Safety Speed Monitoring

Size: px

Start display at page:

Download "Safety Speed Monitoring"

Marsha Long
6 years ago
Views:

1 Monitoring Considerations about sensors in applications for safety speed monitoring Marketing Documentation - November 2013 MV - Rev. 1.0

MOSAIC MV and SENSORS Encoder Proximity MV Module Safety Level 1 Sin/Cos Safety Encoder --- MV1 SIL 3 PL e 1 Sin/Cos or 1 TTL or 1 HTL Encoder 1 Proximity MV1 Cat.

2 MOSAIC MV and SENSORS Encoder Proximity MV Module Safety Level 1 Sin/Cos Safety Encoder --- MV1 SIL 3 PL e 1 Sin/Cos or 1 TTL or 1 HTL Encoder 1 Proximity MV1 Cat. 3 - DCavg 90% up to SIL 3 PL e Proximity MV0 Cat. 3 - DCavg 90% up to SIL 3 PL e 2 Sin/Cos or 2 TTL or 2 HTL Encoder --- MV2 Cat. 3 - DCavg 90% up to SIL 3 PL e 1 Sin/Cos or 1 TTL or 1 HTL Encoder --- MV1 Cat. B - PL b (Cat. 1 - SIL 1 PL c under conditions) Proximity MV0 Cat. B - PL b (Cat. 1 - SIL 1 PL c under conditions)

3 Sensors in applications for safety speed monitoring The safety speed monitoring using sensors (encoders, proximity switch) for the measurement of speed, must be able to detect possible dangerous failures of the sensors themselves. In particular, they must be able to detect faults listed in the annex D.16 to IEC EN : Adjustable speed electrical power drive systems. Part 5-2: Safety requirements Functional.

4 Standard EN Extracted from Table D.16: list of dangerous failures and possible fault exclusion.

5 Standard EN Extracted from Table D.16: list of dangerous failures and possible fault exclusion. Greater the amount of faults detected by the controller, higher is the diagnostic coverage and therefore better the safety level reached by the considered function. The possibility to apply the fault exclusion removes the need to control and increases the reliability (MTTFd) of the component.

MOSAIC MV AND SENSOR COMBINATIONS Certified Safety Encoder Safety Speed The certificate safety encoder, in combination with a certificate speed monitoring, complies with all the requirements

6 MOSAIC MV AND SENSOR COMBINATIONS Certified Safety Encoder Safety Speed The certificate safety encoder, in combination with a certificate speed monitoring, complies with all the requirements specified in EN Its safety level is declared by manufacturer. Simply solution for safety speed monitoring function. SIL 3 PL e 1 Safety Encoder SIL 3 Mosaic MV1 If the safety level of the encoder is SIL 2 the result of the combination will be SIL 2 PL d.

MOSAIC MV AND SENSOR COMBINATIONS Encoder Proximity The system uses two non safety sensors forming a dual channel system. The controller verifies that the two sensors measure the same speed.

7 MOSAIC MV AND SENSOR COMBINATIONS Encoder Proximity The system uses two non safety sensors forming a dual channel system. The controller verifies that the two sensors measure the same speed. Failure of one of the two channels (electrical or mechanical), causes a difference in the measured values. This situation is detected by the controller which provides to generate an alarm signal. 1 proximity Cat. 3 DCavg 90% Safety level up to SIL 3 PL e 1 Encoder Mosaic MV1

MOSAIC MV AND SENSOR COMBINATIONS Encoder Proximity Since the two sensors of different technology, the two channels are not homogeneous.

This is a dual channel solution and the fault is detected due to the wrong difference between the two measured values.

The dual channel solution form a dual-channel Cat 3 function with DCavg (average diagnostic coverage) 90%.

8 MOSAIC MV AND SENSOR COMBINATIONS Encoder Proximity Since the two sensors of different technology, the two channels are not homogeneous. This reduces the possibility of common cause failures by improving the score of the Common Cause Failure (CCF) factor. This is a dual channel solution and the fault is detected due to the wrong difference between the two measured values. This makes it easier to meet the requirements of EN The dual channel solution form a dual-channel Cat 3 function with DCavg (average diagnostic coverage) 90%. With regard to the reliability values (MTTFd) of the sensor used is theoretically possible to achieve a maximum safety level (SIL3 PL e). Such level should be calculated and verified in accordance with EN Values of MTTFd sensors is needed to calculate the PL. Cat. 3 DCavg 90% Up to SIL 3 PL e

9 MOSAIC MV AND SENSOR COMBINATIONS Proximity Proximity The system uses two non safety sensors forming a dual channel system. The controller verifies that the two sensors measure the same speed. Failure of one of the two channels (electrical or mechanical), causes a difference in the measured values. This situation is detected by the controller which provides to generate an alarm signal. Cat. 3 DCavg 90% Safety level up to SIL 3 PL e 2 proximity Mosaic MV0

