IEC TS 63394:2023

Safety of machinery - Guidelines on functional safety of safety-related control systems

IEC TS 63394:2023 In the context of the safety of machinery, the sector standard IEC 62061, along with ISO 13849 1, provides requirements to manufacturers of machines for the design, development and integration of safety-related control systems (SCS) or safety-related parts of control systems (SRP/CS), depending on technology used (mechanical, pneumatic, hydraulic or electrical technologies) to perform safety function(s). This document does not replace ISO 13849-1 and IEC 62061. This document gives additional guidance to the application of IEC 62061 or ISO 13849-1.
This document:
– gives guidelines and specifies additional requirements for specific safety functions based on the methodology of ISO 12100, which are relevant in machinery and respecting typical boundary conditions of machinery;
– considers safety functions which are designed for high demand mode of operation yet are rarely operated, called rarely activated safety functions;
– gives additional information for the calculation of failure rates using other (non-electronic) technologies based e.g. on Weibull distribution, because all the formula defined in IEC 62061 and ISO 13849-1 are based on exponential distribution.
Therefore, the basis for these guidelines and additional requirements is
– a typical classification of safety functions;
– a consideration of typical architectures used for designing safety functions;
– a consideration of modes of operation of safety functions;
– the derivation and evaluation of PFH formulas for subsystems considering the used technology.
This document does not address low demand mode of operation according to IEC 61508.
This document does not take into account either layer of protection analysis (LOPA) or basic process control system (BPCS), according to IEC 61511 as a risk reduction measure.
This document considers all lifecycle phases of the machine regarding functional safety, and SCS or SRP/CS.

Sécurité des machines – Guide pour la sécurité fonctionnelle des systèmes de commande relatifs à la sécurité

General Information

• Status: Published
• Publication Date: 21-Feb-2023
• ICS: 13.110 - Safety of machinery
• ICS: 25.040.99 - Other industrial automation systems
• ICS: 29.020 - Electrical engineering in general
• Technical Committee: TC 44 - Safety of machinery - Electrotechnical aspects
• Drafting Committee: PT 63394 - TC 44/PT 63394
• Current Stage: PPUB - Publication issued
• Start Date: 30-Mar-2023
• Completion Date: 22-Feb-2023

Standards Content (Sample)

IEC TS 63394
®

Edition 1.0 2023-02
TECHNICAL
SPECIFICATION

colour
inside


Safety of machinery – Guidelines on functional safety of safety-related control
system
IEC TS 63394:2023-02(en)

---------------------- Page: 1 ----------------------
THIS PUBLICATION IS COPYRIGHT PROTECTED
Copyright © 2023 IEC, Geneva, Switzerland

All rights reserved. Unless otherwise specified, no part of this publication may be reproduced or utilized in any form
or by any means, electronic or mechanical, including photocopying and microfilm, without permission in writing from
either IEC or IEC's member National Committee in the country of the requester. If you have any questions about IEC
copyright or have an enquiry about obtaining additional rights to this publication, please contact the address below or
your local IEC member National Committee for further information.


IEC Secretariat Tel.: [phone]
3, rue de Varembé [e-mail]
CH-1211 Geneva 20 www.iec.ch
Switzerland

About the IEC
The International Electrotechnical Commission (IEC) is the leading global organization that prepares and publishes
International Standards for all electrical, electronic and related technologies.

About IEC publications
The technical content of IEC publications is kept under constant review by the IEC. Please make sure that you have the
latest edition, a corrigendum or an amendment might have been published.

IEC publications search - webstore.iec.ch/advsearchform IEC Products & Services Portal - products.iec.ch
The advanced search enables to find IEC publications by a Discover our powerful search engine and read freely all the
variety of criteria (reference number, text, technical publications previews. With a subscription you will always have
committee, …). It also gives information on projects, replaced access to up to date content tailored to your needs.
and withdrawn publications.

