Category Archives: Control Reliability

31-​​Dec-​​2011 — Are YOU ready?

Posted by on December 30, 2011 2 comments
This entry is part 8 of 8 in the series Circuit Architectures Explored

31-​​December-​​2011 marks a key mile­stone for machine builders mar­ket­ing their prod­ucts in the European Union, the EEA and many of the Candidate States. Functional Safety takes a pos­i­tive step for­ward with the manda­tory appli­ca­tion of EN ISO 13849–1 and –2. As of 1-​​January-​​2012, the safety–related parts of the con­trol sys­tems on all machin­ery bear­ing a CE Mark will be required to meet these standards.

This change started six years ago, when these stan­dards were first har­mo­nized under the Machinery Directive. The EC Machinery Committee gave machine builders an addi­tional three years to make the tran­si­tion to these stan­dards, after much oppo­si­tion to the orig­i­nal manda­tory imple­men­ta­tion date of 31-​​Dec-​​08 was announced.

If you aren’t aware of these stan­dards, or if you aren’t famil­iar with the con­cept of func­tional safety, you need to get up to speed, and fast.

Under EN 954–1:1995 and the 1st Edition of ISO 13849–1, pub­lished in 1999, a designer needed to select a design Category or archi­tec­ture, that would pro­vide the degree of fault tol­er­ance and reli­a­bil­ity needed based on the out­come of the risk assess­ment for the machin­ery. The Categories, B, 1–4, remain unchanged in the 2nd Edition. I’ve talked about the Categories in detail in other posts, so I won’t spend any time on them here.

The 2nd Edition brings Mean Time to Failure into the pic­ture, along with Diagnostic Coverage and Common Cause Failures. These new con­cepts require design­ers to use more ana­lyt­i­cal tech­niques in devel­op­ing their designs, and also require addi­tional doc­u­men­ta­tion (as usual!).

One of the main fail­ings with EN 954–1 was Validation. This topic was sup­posed to have been cov­ered by EN 954–2, but this stan­dard was never pub­lished. This has led machine builders to make design deci­sions with­out keep­ing the nec­es­sary design doc­u­men­ta­tion trail, and fur­ther­more, to skip the Validation step entirely in many cases.

The miss­ing Validation stan­dard was finally pub­lished in 2003 as ISO 13849–2:2003, and sub­se­quently adopted and har­mo­nized in 2009 as EN ISO 13849–2:2003. While no manda­tory imple­men­ta­tion date for this stan­dard is given in the cur­rent list of stan­dards har­mo­nized under 2006/​42/​EC-​​Machinery, use of Part 1 of the stan­dard man­dates use of Part 2, so this stan­dard is effec­tively manda­tory at the same time.

Part 2 brings a num­ber of key annexes that are nec­es­sary for the imple­men­ta­tion of Part 1, and also out­lines the com­plete doc­u­men­ta­tion trail needed for val­i­da­tion, and coin­ci­den­tally, audit. Notified bpdies will be look­ing for this infor­ma­tion when eval­u­at­ing the con­tent of Technical Files used in CE Marking.

From a North American per­spec­tive, these two stan­dards gain access through ANSI’s adop­tion of ISO 10218 for Industrial Robots. Part 1 of this stan­dard, cov­er­ing the robot itself, was adopted last year. Part 2 of the stan­dard will be adopted in 2012, and RIA R15.06 will be with­drawn. At the same time, CSA will be adopt­ing the ISO stan­dards and with­draw­ing CSA Z434.

These changes will finally bring North America, the International Community and the EU onto the same foot­ing when it comes to Functional Safety in indus­trial machin­ery appli­ca­tions. The days of “SIMPLE, SINGLE CHANNEL, SINGLE CHANNEL-​​MONITORED and CONTROL RELIABLE” are numbered.

Are you ready?

Compliance InSight Consulting will be offer­ing a series of train­ing events in 2012 on this topic. For more infor­ma­tion, con­tact Doug Nix.

