Functional Safety: What Is It and What Do OEMs Need to Know?

Anyone producing heavy-duty or special vehicles in Europe needs a safety strategy for interaction between the subsystems and the electronic components. This is true for on-road or off-road vehicles. Designating a safety level for each safety-relevant application will enable you to ensure functional safety right across your supply chain—and the key to doing this lies in risk analyses that are performed in accordance with the appropriate standards.

Traditional mechanisms are increasingly being replaced by smart electronics, and smart solutions are even replacing mechanical actuators and indicators in heavy-duty and special vehicles. CAN bus systems connect hundreds of bus participants with one another. Data and information are sent across shared cables, reducing the number of wiring harnesses and their associated weight and costs.

At the same time, these data buses expand vehicles’ technical capabilities to the benefit of their users and operators. The downside is that the increasing the complexity of these electronics can cause new types of malfunctions. All it takes to distort the intended information is for a bit to flip from zero to one during digital data transfer, possibly switching the application to an unintended state—with potentially devastating consequences when safety components are affected. This is where functional safety comes in. Highly complex applications can benefit from this. Simple or seemingly non-critical ones, such as window openers or light switches, can as well.

Immediate System Response to Random Errors

Functional safety reduces unacceptable risks caused by random electronic system errors to a level that is acceptable. The risks in question are those that may cause injury to personnel, not damage to property. Functional safety means applying and observing certain standards to ensure that the correct operation of safety functions is monitored. In the event of an error, the system will respond and switch the application to a safe state—for example by stopping it or by alerting the operator.

When it comes to mechanics, it is important to apply appropriate development processes to prevent systematic errors. Increasingly, complex electronics also require the systems to be monitored when in use—and random errors must be detected during this process.

Random errors may be caused by external influences such as radiation, magnetic fields or simply the aging of the electronics systems. In the event of malfunctions like these, the system must respond immediately, for example by switching a vehicle into a safe state. In these situations, systems switch themselves off or warn the driver, for example by causing a monitoring lamp to flash.Emergency components help operators control equipment particularly if an alert message of a failure is received.EAO Corporation

Although functional safety cannot prevent malfunctions, it can significantly reduce the potential damage they may cause. In summary, functional safety means limiting risks to a level that is acceptable. To this end, specific standards define development and production processes, regulate the monitoring of electronics and define what a safe state is. These standards also ensure the necessary protection for manufacturers of safety components, subsystems or entire heavy-duty or special vehicles. The extensive documentation and certification relating to functional safety provides OEMs with proof that they are supplying their customers with “safe” products. These are the methods for error prevention:

For mechanisms and electronics, prevent systematic errors through defined processes in concept phase, during product development and manufacturing.

For electronics, detect random errors through monitoring during use and respond to random errors with safe states during operation.

In Addition to the Machinery Directive, Specific Standards May Apply

Who absolutely must address functional safety? To put it simply: all manufacturers are responsible for ensuring that nobody comes to any harm because of their products. The European Directive on general product safety requires that all products sold on European Union (EU) markets must be safe. This EU Directive will become binding in the corresponding countries when it is transposed into national product safety legislation. Accordingly, product manufacturers must comply with specific standards or uphold the state of the art in their products. This includes the principle of functional safety. The ISO 26262 standard is one of the standards that applies to vehicles containing safety electronics.

This standard was expanded to explicitly include all road vehicles in its second edition in December 2018. Machinery and vehicles should be considered separate applications, and specific technical standards must be considered. Functional safety matters, or rather, the currently applicable standards in this area are often the subject of legal disputes.

Anyone who fails to respect them may be found to have acted in gross negligence and is therefore liable if people are injured. If an OEM neglects functional safety, personnel on the team are putting their company at great risk, not to mention the users of the vehicles and their components.

Addressing the Issue of Functional Safety Is a Corporate Obligation

Special purpose and other vehicles and components of vehicles that do not ensure functional safety pose a big risk to their end users and their environment as well as their manufacturers. Conversely, functional safety in vehicles protects manufacturers from legal ramifications and financial damages. In this respect, it is not just companies that may be prosecuted, but also employees, such as a development manager deemed responsible for a failure. Lawmakers provide for compensation payments or even prison sentences in such cases. Products with insufficient functional safety may result in costly recalls, while reputational damage will inevitably cause long-term financial losses.

Addressing the issue of functional safety is therefore a corporate obligation. For OEMs of safety applications, this means developing a safety culture that also intervenes in management and support processes: functional safety management. At the same time, applying the relevant standards and certifications presents an opportunity that goes beyond product safety and avoiding legal ramifications: the application of the relevant standards increases the quality standards. In actuators and indicators, for example, this affects their switching safety and reliability.

Having a Safety Strategy Allows Manufacturers to Be Responsible

Functional safety with respect to end users is the responsibility of the company that brings a product to the market. The company is therefore dependent on using components that will not cause injury.

The task of such companies is to perform a risk analysis for their overall product as a whole and determine the necessary safety level for it. To this end, the relevant standards define what are known as Safety Integrity Levels (SIL) or Performance Levels (PL) for machine applications (see box on page 2). The safety level must be broken down for each individual component and its respective application. Specific requirements for supplier components can then be derived accordingly. The safety level required for the same component from a supplier for customer A may differ from that for customer B. In each case, the application determines the safety level. For this reason, a safety strategy is required. All manufacturers of heavy duty and special vehicles must determine the following: Which components require which safety level? How do they need to respond to random errors? For some applications it is sufficient to inform the user that a workshop visit is necessary – for other applications, an emergency strategy is implemented in parallel. In other cases, a response must be triggered. This response will then ensure, for example, that a heavy duty or special vehicle can then only be maneuvered at a limited speed. In the case of particularly critical errors, it may even be necessary to stop the vehicle moving altogether.

For Every Application, the Safety Level Must Be Determined

Standards show manufacturers how to achieve the Safety Integrity Levels (SIL) and define risk classification parameters. Risk classification focuses on the questions: How serious are the consequences of the various errors? How often do these errors arise? How successfully can they be managed? The answers to these questions determine the “severity” of the risk classification (see Table 1).

Table 1. Determining the ASIL for a vehicle application

As mentioned above, each application must be considered separately; for example, the braking system will have a high safety level, while a different safety level may be adequate for one of its subsystems, such as the anti-locking system. The risk assessment covers Levels 1 to 4, and the designations may differ slightly depending on the standard being applied. For example, machinery standard EN ISO 13849 defines performance levels, classified from A to E. Meanwhile, the ISO 26262 standard, applicable to vehicles, has Automotive Safety Integrity Levels (ASIL) ranging from A as the lowest safety level to D as the highest (see Table 2). Independent test laboratories or other assessment procedures are prescribed depending on the safety level.Table 2. Risk table

Discipline-Specific Standards Serve As the Basis

Functional safety and the related standards require management systems with defined development processes. The verification and validation model can be used to organize these processes into different phases­—starting with risk analysis. In this respect, functional safety requires further-reaching, more laborious analysis than conventional development processes: fault tree analyses assess the reliability of technical systems and the likelihood that they will fail and form the basis for the safety strategy.

The inspection and documentation of the processes is equally labor intensive: a company must be able to prove that it has implemented all the requirements. This means that all steps must be traceable in detail.

IEC 61508 is the basic functional safety standard, and discipline-specific detailed standards have since been derived from it for different sectors. The ISO 26262 standard focuses on road vehicles (automotive norm) and components that control driving functions. ISO 13849, on the other hand, applies to machine functions such as tippers, compactors and turntable ladders, which are mounted on vehicles.