Tag Archives: EN 954-1 - Page 2

Interlock Architectures – Pt. 4: Category 3 — Control Reliable

Posted by on September 19, 2011 Comments Off
ISO 13849-1 Figure 11
This entry is part 4 of 8 in the series Circuit Architectures Explored

Category 3 sys­tem archi­tec­ture is the first cat­e­gory that could be con­sid­ered to have sim­i­lar­ity to “Control Reliable” cir­cuits or sys­tems as defined in the North American stan­dards. It is not the same as Control Reliable, but we’ll get to in a fol­low­ing post. If you haven’t read the first three posts in this series, you may want to go back and review them as the con­cepts in those arti­cles are the basis for the dis­cus­sion in this post.

So what is “Control Reliable” any­way? This term was coined by the ANSI RIA R15.06 tech­ni­cal com­mit­tee when they were devel­op­ing their def­i­n­i­tions for con­trol sys­tem reli­a­bil­ity, first pub­lished in the 1999 edi­tion of the stan­dard. No men­tion of the con­cept of con­trol reli­a­bil­ity appears in the 1994 edi­tion of CSA Z434 or the pre­ced­ing edi­tion of RIA R15.06.

Essentially, the term “Control Reliable” means that the con­trol sys­tem is designed with some degree of fault tol­er­ance. Depending on the def­i­n­i­tions that you read, this could be sin­gle– or multiple-​​fault-​​tolerance.

There are a num­ber of design tech­niques that can be used to increase the fault tol­er­ance of a con­trol sys­tem. The older approaches, such as those given in ANSI RIA R15.06–1999, CSA Z434-​​03 or EN 954–1:95, rely pri­mar­ily on the struc­ture or archi­tec­ture of the cir­cuit, and the char­ac­ter­is­tics of the com­po­nents selected for use. ISO 13849–1 uses the same basic archi­tec­tures defined by EN 954–1:95, and extends them to include diag­nos­tic cov­er­age, com­mon cause fail­ure resis­tance and an under­stand­ing of the fail­ure rate of the com­po­nents to deter­mine the degree of fault tol­er­ance and reli­a­bil­ity pro­vided by the design.

OK, enough back­ground for now! Let’s look at the def­i­n­i­tion for Category 3 sys­tems. Remember that “SRP/​CS” means “Safety Related Parts of the Control System”.

Definition

6.2.6 Category 3

For cat­e­gory 3, the same require­ments as those accord­ing to 6.2.3 for cat­e­gory B shall apply. “Well-​​tried safety prin­ci­ples” accord­ing to 6.2.4 shall also be fol­lowed. In addi­tion, the fol­low­ing applies. SRP/​CS of cat­e­gory 3 shall be designed so that a sin­gle fault in any of these parts does not lead to the loss of the safety func­tion. Whenever rea­son­ably prac­ti­ca­ble, the sin­gle fault shall be detected at or before the next demand upon the safety function.

The diag­nos­tic cov­er­age (DCavg) of the total SRP/​CS includ­ing fault-​​detection shall be low. The MTTFd of each of the redun­dant chan­nels shall be low-​​to-​​high, depend­ing on the PLr. Measures against CCF shall be applied (see Annex F).

NOTE 1 The require­ment of single-​​fault detec­tion does not mean that all faults will be detected. Consequently, the accu­mu­la­tion of unde­tected faults can lead to an unin­tended out­put and a haz­ardous sit­u­a­tion at the machine. Typical exam­ples of prac­ti­ca­ble mea­sures for fault detec­tion are use of the feed­back of mechan­i­cally guided relay con­tacts and mon­i­tor­ing of redun­dant elec­tri­cal outputs.

NOTE 2 If nec­es­sary because of tech­nol­ogy and appli­ca­tion, type-​​C stan­dard mak­ers need to give fur­ther details on the detec­tion of faults.

NOTE 3 Category 3 sys­tem behav­iour allows that

  • when the sin­gle fault occurs the safety func­tion is always performed,
  • some but not all faults will be detected,
  • accu­mu­la­tion of unde­tected faults can lead to the loss of the safety function.

NOTE 4 The tech­nol­ogy used will influ­ence the pos­si­bil­i­ties for the imple­men­ta­tion of fault detection.

5% Discount on ISO and IEC Standards with code: CC2011

Breaking it down

Let’s take the def­i­n­i­tion apart and look at the com­po­nents that make it up.

For cat­e­gory 3, the same require­ments as those accord­ing to 6.2.3 for cat­e­gory B shall apply. “Well-​​tried safety prin­ci­ples” accord­ing to 6.2.4 shall also be followed.