Inconsistencies in ISO 13849–1:2006

Posted by on November 10, 2011 1 comment
This entry is part 7 of 8 in the series Circuit Architectures Explored

I’ve writ­ten quite a bit recently on the topic of cir­cuit archi­tec­tures under ISO 13849–1, and one of my read­ers noticed an incon­sis­tency between the text of the stan­dard and Figure 5, the dia­gram that shows how the cat­e­gories can span one or more Performance Levels.

ISO 13849-1 Figure 5

ISO 13849–1, Figure 5: Relationship between Categories, DC, MTTFd and PL

 If you look at Category 2 in Figure 5, you will notice that there are TWO bands, one for DCavg LOW and one for DCavg MED. However, read­ing the text of the def­i­n­i­tion for Category 2 gives (§6.2.5):

The diag­nos­tic cov­er­age (DCavg) of the total SRP/​CS includ­ing fault-​​detection shall be low.

This leaves some con­fu­sion, because it appears from the dia­gram that there are two options for this archi­tec­ture. This is backed up by the data in Annex K that under­lies the diagram.

The same con­fu­sion exists in the text describ­ing Category 3, with Figure 5 show­ing two bands, one for DCavg LOW and one for DCavg MED.

I con­tacted the ISO TC199 Secretariat, the peo­ple respon­si­ble for the con­tent of ISO 13849–1, and pointed out this appar­ent con­flict. They responded that they would pass the com­ment on to the TC for res­o­lu­tion, and would con­tact me if they needed addi­tional infor­ma­tion. As of this writ­ing, I have not heard more.

So what should you do if you are try­ing to design to this stan­dard? My advice is to fol­low Figure 5. If you can achieve a DCavg MED in your design, it is com­pletely rea­son­able to claim a higher PL. Refer to the data in Annex K to see where your design falls once you have com­pleted the MTTFd calculations.

Thanks to Richard Harris and Douglas Florence, both mem­bers of the ISO 13849 and IEC 62061 Group on LinkedIn for bring­ing this to my attention!

If you are inter­ested in con­tact­ing the TC199 Secretariat, you can email the Secretary, Mr. Stephen Kennedy  (kennedyatisodotorg)  . More details on ISO TC199 can be found on the Technical Committee page on the ISO web Site.

Copyright secured by Digiprove © 2011
Acknowledgements: ISO for sec­tions of ISO 13849–1 cited more…
Some Rights Reserved

Interlock Architectures Pt. 6 — Comparing North American and International Systems

Posted by on October 3, 2011 Comments Off
industrial Control Console
This entry is part 6 of 8 in the series Circuit Architectures Explored

I’ve now writ­ten six posts, includ­ing this one, on the topic of cir­cuit archi­tec­tures for the safety–related parts of con­trol sys­tems. In this post, we’ll com­pare the International and North American sys­tems. This com­par­i­son is not intended to draw con­clu­sions about which is “bet­ter”, but rather to com­pare and con­trast the two sys­tems so that design­ers can clearly see where the over­laps and the gaps in the sys­tems exist.

Since we’ve spent a lot of time talk­ing about ISO 13849–1 [1] in the pre­vi­ous five posts in this series, I think we should begin there by look­ing at Table 10 from the standard.

Table 10 — Summary of require­ments for cat­e­gories
Category Summary of requirements System behaviour Principle used
to achieve
safety		 MTTFd
of each
chan­nel		 DCavg CCF
B
(see
6.2.3)		SRP/​CS and/​or their pro­tec­tive equip­ment, as well as their com­po­nents, shall be designed, con­structed, selected, assem­bled and com­bined in accor­dance with rel­e­vant stan­dards so that they can with­stand the expected influence.

Basic safety prin­ci­ples shall be used.

