Source: https://www.scribd.com/doc/117259166/
Timestamp: 2017-06-25 04:35:13
Document Index: 301920979

Matched Legal Cases: ['art 1', 'art 1', 'art 5', 'art 4', 'art 1', 'art 1', 'art 1', 'art 2', 'art 1']

.. | Risk | Safety
..Uploaded by bbulutmmRelated InterestsRiskSafetyRisk ManagementMachinesControl SystemRating and Stats0.0 (0)Document ActionsDownloadShare or Embed DocumentEmbedDescription: safetyView MoresafetyCopyright: Attribution Non-Commercial (BY-NC)List price: $0.00Download as PDF, TXT or read online from ScribdFlag for inappropriate contentMachine Safety Guide1
Introduction ........................................................4 Why safety? ........................................................6 Legal framework..............................................10 Risk assessment .............................................. 16 Safe design and safeguarding ....................22 Functional Safety ........................................... 30 Control system standards including worked examples ........................ 38 Sources of information................................. 56 Annexes - architectures ............................... 58
There are various guides to machinery safety legislation which tend to present a distorted view of the requirements of that legislation.
This handbook is an attempt to provide information that is up-to-date and unbiased in order to help machine builders and users to provide workers with machines that are safe, legal, and efficient. It is not intended as an exhaustive guide to compliance with safety legislation, nor as a replacement for referring to the relevant standards themselves; it is to guide you through the logical steps and to point you to the relevant sources of information.
there are laws that require machines to be safe. must ensure that the machine is compliant. adjustment.
. maintenance and eventual scrapping.
Adjustment/operation
New machines . installation. and sound economic reasons for avoiding accidents. Machines have to comply with the Essential Health and Safety Requirements (EHSRs) listed in Annex I of the Directive.Why safety
As well as the moral obligation to avoid harming anyone. the Technical File can be made available to the enforcing authorities on request. the CE marking is affixed. before the machine may be placed on the market within the EAA. Machine manufacturers. operation. or their authorised representatives within the EU.the Machinery Directive
From 29 December 2009 the new Machinery Directive 2006/42/EC compels machine manufacturers to meet a minimum set of requirements before a machine may be placed on the market within the EEA. manufacture.
Safety must be taken into account right from the design stage and must be kept in mind at all stages in the life of a machine: design. and a Declaration of Conformity has been signed. thus setting a common minimum level of protection across the EEA (European Economic Area).
and is inspected and maintained as necessary to ensure that it remains so. including mobile and lifting equipment. It applies to the provision of all work equipment. such as sick pay for injured employees. for example the use of light curtains to protect access points of machines can allow easier access for loading and unloading.
Some of the costs are obvious. The full financial impact can include increase in insurance premiums. The regulations apply to all employers. of which only £37 000 (~42 200 €) was insurable. lost production. The Health and Safety Executive in UK (HSE) give an example of an accident at a drilling machine that resulted in costs to the business of £45 000 (~51 300 €) (HSE INDG355). zoning of isolation devices can allow parts of a machine to be shut down for maintenance while other parts remain productive. in all workplaces and work situations. cost the employer some £90 000 (~102 600 €).
. the outcome of which was a reversible head injury. However this does not include some of the less obvious costs.Existing machines – the Work Equipment Directive
The user has obligations defined by the Use of Work Equipment directive 89/655/EEC which can in most cases be met by using machinery compliant with relevant standards. lost customers and even loss of reputation. An accident analysed by Schneider Electric Ltd. whereas some costs are harder to identify. and some estimates amount to double that figure. It requires that all equipment is suitable for use. and others who have control of the provision of work equipment. Some risk reduction measures can actually increase productivity. the self-employed.
org/Directives/DirectiveList. the reference to which has been published in the Official Journal of the European Union for a specific Directive. A list of such standards can be accessed at http://www.
In many cases European standards (ENs) are technically very similar to International (IEC or ISO) standards. the product is presumed to comply with those essential safety requirements of the Directive.
.newapproach. decree. so only European standards can confer a Presumption of Conformity. with which compliance is not compulsory
A standard becomes harmonised when published throughout the member states
Presumption of conformity:
When a product conforms to a harmonised European standard. However only European standards include a list of which EHSRs are covered. order. regulations)
A “standard” is a technical specification approved by a recognised standardisation body for repeated or continuous application.Legal framework
EC Directive:
Legal instrument to harmonise the legislation of the European member states Defines the essential health and safety requirements (EHSRs) Transposed into national law (act. and which covers one or more of the essential safety requirements.asp
It is of course necessary to ensure compliance with all the other EHSRs as well as those for which a Presumption of Conformity is given by the use of a specific standard.
Safety and EMC requirements for fixed belt conveyors for bulk material
Safety Standards Generic Standard EN/IEC 61508 Harmonized Standards EN ISO 13849-1 EN/IEC 62061 EN ISO 13849-1 EN/IEC 62061 EN/IEC 61508 EN/IEC 61511
EN 574 EN ISO 13850 EN 62061 EN ISO 13849-1
A B & C standards:
European standards for the Safety of machinery form the following structure:
EN 349 EN SO 13857 EN 60204-1 EN ISO 13855 EN 1088/ISO 14119
EN 61496-1 EN 60947-5-5
EN 842 EN 1037 EN 953 EN 201 EN 692 EN 693 EN 289
(Basic safety standards) giving basic concepts.
EN 422 EN ISO 10218-1 EN 415-4 EN 619 EN 620
(Machine safety standards) dealing with detailed safety requirements for a particular machine or group of machines.Hydraulic presses . the Type C standard takes precedence. principles for design.Part 1: Robot Safety of packaging machines .Safety requirements Rubber and plastics machines .General requirements.Design and construction requirements Robots for industrial environments .Electrical equipment of machines .General principles for design Risk assessment and risk reduction Two-hand control devices .principles for design Emergency stop .Principles for design and selection Electro-sensitive protective equipment Part 1: General requirements and tests Low-voltage switchgear and control gear . noise).Functional aspects .Safety requirements Machine Tools .Part 5-5: Control circuit devices and switching elements .Part 4: palletisers and depalletisers Continuous handling equipment and systems .European Directives and Safety Standards
Link between some of the main Safety Standards and the European Directives according with the sectors of activity
Fundamental rights from EU European Union Directive Free circulation (CE mark) Machinery 2006/42/EC Machine Builder Workers protection Use of Work Equipment 89/391/EC Environment protection Seveso II 2008/99/EC96/82/EC
When a Type-C standard deviates from one or more provisions dealt with by a Type A standard or by a Type B standard.Type B1 standards on particular safety aspects (e.Mechanical presses .Principles for design Functional safety of safety-related electrical.
(Generic safety standards) dealing with one safety aspect or one type of safeguard that can be used across a wide range of machinery: .Safety distances to prevent hazard zones being reached by upper and lower limbs Safety of machinery .Safety requirements . two-hand controls.
End User End User System Integrator System Integrator
Some examples of these types of standards are:
EN ISO 12100 A B B B B B B B B B B B 2010 Safety of machinery . guards). design and testing Prevention of unexpected start-up General requirements for the design and construction of fixed and movable guards Machinery for plastics and rubber .Blow moulding machines intended for the production of hollow articles . pressure sensitive devices.