Electropedia - www.electropedia.org
IEC Just Published - webstore.iec.ch/justpublished
The world's leading online dictionary on electrotechnology,
Stay up to date on all new IEC publications. Just Published
containing more than 22 300 terminological entries in English
details all new publications released. Available online and once
and French, with equivalent terms in 19 additional languages.
a month by email.
Also known as the International Electrotechnical Vocabulary

(IEV) online.
IEC Customer Service Centre - webstore.iec.ch/csc

If you wish to give us your feedback on this publication or need
further assistance, please contact the Customer Service
Centre: [e-mail].

---------------------- Page: 2 ----------------------
IEC TS 63394

®


Edition 1.0 2023-02




TECHNICAL



SPECIFICATION








colour

inside










Safety of machinery – Guidelines on functional safety of safety-related control

system


























INTERNATIONAL

ELECTROTECHNICAL


COMMISSION





ICS 13.110; 29.020; 25.040.99 ISBN 978-2-8322-6533-8




  Warning! Make sure that you obtained this publication from an authorized distributor.


® Registered trademark of the International Electrotechnical Commission

---------------------- Page: 3 ----------------------
– 2 – IEC TS 63394:2023 © IEC 2023
CONTENTS
FOREWORD . 9
INTRODUCTION . 11
1 Scope . 12
2 Normative references . 12
3 Terms and definitions . 13
3.1 Terms and definitions . 13
3.2 Alphabetical list of terms, definitions and abbreviated terms . 26
4 Typical classification of safety functions in safety of machinery . 28
4.1 General . 28
4.1.1 Overview . 28
4.1.2 Risk assessment and risk reduction according to ISO 12100 . 28
4.1.3 Risk reduction and interconnection to SCS and SRP/CS . 29
4.1.4 Basic assumptions for risk reduction in machinery . 29
4.2 Basic safety assumptions for the design and integration of the SCS or
SRP/CS . 29
4.3 Safety functions . 30
4.3.1 General . 30
4.3.2 Risk reduction process by safety functions . 30
4.3.3 Typical classification of safety functions . 31
4.4 Interrelation between ISO 12100 and IEC 62061 or ISO 13849-1 . 32
4.4.1 General . 32
4.4.2 Input information in accordance with IEC 62061 or ISO 13849-1 . 32
4.4.3 Output information from IEC 62061 or ISO 13849-1 . 33
4.5 Safety functions for protection of persons . 34
4.5.1 General . 34
4.5.2 Safety functions for protection of persons based on guards and
protective devices . 34
4.6 Other safety functions to prevent hazardous situations . 35
4.6.1 General . 35
4.6.2 Other safety functions . 35
4.7 Safety functions for protection of the integrity of the machine . 36
4.7.1 General . 36
4.7.2 Safety functions for the protection of integrity of the machine . 36
4.8 Safety functions and Type-C standards . 36
5 Demand mode of operation related to safety functions . 37
5.1 General . 37
5.2 High demand or continuous mode of operation . 37
5.2.1 General . 37
5.2.2 Approach of IEC 62061 and ISO 13849-1 . 38
5.2.3 Rarely activated safety functions . 38
5.3 Low demand mode of operation . 39
5.3.1 General . 39
5.3.2 Approach of IEC 62061 and ISO 13849-1 . 40
6 Design process of safety functions . 40
6.1 General . 40
6.2 Design procedure . 40
6.3 Evaluation of required safety integrity . 41