The occur­rence of a fault can lead to the loss of the safety function.Mainly char­ac­ter­ized by selec­tion of componentsLow to mediumNoneNot rel­e­vant
1
(see
6.2.4)		Requirements of B shall apply. Well-​​tried com­po­nents and well-​​tried safety prin­ci­ples shall be used.The occur­rence of a fault can lead to the loss of the safety func­tion but the prob­a­bil­ity of occur­rence is lower than for cat­e­gory B.Mainly char­ac­ter­ized by selec­tion of componentsHighNoneNot rel­e­vant
2
(see
6.2.5)		Requirements of B and the use of well-​​tried safety prin­ci­ples shall apply. Safety func­tion shall be checked at suit­able inter­vals by the machine con­trol system.The occur­rence of a fault can lead to the loss of the safety func­tion between the checks. The loss of safety func­tion is detected by the check.Mainly char­ac­ter­ized by structureLow to highLow to mediumSee Annex F
3
(see
6.2.6)		Requirements of B and the use of well-​​tried safety prin­ci­ples shall apply.

Safety-​​related parts shall be designed, so that

—a sin­gle fault in any of these parts does not lead to the loss of the safety func­tion, and

—when­ever rea­son­ably prac­ti­ca­ble, the sin­gle fault is detected.

When a sin­gle fault occurs, the safety func­tion is always performed.

Some, but not all, faults will be detected.

Accumulation of unde­tected faults can lead to the loss of the safety function.

 Mainly
char­ac­ter­ized
by struc­ture		Low to
high		Low to
medium		 See
Annex F
 4
(see
6.2.7)

Requirements of B and the use of well-​​tried safety prin­ci­ples shall apply. Safety-​​related parts shall be designed, so that
—a sin­gle fault in any of these parts does not lead to a loss of the safety func­tion, and

—the sin­gle fault is detected at or before the next demand upon the safety func­tion, but that if this detec­tion is not pos­si­ble, an accu­mu­la­tion of unde­tected faults shall not lead to the loss of the safety function.

 

When a sin­gle fault occurs the safety func­tion is always per­formed. Detection of accu­mu­lated faults reduces the prob­a­bil­ity of the loss of the safety func­tion (high DC). The faults will be detected in time to pre­vent the loss of the safety function. Mainly char­ac­ter­ized by structure High High includ­ing accu­mu­la­tion of faults See Annex F
NOTE For full require­ments, see Clause 6.

Table 10 sum­ma­rizes all the key require­ments for the five cat­e­gories of archi­tec­ture, giv­ing the fun­da­men­tal mech­a­nism for achiev­ing safety, the required MTTFd, DC and CCF. Note that fault exclu­sion can be used in Categories 3 and 4. There is no sim­i­lar table avail­able for CSA Z432 [2] or RIA R 15.06 [3], so I have con­structed one fol­low­ing a sim­i­lar for­mat to Table 10.

Summary of require­ments for CSA Z432 /​ Z434 and RIA R15.06
 CSA Z432-​​04 /​ Z434-​​03RIA R15.06 1999
Category Summary of requirements System behav­iour Principle used
to achieve
safety		Summary of requirements
AllSafety con­trol sys­tems (elec­tric, hydraulic, pneu­matic) shall meet one of the per­for­mance cri­te­ria listed in Clauses 4.5.2 to 4.5.5.

Safety cir­cuits (elec­tric, hydraulic, pneu­matic) shall meet one of the per­for­mance cri­te­ria listed in 4.5.1 through 4.5.4.2

2 These per­for­mance cri­te­ria are not to be con­fused with the European cat­e­gories B to 3 as described in ISO/​IEC DIS 13849–1, Safety of machin­ery – Safety-​​related parts of con­trol sys­tems – Part 1: General prin­ci­ples for design (in cor­re­la­tion with EN 954–1.) They are dif­fer­ent. The com­mit­tee believes that the cri­te­ria in 4.5.1–4.5.4 exceed the cri­te­ria of B — 3 respec­tively, and fur­ther believe the reverse is not true.

SIMPLESimple safety con­trol sys­temsshall be designed and con­structed using accepted sin­gle chan­nel circuitry.

Such sys­tems may be programmable.

Note: This type of sys­tem should be used for sig­nalling and annun­ci­a­tion pur­poses only.

