Table 154.
ISO 13849 architectural categories
ISO13849-1:2015
Link to IEC61508-compliant safety
architectures
Notes/constraints
Category
Clause
B
6.2.3
Possible with 1oo1 architecture
No requirements for
MTTFd
and
DC
avg
are given for category B, anyway it
is recommended to follow safety manual
recommendation.
1
6.2.4
Not recommended
Category not recommended because of the
NOTE1 in IEC13849-1, section §6.2.4.
2
6.2.5
Possible with 1oo1 architecture (external
WDT is mandatory)
The adoption of external WDT (CPU_SM_5)
acting as TE is mandatory.
Constraints on
DC
avg
and
MTTFd
can be
satisfied but computations are needed
Constraints on
CCF
.
3
6.2.6
Possible with 1oo2 archit
DUAL_SM_0
Constraints on
DC
avg
and
MTTFd
can be
satisfied but computations are needed
Constraints on
CCF
.
4
6.2.7
Possible with 1oo2 archit
DUAL_SM_0
Implementation of DUAL_SM_0 scheme is
mandatory to mitigate fault accumulation.
Constraints on
DC
avg
and
MTTFd
can be
satisfied but computations are needed
Constraints on
CCF
.
1. Computations related to DC
avg
and MTTFd can involve also other components than Device because used
in the safety function implementation (sensors, actuators, etc). The figures need therefore to be evaluated at
system level – refer to
for the correct interpretation of Device data in such a computation.
2. CCF additional requirements expressed in ISO13849-1, Annex F table F.1 are basically enforcing the
system implementation and therefore outside the scope of this manual. It is worth to note that the complete
safety analysis resulting as output of the IEC61508 compliance activity (this manual) helps to claim the
score for item #4 in Table F.1.
6.1.2
ISO 13849 safety metrics computation
Appendix C of ISO 13849 presents tables of standardized
MTTFd
for the various electric or electronics
components. However, table C.3 in ISO 13849 points to ICs manufacturer’s data while attempting to classify
MTTFd
for programmable ICs. As a consequence, safety analysis results of this Safety Manual can be re-mapped
in ISO 13849 domain, because even computed for IEC 61508 they are definitely more and more accurate in the
definition of dangerous failures identification.
When for a certain component
PFH
<< 1 it can be assumed that
MTTFd
= 1 /
PFH
.
It is worth to note that according ST methodology, FMEDA data includes failure rate related to transient faults
without any assumption about their potential partial safeness. Because of this assumption,
PFH
values in Device
FMEDA leads to very conservative values for computed
MTTFd
.
In ISO 13849-1 the
DC
for each single component has the same meaning of the IEC 61508 metric; results of this
safety manual and related FMEA/FMEDA can therefore be reused. However, this standard defines the concept
of
DC
avg
applicable to the whole
SRP/CS
in the form of the equation defined in Annex E, formula E.1, where the
contribution of each part of the control system is weighted with respect to
MTTFd
of the various subsystems of the
channel.
End user
is therefore responsible for the computations of the overall
DC
avg
.
The standard denies any possibility of fault exclusion while calculating
DC
avg
(ISO13849-2 Tab.D.21 no exclusion
allowed), which is also the assumption of
Device
analysis documented in this safety manual.
Note:
Each architectural solution analyzed in this safety manual results in PFH values producing high MTTFd.
UM2305
ISO 13849-1:2015, ISO 13849-2:2012
UM2305
-
Rev 10
page 97/110
