ISO 13849-1:2023 機械の安全性 ～制御システムの安全関連部分～ Part 1: 設計の一般原則 | ページ 6

3.1.1

safety-related part of a control system

SRP/CS

part of a control system that performs a safety function (3.1.27) , starting from a safety-related input(s) to generating a safety-related output(s)

Note 1 to entry: The safety-related parts of a control system start at the point where the safety-related inputs are initiated (including, for example, the actuating cam and the roller of the position switch) and end at the output of the power control elements (including, for example, the main contacts of a contactor).

3.1.2

machine control system

system which responds to input signals from parts of machine elements, operators, external control equipment or any combination of these and generates output signals causing the machine to behave in the intended manner

Note 1 to entry: The machine control system can use any technology or any combination of different technologies (e.g. electrical/electronic, hydraulic, pneumatic and mechanical).

3.1.3

safety requirements specification

SRS

specification containing the requirements for the safety functions (3.1.27) that have to be met by the safety-related control system in terms of characteristics of the safety functions (functional requirements) and required performance levels (PL_r) (3.1.6)

[SOURCE:IEC 61508‑4:2010, 3.5.11, modified — Information from IEC 61508‑4:2010, 3.5.12 has been included.]

3.1.4

category

classification of the subsystem (3.1.45) in respect to its resistance to faults (3.1.8) and the subsequent behaviour in the fault condition which is achieved by the structural arrangement of the parts, fault detection and/or by their reliability

3.1.5

performance level

pl

discrete level used to specify the ability of safety-related parts of control systems (SRP/CS) (3.1.1) to perform a safety function (3.1.27) under foreseeable conditions

Note 1 to entry: See 6.1 for a general overview of performance level.

3.1.6

required performance level

pl_r

performance level (3.1.5) required in order to achieve the required risk (3.1.19) reduction for each safety function (3.1.27)

Note 1 to entry: See 5.3 and Figure A.1 for further information on required performance level (PL_r).

3.1.7

safety integrity level

SIL

discrete level (one out of a possible four) for specifying the safety integrity requirements of safety functions (3.1.27) to be allocated to the safety-related systems ここで, safety integrity level 4 has the highest level of safety integrity and safety integrity level 1 has the lowest

Note 1 to entry: In this document only SIL 1 to SIL 3 are considered.

[SOURCE:IEC 61508‑4:2010, 3.5.8, modified — “allocated to safety-related systems” has been added to definition, NOTES have been deleted and new Note 1 to entry has been added.]

3.1.8

fault

abnormal condition that may cause a reduction in, or loss of, the capability of a functional unit to perform a required function

Note 1 to entry: A fault is often the result of a failure (3.1.10) of the item itself, but can exist without prior failure.

Note 2 to entry: In this document “fault” means random fault or fault caused by a systematic failure (3.1.14) .

[SOURCE:IEC 60050‑192:2015, modified — Note 2 to entry has been amended.]

3.1.9

fault exclusion

exclusion of certain faults (3.1.8) within a safety-related part of a control system (SRP/CS), if this exclusion can be justified due to the negligible probability of these faults

3.1.10

failure

termination of the ability of a device to perform a required function

Note 1 to entry: After a failure, the device has a fault (3.1.8) .

Note 2 to entry: “Failure” is an event, as distinguished from “fault”, which is a state.

Note 3 to entry: Failures which only affect the availability of the process under control are outside of the scope of this document.

[SOURCE:IEC 60050‑192:2015, modified — Note 3 to entry has been amended.]

3.1.11

permanent fault

fault (3.1.8) of an item that persists until an action of corrective maintenance is performed

[SOURCE:IEC 60050‑192:2015]

3.1.12

dangerous failure

[SOURCE:IEC 61508-4:2010, 3.6.7, modified —"EUC" has been replaced by"machine/machinery".]

3.1.13

common cause failure

CCF

failure (3.1.10) that is the result of one or more events, causing concurrent failures of two or more separate channels (3.1.47) in a multiple channel subsystem (3.1.45) , leading to failure of a safety function (3.1.27)

Note 1 to entry: Common cause failures are not identical with common mode failures (see ISO 12100:2010, 3.36).

[SOURCE:IEC 61508‑4:2010, 3.6.10, modified —"system failure" has been changed to"failure of a safety function". Note 1 to entry has been added.]