The occur­rence of a fault can lead to the loss of the safety function. Mainly char­ac­ter­ized by com­po­nent selection.Simple safety cir­cuits shall be designed and con­structed using accepted sin­gle chan­nel
cir­cuitry, and may be programmable.
SINGLE
CHANNEL		Single chan­nel safety con­trol sys­tems shall

a) be hard­ware based or com­ply with Clause 6.5;

b) include com­po­nents that should be safety rated; and

c) be used in accor­dance with man­u­fac­tur­ers’ rec­om­men­da­tions and proven cir­cuit designs (e.g., a sin­gle chan­nel electro­mechan­i­cal pos­i­tive break device that sig­nals a stop in a de-​​energized state).

Note: In this type of sys­tem a sin­gle com­po­nent fail­ure can lead to the loss of the safety function.

The occur­rence of a fault can lead to the loss of the safety function. Mainly char­ac­ter­ized by com­po­nent selection.Single chan­nel safety cir­cuits shall be hard­ware based or com­ply with 6.4, include com­po­nents
which should be safety rated, be used in com­pli­ance with man­u­fac­tur­ers’ rec­om­men­da­tions
and proven cir­cuit designs (e.g. a sin­gle chan­nel electro-​​mechanical pos­i­tive break device which sig­nals a stop in a de-​​energized state.) 

SINGLE CHANNEL
WITH
MONITORING

Single chan­nel safety con­trol sys­tems with mon­i­tor­ing shall include the require­ments for sin­gle chan­nel,
be safety rated, and be checked (prefer­ably auto­mat­i­cally) at suit­able inter­vals in accor­dance with the following:

a) The check of the safety function(s) shall be performed

i) at machine start-​​up; and

ii) peri­od­i­cally dur­ing oper­a­tion (prefer­ably at each change in state).

b) The check shall either

i) allow oper­a­tion if no faults have been detected; or

ii) gen­er­ate a stop if a fault is detected. A warn­ing shall be pro­vided if a haz­ard remains after ces­sa­tion of motion.

c) The check itself shall not cause a haz­ardous sit­u­a­tion.

d) Following detec­tion of a fault, a safe state shall be main­tained until the fault is cleared.

Note: In this type of cir­cuit a sin­gle com­po­nent fail­ure can also lead to the loss of the safety function.

The occur­rence of a fault can lead to the loss of the safety function.Characterized by both com­po­nent selec­tion and structure.Single chan­nel with mon­i­tor­ing safety cir­cuits shall include the require­ments for sin­gle chan­nel,
shall be safety rated, and shall be checked (prefer­ably auto­mat­i­cally) at suit­able intervals.

a) The check of the safety function(s) shall be performed

1) at machine start-​​up, and

2) peri­od­i­cally dur­ing operation;

b) The check shall either:

1) allow oper­a­tion if no faults have been detected, or

2) gen­er­ate a stop sig­nal if a fault is detected.
A warn­ing shall be pro­vided if a haz­ard remains after ces­sa­tion of motion;

c) The check itself shall not cause a haz­ardous situation;

d) Following detec­tion of a fault, a safe state shall be main­tained until the fault is cleared.

CONTROL RELIABLEControl reli­able safety con­trol sys­tems shall be dual chan­nel with mon­i­tor­ing and shall be designed,
con­structed, and applied such that any sin­gle com­po­nent fail­ure, includ­ing mon­i­tor­ing, shall not pre­vent
the stop­ping action of the robot.
These safety con­trol sys­tems shall be hard­ware based or in accor­dance with Clause 6.5. The sys­tems shall include auto­matic mon­i­tor­ing at the sys­tem level con­form­ing to the following:

a) The mon­i­tor­ing shall gen­er­ate a stop if a fault is detected. A warn­ing shall be pro­vided if a haz­ard remains after ces­sa­tion of motion.

b) Following detec­tion of a fault, a safe state shall be main­tained until the fault is cleared.

c) Common mode fail­ures shall be taken into account when the prob­a­bil­ity of such a fail­ure occur­ring is
sig­nif­i­cant.

d) The sin­gle fault should be detected at time of fail­ure. If not prac­ti­ca­ble, the fail­ure shall be detected
at the next demand upon the safety function.

e) These safety con­trol sys­tems shall be inde­pen­dent of the nor­mal pro­gram con­trol (func­tion) and shall be designed to be not eas­ily defeated or not eas­ily bypassed with­out detection.