The first cou­ple of lines remind the designer of two key points:

  • The com­po­nents selected must be suit­able for the appli­ca­tion, i.e. cor­rectly spec­i­fied for volt­age, cur­rent, envi­ron­men­tal con­di­tions, etc.; and
  • “well-​​tried safety prin­ci­ples” must be used in the design.

It’s impor­tant to note here that we are talk­ing about “well tried safety prin­ci­ples” and NOT “well-​​tried com­po­nents”. The require­ment to use com­po­nents designed for safety appli­ca­tions comes from other stan­dards, like EN 1088 and ISO 13850. The require­ments from these stan­dards, such as the use of “direct-​​drive” con­tacts improves the fault tol­er­ance of the com­po­nent, and so ben­e­fits the design in the end. These improve­ments are gen­er­ally reflected in the B10d or MTTFd of the com­po­nent, and are points that inspec­tors will com­monly look for, since they are easy to spot in the field, since “safety-​​rated com­po­nents” often use red or yel­low caps to iden­tify them clearly in the con­trol panel.

In addi­tion, the fol­low­ing applies. SRP/​CS of cat­e­gory 3 shall be designed so that a sin­gle fault in any of these parts does not lead to the loss of the safety function.

This sen­tence makes the require­ment for single-​​fault tol­er­ance. This means that the fail­ure of any sin­gle com­po­nent in the func­tional chan­nel can­not result in the loss of the safety func­tion. To meet this require­ment, redun­dancy is needed. With redun­dant sys­tems, one com­plete chan­nel can fail with­out los­ing the abil­ity to stop the machin­ery. It is pos­si­ble to lose the func­tion of the mon­i­tor­ing sys­tem from a sin­gle com­po­nent fail­ure, but as long as the sys­tem con­tin­ues to pro­vide the safety func­tion this may be accept­able. The sys­tem should not per­mit itself to be reset if the mon­i­tor­ing sys­tem is not working.

One more “gotcha” from this sen­tence: In order to meet the require­ment that any sin­gle com­po­nent fail­ure can be detected, the design will require two sep­a­rate sen­sors to detect the posi­tion of a gate, for exam­ple. This per­mits the sys­tem to detect a fail­ure in either sen­sor, includ­ing mechan­i­cal fail­ures like bro­ken keys or attempts to defeat the safety sys­tem. You can clearly see this in both the block dia­gram, which does not show any mon­i­tor­ing con­nec­tion to the input devices, and in the cir­cuit dia­gram. Both of these dia­grams are shown later in this post. The only way out of the require­ment to have redun­dant sen­sors is to select a gate switch that is robust enough that mechan­i­cal faults can rea­son­ably be excepted. I’ll get into fault excep­tions later in this article.

Whenever rea­son­ably prac­ti­ca­ble, the sin­gle fault shall be detected at or before the next demand upon the safety function.

This sen­tence can be a bit sticky. The phrase “Whenever rea­son­ably prac­ti­ca­ble” means that your design needs to be able to detect sin­gle faults unless it would be “unrea­son­able” to do so. What con­sti­tutes an unrea­son­able degree of effort? This is for you to decide. I will say that if there is a com­mon, off the shelf com­po­nent (COTS) avail­able that will do the job, and you choose not to use it, you will have a dif­fi­cult time con­vinc­ing a court that you took every rea­son­ably prac­ti­ca­ble means to detect the fault.

Following the comma, the rest of the sen­tence pro­vides the designer with the basic require­ment for the test sys­tem: it must be able to detect a sin­gle com­po­nent fail­ure at the moment of demand (this is usu­ally how it’s done, since this is typ­i­cally the sim­plest way) or before it occurs, which can hap­pen if your test equip­ment has a means to detect a change in some crit­i­cal char­ac­ter­is­tic of the mon­i­tored component(s).

 The diag­nos­tic cov­er­age (DCavg) of the total SRP/​CS includ­ing fault-​​detection shall be low.

This sen­tence tells you that your design must meet the require­ments for LOW Diagnostic Coverage. To get to LOW DCavg, we need to look first at Table 6:

ISO 13849–1:06 Table 6

Diagnostic Coverage (DC)

Denotation Range
 None DC < 60%
 Low 60% ? DC < 90%
 Medium 90% ? DC < 99%
 High 99% ? DC

NOTE 1 For SRP/​CS con­sist­ing of sev­eral parts an aver­age value DCavg for DC is used in Figure 5, Clause 6 and E.2. 

