1.1. SIL Calculation Using Risk Graph

Including other standards, IEC-61508 provides various quantitative, semi qualitative, and qualitative methods for the determination of safety integrity levels. A risk graph is a qualitative approach for SIL determination. Semi qualitative and qualitative methods are less costly as compared to the quantitative methods. In table 8 four SIL levels are mentioned according to the IEC-61508.

According to the IEC-61508-5, the risk is calculated as:

R = f * C

Where ‘R’ is a risk without safety-related system, ‘f’ is the frequency of the hazardous event and ‘C’ represents the consequences of the hazardous event. The frequency of a hazardous event is based on three parameters. These parameters are defined as the frequency of exposure time in a hazardous place, the possibility that the hazardous event can be avoided, and the probability of happening of the hazardous event.

The procedure of the risk graph is based on the following four parameters. First of all, consider the consequences of the hazardous event (what can be happen if such an event takes place and how much it is danger) and is represented by (C). The frequency (F) of exposure time, how long such a hazardous event will take and a zone will be in a hazardous situation. The possibility (P) that our safety system will fail to avoid that hazardous event and the probability of occurrence (W) of the hazardous event means how frequently such an event can happen.

The purpose of the safety assessment is to make sure that risks that may result damage, damage to equipment and the potential harm to environmental and damage are reduced by considering all stages of lifecycle, including every step through the development, operation and maintenance / decommissioning. By combination of safety systems, Safety instrumented system (SIS) and methods, residual risk can be minimize to acceptable risk. SIS is often an important part of safety management to reduce the risk of catastrophic accidents [15].

The SIF requirements are regulated by the international standard IEC 61508 and the specific branch industry standard IEC 61511.

The risk graph described in Section 5 of IEC 61508.

Risk Parameters Classification

• Consequences

C1= Minor Injuries

C2= Serious Injuries

C3= Death of Some People

C4= Death of Several People

• Frequency and Exposure Time

F1= Rare Frequent and Exposure to Hazard

F2= High Frequent and Exposure to Hazard

• Possibility

P1= Possible under Some Conditions

P2= nearly Impossible

• Probability of Unwanted Occurrence

W1= Very Slight Probability of Unwanted Occurrence

W2= Slight Probability of Unwanted Occurrence

W3= High Probability of Unwanted Occurrence

Figure 610: Example of Risk Graph from IEC-61508-5 [15].

All these combinations lead to a SIL level according to the graph. These parameters can be qualitative or quantitative depends upon the application and according to the standard.

1.2. Calculation of ASIL using Risk Matrix

Risk matrix is used to determine ASIL of the system and the component in ISO-26262 [5].

According to the standard ISO-26262, which is specifically for the E/E and PES of automotive. The risk matrix is based on severity (S), exposure (E), and controllability (C). This is a way to calculate the automotive safety integrity level as in table 8 according to the standard ISO-26262 four ASIL levels listed for automobiles.

Severity (S): The potential harm and injuries to the driver, passenger, and people around the vehicle or someone individual in the surrounding of the vehicle are due to the potential hazard is classified in different classed and named as severity. In part 3 of standard ISO-26262, a list of severity classification is defined.

It is defined as how intense is the potential of harm. The severity has four classes for determination of ASIL, where SO is assigned when there is no harm to the driver, and S3 is assigned when there is the probability of life-threatening as shown in the below table.

Exposure (E): Exposure is defined as to what extent the vehicle is exposed to a hazardous situation. The exposure levels are assigned for the different driving situations either based on the duration of a hazardous event or the frequency of their occurrence. For example, a vehicle is driven backward once or twice a day therefore, the exposure ranking for this driving factor would be high due to the daily occurrence, not due to the duration of the event which usually lasts for a few seconds. It has five classes starting from E0 to E4 as shown in the below table.

Controllability (C): Controllability classes are defined as an estimation of the probability that the average driver will be able to retain or regain control of a vehicle if a given hazard were to occur. Also, consider the actions of individuals in the vicinity that will contribute to the avoidance of the potential hazard. It is divided into four classes from C0 to C3 as shown in the below table.

