should provide the necessary information to facilitate their integration into a safety-related control system in accordance with either IEC 62061 or ISO 13849-1.
 
7.4.2 Subsystems, for example, adjustable speed electrical power drive systems, that have been designed using product standards, such as IEC 61800-5-2, that implement the requirements of IEC 61508 can be used in safety-related control systems in accordance with IEC 62061(see also 6.7.3 of IEC 62061) and ISO 13849-1 .
 
7.4.3 In accordance with IEC 62061 other subsystems that have been designed using IEC, ISO or other standard(s) are subject to 6.7.3 of IEC 62061. 
 
8. EXAMPLE
 
8.1 GENERAL
 
8.1.1 The following example assumes that all the requirements of the standards have been satisfied. The example is only intended to demonstrate specific aspects of the application of the standards.
 
8.2 SIMPLIFIED EXAMPLE OF THE DESIGN & Validation of Safety-RELATED CONTROL SYSTEM IMPLEMENTING A SPECIFIED SAFETY-RELATED CONTROL FUNCTION
 
8.2.1 This simplified example is intended to demonstrate the use of subsystems that comply with either IEC 62061 and/or ISO 13849-1 in a SRECS/SRP/CS. The example is based on the implementation of a safety function described as “position monitoring of a moveable guard” with a specified safety integrity level of SIL3/required performance level PLr e as described in Figure 1.
 
Figure 1:
Position monitoring of moveable guards by means of a safety module
 
8.2.2 The following information is relevant to the safety requirements specification for this example:
Safety function -
Safety-related stop function, initiated by a protective device: opening of the moveable guard (protective grating) initiates the safety function STO (safe torque off).
Functional description -
a)     Trapping hazards are safeguarded by means of a moveable guard (protective grating). Opening of the protective grating is detected by two position switches B1/B2, employing a break contact/make contact combination, and evaluation by a central safety module K1. K1 actuates two contactors, Q1 and Q2, dropping out of which interrupts or prevents hazardous movements or states.
b)     The position switches are monitored for plausibility in K1 for the purpose of fault detection. Faults in Q1 and Q2 are detected by a start-up test in K1. A start command is successful only if Q1 and Q2 had previously dropped out. Start-up testing by opening and closing of the protective device is not required.
c)     The safety function remains intact in the event of a component failure. Faults are detected during operation or at actuation (opening and closing) of the protective device by the dropping out of Q1 and Q2 and operational disabling.
d)     An accumulation of more than two faults in the period between two successive actuations may lead to loss of the safety function.
8.2.3The following features should also be provided:
e)     Basic and well-tried safety principles are observed (e.g. the load current for the contactors Q1 and Q2 is de-rated by a factor of 50%) and the requirements of Category B are met. Protective circuits (e.g. contact protection) are implemented;
f)       A stable arrangement of the protective devices is assured for actuation of the position switches;
g)     Switch B1 is a position switch with direct opening action in accordance with IEC 60947-5-1, Annex K;
h)     The supply conductors to position switches B1 and B2 are laid separately or with protection.
8.2.4 The following information is available from the manufacturers for each part within the design of SRP/CS:
i)       The safety module K1 is declared by the manufacturer[4] as satisfying the requirements for Category 4, PL e and SIL CL 3;
j)       The contactors Q1 and Q2 possess mechanically linked contact elements to IEC 60947-5-1, Annex L.
8.2.5 The following observation can be made on the design of SRP/CS and/or SRECS:
k)     Category 4 can only be achieved where several mechanical position switches for different protective devices are not connected in a series arrangement (i.e. no cascading). This is necessary as faults in the switches cannot otherwise be detected.
Figure 2:
Safety-related block diagram
8.2.6 Calculation of the probability of failure in accordance with ISO 13849-1
8.2.6.1 Figure 2 shows a logic subsystem (safety module K1) to which two-channel input and output elements are connected. Since an abstraction of the hardware level is already performed in the safety-related block diagram, the sequence of the subsystems is in principle interchangeable. It is therefore recommended that subsystems sharing the same structure be grouped together, as shown in Figure 3. This makes calculation of the PL simpler by reducing the number of times limitation of the MTTFd of a channel to 100 years is performed in the estimation.
Figure 3:
Safety-related block diagram for calculation according to ISO 13849-1
The probability of failure of the standard safety module K1 is declared by the manufacturer and is added at the end of the calculation (2.31 × 10-9 per hour [manufactures value], suitable for PL e). For the remaining subsystem, the probability of failure is calculated as follows:
-        MTTFd: For the position switch B2, the B10d value is 500000 switching operations [manufactures value]. At 365 working days per year, 16 working hours per day and a cycle time of 1 hour, nop is 5840 cycles per year for these components calculated by using equations C.2 and C.7.
-        For the contactors Q1 and Q2, the B10 value corresponds under inductive load (AC 3) to an electrical lifetime of 1000000 switching operations [manufactures value]. If 50 % of failures are assumed to be dangerous, the B10d value is produced by doubling of the B10 value.
-        For both channels the MTTFd is calculated by using equation D.1.
This gives a MTTFd,Ch1 of 1142 years and a MTTFd,Ch2 of 685 years. In accordance with ISO 13849-1 the MTTFd of both  channels is limited to 100 years and, in this case, as the MTTFd of both channels are equal after limiting it is not necessary to perform symmetrisation.
-        DCavg: the DC of 99 % for B1 and B2 is based upon plausibility monitoring of the break/make contact combination in K1. The DC of 99 % for contactors Q1 and Q2 is derived from regular monitoring by K1 during start-up. The DC values stated correspond to the DCavg for each subsystem. The DCavg will be calculated according to equation E.1. Because each single DC is 99 % also the DCavg is 99 %.
-        Adequate measures against common-cause failure in the subsystems B1/B2 and Q1/Q2 (70 points): separation (15), well-tried components (5), protection against overvoltage etc. (15) and environmental conditions (25 + 10).
-        The subsystem B1/B2/Q1/Q2 corresponds to Category 4 with a high MTTFd (100 years) and high DCavg (99 %). This results in an average probability of dangerous failure of 2.47 × 10-8 per hour (see Table K.1). Following addition of the subsystem K1, the average probability of dangerous failure is 2.70 × 10-8 per hour. This corresponds to PL e.
8.2.7       Calculation of the probability of failure according to IEC 62061
8.2.7.1 In accordance with sub-clause 6.6.2 of IEC 62061, the circuit arrangement can be divided into three subsystems: B1/B2, K and Q1/Q2 as shown in the safety-related block diagram.
8.2.7.2 For subsystem K the probability of failure of 2.31×10-9 per hour and a SIL claim limit of 3 for the safety module K1 is declared by the manufacturer.
8.2.7.3 For the remaining subsystems, the probability of failure can be estimated as follows.
-        Subsystem B1/B2: The B10d value of 1000000 cycles [manufactures value] is stated for the mechanical part of B1. For the position switch B2, the B10d value is 500000 switching operations [manufactures value]. At 365 working days per year, 16 working hours per day and a cycle time of 1 hour, nop is 5840 cycles per year for these components, and the MTTFd is 1712 years for B1 which gives a failure rate of 9.9x10-8 and 856 years for B2 which gives a failure rate of 2x10-7.
-        The logical architecture of this subsystem equates to diagram D from clause 6.7.8.2.5 of IEC 62061 as shown in Figure 4.
r         
Figure 4:
 Subsystem D logical representation of
 fe1 = Switch B1, fe2 = switch B2
 