.Injection moulding machines Safety requirements Machine Tools . interlocking devices.Electrical emergency stop devices with mechanical latching function Visual danger signals . safety distances. electronic and electronic programmable control systems Safety of machinery .Safety and EMC requirements for equipment for mechanical handling of unit loads Continuous handling equipment and systems .Requirements for the design and construction Blow moulding machines for producing hollow parts .Safety .Part 1: general requirements Positioning of protective equipment in respect of approach speeds of parts of the human body Interlocking devices associated with guards . . surface temperature. EN ISO 12100 is Type A standards.g. and general aspects that can be applied to all machinery.Safety-related parts of control systems Part 1 general principles for design Minimum gaps to avoid crushing of parts of the human body Safety of machinery .Type B2 standards on safeguards (e.g.
. Machines must be used in accordance with the manufacturer’s instructions.e. Existing machines taken into service before the Machinery Directive came into force do not need to comply. and the company modifying a machine needs to be aware that it might need to issue a Declaration of Conformity and CE marking. Modification of machines can be considered as manufacture of a new machine. and accompanied by a Declaration of Conformity to the Machinery Directive. although they need to comply with the regulations resulting from the Use of Work Equipment Directive and be safe and fit for purpose. Note that “placing on the market” includes an organisation supplying a machine to itself. building or modifying machines for its own use. i.Manufacturers’ responsibilities
Manufacturers placing machines on the market within the European Economic Area must comply with the requirements of the Machinery Directive. even if for use in-house. or importing machines into the EEA.
Users of machines need to ensure that newly-purchased machines are CE marked.
but that is not the case for several reasons. It would seem to be nice if the standard could give a value or ‘score’ for each risk. The score that would be allocated to each risk.Risk assesment
In order for a machine (or other equipment) to be made safe it is necessary to assess the risks that can result from its use.
. and then a target value for the maximum value that must not be exceeded. and none can be said to be “the right way” to perform a risk assessment. Risk assessment and risk reduction are described in EN ISO 12100. including children.
There are various techniques for risk assessment. but cannot give a reliable indication of accident rates that can be expected. depends on a series of judgements. and will vary with the person doing the judging as well as on the environment. might be present. as well as on the level of risk that can be tolerated. For example the risks that might be reasonable in a factory employing skilled workers might be unacceptable in an environment where members of the public. The standard specifies some general principles but cannot specify exactly what has to be done in every case. Historical accident/incident rates can be useful indicators.
Frequency and duration of exposure Possibility of avoiding or limiting the probability of the ocurence of an event that could cause harm
Puncturing. A more detailed list can be found in EN ISO 12100. chemicals. and when?
Who interacts with the machine. severing. together with an indication of the seriousness of each. All plausible consequences should be considered. and why? Again remember foreseeable misuse including the possibility of use of a machine by untrained persons. What is the expected life of the machinery and its application? How is it likely to be disposed of at the end of its life?
Prioritise the risks according to their seriousness
EN ISO 12100 describes this stage as Risk Estimation.
Who might be harmed by the identified hazards.
What aspects of the machine might cause harm to a person? Consider the possibility of entanglement. such as the possible use of a machine outside its specification. stabbing. sharp edges on the machine or on the material being processed. security staff. cutting from tools. installation.
. The result of the Risk Assessment process should be a table of the various risks that exist at the machine. crushing. and disposal. Other factors such as the stability of the machine. not just the worst case. remembering that there can be more than one person exposed. Examples of typical hazards are illustrated below. shearing. This can be done by multiplying the potential harm that can come from the hazard by the exposure to the hazard. trapping
Examples of typical hazards are illustrated here. as well as burns from hot surfaces. However usually when there is more than one possible consequence.A more detailed list can be found in EN ISO 12100. There is not a single “risk rating” or “risk category” for a machine – each risk must be considered separately. including the construction. though this is not an exhaustive list. or friction due to high speeds. visitors. and members of the public. though this is not an exhaustive list. and persons who might be present in the workplace. one will be more likely than the others. given the possibility that every accident can lead to a fatality.Identify the limits of the machinery
That is. This stage should include all hazards that can be present during the lifecycle of the machinery. when. just what is being assessed? What are the speeds/loads/substances etc that might be involved? For example how many bottles is the extruder blow moulding per hour. but cleaners. and emission of substances or radiation also need to be considered. Note that the seriousness can only be estimated – Risk Assessment is not a precise science. vibration. Neither is it an end in itself. noise. the purpose of Risk Assessment is to guide Risk Reduction. entanglement. cutting
Catching. It is difficult to estimate the potential harm. not just machine operators. and how much material is being processed at what temperature? Remember to include foreseeable misuse. drawing in.
and then this process is to be repeated to assess whether the individual risks have been reduced to a tolerable level and that no additional risks have be introduced. assembly. prioritised. and regulations use words like “reasonable” to indicate that it might not be possible to eliminate some risks without a grossly disproportionate cost. The process of risk assessment is iterative – risks need to be identified. if a risk can be reduced then it should be reduced. design steps taken to reduce them (first by safe design. This has to be tempered by commercial realities though.” In general. disabling and scrapping.
Is the machine safe? No Risk reduction
. In the next chapter we examine safe design and safeguarding. quantified. dismantling.Start Determination of machine limits Identification of the potential hazards Risk estimation Risk analysis End Yes
Risk reduction is dealt with EN ISO 12100 Risk reduction is defined in terms of eliminating risk: “the aim of measures taken must be to eliminate any risk throughout the foreseeable lifetime of the machinery including the phases of transport. then by safeguarding).
corners and protusions can help to avoid cuts and bruises. This stage is known as inherently safe design. such as injection of air into the body and compressor noise.
. speeds and pressures can reduce the risk of injury. For example air-powered tools avoid the hazards associated with electricity. reducing maximum gaps can eliminate the possibility of body parts entering.
Standards and legislation express a distinct hierarchy for controls. the use of a non-flammable solvent for cleaning tasks can remove the fire hazard associated with flammable solvents. but can introduce other hazards from the use of compressed air. by inherently safe design measures is the first priority. Reduced forces. The elimination of hazards or reduction of risks to a tolerable level.2)
Some risks can be avoided by simple measures. Increasing minimum gaps can help to avoid body parts getting crushed. and is the only way of reducing a risk to zero.
Removal of shear traps by inherently safe design measures
Source: BS PD 5304
Take care to avoid substituting one hazard for another. Avoidance of sharp edges.Safe design & safeguarding
(as per EN ISO 12100 sub clause 6. Replacing spoked pulleys with smooth discs can reduce shearing hazards. can the task that results in the risk be eliminated? Elimination can sometimes be achieved by automation of some tasks such as machine loading. Removing the drive from the end roller of a roller conveyor will reduce the possibility of someone being caught up by the roller. Can the hazard be removed? For example.
presence sensing to prevent unexpected start-up. when the lever or plunger is actuated. fixed guarding. Guards themselves can be fixed to enclose or distance a hazard. This measure can include. usually to permit tasks such as loading/unloading. power-operated or interlocked. quick stopping times)
Light curtains to detect approach to dangerous areas
By finger. hand or body (upto 14mm. or movable such that they are either self-closing.3)
Where inherently safe design is not practicable. The absence of a door or guard reduces the time taken required for loading.
Safety mats to detect persons
Approaching. They work by detecting persons stepping onto the mat and instigating the stopping of the dangerous movement. Safeguarding should prevent persons from coming into contact with hazards. upto 30mm and above 30mm resolution) Light curtains are typically used in material handling. packaging. They are designed for the protection of persons operating or working in the vicinity of machinery. for example. adjustment etc. They make it possible to protect personnel whilst allowing free access to machines. cleaning. and supplement safety products such as light curtains to enable free access for the loading or unloading of machines. inspection or adjustment operations as well as making access easier. setting.Safeguarding & complementary protective measures
(as per EN ISO 12100 sub clause 6. by the stopping of dangerous movement of parts as soon as one of the light beams is broken. or reduce hazards to a safe state. when the guard is opened or the guard hinge rotates through 5° – generally on machines with low inertia (i. etc. warehousing and other applications. before a person can come into contact with them.
