Industrial Safety, Reliability, and Maintenance

Introduction

Industrial automation improves productivity, quality, and repeatability, but it also introduces hazards arising from moving machinery, electrical energy, stored pneumatic and hydraulic energy, software-controlled behavior, unexpected restart, and failures in sensors, actuators, or control systems. A safe automated plant is therefore not simply one in which guards are installed. It is a system whose hazards are systematically identified, whose risks are reduced by design, whose protective functions are validated, and whose reliability and maintenance strategies preserve safe performance throughout its life cycle.

This chapter connects four closely related engineering activities:

1. Safety engineering prevents unacceptable injury and damage.
2. Functional safety ensures that control systems perform specified safety functions when required.
3. Reliability engineering estimates and improves the probability that equipment performs its intended function.
4. Maintenance engineering restores or preserves performance and detects deterioration before failure becomes dangerous or costly.

Safety and reliability are related but not identical. A production motor may fail without creating a safety hazard, while a safety relay may remain operational for years yet fail to respond when demanded. Conversely, an emergency-stop circuit can be highly reliable but poorly designed if it does not remove the relevant hazardous energy.

Learning Objectives

After studying this chapter, a student should be able to:

• identify hazards and conduct a structured risk assessment;
• distinguish hazard, risk, incident, accident, and unsafe condition;
• explain the hierarchy of risk reduction and the principles of fail-safe design;
• describe machine safety, functional safety, Safety Integrity Level (SIL), and Performance Level (PL);
• apply basic reliability and availability calculations;
• select preventive, predictive, corrective, and condition-based maintenance strategies;
• interpret fault-diagnosis information and construct a simple fault tree;
• relate engineering decisions to major IEC and ISO standards;
• evaluate safety and maintenance decisions in an industrial case.

1. Safety as a Systems Engineering Discipline

A hazard is a potential source of harm. Examples include an exposed robot axis, a 400 V electrical supply, a hot surface, compressed air, or a software command that causes unexpected motion. Risk combines the severity of possible harm with the likelihood that the harm will occur. Risk is not the same as probability alone: a low-probability event can still require strong controls if its consequence is catastrophic.

An accident is an unwanted event resulting in harm or damage. An incident is an event that could have caused harm, whether or not harm occurred. A near miss is valuable evidence because it reveals weaknesses before injury occurs.

A risk assessment generally follows this sequence:

1. Define the machine, its intended use, foreseeable misuse, operating modes, and life-cycle phases.
2. Identify hazards during installation, setup, production, cleaning, fault finding, maintenance, and decommissioning.
3. Estimate risk using severity, frequency or exposure, and possibility of avoiding harm.
4. Reduce risk using the hierarchy of controls.
5. Verify and validate the protective measures.
6. Document residual risk and communicate necessary precautions.

The internationally recognized machinery risk-assessment framework is ISO 12100. It emphasizes that risk reduction begins with inherently safe design, followed by safeguarding and complementary protective measures, and finally information for use. Personal protective equipment is important, but it should not compensate for avoidable design hazards.

Hierarchy of Risk Reduction

The preferred order is:

• eliminate the hazard through design;
• reduce energy, speed, force, travel, temperature, or access;
• install fixed guards, interlocked guards, presence-sensing devices, barriers, or safe control functions;
• provide administrative controls, training, procedures, and warning signs;
• use personal protective equipment as the final layer.

An emergency stop is a complementary protective measure, not a substitute for guarding. It must not be treated as the normal means of stopping production.

2. Machine Safety and Protective Measures

Machine safety begins with the energy sources that can cause injury. These include electrical, mechanical, pneumatic, hydraulic, thermal, gravitational, chemical, and stored energy. A proper isolation procedure identifies every energy source, disconnects it, prevents reconnection, dissipates stored energy, verifies zero energy, and only then permits work. This is commonly implemented through lockout/tagout procedures.