Table 611: ASIL Determination Parameters (ISO-26262) [5]

Severity

S0

S1

S2

S3

No Injuries

Light and Moderate Injuries

Life Threatening Injuries

Life Threatening Injuries, Fatal Injuries

Exposure

E0

E1

E2

E3

E4

Incredible

Very Low Probability

Low Probability

Medium Probability

High Probability

Controllability

C0

C1

C2

C3

Controllable in General

Simple Controllable

Normally Controllable

Difficult to Control

According to the standard ISO-26262, by selecting appropriate classes of exposure, severity, and controllability, we multiply these three factors.

ASIL = Severity ˟ (Exposure ˟ Controllability)

ASIL = S ˟ (E ˟ C)

Table 612: ASIL Determination Table (ISO-26262) [5]

Severity

Probability

Controllability

C1

C2

C3

S1

E1

QM

QM

QM

E2

QM

QM

QM

E3

QM

QM

A

E4

QM

A

B

S2

E1

QM

QM

QM

E2

QM

QM

A

E3

QM

A

B

E4

A

B

C

S3

E1

QM

QM

A

E2

QM

A

B

E3

A

B

C

E4

B

C

D

With the help of this AILs allocation table, by defining the severity, exposure, and controllability we can find the required ASIL level for a specific E/E and PES for an automotive.

ReliabilityReliability is the ability of a system that will perform its required task successfully in a certain period of time under specific conditions. Reliability is measured in terms of probability and it is characteristic which is in-built in the design of a system. It is generally measured by the availability and failure rates that is the reason why reliability and availability are related to the system architecture and cannot consider any pre-maintenance downtime. The availability of a system is the probability that the system will perform its certain task at a certain point of time when it calls upon. In the case of exponentially distributed system reliability is as follows. [16]

Reliability depends on the probability of failure rate as shown in Weibull distribution in Figure 71.

λ (t)

Time

0.25< ��� < 1 11 1

��� > 1

Aging

Burn in

Life time

��� = 1

Figure 71: Weibull Distribution (Failure rate vs. Time) [16]

The failure rate at any given time is proportional to function that will fail in the next unit of time divided by the total units under consideration. Hence the relation between failure rate λ and mean time between failures. [16]

In Figure 72, at an early stage of life in the graph, failure rate and reliability of component or system are high but in the overall result, the early stage of life is not fully reliable because of uncertainty. In the 2nd stage of life, failure rate and reliability of system or component are stable and predictable that’s why components or systems are useful in this stage of life. In the end, the 3rd stage of life, the reliability of components or systems.

R(t)

λ (t)

Time

Aging

Burn In

Failure Rate

Reliability Function

Figure 72: Reliability Function and Failure Rate [16]

2.1. Reliability and Safe Fail Systems

A reliable and safe fail is defined as a process which in the presence of fault are able to work correctly or moves the system into a state selected by the designer which assures that no harm can be done to the operating plant and environment. One of the significant requirements of a fail-safe system is self-diagnostic ability. By considering the example of PLC (programmable logic control) the self-diagnostic cannot be done with single PLC, therefor dual safety PLC and triple safety PLC are used for failure diagnostic by consensus or majority voting. From the industrial PLC’s data analysis it is realized that 90% of the failures come from the input or output of the PLC and 10% comes from the central processing units or power supply etc. So it is obvious that increasing safety at the periphery will result in the form of increased safety of the whole system. Now it needs to consider only those signal which is related to safety in a critical way. The safety of the central processing unit should be set to an acceptable level. The availability of the overall PLC is influenced by the reliability of the software programs. However, the failure probabilities of the software are not the same as hardware. When the software is tested then it is not supposed to create any error. It doesn’t mean that software doesn’t fail but there are very few chances of software to fail if the failure happens it is because of the design errors in the software. [17]

2.1.1. Reliability representation of digital logic functions

Reliability is measured by the laws of probability which are related to the reliability block diagram describe below.

1. If the reliability of the function is R (a) then the probability that the system will fail is nothing but F (a) = (1- R (a)). It is called a probability of the failure of system or unreliability.
2. If a and b are two events and they are not mutually exclusive the probability of happening either of one event is P (a or b) = P (a) + P (b) – P (a and b). In the case when they are mutually exclusive then the probability of either of the event to happen is P (a or b) = P (a) + P (b).