---------------------- Page: 4 ----------------------
IEC TS 63394:2023 © IEC 2023 – 3 –
6.4 Decomposition of a safety function . 41
6.5 Subsystem design . 41
6.5.1 Architectural constraints . 41
6.5.2 Fault accumulation and undetected faults . 43
6.5.3 Evaluation of PFH . 43
6.6 Examples of safety functions. 45
7 Verification procedures for safety functions . 45
7.1 General . 45
7.2 Verification of the test interval of a safety function . 45
7.3 Verification procedures . 46
7.4 Initial verification . 46
7.5 Periodic verification . 47
7.5.1 General . 47
7.5.2 Frequency of periodic verification . 48
7.6 Verification reporting . 49
Annex A (informative) Risk assessment and risk reduction according to ISO 12100 . 50
A.1 General . 50
A.2 Risk assessment principles . 50
A.2.1 General . 50
A.2.2 Basic information to be available (as input to risk assessment) . 50
A.2.3 Risk analysis . 51
A.3 Risk reduction by means of safeguarding and complementary protective
measures . 55
A.3.1 General . 55
A.3.2 Inherently safe design measures . 56
A.3.3 Selection of safeguarding and complementary protective measures . 56
A.4 Other protective measures (procedure based) . 58
A.4.1 General . 58
A.4.2 Procedures for maintenance . 58
A.4.3 Organizational work procedures. 58
A.5 Guards and protective devices according to ISO 12100 . 59
A.5.1 General . 59
A.5.2 Interlocking guard with a start function, with manual reset function . 59
A.5.3 Protective device according to ISO 12100. 60
A.5.4 Manual local control device (and procedure) . 60
A.5.5 Manual parameter selection device (and procedure) . 61
A.5.6 Manual operating mode selection device (and procedure) . 61
A.5.7 Energy control device (and procedure) . 61
A.6 Matrix assignment approach . 61
A.6.1 Overview . 61
A.6.2 General . 62
A.6.3 Methodology of IEC 62061:2021, Annex A . 62
A.7 Risk graph approach . 63
A.7.1 General . 63
A.7.2 Methodology of ISO 13849-1:2015, Annex A with assigned SIL . 63
Annex B (informative) Methodology of SCS or SRP/CS design . 65
B.1 General . 65
B.2 Functional safety plan . 65
B.3 Safety requirements specification . 66

---------------------- Page: 5 ----------------------
– 4 – IEC TS 63394:2023 © IEC 2023
B.3.1 General . 66
B.3.2 Functional requirements . 66
B.3.3 Safety integrity requirements . 66
B.4 Protection against unexpected start-up . 67
B.5 Decomposition of the safety function . 67
B.5.1 General . 67
B.5.2 Subsystem architecture based on top-down decomposition. 67
B.6 Design of the SCS by using subsystems . 67
B.7 Requirements for systematic safety integrity . 68
B.7.1 General . 68
B.7.2 SCS level . 68
B.7.3 Subsystem level . 70
B.8 Electromagnetic immunity . 71
B.9 Software-based manual parameterization . 71
B.10 Security aspects . 73
B.11 Aspects of testing . 73
B.12 Design and development of a subsystem . 74
B.12.1 General . 74
B.12.2 Subsystem architecture design . 74
B.12.3 Fault consideration and fault exclusion . 76
B.12.4 Architectural constraints of a subsystem . 76
B.12.5 Subsystem design architectures . 78
B.12.6 PFH value of subsystems . 78
B.13 Validation . 78
B.14 Documentation . 80
Annex C (informative) Examples of MTTF values for single components . 83
D
Annex D (informative) Examples for diagnostic coverage (DC) . 84
D.1 General . 84
D.2 Influence of cabling, wiring and interconnections . 85
D.2.1 General . 85
D.2.2 "Serial wiring" . 85
D.3 Use of manufacturing process information . 86
D.3.1 General . 86
D.3.2 Use of expected timing or awaiting of signal status . 86
D.4 Typical DC measures . 86
Annex E (informative) Measures for the achievement of functional safety with regards
to electromagnetic phenomena . 88
E.1 General . 88
E.2 Measures . 88
E.2.1 General . 88
E.2.2 Recommendation for electrical/electronic items of equipment (devices

or apparatus) . 88
E.2.3 Recommendation for the integration of an SCS or SRP/CS into the
electrical equipment of the machine . 89
Annex F (informative) Guidelines for software . 90
F.1 General . 90
F.2 Documentation . 90
F.3 Activities . 92
Annex G (informative) Examples of safety functions. 97