Guards and Interlocks

A fixed guard prevents access by its physical construction. An interlocked guard permits access only when dangerous motion has stopped or has been placed in a safe state. Interlocks should be designed to resist defeat and should not be defeated by ordinary tools or easily available objects. ISO 14119 addresses interlocking devices associated with guards.

An interlock is not automatically a complete safety function. The designer must consider the switch, wiring, logic, output devices, stopping time, access time, and the possibility of bypassing the device.

Emergency Stop and Safe Stop

ISO 13850 provides principles for emergency-stop functions. The emergency stop must be readily accessible, clearly identifiable, and capable of stopping the hazardous process within the required time. Its exact behavior depends on the machine and risk assessment.

Modern drives may implement functions such as Safe Torque Off (STO), Safe Stop 1 (SS1), or Safe Limited Speed. IEC 61800-5-2 defines safety-related drive functions. STO prevents the motor from producing torque, but it does not necessarily isolate the electrical supply or remove mechanical energy. A vertical axis may still descend under gravity, so a brake or mechanical support may be required.

Separation Distances and Detection

ISO 13855 relates the position of safeguards to approach speeds and stopping performance. A presence-sensing device must be far enough from the hazard that a person cannot reach it before hazardous motion stops. ISO 13857 provides safety distances for preventing access to danger zones by limbs.

If the total stopping time is T, the approach speed is K, and the intrusion or device-response allowance is C, a simplified separation-distance expression is:

Here, S is the minimum separation distance, usually in millimetres; K is an approach speed in millimetres per second; T is the total time from detection to cessation of the hazardous movement in seconds; and C is an additional intrusion allowance in millimetres. The correct values and method must be selected from the applicable standard and device geometry. The formula is not a universal substitute for the standard.

3. Functional Safety

Functional safety concerns the part of overall safety that depends on a system responding correctly to inputs and producing a safe output. Examples include detecting an open guard and removing torque, monitoring overspeed and initiating a safe stop, or preventing a press from cycling unless both hand controls are operated correctly.

A safety-related control system normally contains:

• input devices, such as emergency-stop buttons, guard switches, light curtains, or pressure switches;
• logic, such as a safety relay, safety PLC, or certified drive controller;
• output devices, such as contactors, valves, brakes, or STO channels;
• diagnostics, testing, feedback, and fault reaction.

The safety function must be specified before components are selected. A specification should state the initiating condition, the required safe state, response time, reset behavior, permitted operating modes, diagnostic behavior, and required SIL or PL.

SIL and PL

IEC 61508 uses Safety Integrity Levels SIL 1 to SIL 4 for electrical, electronic, and programmable electronic safety-related systems. Higher SIL represents a lower probability of dangerous failure, but SIL is not a simple quality grade and cannot be assigned merely because a component is expensive.

IEC 62061 applies functional-safety principles to machinery control systems and uses SIL concepts. ISO 13849-1 uses Performance Levels PL a through PL e for safety-related parts of control systems. PL e is more dependable than PL a. PL assessment considers architecture, component reliability, diagnostics, and common-cause failures.

For a safety function operating in high-demand or continuous mode, a common IEC 61508 measure is the average probability of dangerous failure per hour:

Typical numerical ranges are associated with SIL bands, but the ranges and interpretation depend on the operating mode and applicable standard. For low-demand functions, the relevant measure is often the average probability of failure on demand, PFD_avg, rather than PFH_D. These terms must not be interchanged.

A simplified reliability model for independent dangerous failures in a single channel is sometimes written as:

where λ_D is the dangerous failure rate per hour and DC is the diagnostic coverage expressed as a fraction. This is only a rough conceptual estimate. Real SIL or PL calculations must include proof-test intervals, test effectiveness, architecture, repair, common-cause failure, β-factors, mission time, and component data. A calculated result is valid only when the assumptions and standard method are satisfied.

