Enhancing System Lifecycle Processes by Integrating Functional Safety Information from Practice into Design Requirements

Abstract

To be able to find answers for challenging research questions about the universe, advanced machinery in major research institutions - e.g. accelerator complexes - is needed. In such expensive research facilities, which generate ionizing radiation, it is necessary to protect people, infrastructure and the environment from harm. To meet functional safety requirements, machinery shall fulfil high safety standards throughout its life. This paper aims to propose a methodology for preserving the functional safety of the equipment already in operation and the maintenance phase of the lifecycle. A methodology is proposed to enable better integration of information from practice into design requirements for modifications, such as upgrades and retrofits. The method is based on existing functional safety standards. The goal is to increase the operational time while preserving performance at the intended level.

Keywords

Functional Safety Dependability Lifecycle Key Performance Indicators Scientific Facilities

1. Introduction

Machinery in research institutions, such as CERN, European Organization for Nuclear Research (Switzerland), consists of expensive and complex instruments. Hence, it is of interest to use the facility as much as possible.

In addition to complexity and cost, the scientific infrastructure of CERN has another dominant characteristic: some parts of the facility are subject to ionizing radiation. Therefore, it is of interest to protect both humans and the environment from the harm stemming from the hazardous environment.

One view of protecting people and the environment from radiation is to ensure the system's dependability during the lifespan of the system. System dependability relates to its performance, since engineering integrity includes design criteria for systems and equipment in terms of reliability, availability, maintainability and safety (RAMS) [1].

The scientific facility also includes many subsystems, such as the remotely operated vehicle CH 474, which is used as an example in this paper. For operating the systems in a safe manner, it is necessary to ensure their functional safety. To meet the functional safety requirements, the system shall fulfil high safety standards throughout its life.

The Machinery Directive 2006/42/EC [2] in the European Union and the various Machinery Safety Standards, such as ISO 13849 [3], IEC 61508 [4] and IEC 62061 [5] at three levels in support of the Machinery Directive in the European Union, provide the regulatory basis for the safety requirements. The research in this work is based on the safety lifecycles and functional safety presented in IEC 61508, parts 1 and 4 [4], [6]. The safety lifecycle gives a guideline for functional safety with specified activities, such as hazard and risk analysis, and the specification of safety requirements, required throughout the entire lifecycle [4].

This paper presents a concept of a methodology, developed during a longitudinal study, of how to meet the functional safety requirements throughout the lifespan of the machinery. The concept proposed in this paper is based on existing standards - such as those mentioned - and enables better information integration from practice into the design requirements for the modification projects of the system.

The approach of this paper towards functional safety and RAMS is generic, as well as the method presented in this paper. However, the paper uses the remotely operated vehicle CH 474 from CERN as a practical case example. The operational environment of the vehicle is challenging, and therefore lifecycle management is important.

The paper is organized in the following way. At the beginning, in chapter 2, an introduction to the case example is presented. The paper continues in chapter 3 with an introduction to functional safety and its relation to system dependability. Chapter 4 introduces functional safety standards and solutions. The lifecycle framework for functional safety is discussed in chapter 5. Chapter 6 introduces information management points for functional safety and chapter 7 provides an overview of the performance indicators. Proposed methodology for integrating functional safety information from practice into design is presented in chapter 8 and, finally, chapter 9 concludes and summarizes the study.

2. Case Example

For this paper, we use the remotely operated vehicle CH 474 as an example. This chapter discusses the main characteristics and requirements of the operational environment and the vehicle itself.

Historically, a fundamental reason to use robotics is to remove human operators from work environments that are potentially hazardous [7]. The collaboration of robotics and human operators is emphasized in remotely operated devices - such as in telerobotics - where the objective, according to Ferre et al., is to reproduce operator actions at a distance by connecting humans and robots. Ferre et al. indicate that telerobotics is also used in applications that are characterized by the risk reduction of human operators to an acceptable or non-existent level. [8].

Robot technologies, for instance, provide incentives in nuclear applications, where radiation levels do not permit human interventions in some areas or the operations are restricted to short durations [9].

At CERN, remote devices are used for radiation surveys and remote inspections in particle accelerator environments, such as the Large Hadron Collider (LHC) and the Antiproton Decelerator (AD) Target Area [10 –12].

Rising levels of radioactivity inside the CERN Proton Synchrotron (PS) led to a remote handling development project in the late 1960s [13]. The project began the development of teleoperation in CERN, which is described in more detail in Horne [13]. For example, in the late 1980s a custom-built vehicle, CH 474, was made for the CERN PS complex, which was later used at the AD area to work in the radiation area when needed.

Baird et al. introduce how studies and measures have been made for the CERN AD area to evaluate aspects of radiation safety. The results presented in Baird et al. reveal a recommendation, that in order to limit the amount of shielding, access to the area during operation with protons is not allowed. [14].

Figure 1.

The Antiproton Decelerator (AD) Vehicle CH 474. Photo courtesy of CERN.

The vehicle was designed to ensure all the handling operations, such as handling of the magnets or exchanging targets at the AD target area. The vehicle is remotely operated using video cameras. Human play a large role operating the device and supervising the tasks performed.

The vehicle consists of a mobile platform, a hydraulic arm and a telescopic boom equipped with a camera. It can also be equipped with different accessories in order to handle different loads. Together, they form a complex and unique system. This vehicle (CH 474) can be seen in Figure 1.

The vehicle operates in a challenging environment where human access is either restricted or prevented. In such an environment, the need for the functional reliability of a service vehicle is extremely high. For example, if a failure would cause the vehicle to stop in its position in the radiation area, it would mean that the facility would be out of operation for many weeks. On the other hand, the vehicle would need repairing in an area that is hazardous for humans.