10 MOSAIC MV AND SENSOR COMBINATIONS Proximity Proximity In this case the two sensors use the same technology. The two channels are homogeneous. This may increase the possibility of common cause failures compared to the solution Encoder Proximity, making it more difficult to achieve the minimum score (65) of the CCF factor. This is a dual channel solution and the fault is detected due to the wrong difference between the two measured values. This makes it easier to meet the requirements of EN The dual channel solution form a dual-channel Cat. 3 function with DCavg (average diagnostic coverage) 90%. DCavg is 90% only if it s possible, by means of suitable fastening solutions, apply the exclusion of mechanical failure (loosening or loss of mechanical coupling with the engine) on the encoder wheel (toothed wheel). With regard to the reliability values (MTTFd) of the sensor used is theoretically possible to achieve a maximum safety level (SIL3 PL e). Such level should be calculated and verified in accordance with EN Values of MTTFd sensors is needed to calculate the PL. Cat. 3 DCavg 90% Up to SIL 3 PL e

11 Standard ISO EN Extracted from F.1: Scoring process and quantification of measures against CCF. Assessment needed for dual channel systems (Cat. 2, Cat. 3 and Cat. 4). If you do not reach minimum score of 65 points can not declare that the architecture is Cat. 2, Cat. 3 or Cat. 4.

12 MOSAIC MV AND SENSOR COMBINATIONS Encoder Encoder The system uses two non safety sensors forming a dual channel system. The controller verifies that the two sensors measure the same speed. Failure of one of the two channels (electrical or mechanical), causes a difference in the measured values. This situation is detected by the controller which provides to generate an alarm signal. Cat. 3 DCavg 90% Safety level up to SIL 3 PL e 2 Encoder Mosaic MV2

13 MOSAIC MV AND SENSOR COMBINATIONS Encoder Encoder In this case the two sensors use the same technology. The two channels are homogeneous. This may increase the possibility of common cause failures compared to the solution Encoder Proximity, making it more difficult to achieve the minimum score (65) of the CCF factor. This is a dual channel solution and the fault is detected due to the wrong difference between the two measured values. This makes it easier to meet the requirements of EN The dual channel solution form a dual-channel Cat. 3 function with DCavg (average diagnostic coverage) 90%. With regard to the reliability values (MTTFd) of the sensor used is theoretically possible to achieve a maximum safety level (SIL3 PL e). Such level should be calculated and verified in accordance with EN Values of MTTFd sensors is needed to calculate the PL. Cat. 3 DCavg 90% Up to SIL 3 PL e

14 MOSAIC MV AND SENSOR COMBINATIONS Only one encoder The system uses one not safety sensor forming a single channel system. The controller can not make comparisons and verifications. The channel failure (electrical or mechanical) could not be detected. 1 Encoder Mosaic MV1 Cat. B Safety level up to PL b Cat. 1 Safety level up to SIL 1 - PL c under conditions

15 MOSAIC MV AND SENSOR COMBINATIONS Only one encoder Single channel solution. The fault may not be detected. This makes it more difficult to meet the requirements of EN The solution is Cat.B. This category does not include any diagnostic coverage (DCavg). The maximum achievable level of safety is PL b. The solution could be to Cat. 1 only if the used encoder is considered a well-tried component for safety applications (Well Tried Component - ref. ISO Table 10). It is important to verify the possibility, by means of suitable fastening solutions, of applying the mechanical failure exclusion (loosening or loss of mechanical coupling with the engine). Regarding the value of reliability (MTTFd) of the used sensor, is theoretically possible to achieve a maximum safety level PL b (or SIL 1 PLc if declared Well Tried Component). Such level should be calculated and verified according with ISO EN Values of MTTFd sensor is needed to calculate the PL. Cat. B up to PL b or Cat. 1 up to SIL 1 PL c

16 Encoders in safety applications Standard EN Extracted from table 10: summary of requirements for categories.

17 Encoder Safety Speed Encoders in safety applications The non safety encoder are not part of the list of well-tried components in Table D.3 of EN ISO A manufacturer or a user could declare "well-tried a component if: It has been widely used in the past with positive results in similar applications for a sufficient amount of pieces and for adequately prolonged time. It has been designed, manufactured and verified using principles that demonstrate its suitability and reliability for safety related applications.

18 Standard EN Extracted from table D.3: Well-Tried components. Safety Speed

19 EN ISO REQUIREMENTS OF THE SAFETY CATEGORIES AND ACCESSIBLE PL Category B Category 1 Category 2 Category 3 Category 4 property Redundancy (2 Channels) No No Yes Yes Yes Fault tolerance Accumulation of undetected faults Diagnostic coverage (DC) none none Low to medium Low to medium o Requirements Components MTTFd Low to medium high Low to medium Low to medium high CCF observance No No Yes Yes Yes Safety principles basic Basic and well tried Basic and well tried Basic and well tried Basic and well tried Well tried components - Yes Possible PL a b b c a d a e e I: Input TE: Test Equipment DC: Diagnostic coverage L: Logic O TE : Output test equipment Loss of the safety function O: Output MTTF d: Mean time to dangerous failure