NOTE 2 The choice of the DC ranges is based on the key val­ues 60 %, 90 % and 99 % also estab­lished in other stan­dards (e.g. IEC 61508) deal­ing with diag­nos­tic cov­er­age of tests. Investigations show that (1 — DC) rather than DC itself is a char­ac­ter­is­tic mea­sure for the effec­tive­ness of the test. (1 — DC) for the key val­ues 60 %, 90 % and 99 % forms a kind of log­a­rith­mic scale fit­ting to the log­a­rith­mic PL-​​scale. A DC-​​value less than 60 % has only slight effect on the reli­a­bil­ity of the tested sys­tem and is there­fore called “none”. A DC-​​value greater than 99 % for com­plex sys­tems is very hard to achieve. To be prac­ti­ca­ble, the num­ber of ranges was restricted to four. The indi­cated bor­ders of this table are assumed within an accu­racy of 5 %.

Based on Table 6, the DCavg must be between 60% and 90%, all com­po­nents con­sid­ered. To score this, we must go to Annex E and look at Table E1. Using the fac­tors in Table E1, score the design. If you end up in the desired range between 60% and 90% DC cov­er­age, you can move on. If not, the design will require mod­i­fi­ca­tion to bring it into this range.

The MTTFd of each of the redun­dant chan­nels shall be low-​​to-​​high, depend­ing on the PLr. 

This sen­tence reminds you that your com­po­nent selec­tions mat­ter. Depending on the PLr you are try­ing to achieve, you will need to choose com­po­nents with suit­able MTTFd rat­ings. Remember that just because you are using a Category 3 archi­tec­ture, you have not auto­mat­i­cally achieved the high­est lev­els of reli­a­bil­ity. If you refer to Figure 5 in the stan­dard, you can see that a Category 3 archi­tec­ture can meet a range of PL’s, all the way from PLa through PLe!

ISO 13849-1 Figure 5

ISO 13849–1 Figure 5

 If you want, or need, to know the numeric bound­aries of each of the bands in the dia­gram above, look at Annex K of the stan­dard. The full numeric rep­re­sen­ta­tion of Figure 5 is pro­vided in that Annex.

Measures against CCF shall be applied (see Annex F).

In order for the archi­tec­ture of your design to meet Category 3 archi­tec­ture, CCF mea­sures are required. I’ve dis­cussed Common Cause Failures else­where on the blog, but as a reminder, a Common Cause Failure is one where a sin­gle event, like a light­ning strike on the power line, or a cable being cut, results in the fail­ure of the sys­tem. This is not the same as a Common Mode Failure, where sim­i­lar or dif­fer­ent com­po­nents fail in the same way. For instance, if both out­put con­tac­tors were to weld closed either simul­ta­ne­ously or at dif­fer­ent time due to over­load­ing because they were under­sized, this could be con­sid­ered to be a Common Mode Failure. If they both weld closed due to a light­ning strike, that is a Common Cause Failure.

Annex F pro­vides a check­list that is used to score the CCF of the design. The design must meet at least 65 points to be con­sid­ered to meet the min­i­mum level of CCF pro­tec­tion, and more is bet­ter of course! Score your design and see where you come out. Less than 65 and you need to do more. 65 or more and you are good to go.

The Notes

The notes given in the def­i­n­i­tion are also impor­tant. Note 1 reminds the designer that not all faults will be detected, and an accu­mu­la­tion of unde­tected faults can lead to the loss of the safety func­tion. Be aware that it is up to you as the designer to min­i­mize the kinds of fail­ures that can accu­mu­late undetected.

Note 2 speaks to the pos­si­bil­ity that a Type-​​C prod­uct stan­dard, like EN 201 for injec­tion mould­ing machines for exam­ple, may impose a min­i­mum PLr on the design. Make sure that you get a copy of any Type-​​C stan­dard that is rel­e­vant for your prod­uct and mar­ket. Note that the des­ig­na­tion “Type-​​C” comes from ISO. If you go look­ing for this ter­mi­nol­ogy in ANSI or CSA stan­dards, you won’t find it used because the con­cept doesn’t exist in the same way in these National standards.

Note 3 gives you the basic per­for­mance para­me­ters for the design. If your design can do these things, then you’re halfway there.

Finally, Note 4 is a reminder that dif­fer­ent kinds of tech­nol­ogy have greater or lesser capa­bil­ity to detect fail­ures. More sophis­ti­cated tech­nol­ogy may be required to achieve the PL level you need.

The Block Diagram

Let’s have a look at the func­tional block dia­gram for this Category.