The length of the life varies from system to system. For example, the facility in which CH 474 operates will, according to current estimates, be in operation for the next 25 to 30 years. Hence, the vehicle will need to be available for the same length of time. The reason for this is that the vehicle will be used in the case of a breakdown of equipment as well as for upgrading and for the dismantling of the target area.

The vehicle has been in operation since the late 1980s, when it was originally designed and built. The latest development of the vehicle is a refurbishment project to upgrade the hydraulic and electrical systems used in it. This upgrade was launched after a failure during a series of tests during the Christmas break of 2012. Due to that, there was a need to change some parts of the vehicle. The refurbishment project has also revealed a lack of documentation regarding CH 474.

3. Functional Safety – System Dependability

Functional safety relating to the EUC (equipment under control) i.e. “equipment, machinery, apparatus or plant used for manufacturing, process, transportation, medical or other activities” (quote from [6]) and its control system is a part of overall safety, which is dependent upon the correct functioning of systems. Such correct functioning, on the other hand, is related to safety as well as other risk reduction measurements. [6]. Consequently, two important terms of functional safety are:

safety and

risk,

where safety can be defined as “freedom from unacceptable risk” and risk as the “combination of the probability of occurrence of harm and the severity of that harm” [6], [15]. Risk covers two parameters: the probability of the harmful event and its consequences (severity) [16].

In other words, functional safety depends upon the correct functioning of the system. The ability to perform the required functions without failing is called ‘reliability’ [15]. In addition to safety, the reliability of the system is also important. Especially in the field of robotics, safety and reliability are crucial, as has been anticipated in an extensive literature study of robot system reliability and safety in Dhillon et al. [7], such that in future robots might serve humans as household items.

However, for the system dependability, reliability and safety are not the only important measures. System availability and maintainability also contribute to the correct functioning, as it takes into account these criteria in restoring a failed system to its correct functioning. Altogether, these engineering integrity criteria form an acronym ‘RAMS’. The different aspects of RAMS are discussed shortly in the following chapters.

3.1 Reliability

Reliability indicates the probability of successful system performance with a minimum risk of system failure [1]. The reasons for failure might be, for instance, the subject of poor processes, human errors, abuse, poor maintenance or wear caused by aging [17]. In the nineteenth and early twentieth century, over-designed products generally achieved high reliability levels [16].

A good example of reliability in the field of robotics is from the early nuclear robotic applications, where the applications had to be designed to remain in highly radioactive environments for many months, such as in nuclear fuel reprocessing [18]. However, robot reliability is a complex issue because there are many interlocking variables from the robot itself and from the operational environment [19], [20].

A typical reliability of a robot, according to Dhillon and Fashandi [19], is 98% or more. Methods and techniques in performing reliability analyses of a robot system are listed in Dhillon and Fashandi [19]. For example, the concepts of Mean Time Between Failure (MTBF) and Downtime need to be considered [20]. According to Dhillon and Fashandi [19], the recorded robot Mean Time to Failure (MTTF) is only 500 to 2,500 hours.

The operational environment of the case vehicle used in this paper is challenging and needs to be taken into account. Lauridsen [21] has presented data about hostile environments and reliability. These environments bring their own characteristics to the reliability requirements, since the recovery of a failure may be dangerous or difficult, if even possible. Recovering from a failure and repairing or maintaining a robot in these environments is difficult and potentially dangerous to humans; therefore, knowledge about the functional lifetime of a robot and a high reliability are vital, according to Lauridsen. With the failure strategies, special care should be taken to ensure that the machine is recoverable and that the operators will not be exposed to dangers. [21].

In environments subject to radiation, the component of reliability might be affected. The probability of failure, according to Lauridsen, will increase when materials degrade due to the radiation. Lauridsen suggests that radiation degradation factors should be used in the design for assessing the radiation damage to materials - for example, optical fibres will darken and lubricants will become stiff. [21].

3.2 Availability

Availability is simply the capability of being used over a period of time [1]. It can be computed such as in Smith [16]:

A v a i l a b i l i t y = \frac{U p t i m e}{T o t a l t i m e}

where uptime is the proportion of the potential running time of a robot [19] or, in general, any machine. As early as 1974, the industrial experience of robots showed that the uptime must exceed 97% to satisfy the needs of most users [20].

Availability, according to Stapelberg, is the aspect of system reliability that takes into consideration the maintainability of the equipment. In a design for availability, the consequences of the unsuccessful performance of system and the requirements for restoring performance to expectations are vital. [1].

3.3 Maintainability

Maintainability is the probability of restoring a failed item to operation in accordance with procedures over a given period of time [16]. As mentioned before, availability is all about the uptime of the system, whereas maintainability is about the downtime aspect of maintenance [1]. A design for maintainability takes into account the reparability and accessibility of the system failure [1].

Restoring failed items or systems requires maintenance actions. The maintenance strategy is relevant to RAMS, since it affects both reliability and availability [16].

3.4 Safety

Robots - such as any traditional machines - are sources of hazards to people who work with them. Hazards can, according to Dhillon and Fashandi, be divided into three categories: those due to human error; those caused by robots; and those resulting from human-robot interaction in the environment. The hazards due to the robot include, for instance, joint failures, material fatigue and erosion, etc. The identification and evaluation of system hazards are required before losses occur. [19].

The safety performance of the product is related to its safety requirements, mainly given by laws, regulations and standards, or else stated by the customer [22]. For instance, Directive 2001/95/EC [23] establishes general safety requirements for a product placed on the European market to protect the health and safety of consumers. The requirements need to take into account all types of intended use but also foreseeable misuse [22]. Some methods and techniques for identifying hazards in robotics are listed in Dhillon and Fashandi [19].

4. Functional Safety – Standards and Solutions

Functional safety standards have - according to practical experience presented in Gall [24] - gained widespread acceptance. The IEC 61508 Standard uses the overall safety lifecycle model for ensuring functional safety [4] and it therefore offers a good basis for this research. The lifecycle framework is discussed in more detail in chapter 5.