3.1.14

systematic failure

failure (3.1.10) related in a deterministic way to a certain cause, which can only be eliminated by a modification of the design or of the manufacturing process, operational procedures, documentation or other relevant factors

Note 1 to entry: Corrective maintenance without modification will usually not eliminate the failure cause.

Note 2 to entry: A systematic failure can be induced by simulating the failure cause.

[SOURCE:IEC 60050‑192:2015]

3.1.15

muting

temporary automatic suspension of a safety function(s) (3.1.27) by the SRP/CS

[SOURCE:IEC 61496-1:2020, 3.16]

3.1.16

harm

physical injury or damage to health

[SOURCE:ISO 12100:2010, 3.5]

3.1.17

hazard

potential source of harm (3.1.16)

Note 1 to entry: The term"hazard" can be qualified in order to define its origin (e.g. mechanical hazard, electrical hazard) or the nature of the potential harm (e.g. electric shock hazard, cutting hazard, toxic hazard and fire hazard).

[SOURCE:ISO 12100:2010, 3.6, modified — Note 3 to entry has been deleted.]

3.1.18

hazardous situation

circumstance in which a person is exposed to at least one hazard (3.1.17)

Note 1 to entry: The exposure can result in harm (3.1.16) immediately or over a period of time.

[SOURCE:ISO 12100:2010, 3.10]

3.1.19

risk

combination of the probability of occurrence of harm (3.1.16) and the severity of that harm

[SOURCE:ISO 12100:2010, 3.12]

3.1.20

residual risk

risk (3.1.19) remaining after risk reduction measures (protective measures) (3.1.22) have been taken

Note 1 to entry: See Figure 3.

[SOURCE:ISO 12100:2010, 3.13, modified — Note 1 to entry has been modified.]

3.1.21

risk assessment

overall process comprising risk analysis (3.1.23) and risk evaluation (3.1.24)

[SOURCE:ISO 12100:2010, 3.17]

3.1.22

risk reduction measure

protective measure

action or means to eliminate hazards (3.1.17) or reduce risks (3.1.19)

[SOURCE:ISO/IEC Guide 51:2014, 3.13]

3.1.23

risk analysis

combination of the specification of the limits of the machine, hazard (3.1.17) identification and risk (3.1.19) estimation

[SOURCE:ISO 12100:2010, 3.15]

3.1.24

risk evaluation

judgement, on the basis of risk analysis (3.1.23) , of whether risk reduction objectives have been achieved

[SOURCE:ISO 12100:2010, 3.16]

3.1.25

intended use of the machine

use of a machine in accordance with the information provided in the instructions for use

[SOURCE:ISO 12100:2010, 3.23]

3.1.26

reasonably foreseeable misuse

use of a machine in a way not intended by the designer, but which can result from readily predictable human behaviour

[SOURCE:ISO 12100:2010, 3.24]

3.1.27

safety function

function of a machine whose failure (3.1.10) can result in an immediate increase of the risk(s) (3.1.19)

Note 1 to entry: A safety function is a function implemented by a safety-related part of a control system, which is needed to achieve or maintain a safe state for the machine, in respect of a specific hazardous event.

[SOURCE:ISO 12100:2010, 3.30, modified — Note 1 to entry has been added.]

3.1.28

sub-function

part of a safety function (3.1.27) whose failure (3.1.10) results in a failure of the safety function

Note 1 to entry: A sub-function is a function implemented by a subsystem (3.1.45) of the safety-related part of a control system (SRP/CS). See also IEC 61800-5-2:2016.

3.1.29

monitoring

diagnostic measure which detects a state and compares it to the expected value

Note 1 to entry: Monitoring is realised by the following methods, e.g. plausibility check (3.1.52) , direct, indirect or cross monitoring (3.1.30) (see Annex E), cyclic test stimulus.

3.1.30

cross monitoring

diagnostic measure which checks plausibility of redundant signals in both channels (3.1.47) of a redundant subsystem (3.1.45)

3.1.31

programmable electronic system

PE system

system for control, protection or monitoring (3.1.29) based on one or more programmable electronic devices, including all elements of the system such as power supplies, sensors and other input devices, data highways and other communication paths, and actuators and other output devices

[SOURCE:IEC 61508‑4:2010, 3.3.1]

3.1.32

mean time to dangerous failure

MTTF_D

expectation of the mean time to dangerous failure

Note 1 to entry: In the case of items with an exponential distribution of operating times to dangerous failure (i.e. a constant failure rate) the MTTF_D is numerically equal to the reciprocal of the dangerous failure rate.

