Safety-related control systems failure modes

In the context of safety-related control systems, the Essential Health and Safety Requirements of the Supply of Machinery (Safety) Regulations 1992 lay down generic requirements that must be considered by suppliers for the safety and reliability of control systems control devices starting and stopping devices mode selection failure of the power supply and the control circuit software and movable guards. 

Close attention to detail is essential in the design of all safety-related control systems, whether they are simple hard-wired systems, or complex systems implemented by software. It is important that safety analysis techniques are used to ensure that the requirements in the specification are met, and that the foreseeable failure modes of the control system do not compromise that specification. Issues of concern, which have been identified, include an over-optimistic dependence on the safety integrity of single channel systems, failure to adequately verify software, and poor consideration of human factors. Good design can also eliminate, or at least reduce, the chance of error on the part of the operator or maintenance technician. ... 

The rationale behind the definitions of iow demand mode and high demand or continuous mode in lEC 61508 is based on the failure behaviour of a safety-related system due to random hardware faults. Underlying much of the reasoning is the distinction between safety-functions that only operate on demand and those that operate continuously . A safety function that operates on demand has no influence until a demand arises, at which time the safety function acts to transfer the associated equipment into a safe state. A simple example of such a safety function is a high level trip on a liquid storage tank. The level of liquid in the tank is controlled in normal operation by a separate control system, but is monitored by the safety-related system. If a fault develops in the level control system that causes the level to exceed a pre-determined value, then the safety-related system closes the feed valve. With such a safety function, a hazardous event (in this case, overspill) will only occur if the safety function is in a failed state at the time a demand (resulting from a failure of the associated equipment or equipment control system) occurs. A failure of the safety function will not, of itself, lead to a hazardous event. This model is illustrated in Figure 4. 

Functional safety engineering involves identifying specific hazardous failures whieh lead to serious consequenees (e.g., death) and then establishing maximum tolerable frequency targets for each mode of failure. Equipment whose failure contributes to eaeh of these hazards is identified and usually referred to as safety related. Examples are industrial process control systems, proeess shut down systems, rail signaling equipment, automotive controls, medical treatment equipment, etc. In other words, any equipment (with or without software) whose failure ean eontribute to a hazard is likely to be safety related. 

---