The IEC 61508 standard represents an overall safety lifecycle featuring safety management-related activities, ranging from concept and hazard/risk analysis to overall modification/retrofit and, finally, to decommissioning, dismantling and disposal [4]. Common technology risk facets - according to Crow [25] – include, for example, performance.

The IEC 61508 Standard concentrates on systems comprising electrical and/or electronic and/or programmable electronic (E/E/PE) elements that are used for performing safety functions [4]. However, functional safety is concerned with the overall safety of the system that is detailed to functionality of Safety Instrumented Systems (SIS). With the use of E/E/PE technology, hazardous events are detected and responded to in SIS, as presented in Lundteigen et al., and as such the risk to humans, the environment and material assets is reduced. The use of the SIS is intended to reduce the risk to human lives, the environment and material assets. A good example of an application of SIS is an anti-lock breaking system or an airbag in a car. [22].

The strength of the IEC 61508 Standard [4] is, according to Faller, in its rigorous requirement-driven approach to functional safety in application development, which helps in meeting users' expectations more accurately [26]. Meeting users' expectations in a safe manner, without failure, is important for the success of a product. The difference between a hazard and failure is that the failure is the actual event itself (hazardous or otherwise), whereas a hazard is a situation with the potential for injury or fatality [16].

Some tools and methods in the functional safety domain have been developed for systems that are already in operation. For example, solutions that have been developed by component suppliers. This trend is understandable, since engineering contractors and systems suppliers worldwide are often required, in their responses to bids, to comply with the IEC 61508 Standard [26]. Suppliers and assessors provide solutions and partnership for assisting machinery manufacturers to meet regulatory safety requirements [27 –31].

The solution provided by Rexroth [27], [28], based on the EN ISO 13849 Standard [3], provides a step-by-step methodology for designers to specify the performance level. Similarly, ABB [29] provides assistance based on the IEC 61508 [4] and IEC 61511 [32] standards, from designing to engineering the safety of the instrumented system. The solution offered by ABB [29] provides a method for monitoring the safety performance of the system. The monitoring is based on the data collected regarding the components' condition [29].

To enhance the implementation of functional safety standards, assessors such as TÜV Nord [30] and exida [31] provide methods and tools for companies. These methods and tools include analyses, assessments, training and certification [30], [31]. These developments are good for support and assistance since, according to Faller [26], the IEC 61508 Standard is rather difficult to understand and tailor for smaller projects.

5. Functional Safety – Lifecycle Framework

Lifecycle thinking is not a novelty. According to Cao and Folan [33], academia started writing about lifecycles in the 1950s. The fundamental elements for understanding lifecycle processes are to define what a lifecycle is and what a process is.

We use the lifecycle definition given by Terzi et al. [34], where it is pointed out that the term ‘lifecycle’ is generally used for indicating a set of phases or stages to be passed, followed or performed. For example, consider an easy-to-use lifecycle model, with three phases - beginning-of-life (BOL), middle-of-life (MOL), and endo-of-life (EOL) – introduced, for example, in Kiritsis et al. [35]. We also use this model as a higher level context; however, these lifecycle phases are quite general and do not accurately reflect to the goals of the phase.

For the reasons mentioned BOL, MOL and EOL are not sufficient as a starting point for enhancing measures and we use the term ‘lifecycle process’ to identify a more manageable entity for functional safety activities. Generally, a process is a sequence of interrelated or interacting activities which converts or transforms inputs into outputs [36], [37] or else a set of activities to create value [34]. However, it is highlighted in ISO 10006 [36] that phases and processes are two different aspects: phases divide the lifecycle into manageable sections while processes manage projects and realize the outcomes of the projects. In other words, the processes are those activities that are needed during the lifecycle.

General lifecycle processes consist of requirements, conceptual design, design, realization (e.g., manufacturing), installation, operation/maintenance and, finally, decommissioning and disposal activities. The BOL phase includes activities to design and realize the product; the MOL includes activities relating to using and maintaining the product; and finally, EOL includes various activities of decommissioning (such as possible reuse and refurbishing, etc.) [35].

5.1 BOL

Each lifecycle phase has different requirements of its own. From a safety point of view, for example, the design phase may be addressed by the regulatory requirements (such as directives at the European Union level and laws and regulations at the Member State level) to minimize risks [22].

There are different types of requirements that a system has to comply with. For instance, regulatory requirements may address product safety and how well, for instance, a SIS (see chapter 4) will perform [22]. The customer, however, may add to a safe and reliable product more requirements, such as availability, maintainability and maintenance support [22]. Hence, RAMS parameters are important to take account of in the design as well as in the operation of any system.

Tools and techniques for design engineers to determine the integrity of a design are numerous, such as hazardous operations (HazOp), hazard analysis (HazAn), fault-tree analysis, failure modes and effects analysis (FMEA), as well as failure modes and effects and criticality analysis (FMECA) [1], [16], [17].

The safety lifecycle presented in IEC 61508-1 [4] requires hazard and risk analysis, a safety requirements specification, and safety requirement allocation and safety validation planning. In addition, overall planning for operation and maintenance, as well as installation and commissioning, is required [4].

The general principles for risk assessment and risk reduction are laid out in ISO 12100 [15] for the machines to made safe for their intended use. As has been concluded in Dhillon and Fashandi [19], system design in determining the acceptable level of risk of failure is a concern. Hazards, for instance, may arise from failures or from design features - for example, sharp edges or the choice of materials [22].

Risk assessment is, furthermore, addressed in the regulatory domain. In fact, the European Directive 2006/42/EC on machinery [2] indicates that a manufacturer should ensure that a risk assessment is carried out for products before their release on the market.

