FIG. 5 High Ease of
The impact of change during the de-
velopment ai
low] —-—----" 7

¢
/Sostto
4 Change

--7

Design Phase

Safety framework

The safety framework is a set of recommendations
that addresses the functional safety of PE for mining. It
is a risk-based, system safety process. It encompasses
hardware, software, humans and the operating environ-
ment for the equipment’s life cycle. So the safety process
considers all parts of the system (Fig. 4). The set of rec-
ommendation documents address the life-cycle stages of
design, certification, commissioning, operation and main-
tenance. The safety framework developed by NIOSH is
a proactive effort that enables safety to be “designed in”
early. This approach enables changes to be made early,
thus giving the benefit of lower costs and ease of change
(Fig. 5). Changes to the system, once at the customer’s
site, are more costly and difficult to implement. In addi-
tion, software changes in the field can increase the like-
lihood of introducing new errors.

The mining industry, on a national or international
basis, does not have formalized standards addressing the
safety of PE. So the safety framework is a first step. It is
a practical treatment scaled in size and complexity to
small mining organizations that have a few people with
limited knowledge of functional safety. The safety
framework reflects the importance of having the
industry’s first steps being manageable and successful.
The framework components are as follows (Fig. 6).

FIG. 6
es
The safety framework.
oe Programmable Electronics in Mining:
1.0 An Introduction to Safety
system Safety
24
Design-in Safety for the
Solvers ‘System and Software
Safety
22
Safely Case proof” or Documentation of Safety

Operation Phase

Safety introduction. This section includes an intro-
ductory document for the general mining industry. It
provides basic system/software safety concepts. It dis-
cusses the need for mining to address the functional
safety of PE. And it includes the benefits of implement-
ing a system/software safety program. The document is
supplemented by industry workshops. They establish
fundamental concepts of system safety, create an aware-
ness of the pending NIOSH safety recommendations
and provide a forum for input.

System safety program plan and 2.2 software safety
plan. These documents draw heavily from IEC 61508
(1998) and other standards listed in Table 1. The scope is
“surface and underground safety-related mining systems
employing embedded, networked and nonnetworked
programmable electronics.”

Safety case and assessment. This defines documen-
tation that demonstrates the degree of safety and the
supporting evidence. It also identifies limitations for the
system and its operation. It is a “proof of safety” that the
system and its operation meet the appropriate level of
safety for the intended application. The independent as-
sessment of the safety case is addressed. It establishes
consistent methods to determine the completeness and
suitability of safety evidence and justifications.

Next steps

The mining industry must have a common under-
standing of the functional safety concepts presented in
the framework for safety. Therefore, the first document
concerns the PE functional safety introduction. The con-
cepts of this document will be presented at industry
trade association workshops and NIOSH-sponsored
workshops. The first such workshop was sponsored by
NIOSH and MSHA on Aug. 17, 1999,

Work in 1999 developed technical reports supple-
menting the safety framework. These reinforced con-
cepts, discussed analysis methods and techniques, and
provided examples and additional references. Addition-
ally, a pilot project was explored to implement the safety
framework with a mine equipment manufacturer. This
could help to refine the safety framework and provide
material for case studies.

It is anticipated the framework for safety would be
used as the starting point for industry guidance docu-
ments or voluntary industry standards that could reduce
confusion and establish commonality in the industry. I
(References are available from the author.)


Safety framework
for programmable electronics
in mining

ining has one of the highest
annual average fatality
rates among major US in-

dustries. Health and safety dangers

have been inherent to mining since
the early days of picks and shovels.
Even though miners’ health and
safety has improved over the years,
mining is still one of the most dan-
gerous occupations.

Mining was traditionally a low
tech industry. It is now driven by
competitive pressures to go high-
tech by using programmable elec-
tronics (PE) for machine control,
atmospheric monitoring and mate-
tial processing. The industry's expe-
rience with the functional safety of
PE is limited compared with other
industries. Thus, PE is an emerging

Belt conveyor

ce ont
Former

0
Sa

technology for mining that can po-
tentially create or worsen hazards.

The US National Institute for Occupational Safety
and Health (NIOSH), Pittsburgh Research Laboratory
in Pittsburgh, PA is addressing the safety of this new
technology. NIOSH has a proactive project to generate
recommendations for addressing the functional safety of
PE-based mining systems before the technology prolifer-
ates. The recommendations take the form of a safety
framework encompassing the entire life cycle for a PE-
based mining system.