---------------------- Page: 6 ----------------------
IEC TS 63394:2023 © IEC 2023 – 5 –
G.1 General . 97
G.2 Safety functions . 97
G.2.1 Basic information . 97
G.2.2 Detailed description of safety requirements . 98
G.2.3 Example of interlocking guard . 99
Annex H (informative) Evaluation of PFH value of a subsystem . 101
H.1 General . 101
H.2 Table allocation approach (IEC 62061) . 101
H.3 Simplified formulas for the estimation of PFH value (IEC 62061) . 101
H.4 Approaches of IEC 61508, IEC 62061 and ISO 13849-1 . 101
H.4.1 General . 101
H.4.2 Approach of IEC 61508 . 102
H.4.3 Approach of IEC 62061 . 103
H.4.4 Approach of ISO 13849-1:2015, Annex K . 103
H.5 Basic considerations regarding exponential and Weibull distributions . 107
H.5.1 Exponential distribution . 107
H.5.2 Weibull distribution . 107
H.6 T and B . 109
10 10
H.6.1 General . 109
H.6.2 T with exponential distribution . 109
10
H.6.3 T with Weibull distribution . 110
10
H.7 Overview of PFH formulas . 112
H.7.1 Definitions . 112
H.7.2 Formulas . 112
H.7.3 Examples. 114
H.8 Methodology for the estimation of CCF . 116
H.9 Basic subsystem architecture A (1oo1) . 117
H.9.1 General . 117
H.9.2 PFH . 118
H.9.3 Simplified Weibull approach . 118
H.10 Basic subsystem architecture C (1oo1D) . 119
H.10.1 General . 119
H.10.2 Fault reaction performed by another subsystem . 119
H.10.3 Fault reaction to be considered in the subsystem. 120
H.10.4 PFH . 122
H.10.5 Influence of CCF. 122
H.11 Basic subsystem architecture B (1oo2) . 123
H.11.1 General . 123
H.11.2 PFH . 124
H.11.3 Influence of CCF. 124
H.12 Basic subsystem architecture D (1oo2D) . 124
H.12.1 General . 124
H.12.2 PFH evaluation of Term A . 126
H.12.3 PFH evaluation of Term B . 126
H.12.4 PFH evaluation of Term C and Term D . 126
H.12.5 PFH . 127
H.12.6 Influence of CCF. 127

---------------------- Page: 7 ----------------------
– 6 – IEC TS 63394:2023 © IEC 2023
H.13 Basic subsystem architecture D (1oo2D) with two periods of time
consideration . 127
H.13.1 General . 127
H.13.2 PFH evaluation of Term A . 128
H.13.3 PFH evaluation of Term B . 128
H.13.4 PFH evaluation of Term C and Term D . 128
H.13.5 PFH . 129
H.13.6 Influence of CCF. 129
Annex I (informative) Commented examples of current regulations . 130
I.1 General . 130
I.2 European Union . 130
I.2.1 General European legislation . 130
I.2.2 New proposed machinery regulation (under preparation) . 130
I.2.3 Relevant legislation . 131
I.2.4 Duties of the manufacturer of the machine . 131
I.3 North America – USA . 132
I.4 North America – Canada . 132
I.5 South America – Brazil . 132
I.6 China . 133
I.7 Japan. 133
Annex J (informative) Combination of modes of operation . 134
J.1 General . 134
J.2 Basic approaches with different modes of operation . 134
J.2.1 General . 134
J.2.2 Risk reduction measures on low demand mode of operation . 135
J.3 Use of subsystems in different modes of operation . 136
J.3.1 General . 136
J.3.2 Example with different modes of operation. 136
J.3.3 Subsystem(s) used for different modes of operation . 138
Bibliography . 141

Figure 1 – Integration within the risk reduction process of ISO 12100 . 29
Figure 2 – Decomposition of an SCS or SRP/CS . 30
Figure 3 – Risk reduction process by safety functions . 31
Figure 4 – High demand mode of operation . 38
Figure 5 – Process for determining high demand mode of operation . 39
Figure 6 – Low demand mode of operation . 40
Figure A.1 – SIL assignment approach .
...