. Protection of operators is provided by stopping the machine when the actuator is withdrawn from the head of the switch. interlocked guarding. conveyor.
Typical protective devices used as part of safeguarding systems include:
Interlock switches to detect the position of movable guards for control interlocking. They are mainly designed to ensure the safety of personnel. standing in or climbing into the danger area Safety foot mats are typically used in front of or around potentially dangerous machines or robots. the next step is safeguarding. They provide a protection zone between the machine operators and any dangerous movements.e.
Two such standards available at the time of writing are EN ISO 13849-1 (replacing EN 954-1) and EN 62061.Solenoid interlocks to prevent opening of guards
During dangerous phases of operation. the need to reduce cabling through decentralisation using a fieldbus such as AS-Interface Safety at Work or SafeEthernet. in part.
. where the stopping time is long and it is preferable to permit access only when the dangerous movement has stopped. The choice of logic solver will depend upon many factors including the number of safety inputs to process. mechanically.
Enabling switches to permit access under specific conditions of reduced risk
To areas for fault-finding.e. or even the need to send safety signals/data over long distances across large machines or between machines on large sites. In particular it states “Control systems must be designed and constructed in such a way as to prevent hazardous situations from arising”. These are often used with either a time delay circuit (where machine stopping time is defined and known) or actual detection of zero speed (where stopping times can vary) to permit access only when safe conditions are met. .
Safeguarding will usually involve the use of some kind of control system.
Two hand control stations and footswitches
Used to ensure the operator is standing away from the danger area when causing dangerous movements (e. Interlocking devices should be selected and installed with regard to minimising the possibility of defeat and failure. with a central position and 2 “off” positions (fully released or clenched). driven the evolution of the standards relating to safety related electrical control systems. magnetically or optically. they are used on loads with high inertia i.g. and the Machinery Directive gives various requirements for the performance of the control system. safety controllers or safety PLCs (collectively referred to as “safety logic solvers”).the support for devices shall be sufficiently rigid to maintain correct operation
Monitoring of safety signals – control systems
The signals from safeguarding components are typically monitored using safety relays. . but the use of a control system meeting the requirements of harmonised standard(s) is one means of demonstrating compliance with this requirement of the Machinery Directive.coded devices or systems.
Two such standards available at time of writing include EN ISO 13849-1 (replacing EN 954-1) and EN 62061.physical obstruction or shielding to prevent access to the interlocking device when the guard is open. cost. e. electrically. . commissioning etc (e. which in turn are used to drive (and sometimes monitor) output devices such as contactors. complexity of the safety functions themselves.g. and the overall safeguard should not unnecessarily impede production tasks. Supplementary protection to other personnel can be provided through other measures. The Machinery Directive does not specify the use of any particular standard. jogging and inching). down stroke in press applications) They provide protection primarily to the machine operator. Steps to achieve this include: .g. such as the positioning of light curtains. Unlike non-solenoid interlocks. The now common use of complex electronics and software in safety controllers and safety PLCs has.devices fastened securely in a (fixed) place and requiring a tool to remove or adjust.
Instead they are referred to as a “complementary protective measure”. Even after some iterations of the risk assessment/risk reduction procedure. but these are not as dependable as measures implemented by the designer.Emergency stop
Although emergency stops are required for all machines (the Machinery Directive allows two very specific exemptions) they are not considered to be a primary means of risk reduction. the risk assessment process should be repeated to check that no new risks have been introduced (e. However stop category 2 is not usually considered suitable for emergency stops. They need to be robust. latching must not take place unless the NC contact opens. instructions for use. i. powered guards can introduce trapping hazards) and to estimate whether each risk has been reduced to a tolerable level. dependable.Complementary protective measures .
After risks have been reduced as far as possible by design. which can cause dangerous situations.e. and available at all positions where it might be necessary to operate them. The instructions might also specify measures such as the need for personal protective equipment (PPE) or special working procedures. They are provided as a backup for use in an emergency only. or cable pulled.g.
. Emergency stops on machinery must be “trigger action”. – Stop category 1: a controlled stop with power available to the machine actuators to achieve the stop and then removal of power when the stop is achieved. etc. if the normally-closed contact opens the mechanism must latch. This means that their design ensures that however slowly the button is pressed. Except for machines built to a specific harmonised standard (C Standard) it is for the designer to judge whether the residual risk is tolerable or whether further measures need to be taken. The converse must also be true. and to provide information about those residual risks. EN 60204-1 defines the following three categories of stop functions as follows: – Stop category 0: stopping by immediate removal of power to the machine actuators (uncontrolled stop). in the form of warning labels. Emergency stop devices should comply with EN 60947-5-5. it is likely that there will be some residual risks. and then by safeguarding. – Stop category 2: a controlled stop with power left available to the machine actuators. This prevents “teasing”.
The behaviour of the categories under fault conditions was defined as follows: . ISO 13849-1. IEC 61511. and IEC 61800-5-2 which have all been adopted in Europe and published as ENs.SRP/CS safety related parts of control system in EN ISO 13849-1 standard . 2.Category 2 circuits detect faults by periodic testing at suitable intervals (the safety function can be lost between the periodic tests)
*The safety machine control system is named: . welded contacts etc).SRECS Safety related electrical control system in EN 62061 standard
.ch/zone/fsafety/ A number of standards have been published in recent years that use the concept of functional safety. and were often mistakenly described as ‘Safety Categories’. The user was prompted to subjectively assess severity of injury. but with less probability than category B. rare to frequent.Category 1 can also lead to a loss of the safety function. . frequency of exposure and possibility of avoidance in terms of slight to serious. 1. to arrive at a required category for each safety related part.
A reminder of the principles of EN 954-1
Users of EN 954-1 will be familiar with the old “risk graph” which many used to design their safety related parts of electrical control circuits to the categories B. and possible to virtually impossible. . 3 or 4. Examples include IEC 61508.Category B control circuits are basic and can lead to a loss of the safety function due to a fault.iec. the more it needs to be resistant to faults (such as short circuits. IEC 62061. Functional safety is a relatively recent concept that replaces the old ‘Categories’ of behaviour under fault conditions that were defined in EN 954-1.Functional safety
The IEC have published a series of FAQs related to Functional Safety at http://www.
S1 F1 S2 F2 P1 P2 P1 P2
The thinking is that the more the risk reduction depends upon the safety-related control system* (SRECS).
Category 3 circuits ensure the safety function. and what performance is required for each function. other technology safety-related systems and external risk reduction facilities”. category 3 is always “better” than category 2 and so on. in the presence of a single fault. usually by employing both input and output redundancy. rather than simply relying on particular components. This might be as a result of the misconception that the categories are hierarchical such that for example. but a loss of the safety function can occur in the case of an accumulation of faults
KM1 KM2 KM1
. not just what was expected. but might actually have more suitable functions. Note that it is an attribute of the equipment under control and of the control system. including for example. It applies to all components that contribute to the performance of a safety function. Functional safety standards are intended to encourage designers to focus more on the functions that are necessary to reduce each individual risk.. which means the functions have to be selected correctly. logic solvers such as PLCs and IPCs (including their software and firmware) and output devices such as contactors and variable speed drives. not of any particular component or specific kind of device. In the past there has been a tendency for components specified to a high category of EN 954-1 to be chosen instead of components that have a lower category. input switches. It should also be remembered that the words “correct functioning” mean that the function is correct.Category 4 circuits ensure that the safety function is always available even in the case of one or more faults. for example by employing two (redundant) channels. together with a feedback loop for continuous monitoring of the outputs
Functional safety is “part of the overall safety relating to the EUC* and the EUC control system which depends on the correct functioning of the E/E/PE** safety-related systems. * EUC means Equipment Under Control **Note E/E/PE means Electrical/Electronic/Programmable Electronic.
heavy and misaligned guards can lead to damaged interlock switches unless shock absorbers and alignment pins are fitted. most ‘real-world’ failures are systematic and result from incorrect specification. which defines the required probability that the function will be performed under the specified conditions. This includes a functional specification (what it does.
