PL and SIL merger cancelled. What does it mean for AS 4024.1?

For those who are designing machine safety control systems to achieve international standards you may have been aware of the process in place to merge the two current standards. This would result in a new standard, IEC/ISO 17305, which would merge the methods of Performance Levels (PL as per ISO 13849.1:2015) and Safety Integrity Level (SIL as per IEC 62061).

This process was seen as a positive step for machine safety designers as we would finally have one unified standard that everyone would design their systems to, instead of the confusion of having multiple standards running concurrently. However this merger process has now been cancelled without a guarantee of when or if the process will be restarted.

So what is the relevance of this to Australian Standards?
Our Australian Standard, AS 4024, adopts directly from international standards and as stated in AS 4024.1100 the future direction of the control system section was dependent on the merged standard:
It is envisaged that on completion of the work of Joint Working Group 1 of ISO/TC 199 and IEC/TC 44, combining ISO 13849-1:2006 and IEC 62061, the resulting unified Standard will replace both
Parts 1501 and 1503 in the next revision of the AS 4024.1 series

So what does this mean for the future direction of AS 4024.1? Well that seems to be up in the air at the moment.

Potentially the next revision of AS 4024.1 will see Safety Categories disappear and Performance Levels remain. Another option may be Safety Categories remain as an option for safety control systems that consist of simple devices, such as safety relays, safety contactors, safety valves, etc.

There may be advantages of this second option for the following reasons:

• The Australian industry has much more familiarity and knowledge of Safety Categories compared to PL or SIL
• Safety Categories provide a simple method to design safety control systems
• When applied correctly Safety Categories provide adequate risk reduction
• International systems using PL will still be designed to a Safety Category architecture

What do you think? 
If you have a comment or opinion on what the future direction of safety control systems should be in AS 4024.1 please leave a comment below.

Feedback from the industry is essential so the committee can ensure the standard reflects the industry’s needs.

What Should I Design To: Performance Levels Or Safety Categories?

With last year's revision of AS 4024.1:2014 designers of safety control systems now have two options:

1. Design to Safety Categories (AS 4024.1501), or 
2. Performance Levels (AS 4024.1503)

Why does the series have 2 options? Which option should be used? Wouldn't it be much easier if there was one direction for design guidance?

As explained in AS 4024.1100:2014, the standards are in a transition phase and are mimicking the process followed by international standards. In international standards, Performance Levels replaced Safety Categories in 2012 after a 5 year transition period where the two standards ran in parallel. The Australian standards are now entering a similar transition phase. It was decided that an instant changeover would not be achievable because it would take a period of time for the industry to become familiar with Performance Levels and the two methods would run in parallel during this period.

Which design method should you use? 
Most safety control systems can be designed to Performance Levels or Safety Categories, but here are some reasons why you may want to use certain sections of AS 4024.1503.

• Common Cause Failures (CCF). To learn more about CCFs and for guidance, refer to a previous post titled 'New series provides guidance on Common Cause Failure'. I would recommend using the common cause method in Annex F of AS 4024.1503 for any CAT 2, 3 or 4 system
• Guidance for developing safety software. If you are developing/maintaining software for safety programmable devices then section 4.6 of AS 4024.1503 is the only guidance on software development that you will find in the AS 4024.1:2014 series
• Component reliability. If you are designing a CAT 1 system I would recommend calculating a Mean Time To dangerous Failure (MTTFd) for your safety system using section 4.5.2 of AS 4024.1503. CAT 1 is highly dependent on component reliability and thus ensure your CAT 1 system has a MTTFd of HIGH.
• Architecture flexibility. Safety Categories using AS 4024.1501 can be inflexible on the architecture of the safety system and will generally push the design towards conservative architectures with redundancy. By using Performance Levels you will find greater flexibility with the architecture of the safety system; for example observing Table 7 of AS 4024.1503, it can be seen that a CAT 1, 2 or 3 architecture can be used to achieve the same risk reduction level.

So, be aware that the standards are transitioning away from Safety Categories. During this phase Safety Categories and Performance Levels will run in parallel, this should be seen as providing more choice to safety designers, not confusion. As mentioned above, there are some useful sections in AS 4024.1503 that will improve safety systems' design, even if the systems are designed to the requirements of Safety Categories. By using these sections of AS 4024.1503, you will design improved safety systems, have more flexibility in your system design, and be better placed to cope with future changes of the AS 4024.1 series.