Overview of Emerging Safety Standards Machinery Sector By Phill Carroll Business Development Manager

Topics Historical Situation Introduction of New Standards Terminology Safety Integrity identification ISO 13849 ISO 62061

European Safety Concept is based on 2 pillars European Directives Safety of Machinery EC Contract Article 95 (EEA) EC Contract Article 137 (Social Safety) Directive 89/391/EEC... to encourage improvements in the safety and health of workers at work Low-Voltage Directive (73/23/EC) Machinery Directive (98/37/EC), 89/654/EEC safety & health requirements for the workplace (89/655/EC) use of work equipment by workers at work Harmonised European standards National laws (P.U.W.E.R.) Manufacturer, Supplier End User

Gaining compliance The role of EN standards Machinery manufactured in conformity with specified published European Harmonised standards will be presumed to comply with Essential Health and Safety Requirements covered by those standards

Hierarchic structure of EN Standards Type A Basic safety Standards Safety of machines; EN 292-1 Type B1 Group safety standards Higher-level safety aspects Type B2 Standards Generally handled safety-related devices Safety-relevant parts of control systems EN 954-1 Type C Standards -Specialist standards Specific requirements on specific machines

BSEN 954-1 Safety of Machinery - Design of Safety Related Parts of Control Systems Part 1 - General Principles for Design

BSEN 954-1 Safety of Machinery - Design of Safety Related Parts of Control Systems BS954-1 Scope of Standard Part 1 - General Principles for Design Provides safety requirements and guidance on the principles of Safety Related Electrical Control Systems Specifies safety categories and describes their characteristics Applicable to the electrical, hydraulic, pneumatic and mechanical aspects of a system Highlights five levels of circuit integrity dependant on the severity of risk The standard identifies suitable design criteria for the five levels of circuit integrity

Risk graph for categories S1 Category B 1 2 3 4 EN 954-1 S = Severity of injury F = Frequency of exposure P = Possibility of avoiding hazard S2 F1 F2 P1 P2 P1 P2 = Preferred categories for reference points = Possible categories requiring further steps = Measures which can be over-dimensioned for the relevant risk

Categories in accordance with EN 954-1

OFFICIAL OUT OF CONTROL STUDY Primary cause of safety control system failure (34 incidents) 44% Specification 15% Design & Implementation 6% Installation & Commissioning More than 60% of failures built into the safetyrelated systems before being taken into service 20% Changes after Commissioning 15% Operation & Maintenance NOT ONE PRODUCT FAILURE

Emerging Standards IEC 61508 IEC 62061 ISO 13849

Generic Standard IEC 61508 Nuclear Sector Process Sector IEC 61508 Defined requirements to allow electronics/software for safety-relevant tasks Not harmonized under the Machinery Directive (MD) Defines State-of-the-Art Terminology Specifies EN 62061 for the machinery sector IEC61513 IEC61511 IEC 61508 IEC62061 Medical Sector Machinery Sector

Requirements are obtained from the risk analysis Risk assessment Risk analysis is part of EN ISO 12100 (earlier EN 292) and EN 1050 (ISO 14121) (HRN method) Risk analysis provides The necessary safety functions for the machine being assessed Required safety performance (SIL or PL for every safety function) Methods and techniques to determine the required safety performance are described in; EN 954-1 Category decision IEC 62061 SIL assignment process (Excel table) ISO 13849-1 Risk diagram

Standards previous status EN 954-1: 1996 (int. ISO 13849-1) Harmonized under the MD - presumption of conformance for CE Concept for electro-mechanical, hydraulic systems etc. Not adequate for complex systems Technology has been further developed Methods and techniques have been developed to enhance electronics for safety-relevant tasks

Objectives of the 62061 and 13849 development To provide an unambiguous method for a meaningful quantitative/ qualitative assessment of safety related electrical control systems on machines To add to the existing structural approach (EN 954-1 categories) by including RELIABILITY and SYSTEMATIC measures To provide flexibility of functionality and technology to optimise safety AND productivity

