The hardware categories of each safety function implemented by the SRP/CS represent a subdivision, based on predefined models, of the architecture of the safety-related control system.
Definition of the Categories according to ISO 13849-1
The categories of ISO 13849-1 are conceptually the same as those of other standards relating to functional safety, such as IEC 615058.
ISO 13849-1 also outlines the categories in a block diagram, where the safety function is divided into inputs (e.g. transmitters, switches, etc.), logic solvers (e.g. PLC, relays, etc.) and final items (contactors, valves, etc.).
Do you want to help our page grow? Follow us on Linkedin
ISO 13849-1 calls them SRP/CS a/b/c, but this is basically all it introduces from the point of view of functional safety.
Category B
For an SRP/CS to be considered as meeting the requirements of Category B it must be:
- Designed, constructed, selected, assembled and combined in accordance with the relevant standards and use the basic safety principles established by EN ISO 13849-2.
In this category, importance is placed on diagnostic coverage while the causes of common failure are generally not relevant. The MTTFd of each channel can be from low to medium.
The maximum PL achievable according to the definition of the standard is equal to b.
Category B architectures are all single-channel architectures composed of an input, for example a button or a single contact limit switch, a logic solver (not necessary) and a single contactor as an output to stop a motor and consequently the source of the danger.
More information:
Category 1
For an SRP/CS to be considered as meeting the requirements of Category 1, in addition to what is required for B, it must be:
- Designed and constructed using well-tried safety principles and components of proven use or specific to safety applications, i.e. with MTTFd falling within the maximum range (“well-tried component” and “well-tried safety principles” as specified in ISO 13849-2).
In this category, importance is placed on diagnostic coverage while the causes of common failure are generally not relevant. But the MTTFd of each channel must be high.
The maximum PL achievable according to the definition of the standard is equal to c.
Similarly to Category B, the same single-channel architectures can also be mentioned for Category 1.
The difference is that in the case of Category 1 the chosen components must be specifically designed to perform safety functions.
Category 2
For an SRP/CS to be considered as meeting the requirements of Category 2, in addition to what is required for Category B and the need to use well-tried safety principles, it must be:
- Equipped with an independent TE device capable of diagnosing all the failures of a single-channel architecture by periodically testing it and, if necessary, activating an independent OTE output to ensure safety.
Diagnostic coverage must be low. The MTTFd of each channel must be from low to high. Measures against CCFs should be applied.
The maximum PL achievable is d.
There are additional requirements for this category:
- The interval between two control cycles by the TE must be at least 100 times more frequent than the demand rate of the safety function
- The diagnostic test must always be done before a restart/start and before a potentially dangerous situation
Do you want to help our page grow? Follow us on Linkedin
Category 3
For an SRP/CS to be considered as meeting the requirements of Category 3, in addition to what is required for Category B and the need to use well-tried safety principles, it must:
- Always ensure tolerance to a failure of any of its parts without compromising the safety function and diagnose the dangerous failure with an interval at least equal to the demand rate.
In this category the diagnostic coverage must be at least low, the MTTFd must be from low to high, and measures against CCFs must be applied.
The maximum PL achievable according to the definition is equal to e.
Category 3 is by far the most common category of the main safety devices available on the market.
Fault tolerance can also be an intrinsic feature of a device made for this purpose, such as a safety PLC or safety relay.
More information:
Category 4
For an SRP/CS to be considered as meeting the requirements of Category 4, in addition to what is required for Category B and the need to use well-tried safety principles, it must:
- Always ensure tolerance to a failure of any of its parts without compromising the safety function and diagnose the dangerous failure with an interval at least equal to the demand rate.
In this category the diagnostic coverage, including the accumulation of faults, must be high, and measures against CCFs must be applied. The MTTFd must be high.
The maximum PL achievable according to the definition of the standard is equal to e.
Category 4 is the most reliable because:
- In addition, the system must be able to diagnose a failure immediately upon start-up and before a system recovery
- If this is not possible, the system must be such as to ensure that even a second simultaneous failure does not compromise the safety of the system