MTTFd of each channel Low Medium High a b Not covered Not covered Not covered c a b c b c d b c d c d d Not covered Not covered e
Table 2: Simplified procedure for evaluating PL achieved by SRP/CS
From the table above it can be seen that only a category 4 architecture can be used to achieve the highest PLe. which really needs more detailed consideration. the available alternatives are EN 62061 and EN ISO 13849-1. usually by a modification of the design. etc) be? In EN 62061. d. 2 DCavg = medium Cat. This can be calculated from reliability data for each component or sub-system. initially of the functional specification. 3 DCavg = low Cat. Systematic failures are those which are related to a specific cause. upstream or downstream. The performance of each safety function is specified as either a SIL (Safety Integrity Level) in the case of EN 62061 or PL (Performance Level) in the case of EN ISO 13849-1.g. in detail) and a safety integrity specification. and a simplified method of estimating PL is given in Table 7 of the standard. 4 DCavg = high
Table 1: Relationship between SIL and PFHD
Probability of a dangerous Failure per Hour PFHD
>10-8 to <10-7 >10-7 to <10-6 >10-6 to <10-5
MTTFd of each channel = low MTTFd of each channel = medium MTTFd of each channel = high * In several application the realisation of performance level c by category 1 may not be sufficient. vibration. EN 62061 requires a Safety Requirements Specification (SRS) to be drawn up.
Safety Integrity Level “EN IEC 62061”
Performance level “EN ISO 13849-1”
As part of the normal design processes. but that is possible to achieve lower PLs using categories depending upon the mix of MTTFd and DC of the components used. 3 DCavg = medium Cat. c. b. and can only be avoided by removal of that cause. or by ramping-down the speed using a variable speed drive? Is it necessary to lock the guard closed until the dangerous movements have stopped? Will other equipment. a safety integrity requirement is expressed as a target failure value for the probability of dangerous failure per hour of each Safety related control function (SRCF). will the machine be stopped by removing the coil voltage from a contactor. for example. 2 DCavg = low Cat. In this case a higher category e.
It is important to consider each function in detail. In both cases the architecture of the control circuit which delivers the safety function is a factor. humidity.
. and is related to the SIL as shown in Table 3 of the standard:
e Cat. e). which are explained in Annex 2. but unlike EN 954-1 these new standards require consideration of the reliability of the selected components. 1 DCavg = 0 Cat. contactors should be suitably rated and protected against overloads.
How often will the guard be opened? What might be the consequences of a failure of the function? What will the ambient conditions (temperature.
EN ISO 13849-1 uses a combination of the Mean Time To Dangerous Failure (MTTFd). 2 or 3 should be chosen. this specification should lead to the selection of suitable design measures. Diagnostic Coverage (DC) and architecture (category) to determine Performance Level PL (a. For example. The categories are the same as those in EN 954-1. In practice. An example often used is “stop the machine when the guard is open”.Which standards are applicable to the safety function?
Now that EN 954-1 is withdrawn. need to be shut down? How will the opening of the guard be detected? The safety integrity specification must consider both random hardware failures and systematic failures. B DCavg = 0 Cat.
in so far as they apply. Choose 10 years Diagnostic coverage is a measure of how many dangerous failures the diagnostic system will detect. whereas EN ISO 13849-1 is designed to allow an easier transition from EN 954-1. However it should be remembered that whichever standard is chosen must be used in its entirety.Improved electromagnetic compatibility
. Both EN 62061 and EN ISO 13849-1 are harmonised standards that give a Presumption of Conformity to the Essential Requirements of the Machinery Directive. In the meantime a guidance document has been published by IEC as IEC 62061-1. Work is ongoing in a liaison group between IEC and ISO. in order of preference: 1. and they cannot be mixed in a single system. The level of safety can be increased where sub-systems are tested internally using self-diagnostics. Methods in Annexes C and D of EN ISO 13849-1 3. It should be remembered that these certificates are only an indication of the best SIL or PL that can be achieved by a system using that component in a specific configuration. or indeed any other standard. and by ISO as ISO 23849-1.Separation . the designer is free to choose whether to use EN 62061 or EN ISO 13849-1.
Nil Low Medium High
Table 4: Diagnostic Coverage levels
<60% >60% to <90% >90% to <99% >99%
Common Cause Failures (CCF) occur when an external effect (such as physical damage) renders a number of components unusable irrespective of MTTFd.
For the estimation of MTTFd of a component the following data can be used. with the title “Guidance on the application of ISO 13849-1 and IEC 62061 in the design of safety-related control systems for machinery” with the aim of eventually producing a single standard. Manufacturer’s data (MTTFd. and are not a guarantee that a completed system will meet any specific SIL or PL. Steps taken to reduce CCF include: . B10 or B10d) 2.Diversity in the components used and modes in which they are driven .Protection against pollution .
Some component products are available with certification to a specific SIL or PL. EN 62061 is perhaps more comprehensive on the subjects of specification and management responsibilities.Which standard to use?
Table 3: MTTFd levels
MTTFd range
>3 years to <10 years >10 years to <30 years >30 years to <100 years
Unless a C-standard specifies a target SIL or PL.
. where if it did not stop the resulting possible injury could be a broken arm or amputated finger.Control system standards worked examples
Perhaps the best way to understand the application of EN 62061 and EN ISO 13849-1 is by way of the worked examples on the following pages.
For both standards we will use the example where the opening of a guard must cause the moving parts of a machine to stop.
describe each related function (SRCF). etc. . operating modes.Common cause failures (CCF). i. It gives rules for the integration of sub-systems designed in accordance with EN ISO 13849-1.The procedures and resources for recording and maintaining appropriate information.The probability of dangerous transmission errors where digital communication is used. then consider sub-functions and analyse their interactions before deciding on a hardware solution for the safety control system. Loss of power supply. This standard is specific to the machine sector within the framework of EN 61508. expressed in terms of SIL (Safety Integrity Level). With or without redundancy.The probability of a dangerous failure of the components (PFHD). If the function fails. . . With or without diagnostic features making it possible to control some of the dangerous failures. .The type of architecture (A. frequency of operation. A functional safety plan must be drawn up and documented for each design project. . 5. C or D). Design the diagnostic function and check that the specified safety integrity level (SIL) is achieved.The verification and validation plan.
Functional approach to safety
The process starts with analysis of the risks (EN ISO 12100) in order to be able to determine the safety requirements. it would be possible for the machine operator’s arm to be broken or a finger amputated. Select the components for each sub-system.Worked example using standard EN 62061
Safety of Machinery .Electromagnetic interference (EMI). taking into account organisation and authorised personnel. function priorities.Functional Safety of safety-related electrical.Specification of the safety integrity requirements for each function.e. etc. List the safety requirements for each function block and assign the function blocks to the sub-systems within the architecture. electronic and electronic programmable control systems
Safety-related electrical control systems in machines (SRECS) are playing an increasing role in ensuring the overall safety of machines and are more and more frequently using complex electronic technology. Break down each function into a function block structure (FB). pneumatic).
