Fault Tolerance
How does fault tolerance relate to Performance Level (PL) and Categories under ISO 13849 / CSA Z432?
Fault tolerance is embedded in the Category concept: Categories B and 1 have fault tolerance = 0 (single channel, no diagnostics). Category 2 has single channel with periodic testing, limited fault tolerance. Category 3 ensures a single fault does not lead to loss of safety function; not all faults are detected but accumulation must not cause dangerous failure. Category 4 adds continuous or cyclical fault detection so faults are detected in time. Required PL (a–e) is achieved by combining Category, MTTFd, and diagnostic coverage.
What is the difference between fault detection and fault evaluation in fault-tolerant systems?
Fault detection identifies that a fault exists (e.g., discrepancy between channels). Fault evaluation decides whether the detected fault can be tolerated temporarily or requires immediate shutdown. In a fault-tolerant safety function, the system may permit limited, controlled continued operation (e.g., finishing a cycle) while maintaining safety, then go to a safe state. This behavior must be explicitly specified in safety function requirements and validated.
How is fault tolerance verified and documented under WorkSafeBC expectations?
WorkSafeBC requires designers and employers to maintain a list of all safety functions with required and achieved PL, a statement on achieved PL by a competent party, and documented site testing including fault injection when required by the safety device manufacturer. Testing must demonstrate response to single faults, management of common cause failures, and that the system continues to operate as intended or goes to a safe state under fault conditions. Test intervals must be integrated into PM schedules.
Fault tolerance in industrial safety is the ability of a safety-related control system to continue performing its required safety function in the presence of specified faults or errors, ensuring a single fault does not lead to loss of safety function. It is implemented via dual-channel, monitored designs (Categories 2-4 per ISO 13849/CSA Z432) that detect faults in time to reach or maintain a safe state, as required by WorkSafeBC and OSHA standards.
On the shop floor, fault tolerance is embedded in safety-related control systems (SRP/CS) designed to achieve a required Performance Level (PL) based on risk assessment. For high-risk machinery, Category 3 or 4 systems use dual-channel, monitored designs (e.g., emergency stop circuits with safety relays, light curtains with self-diagnostics) so a single fault does not cause loss of safety function. WorkSafeBC requires documented site testing, including fault injection, to validate that common cause failures are managed. Fault tolerance supports safety but does not replace lockout; hazardous energy control remains primary. Examples include dual contactors for motor power, redundant safety PLC channels, and cross-monitored interlocks on robot cells.
Assuming redundancy equals fault tolerance without proper diagnostics or validation; dual-channel wiring without monitoring can allow a single stuck contact to defeat safety function, violating ISO 13849 Category 3/4 requirements and WorkSafeBC testing expectations.
Degraded fault tolerance over time due to poor maintenance or change management; bypassing one channel during troubleshooting, firmware changes without re-validation, or missed periodic tests for Category 2 systems reduce effective fault tolerance, contrary to CSA Z432 and WorkSafeBC requirements to maintain adequate safeguards.
Using fault-tolerant systems as a substitute for lockout or physical safeguarding; relying on interlocks or safety PLC logic during servicing instead of de-energization and lockout violates BC OHS Regulation expectations for controlling hazardous energy, even if the system is Category 4/PL e.