When a sin­gle fault occurs, the safety func­tion is always performed.

Some, but not all, faults will be detected.

Accumulation of unde­tected faults can lead to the loss of the safety function.

Characterized pri­mar­ily by structure.Control reli­able safety cir­cuitry shall be designed, con­structed and applied such that any sin­gle com­po­nent fail­ure shall not pre­vent the stop­ping action of the robot.

These cir­cuits shall be hard­ware based or com­ply with 6.4, and include auto­matic mon­i­tor­ing at the sys­tem level.

a) The mon­i­tor­ing shall gen­er­ate a stop sig­nal if a fault is detected. A warn­ing shall be pro­vided if a haz­ard remains after ces­sa­tion of motion;

b) Following detec­tion of a fault, a safe state shall be main­tained until the fault is cleared.

c) Common mode fail­ures shall be taken into account when the prob­a­bil­ity of such a fail­ure occur­ring is significant.

d) The sin­gle fault should be detected at time of fail­ure. If not prac­ti­ca­ble, the fail­ure shall be detected at the next demand upon the safety function.

CSA Z434 vs. RIA R15.06

Before we dig into the com­par­i­son between North America and the International stan­dards, we need to look at the dif­fer­ences between CSA and ANSI/​RIA. There are some sub­tle dif­fer­ences here that can trip you up and cost sig­nif­i­cant money to cor­rect after the fact. The fol­low­ing state­ments are based on my per­sonal expe­ri­ence and on dis­cus­sions that I have had with peo­ple on both the CSA and RIA tech­ni­cal com­mit­tees tasked with writ­ing these stan­dards. One more note — ANSI RIA R15.06 has been revised and ALL OF SECTION 4 has been replaced with ANSI/​RIA/​ISO 10218–1 [7]. This is very sig­nif­i­cant, but we need to deal with this old dis­cus­sion first.

Systems vs. Circuits

The CSA stan­dard uses the term “con­trol system(s)” through­out the def­i­n­i­tions of the cat­e­gories, while the ANSI/​RIA stan­dard uses the term “circuit(s)”. This is really the crux of the dis­cus­sion between these two stan­dards. While the dif­fer­ence between the terms may seem insignif­i­cant at first, you need to under­stand the back­ground to get the difference.

The CSA term requires two sep­a­rate sens­ing devices on the gate or other guard, just as the Category 3 and 4 def­i­n­i­tions do, and for the same rea­son. The CSA com­mit­tee felt that it was impor­tant to be able to detect all sin­gle faults, includ­ing mechan­i­cal ones. Also, the use of two inter­lock­ing devices on the guard makes it more dif­fi­cult to bypass the interlock.

The RIA term requires redun­dant elec­tri­cal con­nec­tions to the inter­lock­ing device, but implic­itly allows for a sin­gle inter­lock­ing device because it only explic­itly refers to “circuits”.

The expla­na­tion I’ve been given for the dis­crep­ancy is rooted in the early days of indus­trial robot­ics. Many early robot cells had NO inter­locks on the guard­ing because the haz­ards related to the robot motion was not well under­stood. There were a num­ber of inci­dents result­ing in fatal­i­ties that drove robot users to begin to seek bet­ter ways to pro­tect work­ers. The RIA R15.06 com­mit­tee decided that inter­locks were needed, but there was a recog­ni­tion that many users would balk at installing expen­sive inter­lock devices, so they com­pro­mised and allowed that ANY kind of inter­lock­ing device was bet­ter than none. This was amended in the 1999 edi­tion to require that com­po­nents be “safety rated”, effec­tively elim­i­nat­ing the use of con­ven­tional prox­im­ity switches and non-​​safety-​​rated limit switches.