Probability of a dangerous Failure per Hour. Designing a system is split into 5 steps after having drawn up the functional safety plan: 1. including. 2. B. .
In our example. Overvoltage.Table 1 below gives the target maximum failure values for each SIL. consider a function which removes the power to a motor when a guard is opened.
. 3. Based on the risk assessment.The structured and documented design process for electrical control systems (SRECS).The process for management and modification of the configuration.. It does not specify the operating requirements of non-electrical control components in machines (for example: hydraulic. . . The method consists of assigning a SIL to each function. 4.A description of the functions and interfaces. assign a safety integrity level (SIL) and identify the basic structure of the electrical control system (SRECS).
The advantage of this approach is that it can offer a calculation method that incorporates all the parameters that can affect the reliability of control systems. It must include: A specification of the safety requirements for the safety functions (SRCF) that is in two parts: . A particular feature of EN 62061 is that it prompts the user to make an analysis of the architecture to perform the safety functions. taking into account the following parameters: .. . called safety related electrical control system (SRECS). PFHD
. Short-circuits between channels.
. .Step 1 . irreversible injuries or death. Pr.) and the type of access (manual feeding. . It is recommended that a task analysis is used in order to ensure that estimation of the probability of the harm occurring is correctly taken into account.
Fr Pr Av
Probability of occurrence of a hazardous event
Probability of occurrence of that harm
Frequency and duration of exposure Fr
The level of exposure is linked to the need to access the hazardous zone (normal operation. losing an eye or arm Irreversible: broken limb(s). adjustment..
Severity Se
The severity of injuries or damage to health can be estimated by taking into account reversible injuries..
Risk related to the identified hazard
Severity of the possible harm
Irreversible: death.. The recommended classification is shown in the table below:
<1h > 1 h to < 1 day > 1 day to < 2 weeks > 2 weeks to < 1 year > 1 year
Duration > 10 min
. It is then possible to estimate the average frequency and duration of exposure. losing a finger(s) Reversible: requiring attention from a medical practitioner Reversible: requiring first aid
Each of the three parameters Fr. maintenance.Assign a safety integrity level (SIL) and identify the structure of the SRECS
Based on the risk assessment performed in accordance with EN ISO 12100. Av is estimated separately using the least favourable case.). estimation of the required SIL is performed for each safety-related control function (SRCF) and is broken down into parameters. as shown in the illustration below. The recommended classification is shown in the table below.
Basic structure of the SRECS
Before going into detail about the hardware components to be used. and the possibility for a person to identify a hazardous phenomenon. In our example.
Very high Likely Possible Rarely Negligible
3-4 SIL 2 5-7 SIL 2 (OM) 8-10 SIL 2 SIL 1 (OM) 11-13 SIL 3 SIL 2 SIL 1 (OM) 14-15 SIL 3 SIL 3 SIL 2 SIL 1
Probability of avoiding or limiting the harm Av
This parameter is linked to the design of the machine.Probability of occurrence of a hazardous event Pr
Two basic concepts must be taken into account: the predictability of the dangerous components in the various parts of the machine in its various operating modes (normal. troubleshooting). using the terminology given in the standard. In this example. the possibility of physically avoiding the hazard. behaviour of the persons interacting with the machine. fatigue. electrical). etc. All the other parameters must be added together in order to select one of the classes (vertical columns in the table below).
Probabilities of avoiding or limiting harm (AV)
Impossible Rarely Probable 5 3 1
Subsystems Logic solving output
. the system is broken down into sub-systems. which gives: Fr = 5 accessed several times a day Pr = 4 hazardous event probable Av = 3 probability of avoiding almost impossible Therefore a class CI = 5 + 4 + 3 = 12 The safety-related electrical control system (SRECS) of the machine must perform this function with an integrity level of SIL 2. paying particular attention to unexpected restarting. temperature. the degree of severity (Se) is 3 because there is a risk of a finger being amputated. inexperience. processing and output functions. such as stress. It takes into account the suddenness of the occurrence of the hazardous event. the nature of the hazard (cutting. maintenance. 3 sub-systems are necessary to perform the input.
SIL assignment:
Estimation is made with the help of the table below. The figure opposite illustrates this stage. this value is shown in the first column of the table.
so the duty cycle C is 8 operations per hour.Break down each function into a function block structure (FB)
A function block (FB) is the result of a detailed break down of a safety-related function.List the safety requirements for each function block and assign the function blocks to the sub-systems within the architecture. if necessary.2
Motor Power Switching
Contactor 1 Subsystem element 3. These diagnostic functions are considered as separate functions. they may be performed within the sub-system.Select the components for each sub-system
The products shown below are selected.
Guard Sensing
Subsystem 1 (SS1)
safety Switch 1
Subsystem 2 (SS2)
Subsystem 3 (SS3)
SIL target = SIL2
Guard Sensing Function block FB1
Logic Solving Function block FB2
Motor Power Switching Function block FB3
(Subsystem elements) SS1 SILCL 2 Safety Relay SS2 SILCL 2 (Subsystem elements) SS3 SILCL 2
Step 4 .2
. The safety requirements of each block are derived from the safety requirements specification of the corresponding safety-related control function.
Interlock Switch 1 Subsystem element 1. The sub-systems must achieve at least the same SIL capability as assigned to the entire safety-related control function. The cycle length in this example is 450 seconds. In this case the SILCL of each subsystem must be 2.Step 2 . (The standard defines ‘subsystem’ in such a way that failure of any sub-system will lead to the failure of a safety-related control function. or by another sub-system. each with its own SIL Claim Limit (SILCL).e.389 x 10-9 1 000 000
% dangerous failures
The reliability data is obtained from the manufacturer. the guard will be opened 8 times per hour.) More than one function block may be assigned to each sub-system. i.
XCS safety limit switches XPS AK safety logic module LC1 TeSys contactor
Number of operations (B10)
10 000 000 PFHD = 7.
Each function block is assigned to a sub-system in the SRECS architecture. The function block structure gives an initial concept of the SRECS architecture.1 Interlock Switch 2 Subsystem element 1. Each sub-system may include sub-system elements and.1
Contactor 2 Subsystem element 3. diagnostic functions in order to ensure that failures can be detected and the appropriate action taken.
i. to avoid the use of an unrealistically short proof test interval being use to improve the SIL calculation.
The failure rate. where C is the number of operations per hour in the application and B10 is the expected number of operations at which 10% of the population will have failed.125 h (1 000 000/8) = 125 000 Not applicable lDssB =(1 – 0.389x10
Subsystem SS3
PFHD = ? (Architecture B)
Feed back loop not used
lD: rate of dangerous failures (l = x proportion of dangerous failures). of an electromechanical subsystem element is defined as le = 0. B10/C) le = 0.1 • C/B10 e
= le • 20%
= 0. For this example. C: Duty cycle (number of operations per hour).1 x C / B10 . T2: diagnostic test interval.1 • C/B10 = le • 73%
Subsystem SS1
PFHD = ? (Architecture D)
Subsystem SS2
PFHD = 7.Design the diagnostic function
The SIL achieved by the sub-systems depends not only on the components. and also checks the safety limit switches. the safety logic module performs self-diagnostics.