In a system where the components are connected in series with each other, the reliability of the whole system is calculated by multiplying the reliability of each component with each other. If a and b are two independent components and are connected in series with each other than the reliability of the system is the multiplication of R (a) and R (b). Which is proof that reliability decrease in the series system? If the probability of failure is under consideration then the unreliability is the sum of those probabilities of failures. In the case of a parallel system, the total reliability will be the sum of all reliabilities of components. And same as before while considering the probability of failures the total unreliability is nothing but the multiplication of these failure probabilities. The sensitivity of the series system is linear with respect to individual components or devices. While in the case of parallel systems the sensitivity is a nonlinear function of reliability with respect to devices and components while considering only one in a unit time. [17]

2.1.2. Fail-safe operation and enhancement of reliability

In this paragraph, an example will be discussed to enhance the reliability of a distributed process plant with PLC using fail-safe methods. A distributed process control has different functional modules installed at different places. These modules were being controlled by operators through the data highway bus (Ethernet). The controlling operation performs two functions. The analog and discrete inputs measurements and output signal generation which controls the actuator. In distributed system data highway is the internal communication system which controls the buses, at the same time when a conflict occurs in the CPU and input-output controller, it resolves the same.

In-order to address all the above mention problems the proposed solution could be like as below…

• To achieve a certain safety level proper nodes should be added in the existing system.
• To add a mechanism that can detect and prevent the output failure which could be the reason for the unsafe performance of the control system.
• By using a PLC of an appropriate safety level for most of the critical application.
• It should be able to work with more than one PLC for example in case of a triple modular redundant system.

The bus nodes architecture is shared communication lines among the operator console and different PLC nodes. Currently, all buses are designed according to OSI which is nothing but open systems interconnections. Because of this open system, each sensor can transfer its process value and every valve receive its set point and control values from the controller. All protocols designed for communication nodes and buses are OSI or MAP models. In the current example, the protocols are designed in such a way that data should be transferred to its required destination under hazards environmental conditions, some protocols are TCP/IP, X-25 are used for such safety-critical functions.

Basically, the output of the PLC is of three different types it can be relay, rectifier or transistor, and most of the case its transistor. A problem can be in the case of output failure either it can be a short circuit or open circuit. In either of these cases, the output can be active or inactive independent from the result internally achieved from the electronic control systems. The same case can appear if opto-coupler or any other system which controls the output fails. To solve such kind of problem a dynamic logic can be implemented according to the requirement of output.

In order to enhance the reliability and fail-safe operation of the current system, a hot stand by system consist of PLCs and OSI models for communication can be used. The ladder diagram programming can be used for sequencing operations to make sure the fail-safe operation and hot standby configuration are for the reliability enhancement. Two types of systems can be design one with redundant system and dual operator console and others can be the dual bus without redundant operator console. When the reliability of both the system was calculated then the system with dual bus and the dual console was more reliable and provides better fail-safe operation.

In the above example, a dual bus and hot standby PLC system is recommended for safe operation. The method is more effective when applied to the PLCs of low or medium range. As discussed above the input and output of the PLC are more prone to failures so in this case, the safety is achieved by applying it to the output. A fail-safe system is a design of the manufacturer who decides which state is safe for a specific failure so it can be said that a fail-safe and reliable process is one which in case of failure pushes the system in a stated defined by the designer. Eventually, the required state guarantees that no failure could happen to the machinery or environment.

1. Availability

Availability is defined as the function of probability and maintainability. It is denoted by ‘V‘. The probability that a system, subsystem, or component performed its required or defined functionality at a certain time under given or designed working conditions called availability. More perfectly, the availability can be named as point availability (PA) because it predicts a certain time and does not know that the system will work perfectly or not for the next extent of time and will carry it’s all required functions. Generally, it’s complicated to calculate the availability of the system. Because the operating conditions like (Temperature, Humidity, voltages, current, pressure) changes at every instant of time.