[SOURCE:IEC 62061:2021, 3.2.38, modified — Note 1 to entry has been modified.]

3.1.33

MTBF

mean time between failures

expected value of the operating time between consecutive failures (3.1.10)

3.1.34

RDF

ratio of dangerous failures

fraction of the overall failure (3.1.10) rate of an element that can result in a dangerous failure (3.1.12)

3.1.35

diagnostic coverage

DC

measure of the effectiveness of diagnostics, which is determined as the ratio between the failure (3.1.10) rate of detected dangerous failures (3.1.12) and the failure rate of total dangerous failures

Note 1 to entry: Diagnostic coverage can exist for the whole or parts of a safety-related system. For example, diagnostic coverage can exist for sensors and/or logic systems and/or power control elements.

3.1.36

mission time

T_M

period of time covering the intended use of a safety-related part of a control system (SRP/CS)

3.1.37

test rate

r_t

frequency of tests to detect faults (3.1.8) in a safety-related part of a control system (SRP/CS)

Note 1 to entry: Test rate is also used as reciprocal value of diagnostic test interval.

3.1.38

demand rate

r_d

frequency of demands for a safety function (3.1.27) to be performed by the safety-related part of a control system (SRP/CS)

3.1.39

limited variability language

LVL

type of language that provides the capability to combine predefined, application specific, library functions to implement the safety requirements specifications (SRSs) (3.1.3)

Note 1 to entry: An LVL provides a close functional correspondence with the functions required to achieve the application.

Note 2 to entry: Typical examples of LVL are given in IEC 61131-3. They include ladder diagram, function block diagram and sequential function chart. Instruction lists and structured text are not considered to be LVL.

Note 3 to entry: Typical example of systems using LVL: Programmable Logic Controller (PLC) configured for machine control.

[SOURCE:IEC 62061: 2021, 3.2.62]

3.1.40

full variability language

FVL

type of language that provides the capability to implement a wide variety of functions and applications

Note 1 to entry: Typical example of systems using FVL are general-purpose computers.

Note 2 to entry: FVL is normally found in embedded software and is rarely used in application software.

Note 3 to entry: FVL examples include: Ada, C, Pascal, Instruction List, assembler languages, C++, Java, SQL.

[SOURCE:IEC 62061: 2021, 3.2.61]

3.1.41

safety-related application software

SRASW

software specific to the application and generally containing logic sequences, limits and expressions that control the appropriate inputs, outputs, calculations and decisions necessary to meet the safety-related part of a control system (SRP/CS) requirements

3.1.42

safety-related embedded software

SRESW

software that is part of the system supplied by the manufacturer and is not intended for modification by the end-user

Note 1 to entry: Embedded software is also referred to as firmware or system software. See, full variability language (FVL) (3.1.40) .

[SOURCE:IEC 61511‑1:2016, 3.2.76.2]

3.1.43

high demand or continuous mode

mode of operation in which the frequency of demands on a safety-related part of a control system (SRP/CS) to perform its safety function (3.1.27) is greater than one per year or the safety function retains the machine in a safe state as part of normal operation

[SOURCE:IEC 61508‑4:2010, 3.5.16]

3.1.44

low demand mode

mode of operation in which the frequency of demands on the safety-related part of a control system (SRP/CS) to perform its safety function (3.1.27) is not greater than once per year

Note 1 to entry: Low demand mode is not addressed in this document. See Clause 1 for further details.

[SOURCE:IEC 61508‑4:2010, 3.5.16, modified — Note 1 to entry has been amended.]

3.1.45

subsystem

entity which results from a first-level decomposition of a safety-related part of a control system (SRP/CS) and whose dangerous failure (3.1.12) results in a dangerous failure of a safety function (3.1.27)

Note 1 to entry: The subsystem specification includes its role in the safety function and its interface with the other subsystems of the SRP/CS.

Note 2 to entry: One subsystem can be part of one or several SRP/CS, e.g. the same combination of contactors can be used to de-energise a motor in case of detection of a person in a danger zone and also in case of opening a safe guard.

3.1.46

subsystem element

part of a subsystem (3.1.45) comprising a single component or any group of components

Note 1 to entry: A subsystem element can comprise hardware or a combination of hardware and software. For the purposes of this document, software-only components are not considered subsystem elements.