5.2 MOL

A well-known concept for indicating the different failure rates is the hazard rate bathtub curve - for example [16], [17], [25]. The hazard rate in this context means the time-dependent failure rate [17]. The overall curve of failures seeks to describe the rate of failures of components during their life [16]. A bathtub curve can be seen in Figure 2.

Figure 2.

Bathtub hazard rate curve. Modified from [16], [17].

The MOL phase is also interesting. As identified in the earlier studies of van Heel et al. [38], for some lifecycle phases the safety point-of-view is not well documented - “It is not by every change possible to go back to the appropriate phase after modification or retrofit” [38]. As a matter of fact, there has been a lack of documentation regarding vehicle CH 474, as mentioned previously, which contributes to strengthening the statements of van Heel et al. [38].

The operation and maintenance phase includes reliability and maintainability management tasks to support the system. These tasks, for example, include collecting, monitoring and analysing relevant data, preparing maintenance documents and developing change proposals [17]. According to Jun et al., in the MOL phase reliability, availability and maintainability provide interesting improvement issues. To meet the requirements for design improvement, generally it is maintenance and failure information, technical customer support information and usage environment information that are of interest. [39].

From the information point of view, Kiritsis et al. [35] note that there is a gap in the flow of information. The feedback of expertise and know-how from, for example, maintenance experts, does not loop back to designers [35]. Jun et al. [39] go even further and advance that for the majority of products, the information flow completely breaks down once the product is delivered to the customer. Indirect methodologies - such as surveys and interviews - are possible, but they do not reveal the real usage status of products [39].

Safety-related activities in the operation and maintenance phase include data collection and analysis, random field testing, decisions regarding “adequate safety”, the updating of hazard analyses, and safety documentation and information to users and distributors regarding unrevealed hazards [40].

It is good to remember that the actual performance information is not only dependent upon the product properties alone since other important lifecycle elements, such as operation and maintenance, are also influential [22].

The IEC 61508 Standard [4] defines the various activities for both during and after the modifications and retrofit phases for ensuring that the functional safety is on an appropriate level. It is to ensure that the actual performance of the system matches the desired performance which gives the motivation for this research. The methodology presented in this paper seeks answers to narrow the gap mentioned.

5.3 EOL

The end-of-life (EOL) consists of different decommissioning activities. IEC 61508 [4] also defines those procedures that are necessary to ensure functional safety during and after the decommission. Prior to actions, an impact analysis shall be carried out with a hazard and risk analysis and, after verification activities, according to a verification plan created during the EOL phase [4].

It is of interest to notice that during the operation and maintenance phase there might be subsystems or parts that are already at the end of their life (disposal and recycling). This was the case for some elements of the vehicle CH 474, which had to be changed during the refurbishment project mentioned earlier.

In addition to operation and maintenance information, it is of interest to take into account the disposal of the subsystems and parts and their recycling information. In Jun et al. [39], this information is defined as the recycling/reusing part or the component information from EOL to MOL and EOL product status information, dismantling information and environmental effects information from EOL to BOL.

6. Functional Safety – Information Management

No equipment can enjoy a zero rate of failure; as a natural consequence, long before formal procedures for data collection, failures have been a central feature for development, as presented in Smith. Collecting information from practice has great value, since it contains failures and repair actions under real conditions. [16].

Important issues, according to Rausand and Utne, include analysing data and achieving organizational learning. With organizational learning, Rausand and Utne aim at product development and giving feedback for it. [40].

For the reasons mentioned, we shortly describe both the collection of the data and the data analysis itself in the form of reporting.

6.1 Collecting data

As described in Smith [16], collecting data for so-called field recording is labour-intensive. Nevertheless, it is important for monitoring the condition of a system and measuring its performance. The following chapters present shortly some ways to collect data from the operation and maintenance phases of the lifecycle.

6.1.1 Sensors

As shown in McGhee, there is a substantial amount of literature dealing with sensor technologies (sensors, sensing and sensor systems). The underlying information handling of the sensor is either information carrying or information capturing, as shown in McGhee. [41].

Sensors in the sense of functional safety are important, since safety functions (SIS applications) are, in many cases, triggered by sensors. For instance, an airbag in a car is deployed when forward collision warning sensors sense that a crash is imminent [42]. In addition, fault diagnostics and the reliability engineering of the maintenance and logistics functions of systems engineering belong to the constituent disciplines of sensor sciences [41].

6.1.2 Human sensing

In maintenance work, there is no denying the importance of human sensory capabilities. A human has five major senses - sight, taste, smell, touch and hearing – which, according to Dhillon, need to be understood for maintainability work. With these senses, a maintenance worker can sense, for example pressure, vibration, temperature, linear motion and acceleration (shock). [17].

The sensory perception process of humans is complex, whereby experiences, memories and behavioural patterns can provoke powerful responses [43]. It is also noticeable that the subjective information embodied in human perception results from intuitions, opinions and feelings [44]. Hence, these are issues that need to take into account by, for example, training.

Regardless of the limitation of human senses, human perception and cognition is fundamental in measurement, in particular defining the measure and the associated scale [45].

6.1.3 Combination of sensors and human sensing

The main results published to date have mostly focused on collecting the data automatically with sensors, such as [27 –29]. However, the collection of data by human actors is equally important. To the best of our knowledge, there is a lack of research simultaneously addressing both performance data collection methods.

Combining the possibilities of human sensing and sensors together opens up new possibilities. Extending human capabilities for sensing and perception with technical instruments, such as sensors, enables humans to acquire objective information [44].

In the remote devices, which are implemented with teleoperation, human sensing is extended with manipulation capability from a remote location [18]. Telerobotics is a form of teleoperation, where a human operator plays a significant supervising role [18], [46]. This includes communicating to a computer, for instance, the goals, constraints and orders about a task, but also receiving information, such as raw sensory data [18].