I assume the constant operating conditions at a certain time, then at that time, we can calculate the availability of the system. Which will be independent of the starting conditions of the system at the time t=0:

Here MTTF is mean time to failure for the system or the time from starting to the first failure of the system and MTTR is the meantime to repair or the time of repairing of a system. Mean-time to repair of the system is very short and we can write MTTF+MTTR is equal to the mean time between the failure MTBF. So, the equation of availability can be rewritten as:

The availability of a system or process can be calculated by using the stochastic process. Availability depends upon the failure time and repair time of the system. The different types of probability distribution forms exist. Normally, to calculate the availability use exponential, Weibull, poison, and normal distribution probabilities function for electrical/electronic and programmable electronic devices. In functional safety, we can also use the Markov chain, renewal process, regenerative process, semi Markov process, and semi-regenerative process models to derive the point availability expression. The availability of the system can be increased by using redundant systems. The architecture of the redundant components is designed in such a way that the system functionality does not affect by the loss or failure of components. The safety of the system cannot be increased directly by increasing the availability of the system. To increase the safety of redundant system online diagnostic and test procedures are applied.

The availability of the system can be increased by increasing the meantime to failure of the system. For this purpose, calculate the meantime to failure of the system and apply online diagnostic methods and also design a system in such a way that during the failure or random failure system should goes the safe state. By designing such a way functionality of other integrated systems will not be interrupted and our system will be more efficient. Let explain the term mean time to failure.

3.1. Mean time to failure (MTTF)

Mean time to repair or the lifetime of the system can be calculated from the failure rates of the system. MTTF is defined as the approximate time to the failure of a completely or partially repairable system.

Here ‘���’ is the failure rate for the components or system.

Mean Time to Repair (MTTR) refers to the amount of time required to repair a system and bring back it to full functionality as shown in the below Figure 81.

Resume normal operation

System failure

System failure

Time between failures

Time to repair

Time to failure

Figure 81: MTBF is a summation of MTTR and MTTF

To calculate MTTF, divide the total maintenance time by the total number of maintenance actions over a given period. As shown in the below expression.

In the case of repairable systems, we use mean time between failures (MTBF) which is the ratio of operation hours of a device to the number of failures:

For example, imagine a pump that fails three times over the distance of a workday. The time spent repairing each of those breakdowns totals one hour. In that case,

MTTR would be 1 hour / 3 = 20 minutes [19].

3.2. Point Availability

The point availability can be defined as the probability that a system or component is working or functioning correctly at the given instant of time (intentions time) t. Normally, use the standard notation A(t) to represent the point availability. Availability expression for a given system or process can be obtained by using stochastic processes. It depends upon the time to failure and time to repair distributions (normal, exponential, Weibull, or poison). Other methods exist to derive point availability. One can use the Markov chain, renewal process, regenerative process, semi Markov process, and semi-regenerative process models to derive the point availability expression [19].

The instantaneous availability measure incorporates maintainability information. At any given time, t the system will be operational if the following conditions are met:

1. It functioned properly during time t with probability R (t), or,
2. It functioned properly since the last repair at time u, 0 < u < t, with probability:

With m(u) being the renewal density function of the system.

The point availability is the summation of these two probabilities, or

1. Redundancy

Redundancy is basically a duplication of a function or a critical component in a system. Normally, when the system is not fail-safe then the system requires high redundancy for backup.

In many safety-critical systems, such as aircraft have triple modular redundancy (TMR) and PLC’s have two power supplies, 1756-PA75R and 1756-PB75R as shown in Figure 91. [20]

1756-PB75R Power Supply

PLC

1756-PA75R Power Supply

Figure 91: Redundant Power Supplies [20].

There are many types of redundancies in different fields like mechanical, electrical and computer sciences are given below:

1. Hardware redundancy
2. Software redundancy
3. Time redundancy
4. Information redundancy
5. Functional redundancy (the combination of hardware and software redundancies etc.)

Hot Redundancy (active or parallel redundancy): The redundant element is equally exposed to the same task from the beginning. Today, this is almost the only method in the process of safety and safety-related automation.

Warm Redundancy (low loaded redundancy): The redundant element has a small load until the control element fails. This design does not apply to safety processes and the automation industry.

Passive Redundancy (unloaded redundancy): The redundant element does not carry a load until the control element fails. This design is not used in safety processes and in the automation industry.