The recent revi­sion of ANSI/​RIA R15.06 to include ANSI/​ISO 10218–1 as a replace­ment for Section 4 is sig­nif­i­cant for a cou­ple of rea­sons: 1) It now means that the robot itself need only meet the ISO stan­dard; instead of the ISO and the RIA stan­dards; and 2) It brings in ISO 13849–1 def­i­n­i­tions of reli­a­bil­ity cat­e­gories. This means that the US has now offi­cially dropped the “SIMPLE, SINGLE-​​CHANNEL,” etc. def­i­n­i­tions and now uses “Category B, 1, etc.” However, they have only adopted the Edition 1 ver­sion of the stan­dard, so none of the PL, MTTFd, etc. cal­cu­la­tions have been adopted. This means that the RIA stan­dard is now har­mo­nized to the 1995 edi­tion of EN 954–1. These updates to the 2006 edi­tion may come in sub­se­quent edi­tions of R15.06.

CSA has cho­sen to reaf­firm the 2003 edi­tion of CSA Z434, so the Canadian National Standard con­tin­ues to refer to the old definitions.

North America vs International Standards

In the descrip­tion of single-​​channel sys­tems /​ cir­cuits under the North American stan­dards you will notice that par­tic­u­lar atten­tion is paid to includ­ing descrip­tions of the use of “proven designs” and “positive-​​break devices”. What the TC’s were refer­ring to are the same “well-​​tried safety prin­ci­ples” and “well-​​tried com­po­nents” as referred to in the International stan­dards, only with less descrip­tion of what those might be. The only major addi­tion to the def­i­n­i­tions is the rec­om­men­da­tion to use “safety-​​rated devices”, which is not included in the International stan­dard. (N.B. The use of the word “should” in the def­i­n­i­tions should be under­stood as a strong rec­om­men­da­tion, but not nec­es­sar­ily a manda­tory require­ment.) Under EN 954–1 [4] and EN 1088 [5] (in the ref­er­enced edi­tions, in any case) it was pos­si­ble to use stan­dard limit switches arranged in a redun­dant man­ner and acti­vated using com­bined pos­i­tive and non-​​positive-​​mode acti­va­tion. In later edi­tions this changed, and there is now a pref­er­ence for devices intended for use in safety applications.

Also worth not­ing is that there is NO allowance for fault exclu­sion under the CSA stan­dard or the 1999 edi­tion of the ANSI standard.

As far as the RIA committee’s asser­tion that their def­i­n­i­tions are not equiv­a­lent to the International stan­dard, and may be supe­rior, I think that there are too may miss­ing qual­i­ties in the ANSI stan­dard for that to stand. In any case, this is now moot, since ANSI has adopted EN ISO 13849–1:2006 as a ref­er­ence to EN ISO 10218–1 [6], replac­ing Section 4 of ANSI/​RIA R15.06–1999.

References

[1] “Safety of machin­ery — Safety-​​related parts of con­trol sys­tems — Part 1: General prin­ci­ples for design”, ISO 13849–1, Edition 2, International Organization for Standardization (ISO), Geneva, 2006.

[2] “Safeguarding of machin­ery”, CSA Z432, Canadian Standards Association (CSA), Toronto, 2004.

[3] “American National Standard for Industrial Robots and Robot Systems — Safety Requirements”, ANSI/​RIA R15.06, American National Standards Institute, Inc. (ANSI), Ann Arbor, 1999.

[4] “Safety of machin­ery — Safety related parts of con­trol sys­tems — Part 1. General prin­ci­ples for design”, EN 954–1, European Committee for Standardization (CEN), Geneva, 1996.

[5] “Safety of machin­ery — Interlocking devices asso­ci­ated with guards — Principles for design and selec­tion”, EN 1088, CEN, Geneva, 1995.

[6] “Robots and robotic devices — Safety require­ments for indus­trial robots — Part 1: Robots”, European Committee for Standardization (CEN), Geneva, 2011.

[7] “Robots for Industrial Environment — Safety Requirements — Part 1 — Robot”, ANSI/​RIA/​ISO 10218–1, American National Standards Institute, Inc. (ANSI), Ann Arbor, 2007.

Copyright secured by Digiprove © 2011
Acknowledgements: See ref­er­ences listed at end of article.
Some Rights Reserved
All original content on these pages is fingerprinted and certified by Digiprove
Performance Optimization WordPress Plugins by W3 EDGE