Reasons for teleoperation are considered in Sheridan [18], from which the most important from the point of view of this research is that many tasks that are necessary to perform are unpredictable or else one of a kind.

Unpredictable tasks are not doable by special-purpose or pre-programmable machines, while one of a kind tasks done by dedicated automatic devices are too costly to perform [18].

Vehicle CH 474 is an example of a remotely operated system, where the human has a significant role in operating the device and supervising the actions done by the machine.

6.2 Maintenance reporting

Collecting data does not add value; however, after data has been collected it should be analysed and put to use [16] - for example, by the maintenance personnel, who combine the collected information and make their own interpretations, finally recording the process with a maintenance report.

In the case of incidents, according to Smith, recording relies upon people and, therefore, it is subject to errors, omissions and misinterpretation. To avoid these errors as much as possible, Smith highlights the importance of formal documents. [16].

7. Performance Indicators

Successful products have to possess sufficient quality features related to RAMS performance while our activities are more and more dependent upon the system abilities in delivering the expected services [22]. Performance management, including operational availability analysis, maintainability analysis and maintenance support analysis, is also discussed in terms of functional safety management features in Lundteigen et al. [22].

The RAMS performance information can be collected and reported, as discussed above. However, it is useful to distinguish the desired, predicted and actual RAMS performance [22]. It is important to constantly review the actual RAMS performance against the original performance data (the desired or predicted performance) or else against the RAMS targets, as mentioned in the RAMS-cycle model in Smith [16] and, as a result, measure the gap in between. This is because with a successful product the gap between desired and actual is very narrow [22].

The information that is collected should also be validated against key performance indicators (KPIs) - a set of rules which helps to measure performance. A KPI contains a target value or value range and a computational definition [47]. KPIs are also used, for example, in Wetzstein and Leymann [47] for controlling business goals in evaluating the efficiency and effectiveness of business processes.

A KPI is determined in Ahmad and Dhafr [48] as a number or a value that can be used as a base for comparing internal or external targets. The target data can be collected or calculated from processes or activities [48].

There are several parameters or KPIs available for the reliability and maintainability characteristics of an item [16]. In the case of this study, KPIs are set out in the Machinery Directive 2006/42/EC [2] and applicable A, B and C level standards, and are appropriate for the case.

The following KPIs, for example, can be found in EN ISO 13849-1 [3]:

Mean Number of Cycles Until 10% of the Components Fail Dangerously (B_10d)

Mean Time Until 10% of the Components Fail Dangerously (T_10d) (see Table 1)

Mean Time to Dangerous Failure (MTTF_d) (see Table 1)

Mean Time to Failure (MTTF)

Performance Level (PL) (see Table 1)

Common Cause Failure (CCF)

IEC 62061 [5] provides, for example, the following indicators:

Severity (Se)

Frequency and Duration of Exposure (Fr)

Probability of Avoiding or Limiting Harm (Av)

Probability of Occurrence of Hazardous Event (Pr)

Class of probability of harm (Cl)

Probability of Dangerous Failure per Hour (PFH_D)

Safe Failure Fraction (SFF)

Safety Integrity Level (SIL)

The KPIs taken into consideration in this study can be derived and computed based on the runtime information (as is the case in Wetzstein and Leymann [47]) or they can be extracted from maintenance reports. For computing the runtime information, measurement of the time between the activities is needed - for example, in MTTF the time from correcting the failure to the occurrence of a new failure.

Table 1.

Some examples of calculating KPIs. The formulae are adapted from ISO 13849-1 [3].

KPI	Computation	Remarks
Mean Time to Dangerous Failure (MTTF_d)	${M T T F}_{d} = \frac{B_{10 d}}{0,1 \times n o p}$	Where B_10d = The mean number of cycles until 10 % of the components fail dangerously nop = The mean number of annual operations
Mean Time Until 10 % of the Components Fail Dangerously (T_10d)	$T_{10 d} = \frac{B_{10 d}}{n o p}$
Performance levels (PL)	Average probability of dangerous failure per hour 1/h, For example level a ≥ 10⁻⁵ to < 10⁻⁴	Levels a-e determined in ISO 13849-1 [3].

In Table 1, some examples of a computed KPI are presented. Some typical values for the MTTF_d for different types of components are given in ISO 13849 [3] - for example, for mechanical components the average value is 150 years. To determine the MTTF_d value for components it is necessary to carry out an FMEA (failure mode and effects analysis) [3].

8. The Proposed Methodology for Integrating Functional Safety Information from Practice into Design Requirements

The goal of the methodology created in this study is to meet the functional safety requirements throughout the lifespan of a system, such as remotely operated vehicle. This work aims especially on integrating the relevant information together with original performance information and using this new knowledge as requirements for a modification - such as refurbishments - of the system.

The objective of this method has been to keep it as generic as possible, so that it could be applicable to different systems that need to comply with the Machinery Directive 2006/42/EC [2]; hence, the proposed methodology is based on existing standards.

8.1 Motivation

The research is inspired by the safety lifecycle presented in IEC 61508. The safety lifecycle requires that, during the modification and retrofit, the lifecycle is begun from an appropriate overall phase. [4].

Ensuring that the designed performance of the system is achieved is, in practice, the most significant motivator for this research.

The focus of the methodology is to compare information collected from practice with original design requirements and performance information used during the design phase. Such a process is presented in Figure 3, which originated from IEC 61508 [4] and was modified to fit our purpose.

Figure 3 presents a flowchart to control and propose changes derived from systems' performances and failures. Systematic performance problems and failures trigger the change request directly. Correcting failures or systematically occurring performance issues has been and is important source for learning. In addition, the figure also takes into account random performance issues and failures, which are not easy to detect.

Figure 3.

Performance problem and failure information management model. Modified from IEC 61508-1 [4].