Fail-Safe Design

A fail-safe system moves to, or maintains, a state that minimizes hazard when a fault occurs. Typical principles include:

• de-energize-to-trip circuits, where loss of power causes a safe action;
• normally closed monitoring circuits for guard and emergency-stop devices;
• dual channels for critical functions;
• discrepancy and short-circuit detection;
• monitored contactors with feedback;
• controlled restart after a power interruption;
• separation of safety logic from ordinary control logic where appropriate.

Fail-safe does not mean that every failure produces zero risk. A loss of power may stop a conveyor but cause a suspended load to fall. Safe-state definition must therefore be specific to the machine and hazard.

4. Reliability, Availability, and Maintainability

Reliability is the probability that an item performs its required function for a specified time under stated conditions. Maintainability is the probability that a failed item can be restored within a specified time. Availability is the proportion of time that an item is capable of performing its required function.

For a constant failure rate and an item with an exponential time-to-failure distribution:

where R(t) is reliability at time t, λ is the constant failure rate in failures per unit time, and e is the base of natural logarithms. The model assumes statistically constant failure rate and independent failures; it is not appropriate for infant mortality or wear-out without modification.

The mean time to failure under this model is:

For a repairable item with constant failure and repair rates, a simple steady-state availability estimate is:

MTBF is mean time between failures and MTTR is mean time to repair. This expression assumes that the means are representative, the system reaches steady state, and planned downtime and logistics are either included consistently or excluded consistently. Operational availability may also include waiting for spare parts, inspection, and administrative delays.

Series and Parallel Systems

For independent components in a series system, every component must work:

For two independent components arranged redundantly in parallel, the system works if at least one works:

Redundancy does not automatically improve safety. Common power supplies, common software defects, environmental stress, poor diagnostics, or a shared actuator can defeat redundant channels. Common-cause failure analysis is essential.

Worked Reliability Example

Two independent controllers each have reliability 0.98 over a specified mission time and are arranged in parallel so that either can perform the function. The idealized reliability is:

R_parallel = 1 − (1 − 0.98)(1 − 0.98) = 1 − 0.0004 = 0.9996

Thus the theoretical reliability is 0.9996, or 99.96%. This result assumes independence and successful changeover. If both controllers share one unmonitored power supply, the calculated value overstates actual system reliability.

5. Fault Diagnosis and Fault-Tree Thinking

Fault diagnosis determines what has failed, why it failed, and what action is safe. A disciplined diagnosis separates symptoms from causes. Useful evidence includes alarm history, sequence-of-events records, input and output status, measured currents, temperatures, vibration, network diagnostics, and maintenance history.

A practical diagnostic sequence is:

1. Make the equipment safe and apply isolation procedures.
2. Confirm the symptom and operating conditions.
3. Divide the system into functional blocks.
4. Test from the source of energy toward the load, or from the command toward the actuator.
5. Check simple causes first: supply, fuse, connector, permissive, sensor alignment, and configuration.
6. Change one condition at a time and record results.
7. Repair, test the safety function, and document the cause.

A fault tree analysis (FTA) begins with a top event, such as “robot starts while the gate is open,” and works backward through logical AND and OR relationships. An OR gate means any listed event can cause the output; an AND gate means all listed events are required. Failure Mode and Effects Analysis (FMEA) begins at component or process level and evaluates failure mode, effect, cause, detection, and control. FMEA is usually bottom-up, whereas FTA is top-down.

A frequently used risk-priority number in traditional FMEA is:

where S, O, and D are rating scales for severity, occurrence, and detection. Because the scales are ordinal rather than true physical measurements, RPN should support engineering judgment rather than replace it. High-severity hazards must not be accepted merely because their numerical RPN is moderate.

6. Maintenance Engineering

Maintenance strategies should be selected according to failure behavior, consequence, detectability, and cost.