Approach

The approach to generate rec-
ommendations for a safety frame-
work was threefold. Get early in-
dustry input, look at current and fu-
ture trends of PE use for mining and
assess the extent of the problem for
mining by reviewing mine accident

John J.

Sammarca

John J. Sammarceis gata and general industrial accident

an electicl engineet’ = data. In addition, an assessment was

with the US National © - Made of the existing international

. body of knowledge captured by

_ situ for Ceti standards for the functional safety

tional Safety and Health, = of PE.

Per eer Industry input

Laborato, PO Box An industry panel was estab-

‘18070, Pittsburgh, PA lished in the early project stages to

15236-0070, help identify safety issues and to es-

memes = tablish initial project direction. This

small panel consisted of an industry cross section that
included manufacturers, coal operators, academia and
government.

The safety issues identified by the industry panel
and Sammarco, et al. (1997) involved software, human
factors and hardware. Extramural activity was estab-
lished with The Pennsylvania State University and The
University of Alabama to investigate these issues in de-
tail. Additional industry input was obtained by informal
contact with manufacturers and end users.

The sampling of industry input indicated an absence
of a unified safety approach or a common understanding
of the key concepts of PE functional safety concepts. So
the first priority task in the safety framework became
establishing a common ground and understanding of
these key concepts for the mining industry.

Mining trends for PE use

As stated by Phillips, et al. (1997) in the Wall Street
Journal,“ Mining, that most basic of industries, is increas-
ingly throwing down its old tools and picking up new
technology. It is a matter of survival.”

Informal industry surveys, industry studies and pub-
lished equipment surveys were used to look at the cur-
rent state and future trends of PE use. It was found that
PE use is not limited to specific systems, mining methods
or commodities. In mining, PE use can be categorized in
three fundamental areas: control, monitoring and protec-
tion.

Within these categories, there are several applica-



tions. These include longwall coal
mining systems, automated haulage
vehicles for surface and under-
ground metal/nonmetal mines, re-

mote controllers for underground
mining machines, mine elevators
and hoists, and mine atmospheric-
monitoring systems that monitor
methane, carbon monoxide and
fresh airflow.

Underground mine atmospher-
ic monitoring and control began in
the late 1970s. It has grown during
the 1990s to where almost 17% of all
underground mines have computer-
based systems (Francart, et al.,
1997). From 1990 to 1996, program-
mable longwall systems usage doub-
led to about 95% of all US longwalls
(Fig. 1) (Fiscor, 1998). Microproces-
sor technology is also finding its way
into control and monitoring of con-

Conveyor carrying frame

_—Roof shield

J Oaning shield

Waste
/ shield

Guide wedge Floor beam

veyor systems.

Industry trends are towards more use and complex-
ity as machinery moves from localized PE control to dis-
tributed control of machines and processes. This trend is
expected to increase due to economic pressures, lower
grades of coal and ores, and because of increased diffi-
culties in physically accessing these resources.

Accident data

Accident.data is needed to determine root causes
and contributing factors. This information is just one
component helping to focus safety recommendations.
However, accident data is limited for mining. There are
lessons that can be learned from others that have ad-
dressed the functional safety of PE. The mining industry
will likely repeat some of the same mistakes or have
some of the shortcomings experienced by other indus-
tries. So NIOSH also looked at studies of accidents in
other industries.

Several studies concur that most causes are traced to
the safety-requirement specifications for the system. A
study by Lutz (1992) on NASA soft- yb 4
ware found that most problems with Ebi
safety-related software came from
misunderstandings and discrepan-

reported accidents was found. This was because PE is an
emerging technology in mining and some incidents and
near misses go unreported. It is anticipated that inci-
dents will increase as the number and complexity of PE
increases for the industry to remain competitive.

Secondly, some accidents caused by PE have gone
unrecognized. This is because they are nontraditional
and investigative expertise is so strong in the occupa-
tional hazards associated with slips and falls, material
handling, roof falls, contact with moving machinery and
poor work practices.

Accident data obtained from the US Mine Safety
and Health Administration (MSHA) — web site http://
www.msha.gov/ — has been helpful. MSHA conducts
accident investigations of all fatalities but not all acci-
dents or near misses. So it is not known if a large num-
ber of uninvestigated PE-related accidents and near
misses have occurred.