-        The subsystem elements (switches B1 and B2) are of different design therefore the following formula D1 from clause 6.7.8.2.5 is used to determine the PFHD of the subsystem.
     Where:
a)     T2 is the diagnostic test interval. For Subsystem B1/B2 this is 1 hour
 
b)     T1 is the proof test interval. For Subsystem B1/B2 this is 749996 hours at the given rate of use based on the lowest subsystem element T10d value (see EN ISO 13849-1 Annex D Clause C.4.2). Switch B2 has the lowest T10d value.
 
c)     ß is the susceptibility to common cause failures. This has a value of 5% (0,05) resulting from 63 points scored in the simplified method at IEC 62061 Annex F.
 
d)     lDe1 is the dangerous failure rate of subsystem element 1. For switch B1 this equates to 9.9x10-8 (see above).
 
e)     DC1 is the diagnostic coverage of subsystem element 1. For switch B1 this is estimated to be 99% based upon plausibility monitoring of the break/make contacts of B1 and B2 in combination with K1.
 
f)       lDe2 is the dangerous failure rate of subsystem element 2. For switch B2 this equates to 2x10-7 (see above).
 
g)     DC 2 is the diagnostic coverage of subsystem element 2. For switch B2 this is estimated to be 99% based upon plausibility monitoring of the break/make contacts of B1 and B2 in combination with K1.
 
8.2.7.4 The data above is entered into the formula to give a PFHD of 7.6 x10-9.
 
8.2.7.5 Similarly, for Subsystem Q1/Q2: contactors Q1 and Q2 have a B10 value that corresponds under inductive load (AC 3) to an electrical lifetime of 106 switching operations [M]. If 50% of failures are assumed to be dangerous, the B10d value is produced by doubling of the B10 value. The value assumed above for nop results in an MTTFd of 3424 years which gives a failure rate of 5x10-8 for each contactor.
 