Preventive replacement is beneficial when failure probability increases with age. It can be wasteful when failures are random and inspection is effective. Predictive maintenance requires appropriate sensors, trustworthy thresholds, competent interpretation, and a response process. Collecting data without acting on it is not predictive maintenance.

Typical condition-monitoring methods include vibration analysis for rotating machinery, infrared thermography for electrical hot spots, motor-current signature analysis, lubricant analysis, ultrasonic inspection for compressed-air leaks, and trend analysis of cycle time or servo following error.

Maintenance effectiveness can be evaluated using indicators such as mean time to repair, planned-maintenance percentage, schedule compliance, repeat-failure rate, and availability. Metrics must not encourage unsafe shortcuts. For example, reducing MTTR by bypassing a guard is unacceptable.

7. Standards, Governance, and Professional Responsibility

Standards are not interchangeable and do not eliminate the need for engineering judgment. Important references include:

• ISO 12100: machinery risk assessment and risk reduction;
• IEC 60204-1: electrical equipment of machines;
• ISO 13849-1 and ISO 13849-2: safety-related parts of control systems and validation;
• IEC 62061: functional safety of machinery control systems;
• IEC 61508: general functional-safety framework;
• ISO 13850: emergency-stop function;
• ISO 13855: positioning of safeguards relative to approach speeds;
• ISO 13857: safety distances;
• ISO 14119: interlocking devices associated with guards;
• IEC 61800-5-2: functional safety of adjustable-speed drive systems.

The legally applicable requirements depend on jurisdiction, machine type, workplace regulations, and conformity-assessment arrangements. Engineers must identify the applicable legislation and current edition of each standard rather than relying on an old checklist.

Safety documentation should include the risk assessment, safety-function specifications, circuit diagrams, calculations, validation records, test intervals, operating modes, residual risks, training requirements, and change history. Management of change is essential: a new robot program, altered speed, replacement sensor, or software update can invalidate a previous assessment.

Ethically, engineers have a duty to place protection of people above production pressure. Safety devices must never be bypassed to recover output without a documented, authorized, and safe procedure. Cybersecurity also has a safety dimension: unauthorized commands, malware, or loss of network integrity can create hazardous motion. Access control, secure backups, network segmentation, authenticated changes, and recovery testing support both cybersecurity and functional safety.

8. Illustrative Case: Robotic Palletizing Cell

Background

A palletizing cell contains a six-axis robot, conveyor, light curtain, access gate, pneumatic gripper, and safety PLC. Operators enter the cell to clear fallen cartons. The original design stopped the robot through a single guard switch wired to a standard PLC input.

Problem

A near miss occurred when the gate was opened during a fault. The standard PLC displayed a gate-open message, but the robot continued moving briefly because the PLC program treated the input as an ordinary permissive and the drive command was not connected to a safety-rated stop. The event demonstrated that indication is not equivalent to a safety function.

Analysis

The assessment identified hazards from robot motion, unexpected restart, pneumatic gripping force, and access during stopping. Measurements showed that the robot required 0.8 s from stop initiation to cessation of hazardous motion. The guard switch response and logic added 0.1 s, and the required intrusion allowance was 120 mm. Using the simplified separation expression with an approach speed of 1600 mm/s:

S = 1600 × (0.8 + 0.1) + 120 = 1560 mm

The value is an engineering estimate subject to verification against the applicable standard, device type, and approach geometry. The existing gate was closer than this distance, so physical redesign or a faster validated protective arrangement was necessary.

Solution

The team implemented dual-channel guard monitoring through a safety controller, monitored contactors or a suitable safe-drive function, a reset outside the hazard zone, controlled restart prevention, and validated stopping performance. Pneumatic energy was addressed separately with isolation and exhaust provisions. The robot program was modified so that ordinary control logic could not override the safety function. Operators received revised procedures and training.

Outcome

Validation confirmed that opening the gate removed the hazardous drive torque within the specified time, that a single channel fault was detected, and that power restoration did not cause automatic restart. The cell was reassessed after a later speed increase, demonstrating the importance of management of change.