Using MSHA data, nine accidents were identified.
An additional data source concerned mine hoists using

Cem
Key standards shaping the safety framework.

cies in the safety-requirement speci-
fications.

A Health and Safety Executive
(HSE) (1995) study of 34 accidents
in general industrial applications
grouped the accidents by five prod-
uct life-cycle phases. These included
safety requirements specification,
design and implementation, installa-
tion and commissioning, operation
and maintenance, and changes after
commissioning. This study found
that 44.1% of the causes were attrib-

MIL-STD-882C

uted to the safety requirement spe- STANAG 4404
cifications. The second-leading cause

(20.6%) was attributed to changes

after commissioning. UL 1998

For mining, a small number of

IEC 61508, parts 1-7
ANSI/ISA $84.01

ISA draft technical report
and TR84.0.02, parts 1-5.

UK definition standard 00-58

Functional safety of electrical/electronic/
programmable electronic
safety-related systems.

Application of safety instrumented
systems for the process industries.

Safety instrumented systems (SIS) —
safety integrity level (SIL)
evaluation techniques.

Standard practice for systems safety
program requirements.

HAZOP studies on systems containing
programmable electronics.

Safety requirements and guidelines for
munition-related safety-critical
computing systems.

Software in programmable components.



50 FIG. 3
Key The data analysis from 21 mine acci-
40 dents shows similarities to the Health
i. MM HE study and Safety Executive (HSE) study of
Zz Mining lustrial accidents involving
lw 30 programmable electronics.
w
WW 20 Pre
o |
10
|
i
qi Specification _Designand —_— installation Operation and Changes
implementation and maintenance after
commissioning commissioning
PHASE

program logic controllers (PLC) was obtained. Mine
hoist accident data for 12 accidents from 1987 to 1998
was obtained from the Ontario Ministry of Labor. In all,
the data consisted of 21 accidents that were analyzed us-
ing the same methodology as the HSE study.

All incidents resulting in injury or fatality involved
unintentional or unexpected machine movements. The
likelihood and severity of this hazard is greater under-
ground because of the confined space, noise and limited
visibility and mobility of workers from awkward body
placements and poor floor conditions where obstruc-
tions, rubble, water and mud are commonplace. The haz-
ard of unintentional or unexpected machine movement
of longwall shields is called ghosting, (Fig. 2). Mishaps
and near-misses have occurred because of shield “ghost-
ing.” Longwall mining uses PE extensively, where more
than 95% of longwall shields use PE control.

FIG. 4

All parts of the mining system must be considered for
safety.

© Processors

© Sensors
© Actuators

Maintenance
Management

The mine-accident-analysis results are compared to
the HSE study and are shown in Fig. 3. The predominant
cause for mining accidents was the same as found by the
HSE study and by Lutz. The safety requirement specifi-
cation accounted for 38.1% of the data. So the safety
framework places emphasis in this area.

Several factors can contribute to a deficient safety
requirements specification and implementation. They
include inadequate hazard analysis, errors of omission
and misunderstandings. Criteria identified by Leveson
(1995) are useful for safety requirements specification
completeness. The activity driving the specification is the
hazard analysis.

Systematic hazard analysis techniques include a haz-
ard and operability study (HAZOP) performed at the
requirements phase and continuing into the design, op-
eration and maintenance phases. These could improve
the safety requirements specification and mitigate some
of the safety problems.

HAZOP began in the chemical process industry.
This team-based, qualitative technique uses guide words
to discover deviations from the intended design. These
guide words are well-suited for process industry param-
eters, such as flow, pressure, temperature and level.

HAZOP has been extended, as described in the
Ministry of Defense (1998), for the hardware and soft-
ware of programmable systems. Guide words are ex-
tended with “early, late, before and after.” They are used
with attributes such as “data rate and data value.”

HAZOP is applicable to mining. In fact, Australian
law requires a HAZOP study for mining equipment. An
extension or customization of HAZOP for mining
equipment would be desirable because this involves pro-
cedural activities as well as process activities,

Procedural activities for operational sequences in-
volve a combination of people, equipment and the envi-
ronment. Such a procedural technique, known as Dril-
ler’s HAZOP, was created for oil-drilling systems
(Comer, et al. 1986).

A procedural example in mining would involve a
continuous mining machine used to mine coal. This ma-
chine spends 32% of the time for production activities,
10% for maneuvering, 42% for delays and idle time and
15% for related personnel activities.