Note 2 to entry: For the safety-related values of components or parts of control systems, see Annex O.

3.1.47

channel

element or group of elements that independently implement a safety function (3.1.27) or a part of it

Note 1 to entry: Channel can be a functional channel or a testing channel.

[SOURCE:IEC 61508‑4:2010, 3.3.6, modified — “or a part of it” has been added to the definition and Note 1 to entry has been added.]

3.1.48

operating mode

mode of operation in a machine (e.g. automatic, manual, maintenance) to select predefined machine functions and safety measures related to those functions

Note 1 to entry: For each specific operating mode, the relevant safety functions (3.1.27) and/or risk reduction measures (3.1.22) are implemented.

Note 2 to entry: Operating mode is not a machine function itself. The functions (including safety functions) summarized under an operating mode can only be used when that particular operating mode has been activated.

3.1.49

well-tried safety principle

principle that has proved effective in the design or integration of safety-related control systems in the past, to avoid or control critical faults (3.1.8) or failures (3.1.10) which can influence the performance of a safety function (3.1.27)

Note 1 to entry: Newly developed safety principles can only be considered as equivalent to well-tried if they are verified using methods which demonstrate their suitability and reliability for safety-related applications.

Note 2 to entry: Well-tried safety principles are effective not only against random hardware failures, but also against systematic failures (3.1.14) which can creep into the product at some point in the course of the product life cycle, e.g. faults arising during product design, integration, modification or deterioration.

Note 3 to entry: ISO 13849-2:2012, Tables A.2, B.2, C.2 and D.2 address well-tried safety principles for different technologies.

3.1.50

well-tried component

component successfully used in safety-related applications

Note 1 to entry: See 6.1.11 for requirements and ISO 13849-2:2012 for a list of recognized well-tried components.

3.1.51

dynamic test

executing either software or operating hardware, or both, in a controlled and systematic way, so as to demonstrate the presence of the required behaviour and the absence of unwanted behaviour

Note 1 to entry: The test fails if monitoring (3.1.29) did not detect the change as expected.

Note 2 to entry: The use of test pulses is a common technology of dynamic testing and is widely used to detect short circuits or interruptions in signal paths or malfunctions.

3.1.52

plausibility check

diagnostic measure which is monitoring (3.1.29) that the state of an input (output) fits to the state of the system or other inputs (outputs)

3.1.53

verification

confirmation, through the provision of objective evidence, that specified requirements have been fulfilled

Note 1 to entry: The objective evidence needed for a verification can be the result of an inspection or of other forms of determination such as performing alternative calculations or reviewing documents.

Note 2 to entry: The activities carried out for verification are sometimes called a qualification process.

Note 3 to entry: The word “verified” is used to designate the corresponding status.

[SOURCE:ISO 9000:2015, 3.8.12]

3.1.54

validation

confirmation by examination and provision of objective evidence that the particular requirements for a specific intended use are fulfilled

Note 1 to entry: The objective evidence needed for a validation is the result of a test or other form of determination such as performing alternative calculations or reviewing documents.

Note 2 to entry: The word “validated” is used to designate the corresponding status.

Note 3 to entry: The use conditions for validation can be real or simulated.

[SOURCE:IEC 61508-4:2010, 3.8.2]

3.1.55

skilled person

person with relevant training, education, and experience to enable him or her to perceive risks (3.1.19) and to avoid hazards (3.1.17) associated with the relevant equipment

Note 1 to entry: Several years of practice in the relevant technical field can be taken into consideration in assessment of professional training.

[SOURCE:ISO 14990‑1:2016, 3.5.4, modified — “electricity” has been replaced by “the relevant equipment” in the definition and Note 1 to entry has been added.]

3.1.56

black box

device, system or object which can be viewed in terms of its inputs and outputs only

3.1.57

grey box

device, system or object where some of the internal functions are known

Note 1 to entry: The third way for functional testing is “white box” ここで, all internal functions are known.

3.1.58

average frequency of a dangerous failure per hour

PFH

average frequency of a dangerous failure of a safety-related part of a control system (SRP/CS) (3.1.1) to perform the specified safety function over a given period of time

[SOURCE:IEC 61508-4:2010, 3.6.19, modified — “an E/E/PE” has been deleted.]