The starting point of this methodology's development is to ensure that the flow presented in Figure 3 is realized. We assume that the performance and failure data about actual performance will be collected from multiple sources, such as sensors and human sensing. However, to preserve the human ability, it is also important to analyse data from the reports.

8.2 The Steps

The principles of the proposed methods for lifecycle processes enhancement rely upon four steps, as presented in the earlier work of the authors [49]. The focus of this methodology is to collect information about the actual performance data and compare it with original data used in the design phase. In this way, the actual performance is evaluated and finally validated against the KPIs. Discrepancies are generated to change requests, which represent requirements for modifications, such as retrofits, upgrades or new systems.

Inspired by Jun et al. [39], we would like to present a use case diagram for the information flows in the method, with information collection, information comparison, ECR and workflow (the steps of the method). The use case is presented in Figure 4.

A use case diagram, in our view, is a good representation of the interfaces of the different steps, also presenting the method with a single view. Figure 4 collects the different actors or stakeholders together with their participation or responsibilities for the method to work properly.

The method also takes into account the regulatory environment and possible changes in it. This is also present in Figure 4. Changes in the regulatory domain may also propagate changes in the system level. This is a scenario that it is important to remember and to have the means to react to.

Another scenario that Figure 4 raises is the audit process - sometimes referred to as the assessment process. The audit process is a common means to evaluate and improve processes. It is also good from time to time to audit the performance and failure records that have not led to an ECR so as to find latent performance problems (see Figure 3).

Figure 4.

Use case of the methodology's application.

The method assumes that the safety lifecycle activities, such as hazard and risk analyses (chapter 5), have been carried out and the results are constructed to form the KPIs – required ‘original performance data’ – presented in chapter 7. These will be used in the comparison (step 2). The KPIs will be selected to represent the needs of the components and structures used in the vehicle. For example, the hazard analysis might bring an indicator of Probability of Occurrence of Hazardous Event (Pr) (see chapter 7). KPIs such as Pr and Mean Time to Failure (MTTF) also need a specific target value. For example, the Pr will be estimated and a value from 1–5 (negligible to very high) will be selected to present the probability. Standard IEC 62061 [5] instructs how to estimate this value.

8.2.1 Step 1

In step 1, the information is collected and formulated in the form of KPIs. Some KPIs need to be computed, for example, based on time stamps such as Mean Time to Dangerous Failure (MTTF_d).

This phase is critical because it is the enabler of the whole improvement process. The data can be collected and analysed by a human or, alternatively, more sophisticated data mining tools can be created and applied.

In addition, incident/accident experiences should be analysed if they trigger modification requests (most likely). Audit/assessment reports and possible legislation/regulation change requirements should be added as a source for information. The collected information indicates the performance of the system with the KPIs, which have a measurable value.

8.2.2 Step 2

In step 2, the information collected in step 1 is compared with the original design requirements and performance information used in the design. The following symptoms, which are extracted from IEC 61508-1 clause 7.16.2.2 [4], are sought:

Functional safety below specified;

Systematic fault experiences;

New or amended safety legislation;

Modification to the system or its use;

Modification to the overall safety requirement;

Analysis of the operations and maintenance performance indicating that the performance is below target;

Routine functional safety audits.

This comparison task can be performed by a human or else there is the possibility of creating and applying more sophisticated tools, such as those used for database comparison.

8.2.3 Step 3

In the case of deviations from the allowed values of the KPIs, in step 3, a modification request (also known as an ‘Engineering Change Request’ – ECR) based on the information acquired in step 2 should be created.

The requirements extracted from IEC 61508-1 clause 7.16.2.2 [4] for the generated change request include the determined hazards that may be affected, the proposed change (both hardware and software), and the reason for the change [4]. In addition, changes that have been made against original requirements/current legislation should be brought up.

8.2.4 Step 4

Once a change request (ECR) is generated, a predetermined workflow for managing the ECR should be started in step 4. Workflow systems offer the better management of the change process [50]. The workflow ensures that the ECR is properly analysed and that causes for deviations from the KPIs are sought.

PDM (Product Data Management) and PLM (Product Lifecycle Management) systems have functionalities for handling workflows which can be of help for this step. The systems automate processes and use a predefined sequence of activities or tasks to control the progress of ECR processing. For this method, it is not compulsory to use a PDM or PLM system; however, in this case it is necessary to carefully follow the predefined process flow in processing the ECR.

Finally, the ECR generated should be taken into account in modification projects, such as retrofits and upgrades. Eventually, actions are taken to correct the situation, if needed.

8.3 Method with the Case Example

This paper has introduced the remotely operated vehicle CH 474 from CERN and used it as a case study (see chapter 2). As mentioned previously, CH 474 has been subject to a refurbishment project, which from a lifecycle point of view starts the safety lifecycle again. Since the authors do not know either the exact structure of the vehicle nor the exact actions performed or planned, we keep this example simple and general. We assume that the safety lifecycle is followed during the refurbishment project and that any needed safety information is created (see chapter 5). We also assume that engineering change management procedures are in place with predefined ECRs and workflows.

During the refurbishment project, the hazard and risk analysis need to be brought up to date along with the safety requirements and their allocations. During the design phase, as well as the operation and maintenance phases, installation, commissioning and safety validation should be planned (as mentioned in chapter 5). In addition, it might be a good idea during the design phase to add some extra sensors to the structure for future data collection.

The design phase of the refurbishment should produce the needed information - ‘the original data’ - for step 1. In addition, the KPI target values need to be specified.

For improving the design and learning from the experience, the key phase will begin after the commissioning of the vehicle and the ramp up for operation. During the period of operation and the maintenance actions, it is important to keep records of the activities done as well as any failures and operational observations. In case some extra sensors have been applied, the sensory data should be handled and managed. The records should be processed and the data should be constructed in line with the KPIs. Thus, for example, the MTTF value should be computed from the time stamps of the related maintenance records.