8.2.7.6 The logical architecture of subsystem Q1/Q2 equates to diagram D from clause 6.7.8.2.5 of IEC 62061. The subsystem elements (contactors Q1 and Q2) are of the same design therefore the following formula D1 from clause 6.7.8.2.5 is used to determine the PFHD of the subsystem:
 
Where:
 
     T2 is the diagnostic test interval; for Subsystem Q1/Q2 this is I hour
 
      T1 is the proof test interval; for Subsystem Q1/Q2 this is 2995920 hours at the given usage rate based on the subsystem element T10d value (see EN ISO 13849-1 Annex D Clause C.4.2.)
 
lDe is the dangerous failure rate of each subsystem element (contactors Q1 and Q2) = 5x10-8 (see above).
 
DC is the diagnostic coverage of each subsystem element (contactors Q1 and Q2) = 99% based upon regular monitoring of mechanically linked mirror contacts by K1 during start-up.
 
ß is the susceptibility to common cause failures; this has a value of 5% (0.05) resulting from 63 points scored in the simplified method at IEC 62061 Annex F.
 
The data above is entered into the formula that produces a PFHD of 9.3 x10-9.
 
8.2.7.7 The subsystems B1/B2 and Q1/Q2 are then subjected to the architectural constraints given in table 5 of IEC 62061 at clause 6.7.6.3 (see Figure 5).
 
Safe failure fraction
 
Hardware fault tolerance (see Note 1)
0
1
2
< 60 %
Not allowed (for exceptions see Note 2)
SIL1
SIL2
60 % – < 90 %
SIL1
SIL2
SIL3
90 % – < 99 %
SIL2
SIL3
SIL3
³ 99 %
SIL3
SIL3
SIL3
NOTE 1 A hardware fault tolerance of N means that N+1 faults could cause a loss of the safety-related control function.
NOTE 2 See 6.7.6.4 of IEC 62061 or for subsystems where fault exclusions have been applied to faults that could lead to a dangerous failure see 6.7.7 of IEC 62061.
Figure 5:
Architectural constraints on subsystems maximum SIL CL
that can be claimed for a SRCF using this subsystem
 
8.2.7.8 Each subsystem has a safe failure fraction of 99% (based on their DC) and a hardware fault tolerance of 1. That produces a SIL CL (SIL claim limit) of 3 for each subsystem.
 
8.2.7.9 For Subsystem K1 the PFHD of 2.31 × 10-9 per hourand SIL CL 3 have been declared by the manufacture (see above).
 
8.2.7.10 The maximum SIL that can be claimed based on the lowest SIL CL is therefore 3.
 
8.2.7.11 The PFHD of each subsystem is added together:
 
7.6×10-9(subsystem B1/B2) + 2.31×10-9(subsystem K) +   9.3x10-9 (subsystem Q1/Q2) =  1.92 ×10-8
 
This satisfies the range ≥ 10–8 to < 10–7 as given at IEC 62061 Table 3 at clause 5.2.4.2. Therefore if all other requirements of IEC 62061 are fulfilled this safety function achieves SIL 3.
 
8.3 CONCLUSION
 
8.3.1 The results of the above calculation for this simple example using the method from ISO 13849-1 gives the average probability of dangerous failure as 5.16 × 10-8 per hour (ie corresponding to PL e) whilst use of the method from IEC 62061 gives a a probability of dangerous failure as 1.92 × 10-8 per hour (ie corresponding to SIL 3). The difference between these results (3.24 x 10-8 per hour) is within expected error bounds and therefore shows an acceptable level of correspondence between both standards.


[1]This technical report considers ISO 13849-1:2006 rather than ISO 13849-1:1999 which has been withdrawn.
[2]These standards have been adopted by the European standardization bodies CEN and CENELEC as ISO EN 13849-1 and EN 62061, respectively, where they are published with the status of transposed harmonized standards under the Machinery Directive (98/37/EC and 2006/42/EC). Under the conditions of their publication, the correct use of both of these standards is presumed to conform to the relevant essential safety requirements of the Machinery Directive (98/37/EC and 2006/42/EC).
[3] Although there is no definition for the term “non-complex” SRECS or SRP/CS this should be considered equivalent to low complexity in the context of 3.2.7 in IEC 62061.
[4]This module is dealt with as a subsystem and, as such, the MTTFd of its individual channels may not be given (see 7.2.1.1).