Hot Standby: The redundant element does not carry a load, but in the event of the main element failure, the excess element is switched to keep the system functional. This design is rarely used in safety processes and in the automation industry.

4.1. Hardware Redundancy

Hardware redundancy is just a physical copy of a component in a system. Hardware redundancy used for the critical task in the system. Hardware redundancy provides better reliability and better performance than software redundancy. Researchers have introduced many redundancy mechanisms. For example, RMT (Redundant Multithreading), Lockstep and TMR (Triple Modular Redundancy) [21].

4.2. Software Redundancy

Software redundancy is similar to hardware redundancy. In software redundancy, the program executes several times to check code and task run a few times with different codes. Sometimes in different core-processors also. Software redundancy improves diagnostic coverage. The basic model is responsible for the calculations that can cause a risk if incorrectly determined. The redundant mode is responsible for estimating the basic mode for estimating and executing a movement when an error is detected. Excessive management is done with computational structures and special codes to ensure software diversity. When both modes are completed, the performance information of the two redundant technology applications is corrected. Detected differences lead to an error message. Peripheral devices take signals from outside of the system and send it to the processor and then the processor executes it and sends it to output peripheral devices.

4.3. Time Redundancy

System planning fails. Some tasks are restarted during this time. During the discharge, safety-critical tasks become unnecessary and take some time. Because surplus allocations are spread out over time, temporary errors can be avoided.

Critical safety tasks are performed multiple times on normal hardware with the same software. The consequences of different tasks are compared, and when contrasts are identified, significant review activities are performed.

Safety-critical tasks that run on parallel channels, but not all at the same time, help create redundancy over time. A temporary error does not affect operation in the same way, even if the parallel channels are symmetrical hardware.

4.4. Information Redundancy

The data is encoded in such a way that bit errors are recognized and corrected. Excess information is redundant information that is added to real data for error detection or correction since the information is transmitted over a noisy channel. Some redundancy schemes are described below.

• Parity Bit

An equality bit has been added to the binary word to demonstrate whether the amount of information is even or odd. Indeed, equality is exactly the plan in which “1” of information is added when the information has an odd number. Odd parity is when information is included as “1” when the information contains a very large amount of information. For example, if the actual information is “1111 0000” and an identical bit is turned on at the end, “1111 0000 0” is transmitted to the main channel. An odd number of bits transmitted is identified at the end of the user.

• Checksum

The checksum is a value that is determined by a function via an information block. It is transmitted along with the information on the noise channel. With regard to the recipient, the control quantity determined should correspond to the control quantity received. The ability to detect errors is based on the number of double bits, the size of the information, and the calculation used to create the controller. Parity, modular amount and position-dependent checking are some examples of checks that can be used to identify errors. The sender can be instructed to redirect the information if an error is found.

4.5. Functional Redundancy

In functional redundancy, there are two systems, generate the same output but one produces output through the mechanical system and other produce output through the software system. Same as one have hardware redundancy and others have software redundancy. For example, the hydraulic brake system based on the paddle and as well as software-based in cars but both system works independently.

Parallel and combined systems have different levels of redundancy. Mostly structures are generally designed with redundant parts of the system. Because if one part of the system fails then the whole system will not fail or damage. When the whole system fails due to the failure of one component, it means not any part is redundant in the entire system. Such structures called fracture-critical. [22] [23]

There are two types of function of redundancy. Which are active and passive redundancy?

Active redundancy monitors individual devices and decides on the base of voting logic. The voting logic connected to the switching system which configures the components automatically. For example, in information redundancy, error detection and correction is an example of active redundancy. Electrical power distribution is also a good example of active redundancy. When load excess at user end then load shifts to another connection and also sometimes load trips as shown in Figure 92. In below figure when load exceed then shift from station A to station B. [22]

Figure 92: Redundant Electrical Power System.

In passive redundancy, there are more than two elements that work continuously and produce output. But, the performance of a system based on just a limited number of failures. TMR and N-modular redundancy are the best examples of passive redundancy as shown in Figure 93 [22]. For the TMR system shown in Figure 93, the reliability of R is given by the following equation.

Figure 93: Triple Modular Redundancy (Passive Redundancy)

References

[1]

IEC-61508, International Standard IEC 61508: Functional Safety of Electrical/Electronic/Programmable Electronic Safety-Related Systems., Geneva: Internation Electrotechnical Commission, 2000.