The next phase of the methodology is step 2, comparing the performance data with the original data. If the results in the comparison differ from the original KPI rules, a predefined ECR should be created and processed with a predefined workflow (steps 3 and 4).

9. Summary and Conclusions

This paper introduces a concept of a methodology suitable for preserving functional safety in systems or machinery already in use, by integrating functional safety information acquired from practice into the design change requirements for the modification or retrofitting of an operational system or machinery. Hence, the integrity and thereby the dependability of the equipment is ensured.

Footnotes

29. Acknowledgments

The research was done in within a framework of the Initial Training Network work programme PURESAFE - “Preventing human intervention for increased safety infrastructures emitting ionizing radiation” - funded under the European Commission's seventh Framework Programme Marie Curie Actions, which the authors acknowledge with sincere thanks. The authors would like to acknowledge the PURESAFE consortium members and especially the Coordinator, Prof. Jouni Mattila, from Tampere University of Technology, Finland. We would also like to present our thanks to Jean-Louis Grenard and Keith Kershaw from CERN, Switzerland, for the case example used in this paper.

References

Stapelberg

R. F.

, Handbook of Reliability, Availability, Maintainability and Safety in Engineering Design. London: Springer-Verlag, 2009.

European Commission, DIRECTIVE 2006/42/EC OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 17 May 2006 on machinery. 2006.

EN ISO 13849–1, Safety of machinery – Safety-related parts of control systems – Part 1: General principles for design (ISO 13849–1:2006). 2008.

IEC 61508–1, Functional safety of electrical/electronic/programmable electronic safety-related systems – Part 1: General requirements (IEC 61508–1:2010). 2010.

IEC 62061, Safety of machinery – Functional safety of safety-related electrical, electronic and programmable electronic control systems (IEC 62061:2005). 2004.

IEC 61508–4, Functional safety of electrical/electronic/programmable electronic safety-related systems – Part 4: Definitions and abbreviations (IEC 61508–4:2010). 2010.

Dhillon

B. S.

Fashandi

A. R. M.

Liu

K. L.

, “Robot systems reliability and safety: A review,” Journal of Quality in Maintenance Engineering, vol. 8, no. 3, pp. 170–212, Sep. 2002.

Ferre

Buss

Aracil

Melchiorri

Balaguer

, “Introduction to Advances in Telerobotics,” in Advances in Telerobotics, Ferre

Buss

Aracil

Melchiorri

Balaguer

, Eds. Springer Berlin Heidelberg, 2007, pp. 1–7.

Byrd

J. S.

DeVries

K. R.

, “A Six-Legged Telerobot for Nuclear Applications Development,” The International Journal of Robotics Research, vol. 9, no. 2, pp. 43–52, Apr. 1990.

10.

Kershaw

Bertone

Forkel-Wirth

Rousset

Feniet

Grenard

J. L.

Bestmann

, “Remotely Operated Train for Inspection and Measurement in CERN's LHC Tunnel,” 15-Apr-2009. [Online]. Available: CERN Document Server http://cds.cern.ch/record/1223624/files/we6rfp047.pdf. [Accessed: 10-Jan-2013].

11.

Kershaw

Chapron

Coin

Delsaux

Feniet

Grenard

J.-L.

Valbuena

, “Remote inspection, measurement and handling for LHC,” in IEEE Particle Accelerator Conference, 2007. PAC, 2007, pp. 332–334.

12.

Vincke

Forkel-Wirth

Roesler

Silari

Theis

Vincke

, “Radiation Protection at CERN,” CAS, Bilbao, 01-Jun-2011.

13.

Horne

R. A.

, “Teleoperator evolution at CERN,” International Symposium on Teleoperation and Control, Bristol, UK, 12 – 15 Jul 1988, 1988. [Online]. Available: CERN Document Server http://cds.cern.ch/record/188958.[Accessed: 16-Jan-2013].

14.

Baird

S. A.

Paoluzzi

Simon

D. J.

Möhl

Mulder

Pedersen

Bosser

Giannini

Maury

Brouet

Eriksson

Riunaud

J. P.

Garoby

Gruber

Serre

Hémery

J. Y.

Dekkers

MacCaferri

Boillot

Williams

Buttkus

Tuyn

J. W. N.

Metzmacher

K. D.

Koziol

Berlin

Tranquille

Gröbner

Caspers

Metzger

Chohan

, “Design study of the antiproton decelerator: AD,” Nov-1996. [Online]. Available: CERN Document Server http://cds.cern.ch/record/317704. [Accessed: 10-May-2013].

15.

ISO 12100, Safety of machinery - General principles for design - Risk assessment and risk reduction (ISO 12100:2010). 2010.

16.

Smith

D. J.

, Reliability, maintainability, and risk: Practical methods for engineers, 6th ed. Oxford: Butterworth-Heinemann, 2001.

17.

Dhillon

B. S.

, Maintainability, Maintenance, And Reliability for Engineers. Boca Raton: CRC Taylor & Francis, 2006.

18.

Sheridan

T. B.

, “Telerobotics,” Automatica, vol. 25, no. 4, pp. 487–507, 1989.

19.

Dhillon

B. S.

Fashandi

A. R. M.

, “Safety and reliability assessment techniques in robotics,” Robotica, vol. 15, no. 06, pp. 701–708, 1997.

20.

Engelberger

J. F.

, “Three Million Hours of Robot Field Experience,” Industrial Robot: An International Journal, vol. 1, no. 4, pp. 164–168, Dec. 1974.

21.

Lauridsen

, “Reliability of remote manipulator systems for use in radiation environments,” in IEE Colloquium on Safety and Reliability of Complex Robotic Systems, 1994, pp. 1/1–1/4.

22.