20 MOSAIC MV AND SENSOR COMBINATIONS Only one Proximity The system uses one non safety sensor forming a single channel system. The controller can not make comparisons and verifications. The channel failure (electrical or mechanical) could not be detected. 1 Proximity Mosaic MV0 Cat. B Safety level up to PL b Cat. 1 Safety level up to SIL 1 - PL c under conditions

21 MOSAIC MV AND SENSOR COMBINATIONS Only one Proximity Single channel solution. The fault may not be detected. This makes it more difficult to meet the requirements of EN The solution is Cat.B. This category does not include any diagnostic coverage (DCavg). The maximum achievable level of safety is PL b. The solution could be to Cat. 1 only if the used encoder is considered a well-tried component for safety applications (Well Tried Component - ref. ISO Table 10). It is important to verify the possibility, by means of suitable fastening solutions, of applying the mechanical failure exclusion (loosening or loss of mechanical coupling with the engine). Regarding the value of reliability (MTTFd) of the used sensor, is theoretically possible to achieve a maximum safety level PL b (or SIL 1 PLc if declared Well Tried Component). Such level should be calculated and verified according with ISO EN Values of MTTFd sensor is needed to calculate the PL. Cat. B up to PL b or Cat. 1 up to SIL 1 PL c

Solution with 2 proximity switches Safety Speed Proximity switches in safety applications Appropriate installation measures should be taken to prevent a

To increase the detected faults: At least one of proximity switches must be always activated.

22 Solution with 2 proximity switches Safety Speed Proximity switches in safety applications Appropriate installation measures should be taken to prevent a foreign body coming between the signal input device and the proximity switch. To increase the detected faults: At least one of proximity switches must be always activated. The proximity switches must be fitted so that the recorded signals overlap. See below: Solution with 1 proximity switch It is preferable to use 4-wire and two antivalent outputs proximity switches to detect the open circuit failure (basic safety principle - Extracted from Table D1 Standard ISO ).

Encoders in safety applications Additional requirements In order to build and use machinery complying with safety standards, an encoder without its own PFHd (safety

16) filled in with comments included in the standard EN 61800-5-2 declarations of "fault exclusion" for the loss of the mechanical connection (see next).

23 Encoders in safety applications Additional requirements In order to build and use machinery complying with safety standards, an encoder without its own PFHd (safety encoder certified) requires the following information from the manufacturer of the encoder: MTTF value of the encoder fault table (table D.16) filled in with comments included in the standard EN declarations of "fault exclusion" for the loss of the mechanical connection (see next). The Safety encoder complies with all the above additional requirements. A single standard encoder, which does not comply with specific safety requirements, can be used in safety applications up to PL b.

24 Fault exclusion Encoders in safety applications Fault considered Fault exclusion Remarks Loss of attachment during standstill: sensor housing from motor chassis sensor shaft from motor shaft Loss or loosening of attachment during motion: sensor housing from motor chassis sensor shaft from motor shaft Preparing FMEA (Failure mode and effects analysis) and prove longterm integrity of mechanical fixings. Preparing FMEA (Failure mode and effects analysis) and prove longterm integrity of mechanical fixings. Effect: output signal equals standstill. If fault exclusion is claimed, the design of the sensor housing to chassis and sensor shaft to motor shaft mounting usually withstands an overstress factor of approximately 20, and specific maintenance information should be provided. Possible effects: Static offset of sensor shaft Dynamic slip of sensor shaft Wrong output signal/zero speed signal If fault exclusion is claimed, the design of the sensor housing to chassis and sensor shaft to motor shaft mounting usually withstands an overstress factor of approximately 20, and specific maintenance information should be provided. Source from table D16 in the safety standard EN

25 Encoders in safety applications Once you have obtained the necessary data from the manufacturer of the encoder and controller, you will have to determine: The safety categorie provided The DCavg /diagnostic coverage on the potential dangerous failures that can be detected The MTTFd value of the safety function These elements make it possible to calculate the PL security level achieved.

26 EN ISO ISO simplifies calculation by providing a table based on Markov modeling in which average probability of dangerous failure per hour is pre-calculated for various Category combinations and range values of MTTFd and DCavg which are in turn obtained using tables. Denotations of MTTF d Low Medium High Range of MTTF d 3 years MTTFd < 10 years 10 years MTTFd < 30 years 30 years MTTFd < 100 years Denomination DCavg Range of values DC / DCavg None DC < 60% Low 60% DC < 90% Medium 90% DC < 99% High 99% DC

27 EN ISO The combination of Category plus DCavg adopted is shown in one of the seven columns of fig. 5 of ISO Calculated MTTF d determines which part of the column has to be considered. Corresponding PL is shown on the left of the table.

Functional Safety of Machinery: EN ISO Stewart Robinson. Overview of the presentation. References. TÜV SÜD Product Service

Functional Safety of Machinery: EN ISO 13849-1 Stewart Robinson Overview of the presentation Defining Safety Functions Avoidance of Systematic Failures Defining Performance Levels Required Verifying Performance