Learning Points

A safety message on an HMI is not a protective measure. The complete safety chain must be specified and validated. Stopping distance, stored energy, reset behavior, foreseeable misuse, and changes in speed must all be considered. Reliability calculations are useful only when their assumptions reflect the real architecture.

9. Challenges and Contemporary Developments

Industrial systems increasingly combine robots, autonomous mobile equipment, cloud analytics, wireless sensors, and artificial intelligence. These technologies can improve predictive maintenance but also create new failure modes. An AI model may produce false alarms, miss rare failures, or drift when operating conditions change. It should support—not silently replace—engineering judgment and established safety functions.

Digital twins and edge analytics can combine vibration, temperature, current, and controller data to identify deterioration. Their value depends on sensor quality, calibrated baselines, explainable decisions, and secure data handling. Safety-related decisions should use validated architectures and certified components where required; an uncertified predictive model should not be the sole barrier against hazardous motion.

The major limitations of safety and maintenance analysis are incomplete data, changing operating conditions, human factors, common-cause failures, organizational pressure, and overconfidence in numerical scores. Effective engineering therefore combines quantitative analysis with observation, testing, competent supervision, and continual improvement.

Best-Practice Design Checklist

• Define intended use and foreseeable misuse.
• Identify all energy sources and life-cycle hazards.
• Reduce hazards by design before adding warnings or PPE.
• Specify each safety function in terms of input, logic, output, safe state, response time, and reset.
• Select the correct SIL or PL method and document assumptions.
• Consider diagnostics, common-cause failure, proof testing, and bypass resistance.
• Verify stopping time and safeguard separation distance.
• Apply isolation and lockout procedures before intervention.
• Select maintenance tasks from failure consequences and evidence.
• Validate repairs, software changes, and modified operating speeds.
• Record residual risk, training, inspections, and management-of-change decisions.

Chapter Summary

Industrial safety, reliability, and maintenance form an integrated life-cycle discipline. Risk assessment identifies hazards, estimates risk, and applies the hierarchy of controls. Machine safety uses inherently safe design, guards, interlocks, emergency stops, separation distances, and energy isolation. Functional safety concerns control systems that detect dangerous conditions and achieve a defined safe state; SIL and PL express integrity requirements through different but related frameworks.

Reliability models quantify the probability of successful operation under stated assumptions. Series systems reduce reliability, while redundancy can improve it only when independence, diagnostics, and common-cause effects are addressed. Fault-tree analysis and FMEA provide complementary top-down and bottom-up methods for understanding failure. Corrective, preventive, predictive, and condition-based maintenance should be selected according to failure behavior and consequence. Standards such as ISO 12100, ISO 13849, IEC 62061, IEC 61508, and IEC 60204-1 provide structured requirements, but competent application, validation, documentation, ethical judgment, and management of change remain essential.

Key Terms

Hazard: A potential source of harm.

Risk: Combination of the likelihood and severity of harm.

Residual risk: Risk remaining after protective measures are applied.

Inherently safe design: Eliminating or reducing hazards through design choices.

Safeguarding: Physical or control measures that prevent access to hazards.

Functional safety: Safety achieved by correct operation of safety-related control systems.

Fail-safe: Design behavior that moves toward a defined safe state after relevant faults.

Safety Integrity Level (SIL): Integrity level used in IEC functional-safety frameworks.

Performance Level (PL): Reliability and diagnostic classification used in ISO 13849.

Safe Torque Off (STO): Drive function that prevents torque production.

Reliability: Probability of performing a required function for a specified time.

Maintainability: Probability of restoring function within a specified time.

Availability: Proportion of time an item is capable of performing its function.

MTBF: Mean time between failures for a repairable item.

MTTR: Mean time to repair.

FMEA: Bottom-up analysis of failure modes, effects, causes, and controls.

Fault-tree analysis: Top-down analysis using logical relationships from a top event.