Lundteigen

M. A.

Rausand

Utne

I. B.

, “Integrating RAMS engineering and management with the safety life cycle of IEC 61508,” Reliability Engineering & System Safety, vol. 94, no. 12, pp. 1894–1903, 2009.

23.

European Commission, DIRECTIVE 2001/95/EC OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 3 December 2001 on general product safety. 2001.

24.

Gall

, “Functional safety IEC 61508 / IEC 61511 the impact to certification and the user,” in Proceedings of the 2008 IEEE/ACS International Conference on Computer Systems and Applications, Washington, DC, USA, 2008, pp. 1027–1031.

25.

Crow

, Design for Reliability. CRC Press, 2001.

26.

Faller

, “Project experience with IEC 61508 and its consequences,” Safety Science, vol. 42, no. 5, pp. 405–422, 2004.

27.

Rexroth , “Always on the Safe Side with Rexroth: 10 Steps to Performance Level.” [Online]. Available: http://www.kmagazin.de/fileserver/henrich/files/1437.pdf. [Accessed: 31-Oct-2012].

28.

Rexroth , “Always on the Safe Side – Safe Solutions from Rexroth.” [Online]. Available: http://www.boschrexroth.com/country_units/europe/norway/download/RE_08510.pdf. [Accessed: 31-Oct- 2012].

29.

ABB, “ABB - your partner in functional safety.” [Online]. Available: http://library.abb.com/GLOBAL/SCOT/scot267.nsf/VerityDisplay/CC4A1ED875A571BC8525721B005B6BFE/$File/Safety_edit72rgb.pdf. [Accessed: 31-Oct-2012].

30.

“Functional safety - TÜV NORD,” 17-Jan-2013. [Online]. Available: http://www.tuev-nord.de/en/systemscomponents/Functional_safety_10784.htm. [Accessed: 18-Jan-2013].

31.

“Functional Safety, Security, & Reliability | exida.” [Online]. Available: http://www.exida.com/.[Accessed: 18-Jan-2013].

32.

IEC 61511, Functional safety - Safety instrumented systems for the process industry sector (IEC 61511:2003). 2003.

33.

Cao

Folan

, “Product life cycle: The evolution of a paradigm and literature review from 1950–2009,” Production Planning & Control, vol. 23, no. 8, pp. 641–662, 2012.

34.

Terzi

Bouras

Dutta

Garetti

Kiritsis

, “Product lifecycle management – from its history to its new role,” International Journal of Product Lifecycle Management, vol. 4, no. 4, pp. 360–389, 2010.

35.

Kiritsis

Bufardi

Xirouchakis

, “Research issues on product lifecycle management and information tracking using smart embedded systems,” Advanced Engineering Informatics, vol. 17, no. 3–4, pp. 189–202, 2003.

36.

ISO 10006, Quality management systems — Guidelines for quality management in projects (ISO 10006:2003). 2003.

37.

ISO 9000, Quality management systems - Fundamentals and vocabulary (ISO 9000:2005). 2005.

38.

van Heel

K. A. L.

Knegtering

Brombacher

A. C.

, “Safety lifecycle management. A flowchart presentation of the IEC 61508 overall safety lifecycle model,” Quality and Reliability Engineering International, vol. 15, no. 6, pp. 493–500, 1999.

39.

Jun

H.-B.

Shin

J.-H.

Kim

Y.-S.

Kiritsis

Xirouchakis

, “A framework for RFID applications in product lifecycle management,” International Journal of Computer Integrated Manufacturing, vol. 22, no. 7, pp. 595–615, 2009.

40.

Rausand

Utne

I. B.

, “Product safety – Principles and practices in a life cycle perspective,” Safety Science, vol. 47, no. 7, pp. 939–947, 2009.

41.

McGhee

, “Principles of Sensor Science,” in Handbook of Measuring System Design, John Wiley & Sons, Ltd, 2005.

42.

Jones

W. D.

, “Building safer cars,” IEEE Spectrum, vol. 39, no. 1, pp. 82–85, 2002.

43.

Macdonald

A. S.

, “Developing a qualitative sense,” in IEE Colloquium on Aesthetics in Design, 1993, pp. 21–24.

44.

McGhee

, “Substructure of Human–Machine Systems,” in Handbook of Measuring System Design, John Wiley & Sons, Ltd, 2005.

45.

Yang

Q. P.

, “Signals, Information and Knowledge, and Meaning,” in Handbook of Measuring System Design, John Wiley & Sons, Ltd, 2005.

46.

Aracil

Buss

Cobos

Ferre

Hirche

Kuschel

Peer

, “The Human Role in Telerobotics,” in Advances in Telerobotics, Ferre

Buss

Aracil

Melchiorri

Balaguer

, Eds. Springer Berlin Heidelberg, 2007, pp. 11–24.

47.

Wetzstein

Leymann

, “Towards Measuring Key Performance Indicators of Semantic Business Processes,” in Business Information Systems, vol. 7, Abramowicz

Fensel

Aalst

Mylopoulos

Rosemann

Shaw

M. J.

Szyperski

, Eds. Springer Berlin Heidelberg, 2008, pp. 227–238.

48.

Ahmad

M. M.

Dhafr

, “Establishing and improving manufacturing performance measures,” Robotics and Computer-Integrated Manufacturing, vol. 18, no. 3–4, pp. 171–176, 2002.

49.

Lintala

Ovtcharova

, “Functional Safety Management in Large Scientific Facilities with Combining Information from Design and Practice,” 1st International Workshop on Telerobotics and Systems Engineering for Scientific Facilities, Madrid, Spain, 04-Oct-2012.

50.

Alemanni

Alessia

Tornincasa

Vezzetti

, “Key performance indicators for PLM benefits evaluation: The Alcatel Alenia Space case study,” Computers in Industry, vol. 59, no. 8, pp. 833–841, 2008.