T1: Proof Test Interval or life time. C and D).1
= 0. = 1/8 = 0.
Subsystem element 1. or in the case of electromechanical components the B10D value divided by the rate of operations C. DC: Diagnostic coverage rate = lDD / lDtotal.1 C/B10 lDe = le x proportion of dangerous failures 99% Not Applicable
SS3 2 contactors without diagnostics
Assumed worst case of 10% (10 000 000/8) = 1 250 000 Each demand. SS3: two contactors used in accordance with a type B (redundant with no feedback) architecture The calculation takes into account the following parameters: B10: number of operations at which 10% of the population will have failed. whichever is smaller. SS1 2 monitored limit switches
Failure rate for each element le Dangerous failure rate for each element lDe DC Common cause failure factor b T1 Diagnostic test interval T2 Dangerous failure rate for each subsystem Formula for architecture B: Formula for architecture D for subsystems with the same design lDssD = (1 – b)2 {[ lDe2 x 2 x DC ] x T2/2 + [ lDe2 x (1 – DC) ] x T1} + b x lDe T1 = min (life time. SS2: a SILCL 3 safety logic module (determined from the data. In this architecture. The standard states that designers should use a lifetime of 20 years. provided by the manufacturer). as specified by the manufacturer.Step 5 . including PFHD. 8 times per hour. b: common cause failure factor: see Annex F of the standard.1 • C/B10 = le • 73%
Subsystem element 1. the ratio between the rate of detected dangerous failures and the rate of total dangerous failures. However it recognises that electromechanical components can need replacement when their specified number of operations is reached. Therefore the figure used for T1 can be the manufacturer’s quoted lifetime.e.2
Subsystem element 3. There are three sub-systems for which the SILCLs (SIL Claim Limits) must be determined: SS1: two safety limit switches in a sub-system with a type D (redundant) architecture.9)2 x lDe1 x lDe2 x T 1 + b x (lDe1 + lDe2 )/2
lDssB =(1 – b)2 x lDe1 x lDe2 x T 1 + b x (lDe1 + lDe2 )/2
. In this example we will consider C = 8 operations per hour.1
Subsystem element 3. but also on the architecture selected.2
= 0. we will choose architectures B for the contactor outputs and D for the limit switch (See Annex 1 of this Guide for explanation of architectures A. l. B.1 • C/B10
= le • 20% De
1 x 5.<99% >=99%
Hardware fault tolerance (HFT) 0 1 2 Not allowed SILCL 2 SILCL 1 (For exceptions see note 3) SILCL 1 SILCL 2 SILCL 3 SILCL 2 SILCL 3 SILCL 3
Note 1: A hardware fault tolerance of N means that N+1 faults could cause a loss of the safety related control function.1 •C / B10 = 0.684 x 10-8. they need additional diagnostic coverage.6 x 10-9 Since PFHDssD = lDssD x 1h.1 x C / 1 000 000) = 5.84 x 10-7 x 5. 125 000) = 125 000 hours lDssB = (1 – 0.453 x 10-8) + (5.7
SILCL 3 SILCL 3 SILCL 3
(See note 2) (See note 2)
For Subsystem elements of the same design lDssD = (1-b)2 {[lDe2 x 2 x DC] T2/2 + [lDe2 x (1-DC)] x T1} + b x lDe PFHDssD = lDssD x 1h In this example b = 0.1 X C / 1 000 000) = 0.84 x 10-7 x 2 x 0. referring to table 5 it becomes possible to achieve up to SIL CL 3.84 x 10-7 x 125 000 + 0.2 of the standard PFHDssD = lDssD x 1h le= 0.24 x 10-13 + 1.84 x 10-7 x 5.81 x 5. For SIL 4 see IEC 61508-1. the stated maximum SIL claim limit that can be achieved is actually SILCL 1. PFHD
LC1D TeSys contactors feature mirror contacts
. thus.84 x 10-7 = (3. and in the case of architecture B where the safe failure fraction is lessthan 60% (the safe failure fraction is 27% for contactors) and the hardware fault tolerance is 1. see 6.73 (0.84 x 10-7 x (1-0. Table 5 of EN 62061 places architectural constraints upon achieving a particular SIL claim limit.81x 3.1)2 {[ 1.2.6 x 10-8 DC = 99% b = 10% (worst case) T1 = min (life time.39 x 10-9 + 6. for Subsystem elements of the same design: lDssD = (1 – 0.56 x 10-17 + 2.6.6 x 10-9 + 7.99 ] x 0. However. For the type B architecture (single fault tolerant.753 x 10-13 x 0. This means the subsystem has a SILCL of 3
For the limit switches in Subsystem SS1.
Note: the wiring of the contactors back into the safety relay also changes the Safe Failure Fraction of the contactor subsystem from less than 60% to greater than 99% (a dangerous failure of one of the contactors will prevent a restart). This means that the overall SIL of this system can not be greater than 1.84 x 10-7 = 0.99) ] x 87 600} + 0.4 of for subsystems where fault exclusions have been applied to faults that could lead to a dangerous failure.84 x 10-7 x 125 000 + 0.84 x 10-7 x 5.753 x 10-13) 0.84 x 10-8 = (3.84 x 10-7 T1 = min (life time.1 x 8/10 000 000 = 8 x 10-8 lDe= le x 0. lDssD = (1 – 0.44 x 10-9) + (5.1)2 x 5. In order to achieve greater than SILCL 1 for the contactors. b = 0.6 x 10-8 x 2 x 0.<90% 90% . 1 000 000/8) = min (175 200.1 lDe1 = lDe2 = 0.1 x 125 000) + 5. the PFHDssD for the contactor subsystem in architecture B is 6.92 (6.29 x 10-8 This is within the limits of SILCL 2 and SILCL 3.125 hour From D. without diagnostics) the probability of dangerous failure of the subsystem is: lDssB =(1 – b)2 x lDe1 x lDe2 x T1 + b x (lDe1 + lDe2 )/2 [Equation B of the standard] PFHDssB = lDssB x 1h In this example.58 x 10-8 All of the subsystems have SIL claim limits within SILCL 3. thus achieving a type D architecture with a SFF of >99% and a SILCL of 3 (calculation follows).99] 0. and is therefore: PFHDSRECS = PFHDSS1 + PFHDSS2 + PFHDSS3 = 1. B10/C) = min (175 200.684 x 10-8 Since PFHDssD = lDssD x 1h.84 x 10-8) = 9.0625 + (6.125 hour DC = 0. and the calculation above results in an overall SIL for the system within the limits of SIL 3.73(0.6 x 10-8 x 1.84 x 10-7 = 0. 125 000) = 125 000 hours T2 = 1/C = 1/8 hour = 0.7.41056 x 10-13 x 125000 + 0.1)2 {[5.1 x ((5. B10/C) = min[87600. B10/C) = min (175 200. Note 3: See 6.84 x 10-8) = 6.99)] x 125 000} + 0. Note 2: A SIL 4 claim limit is not considered in this standard.1 lDe = 0.1 x 5.84 x 10-7 x 5. PFHD for the limit switches in Subsystem SS1 = 1.63 x 10-9 We already know that for Subsystem SS2. which are in architecture D D.68 x 10-8 = 7.2 = 1.(10 000 000/8)] = 87 600 hours T2 = 1/C = 1/8 = 0.7.6 x 10-8 = 2.84 x 10-7) + (5.73(0.84 x 10-7 T1 = min (life time.8/1 000 000) = 5.6 x 10-8 x (1 – 0.883 x 10-14) + (8.125 /2 + [1.6 x 10-9 = 1.125 /2 + [5.1 x 1.99 (achieved by feeding the mirror contacts from both contactors in to the safety relay to detect contactor welds)
Probability of a dangerous Failure per Hour.29 x 10-8 Since PFHDssB = lDss x 1h.6 x 10-8 x 1. and in the case of Schneider Electric contactors this can be achieved by wiring the mirror contacts (n/c auxiliaries) back into the safety relay “external device monitoring” input (EDM).