IEC 62061/ISO 13849 Functional Safety Terminology Performance Level Discrete level to specify the ability of safety-related parts of control systems to perform a safety function under foreseeable conditions. Safety integrity level (SIL) Discrete level (one of a possible 3) for specifying the safety integrity requirements of the safety-related control functions to be allocated to the SRECS, where level 3 has the highest level of safety integrity and level 1 has the lowest

Functional Safety Terminology IEC 62061/ISO 13849 Functional Safety Part of the safety of the machine and the machine control system which depends on the correct functioning of the SRECS, other technology safety-related systems and external risk reduction facilities. Safety Category Classification of the safety related parts of a control system in respect of their resistance to faults and their subsequent behaviour in the fault condition, and which is achieved by the structural arrangement of the parts and/or by their reliability. Categories B,1,2,3, or 4 (designated architectures) In addition to the qualitative requirements, now contain quantifiable aspects, to the designated architectures to achieve PL (performance levels)

Solution: IEC 62061 and ISO 13849 Complex programmable electronic A quantitative measure for safety performance will be introduced IEC 62061: Safety Integrity Level (SIL) ISO 13849-1(rev): Performance level (PL) IEC 62061 and ISO 13849-1(rev) considered safety functions A specific hazard (as a result of the machine) can be assigned a defined safety function The required safety performance can be defined for a specific safety function With SIL (IEC 62061) and the PL (ISO 13849-1(rev)) a clear hierarchically structured, graduated quantity will be defined that can be used to measure safety performance (safety-related performance)

Control categories and additional requirements Additional requirements for safety categories in ISO 13849-1 ISO 13849 B 1 2 3 4 Design in accordance with relevant standards, X X X X X to withstand expected influences Tried and tested safety principles X X X X Tried and tested components X Mean time to dangerous failure MTTFd low high low - low - high medium medium high Fault detection (tests) X X X Single fault safety X X Consideration of fault accumulation X Diagnostic coverage DCavg low - low - high medium medium Measures to combat CCF X X X Principally characterised by Component Structure selection

Risk graph for performance levels Low risk Required performance Level PL r ISO 13849 Starting point to gauge risk reduction Key: S = Severity of injury F = Frequency and/or exposure time of hazard P = Possibility of avoiding the hazard or limiting the harm High risk

ISO 13849 Designated Architectures Category B and 1 Key i m interconnecting means I input device L logic O output i m i m I L O Their components shall be designed, constructed, selected, assembled and combined to conform to the relevant standards to withstand the expected influence Zero fault tolerance Mainly characterised by selection of components

ISO 13849 Designated Architectures Category 2 Key i m interconnecting means I input device L logic O output m monitoring TE test equipment OTE output of test i m i m I L O TE The requirements of B shall apply The use of well tried safety principles The loss of the safety function is detected by the check Zero fault tolerance, but the loss will be detected m OTE

Designated Architectures Category 3 i m i m I1 L1 O1 m c m i m I2 L2 O2 Key i m interconnecting means I input device L logic O output C cross monitoring m monitoring i m ISO 13849 The requirements of B shall apply The use of well tried principles When the single fault occurs, safety function is always performed Accumulation of undetected faults can lead to the loss of the safety function

Designated Architectures Category 4 i m i m I1 L1 O1 m c m i m I2 L2 O2 Key i m interconnecting means I input device L logic O output C cross monitoring m monitoring i m ISO 13849 The requirements of B shall apply The use of well tried principles When the single fault occurs, safety function is always performed The faults will be detected in time to prevent loss of the safety function Accumulation of undetected faults is taken into account

Performance levels achieved with safety categories ISO 13849 MTTFd = low MTTFd = medium MTTFd = high Category B DC avg = 0 Category 1 DC avg = 0 Category 2 DC avg = low Category 2 DC avg = medium Category 3 DC avg = low Category 3 DC avg = medium Category 4 DC avg = high

13849 Performance level attributes As in EN 954-1 (1997) ISO 13849 Mean Time to failure MTTF d Categories Common Cause Factor CCF DC Diagnostic Coverage

ISO 13849 Mean time to dangerous Failure Low Denotation of MTTFd Range of MTTFd Between 3 Years and 10 years Medium Between 10 Years and 30 years High Between 30 Years and 100 years Note 1: MTTFd should be taken into account for each individual channel of operation.