Preventive maintenance: Maintenance performed according to time or usage.

Predictive maintenance: Maintenance based on condition data and predicted deterioration.

Common-cause failure: Failure of multiple channels or components from one shared cause.

Review Questions

Short Answer Questions

1. Distinguish between a hazard and a risk.
2. Why is an emergency stop not a substitute for guarding?
3. What is the difference between SIL and PL?
4. State the assumptions behind the exponential reliability model.
5. Give two examples of predictive-maintenance techniques.

Long Answer Questions

1. Explain the hierarchy of risk reduction and apply it to an automated conveyor.
2. Describe the components and validation requirements of a guard-door safety function.
3. Compare FMEA and fault-tree analysis, including the direction of reasoning in each.
4. Explain why redundancy does not necessarily guarantee a safe or reliable system.
5. Discuss how maintenance strategy should be selected for a safety-critical robot cell.

Analytical / Application Questions

1. A machine has a stopping time of 0.65 s, device and logic delay of 0.15 s, approach speed of 1600 mm/s, and an intrusion allowance of 120 mm. Calculate the simplified separation distance and identify assumptions that must be checked before accepting the result.
2. Two independent channels each have reliability 0.97 over a mission period and are arranged in ideal parallel redundancy. Calculate system reliability and explain two reasons why the practical result could be lower.
3. Design a high-level safety and maintenance plan for a pneumatic pick-and-place cell. Identify hazards, at least three safety functions, a suitable maintenance approach, and the evidence required for validation.

Multiple Choice Questions with Answers

Question 1

Which measure has the highest priority in the hierarchy of risk reduction?

A. Personal protective equipment

B. Warning labels

C. Inherently safe design

D. Operator retraining

Correct Answer: C. Inherently safe design

Question 2

What does Safe Torque Off primarily prevent?

A. All electrical energy from entering a drive

B. The motor from producing torque

C. A pneumatic cylinder from losing pressure

D. All mechanical movement caused by gravity

Correct Answer: B. The motor from producing torque

Question 3

For an exponential reliability model, which assumption is required?

A. The failure rate is constant

B. The item cannot be repaired

C. All failures are caused by wear-out

D. Components must be connected in parallel

Correct Answer: A. The failure rate is constant

Question 4

A series system operates only when every component operates. If two independent components have reliabilities 0.9 and 0.8, what is system reliability?

A. 0.10

B. 0.72

C. 0.85

D. 1.70

Correct Answer: B. 0.72

Question 5

Which analysis normally begins with a top event and works backward toward causes?

A. Fault-tree analysis

B. Preventive-maintenance scheduling

C. Thermographic inspection

D. Bottom-up FMEA

Correct Answer: A. Fault-tree analysis

Question 6

Which standard is primarily associated with machinery risk assessment and risk reduction?

A. ISO 12100

B. ISO 9001

C. IEC 60034

D. ISO 14001

Correct Answer: A. ISO 12100

Question 7

If MTBF is 900 h and MTTR is 100 h, the simple steady-state availability is:

A. 0.10

B. 0.50

C. 0.90

D. 1.11

Correct Answer: C. 0.90

Question 8

Which statement about an emergency-stop function is correct?

A. It should normally be used for every production stop

B. It is a complementary protective measure

C. It eliminates the need for risk assessment

D. It always isolates every energy source

Correct Answer: B. It is a complementary protective measure

Question 9

In FMEA, severity, occurrence, and detection ratings are commonly combined as:

A. MTBF

B. PFH_D

C. RPN

D. SIL

Correct Answer: C. RPN

Question 10

Why can two redundant safety channels still fail from one common cause?

A. Parallel systems cannot contain sensors

B. Shared power, environment, or design defects can affect both channels

C. Redundancy always increases failure probability

D. Diagnostics prevent all failures

Correct Answer: B. Shared power, environment, or design defects can affect both channels