Safe failure fraction (SFF) <60% 60% .84 x 10-7 ))/2 = 0. PFHD for the contactors in Subsystem SS3 = 9. 1 000 000/8) = min (175 200. PFHD for the logic solver Function Block (implemented by the safety relay XPSAK) is 7.Looking at the output contactors in subsystem SS3 we need to calculate the PFHD.389 x 10-9 (manufacturer’s data) The overall PFHD for the safety related electrical control system (SRECS) is the sum of the PFHDs for all the Function Blocks.1 x 5.
STEP 1: As in the previous example.1 of EN ISO 13849-1. the process can be considered to comprise a series of 6 logical steps. STEP 3: Identify the combination of safety-related parts which carry out the safety function.The Common Cause Failures (see score table in Annex F of EN ISO 13849-1)
For more detail please refer to Annex 2 of this Guide.Worked example using standard EN ISO 13849-1
Safety of machinery . in other words category 3 architecture without feedback
Safety Switch 1 SW1
Safety relay XPS Safety Switch 2 SW2 Contactor 2 CON2
STEP 4: The PL of the SRP/CS is determined by estimation of the following parameters: (see Annex 2): . H L S = = = High contribution to reduction of the risk by the control system Low contribution to reduction of the risk by the control system Severity of injury S1 = Slight (normally reversible injury) S2 = Serious (normally irreversible injury including death) Frequency and/or exposure time to the hazard F1 = seldom or less often and/or the exposure time is short F2 = frequent to continuous and/or the exposure time is long Possibility of avoiding the hazard or limiting the harm P1 = possible under specific conditions P2 = scarcely possible
The manufacturer gives the following data for the components:
Example SRP/CS Safety limit switches Safety logic module XPSAK Contactors
B10 (operations) 10 000 000
154.The MTTFd for the single components (see Annexes C & D of EN ISO 13849-1) . he can only give B10 or B10d data for the electromechanical components. the required Performance Level is d (note: PL d is often compared to SIL 2 as “equivalent”).Part 1: General principles for design
As with EN 62061. STEP 4: Evaluate the Performance Level PL for the all safety-related parts. This explains why no manufacturer should provide an MTTFd figure for an electromechanical device.Safety-related parts of control systems .5 1 000 000
Note that because the manufacturer does not know the application details.The CATEGORY (structure) (see Clause 6 of EN ISO 13849-1).
STEP 3: The same basic architecture as in the previous example for EN 62061 will be considered.
*Safety related part of control system (name of safety machine control system in EN ISO 13849-1 standard). STEP 5: Verify that the PL of the SRP/CS* for the safety function is at least equal to the PLr. STEP 1: Risk Assessment and identification of the necessary safety functions.The Diagnostic Coverage (see Annex E of EN ISO 13849-1) .
. STEP 2: Determine the required Performance Level (PLr) for each safety function. and the same parameters as in the previous example. STEP 6: Validate that all requirements are met (see EN ISO 13849-2). Note that in this example the use of a category 3 architecture means that the mirror contacts on the contactors are not used. STEP 2: Using the “risk graph” from Figure A. we need a safety function to remove the power supply to the motor when the guard is open. and specifically the cycle rate of the electromechanical devices.
1 MTTFd = 1 9469 years + 1 154. Without specific knowledge of which mode in which a component is being used. B10 is number of operations at which 10% of the population will have failed. 4 DCavg = high
SW1 MTTFd = 9469y XPS SW2 MTTFd = 9469y MTTFd = 154. it can be seen from the table below (fig.4% . nop will be 52800 operations per year.1 x nop) Where nop is the mean annual number of operations. a high MTTFd and a high average Diagnostic Coverage (DCavg). this is “high” according to Table 4 Knowing that we have a category 4 architecture. which meets the required PL d. Assuming that B10d = B10/20%. referring to Table 7 of the standard shows that the resulting Performance Level is PL e.5 259 DC 99% 99% 0%
STEP 5: Verify that the PL of the system matches the required PL (PLr) Knowing that we have a category 3 architecture. 5 of the standard) that we have met PL d. this is “high” according to Table 3 From the equations in Annex E of the standard we can determine that DCavg = 62.5 years + 1 259 years = 1 95. the table becomes: Example SRP/CS Safety limit switches Safety logic module XPSAK Contactors 1 000 000 1 369 863 B10 (operations) 10 000 000 B10d 50 000 000 MTTFd (years) 9469 154. 2 DCavg = medium Cat.5y
CON1 MTTFd = 259y
Safety category level EN ISO MTTFd of each channel = low MTTFd of each channel = medium MTTFd of each channel = high
CON2 MTTFd = 259y
In this example the calculation is identical for channels 1 and 2: STEP 6: Validation – check working and where necessary test (EN ISO 13849-2).The MTTFd for components can be determined from the formula: MTTFd = B10d / (0. 2 DCavg = low Cat. Just as in the EN 62061 worked example. for a limit switch the % of dangerous failure is 20%. Doing this converts DCavg to 99% . B DCavg = 0 Cat. which matches the PL r. a high MTTFd and a low average Diagnostic Coverage (DCavg). therefore B10d = B10/20% Assuming the machine is used for 8 hours a day. this is “low” according to Table 4
. it only takes the wiring of both contactors’ normally closed auxiliary mirror contacts back to the external device monitoring input of the safety relay to change the architecture to category 4. with a cycle time of 120 seconds. 3 DCavg = medium Cat. and hence what constitutes a dangerous failure. The MTTFd can be calculated for each channel by using the parts count method in Annex D of the standard.85 years
The MTTFd for each channel is therefore 95 years. B10d is the expected time at which 10% of the population will have failed in a “dangerous” mode. 3 DCavg = low Cat.
e Cat. for 220 days per year.
The MTTFd figures in bold red have been derived from the application data using the cycle rates and B10d data. 1 DCavg = 0 Cat.
org European Committee for Standardisation (CEN) .be European Committee for Electrotechnical Standardisation (CENELEC) .eu International Electrotechnical Commission (IEC) . Functional safety of safety-related electrical.Risk assessment and risk reduction EN 60204 Safety of machinery.Sources of information
European Machinery Directive 2006/42/EC EN ISO 12100 2010 Safety of machinery . Ref.General principles for design .www. General requirements EN ISO 13850 Safety of machinery.www.www.iso. Emergency stop.www.Safety-related parts of control systems Part 2: Validation
Schneider Electric documents
Schneider Electric “Safety Functions and solutions using Preventa” Catalogue 2011.org
.www. Electrical equipment of machines. electronic and programmable electronic control systems EN 61508 Functional safety of electrical/electronic/programmable electronic safety related systems EN ISO 13849-1 Safety of machinery .Safety-related parts of control systems Part 1: General principles for design EN ISO 13849-2 Safety of machinery .newapproach. MKTED211042EN
New approach standardisation in the internal market .cen. Principles for design EN 62061 Safety of machinery.iec.cenelec.ch Internation Organisation for Standardisation (ISO) .
b)2 • lDe1 • lDe2 • T1 + b • (lDe1 + lDe2)/2 PFHDSSB = lDSSB • 1h
Subsystem element 1 lDe1 Common cause failure
Subsystem element 2 lDe2
Logical representation of the subsystem
..1 from EN 62061) lDSSB = (1 .Annexes architectures
Architectures of EN 62061
Architecture A: Zero fault tolerance. + lDen PFHDSSA = lDSSA • 1h
Subsystem element 1 lDe1 Subsystem element 1 lDen
Architecture B: Single fault tolerance. no diagnostic function Where: T1 is the proof test interval or life time whichever is smaller (Either from the supplier or calculate for electromechanical product by: T1 = B10/C) b is the susceptibility to common cause failures (b is determined using the Score Table F. no diagnostic function Where: lDe is the rate of dangerous failure of the element lDSSA = lDE1 + ..
at switch on.