[2]

6. Mahdi S and A. Rafah M, “Operating System,” Hillah, University of Babylon, p. chapter 6.

[3]

2017. U. Merino, “Understanding and Extending Safety,” Analog Dialogue, Valencia,, 2017.

[4]

4. Tom, “www.analog.com,” [Online]. Available: https://www.analog.com/en/technical-articles/functional-safety-and-industry-4.0.html. [Accessed 12 Sept 2020].

[5]

Road vehicles – Functional safety, Switzerland: International Organization for Standardization, 2011.

[6]

2004. Börcsök, Electronics Safety Systems – Hardware Concepts, Models, and Calculations, Hüthig, 2004.

[7]

1. Safety, “ISS Safety Ltd,” Safety Providers, [Online]. Available: https://www.iss-safety.co.uk/products/machine-safety. [Accessed 19 July 2020].

[8]

1. M. Company, Failure Mode and Effects Analysis FMEA Handbook (with Robustness Linkages) FMEA Handbook (with Robustness Linkages), DEARBORN: Ford Motor Company, December 2011 .

[9]

1999. B. W.M. Goblea, “Using a failure modes, effects and diagnostic analysis (FMEDA) to measure diagnostic coverage in programmable electronic systems,” in Reliability Engineering and System Safety 66 (1999) 145–148, Eindhoven, 13 April 1999.

[10]

2003. S. Dhillon, Engineering safety fundamentals, techniques and applications, Singapore: World Scientific publication Co.Pte. Ltd., 2003.

[11]

2011. B. F. c. Enrico Zio, BASICS OF RELIABILITY AND RISK ANALYSIS Worked out problems and solutions, Singapore: World Scientific printers, 2011.

[12]

2007. Z. a. N. O. R. Nait-Said, “Fuzzy Risk Graph Model for Determining Safety Integrity Level,” Fuzzy Risk Graph Model for Determining Safety Integrity Level, no. 14 January 2008, p. 13, 15 August 2007.

[13]

2004. G. G. C. R. H. T. K. W. H. S. A G Foord, “Applying the latest standard for Functional Safety – IEC 61511,” Springer, February 2004.

[14]

2007. E. M. D. BÖRCSÖK J., “Calculation of MTTF values with Markov Models for Safety Instrumented,” in 7th WSEAS International Conference on APPLIED COMPUTER SCIENCE, Venice, Italy, 2007.

[15]

N.-S. Rachid, Z. Fatiha and O. Nouara, “Fuzzy Risk GraphModel for Determining Safety Integrity Level,” International Journal of Quality Statistics and Reliability, 2008.

[16]

2019. Armin, Quality and reliability assurance of electronic components and systems: methods – procedures – predictions (contact & study), Berlin, 2019.

[17]

2012. Kumar and K. Singh, “Fail-Safe Operation and Reliability Enhancement of Distributed Process Plant with PLC.,” in IEEE, Dehli, India, 2012.

[18]

2020. Bryan, “limblecmms,” 01 June 2020. [Online]. Available: https://limblecmms.com/blog/mttr-mtbf-mttf-guide-to-failure-metrics/. [Accessed 11 June 2020].

[19]

1. U Dinesh, C. John, C. T and S. Haritha, Reliability and Six Sigma, Springer.

[20]

2006. Automation, “ControlLogix Redundancy System,” Allen Bradley ( 1756-UM523F-EN-P), USA, 2006.

[21]

2014. Y. Chae, K. Kwon and J. Jae Wook, “Method of Improved Hardware Redundancy for Automotive System,” IEEE, Suwan, 2014.

[22]

2007. K. C. M. Krishna, Fault-Tolerant Systems, Amherst: Morgan Kaufmann, 2007.

[23]

2019. Herold, “Redundant Steering System for Highly Automated Driving of Trucks.,” Darmstadt, 2019.

[24]

2011. Stephen and R. Pack, “blog.fosketts,” 06 July 2011. [Online]. Available: https://blog.fosketts.net/2011/07/06/defining-failure-mttr-mttf-mtbf/. [Accessed 11 June 2020].