ISO 13849 Diagnostic coverage Denotation of DC None Low Medium High Range of DC DC Less than 60% DC between 60% and 90% DC between 90% and 98% DC at 99% Note 1: Diagnostic coverage, including safe failures, is used to describe the fractional decrease in the probability of safe and dangerous hardware failure resulting from the operation of the automatic tests

IEC 62061 Reasons for new standard IEC 62061 Current standards do not address the main causes of failure of safety systems They primarily address the failure of safety devices They do not address the management process necessary to achieve a safe system They do not address the new technologies

IEC/EN 62061 Main requirements; IEC 62061 Define/measure the functional safety required/ achieved using the prescribed parameters Manage the design process of the required functional safety in the prescribed manner Manage the design activities using the prescribed process Realize the design using the prescribed design methodology Produce and maintain the prescribed documents relating to the specification, realization, verification, modification, installation, commissioning and validation Note: The standard is prescriptive in terms of the methods used to manage and document the design process but not in terms of the content of the control system design itself.

Overall design process for a SRECS according to IEC/EN 62061 IEC 62061 Functional safety management Documentation Safety requirements specification System outline design Detail design Installation and commissioning Validation Verification Planning Modification

IEC 62061 Example for SIL assignment process

IEC 62061 4 4 3 3 10 Example proforma for SIL assignment process

62061 Safety Integrity Level (SIL) attributes IEC 62061 Probability Failure per Hour Structure PFH D Common Cause Factor CCF SFF Safe Failure Fraction

IEC 62061 IEC 62061/EN 62061: Safety of Machinery Functional Safety of Electrical, Electronic and Programmable Electronic Control Systems Probability of random hardware failure (PFH D ) Safety integrity level 3 2 Probability of a dangerous failure per hour (PFHD) 10 8 to < 10 7 10 7 to < 10 6 1 10 6 to < 10 5 PFH D = PFH D1 + + PFH Dn + P TE

Structure of safety system (1b) Architecture assigned to one function Safety integrity information of sub-systems Sensor SIL claim limit: 2 PFH D1 = 2*10-7 / h SIL capability PLC SIL claim limit: 3 PFH D2 = 1*10-7 / h SIL CL SYS <= (SIL CL Sub-system ) lowest SIL claim limit: 2 Actuator SIL claim limit: 2 PFH D3 = 3*10-7 / h Random integrity PFH D = PFH D1 +...+ PFH Dn + P TE PFH D = (2 + 1 + 3)*10-7 <10-6 System attained: SIL 2

Measure of safety performance IEC 62061 The required safety performance depends on the risk Previously: Category Dependant on the solution No clear reference to the magnitude of the risk Future: SIL (Safety integrity level)/ PL (Performance level) Independent of the solution Clear graduation according to the magnitude of the risk SIL and PL can be mapped with each other

Demarcation when applying 62061 13849 (cont )

Demarcation when applying 62061 13849 (cont ) ISO 13849-1(Revision) Can be used for hydraulic, pneumatic and electromechanical systems without any restrictions Can only be used for programmable electronic systems with some restrictions; A specific architecture (topology) Up to PL d or SIL 2 The calculation concept of ISO 13849-1 is based on specified architectures The requirements specified by 13849-1 for electronic (sub) systems are for less complex systems.

Competency In applying new standards and technologies Training Safety related Product specific Experience safety related Third party assessment Independent validation

Thanks for your time....any Questions?