Test Equipment Input 1 im Logic 1
im m im m
Test Output Output 1
SRP/CS to Category 3 shall be designed so that a single fault in any of these safety-related parts does not lead to the loss of the safety function. with a diagnostic function Where: DC is the diagnostic coverage = S lDD/lD lDD is the rate of detected dangerous failure and lD is the rate of total dangerous failure The DC depends on the effectivity of the diagnostic function used in this subsystem lDSSC = lDe1 • (1 . DC = diagnostic coverage of the subsystem element 1 or 2 lDSSD = (1-b)2 {[lDe2 • 2 • DC] T2/2 + [lDe2 • (1-DC)] • T1} + b • lDe PFHDSSD = lDSSD • 1h
Diagnostic function(s)
Categories of EN ISO 13849-1 Category Category B Description
When a fault occurs it can lead to the loss of the safety function im
Architecture D: Single fault tolerance.
. with a diagnostic function Where: T1 is the proof test interval or life time whichever is smaller T2 is the diagnostic test interval (At least equal to the time between the demands of the safety function) b is the susceptibility to common cause failures (To be determined with the score table in Annex F of EN 62061) DC is the diagnostic coverage = S lDD/lD (lDD is the rate of the detected dangerous failure and lD is the rate of the total dangerous failure)
Subsystem element 1 lDe1
When a fault occurs it can lead to the loss of the safety function. DC1 = diagnostic coverage of subsystem element 1 lDe2 = dangerous failure rate of subsystem element 2. If this detection is not possible an accumulation of undetected faults shall not lead to the loss of the safety function. and the single fault is detected on or before the next demand upon the safety functions.Architecture C: Zero fault tolerance.g. DC2 = diagnostic coverage of subsystem element 2 lDSSD = (1-b)2 {[lDe1• lDe2 (DC1 + DC2)]•T2/2 + [lDe1• lDe2•(2-DC1-DC2)]•T1/2}+b• (lDe1+ lDe2)/2 PFHDSSD = lDSSD • 1h
Subsystem element 1 lDe1 Subsystem element n lDen
For Subsystem elements of the same design lDe = dangerous failure rate of subsystem element 1 or 2.DCn) PFHDSSC = lDSSC • 1h
Architecture D: Single fault tolerance. e. the loss of the safety function is detected by the check.. with a diagnostic function For Subsystem elements of different design lDe1 = dangerous failure rate of subsystem element 1. but the MTTFd of each channel in Category 1 is higher than in Category B. + lDen • (1 . immediately.DC1) + .
Diagnostic function(s) Common cause failures
Category 2 system behaviour allows that: the occurrence of a fault can lead to the loss of the safety function between the checks. Whenever reasonably possible the single fault shall be detected at or before the next demand upon the safety function SRP/CS to Category 4 shall be designed so that a single fault in any of these safety-related parts does not lead to the loss of the safety function. Consequently the loss of the safety function is less likely.. at end of a machine operation cycle.
837703 Due to evolution of standards and equipment. Design: BlueLoft Photos: Schneider Electric Print: 03 / 2011
.Schneider Electric Industries SAS
DIA4ED1100102EN Head Office 35. characteristics indicated in the text and images in this document are not binding only after confirmation by our departments.schneider-electric.com ART. rue Joseph Monier – CS 30323 F92506 Rueil-Malmaison Cedex FRANCE www.
Recommended DocumentsDocuments Similar To ..Skip carouselSayNotoSafetyReliabilityCal Final16_Autronica_JSchexnayderIEC 61508-2;2010(E)(F)f 5 Applied AutomationAchieving Hardware Fault Tolerancehimasela-april06Reer Mosaic user manualWorking Under PressureSafety ManualéSil Manual GmiSIL Manual for Plant Maintenance and Engineering IEC61508 IEC61511Ti350FPED 97-23-ECML040690441 - The NRC’s Guidelines for External Risk CommunicationAre Political Risks the greatest emerging threat to improved fire safetyDirective 97 23 EGRA 002 - Engine Casing Exhaust Funnel - Hot WorkA Ccis Report 31Gas Safety Plansample-project-plan-template.docintroduction to eCreating Risk Culture a FrameworkEn 12101-2 SHEV-Info English405Data Management for Risk in Capital MarketsRG 1.174 (Rev 2)PF3204 Risk ManagementGlobal HRM Tool Governance and Risk Management Controlsnera-volume-5.pdfBHADDocuments About RiskSkip carouselEBITDA Used and Abused Nov-20141Building a Reputation Risk Management Capability Natural Hazards, UnNatural DisastersHoward Marks - Investing in Uncertain TimesGovernment Support to Agricultural InsuranceGlobal Risks Report 2009A Workbook on Planning for Urban Resilience in the Face of DisastersGoldman's Lloyd Blankfein Testimony to LawmakersPetroleum Exploration and Production RightsFinancial System Supply-Chain Cross-Contagion - A Study in Global Systemic CollapseHoward Marks - The Role of Confidence_08!05!13IFC's Performance Standard 1The Middle East and North Africa at Risk 2010Public-Private Partnership in Housing and Urban DevelopmentAmerica's Climate Choices, Report in BriefPershing Square Q3 2008 Investor LetterJohn Mack's Year-End Message for 2009Marks_Dare to Be Great IIPEFC ST 2002-2013 CoC Standard - Second EditionCities and FloodingDisaster Risk ReductionGlobal Risks Report 2012Hedge YeConfessions of a Value Investor- A Few Lessons in Behavioral FinanceRiskmap Report 2011Mamis Last LetterCitadel LetterBrookfield Letter to General Growth re Reorganization PlanNevsky Newsletter 151231Einhorn Vic 2009 SpeechMore From bbulutmmSkip carouselMinimum Aydinlik DuzeyleriMinimum Aydinlik DuzeyleriDöner Fırın EğitimStep 1.2.5 Awareness Presentation TemplateUTP 7013FilterSense Particulate Monitoring and Control Solutions LowRes Rev a - DynaCHARGE 100 SeriesBag FiltersAeration HoseAir SlideHidroliin temel presnsipleriArticleb w Products 2011 WebFlo Way BrochureFlo Way PresentationCeramite T fArıza Oranı3 Fazlı Asenkron Motorlarda Arızalar Ve Verime EtkileriVOITH OilFill Chart SmallFlender Turbo Yag -Kw IlşkisiSiemens Flender Kaplin KataloguMagnaDnrive MGD-MGTL BrochureMagnadrive PresentationMD Comparison TR2MAGNADRIVEMGDMGTL2008_4MagnaDrive MGE BrochureVacu ValveAltmayer Aeration nozzle in G + ESiemens Flender Kaplin KataloguFlender n EupexFilterSense Particulate Monitoring and Control Solutions LowRes Rev a - DynaCHARGE 100 Series