ISO 13849-1 Figure 11By look­ing at the dia­gram you can see clearly the two inde­pen­dent chan­nels and the cross-​​monitoring con­nec­tion between the chan­nels. Input devices are not mon­i­tored, but out­put devices are mon­i­tored. This is another sig­nif­i­cant rea­son requir­ing the use of two phys­i­cally sep­a­rate input devices to sense the guard posi­tion or what­ever other safe­guard­ing device is inte­grated into the sys­tem. The only way that a fail­ure in the input devices can be detected is if one chan­nel changes state and one does not.

If you want to learn more about apply­ing the block dia­gram­ming method to you design, there is a good expla­na­tion of the method in the SISTEMA Cookbook 1, pub­lished by the IFA in Germany. You can down­load the English ver­sion from the link above, or get the doc­u­ment directly from the IFA web site.

Circuit Diagram

By now you prob­a­bly get the idea that there are as many ways to con­fig­ure a Category 3 cir­cuit as there are appli­ca­tions. Below is a typ­i­cal cir­cuit dia­gram bor­rowed from Rockwell Allen-​​Bradley, show­ing the appli­ca­tion of typ­i­cal safety relays in a com­plete sys­tem that includes the emer­gency stop sys­tem, a gate inter­lock and a safety mat. You can meet the require­ments for Category 3 archi­tec­ture in other ways, so don’t feel that you must use a COTS safety relay. It just may be the most straight­for­ward way in many cases.

This is not a plug for A-​​B prod­ucts. Neither Machinery Safety 101, nor I, have any rela­tion­ship with Rockwell Allen-​​Bradley.

From Rockwell Automation pub­li­ca­tion SAFETY-​​WD001A-​​EN-​​P – June 2011, p.6.

If you’re inter­ested in obtain­ing the source doc­u­ment con­tain­ing this dia­gram, you can down­load it directly from the Rockwell Automation web site.

Emergency Stop Subsystem

The emer­gency stop cir­cuit uses the 440R-​​512R2 relay on the left side of the dia­gram. This par­tic­u­lar sys­tem uses Category 3 archi­tec­ture in the e-​​stop sys­tem, which may be more than is required. A risk assess­ment and a start-​​stop analy­sis is required to deter­mine what per­for­mance level is needed for this sub­sys­tem. Get more infor­ma­tion on emer­gency stop.

 Gate Interlock Subsystem

The gate inter­lock cir­cuit is located in the cen­ter of the dia­gram, and uses the 440R-​​D22R2 relay. As you can see, there are two phys­i­cally sep­a­rate gate inter­lock switches. Only one con­tact from each switch is used, so one switch is con­nected to Channel 1, and the other to Channel 2. Notice that there is no other mon­i­tor­ing of these devices (i.e. no sec­ond con­nec­tion to either switch). The sec­ondary con­tacts on these switches could be con­nected to the PLC for annun­ci­a­tion pur­poses. This would allow the PLC to dis­play the open/​closed sta­tus of the gate on the machine HMI.

The out­put con­tac­tors, K3 and K4, are mon­i­tored by the reset loop con­nected to S34 and the +V rail.

One more inter­est­ing point — did you notice that there is a “zone e-​​stop” included in the gate inter­lock? If you look imme­di­ately below the cen­tral safety relay and a lit­tle to the left you will find an emer­gency stop device. This device is wired in series with the gate inter­lock, so acti­vat­ing it will drop out K3 and K4 but not dis­turb the oper­a­tion of the rest of the machine. The safety relay can’t dis­tin­guish between the e-​​stop but­ton and the gate inter­locks, so if annun­ci­a­tion is needed, you may want to use a third con­tact on the e-​​stop device to con­nect to a PLC input for this purpose.

Safety Mat Subsystem

The safety mat sub­sys­tem is located on the right side of the dia­gram and uses a sec­ond 440R-​​D22R2 relay. Safety mats can be either sin­gle or dual chan­nel in design. The mat show in this draw­ing is a dual-​​channel type. Stepping on the mat causes the con­duc­tive lay­ers in the mat to touch, short­ing Channel 1 to Channel 2. This cre­ates an input fault that will be detected by the 440R relay. The fault con­di­tion will cause the out­put of the relay to open, stop­ping the machine.

Safety mats can be dam­aged rea­son­ably eas­ily, and the cir­cuit design shown will detect shorts or opens within the mat and will pre­vent the haz­ardous motion from start­ing or continuing.

The out­put con­tac­tors, K5 and K6 are mon­i­tored by the relay reset loop con­nected to S34 and the +V rail.

This cir­cuit also includes a con­ven­tional start-​​stop cir­cuit that doesn’t rely on the safety relay.

One more thing — just like the gate inter­lock cir­cuit, this cir­cuit also includes a “zone e-​​stop”. Look below and to the left of the safety mat relay. As with the gate inter­lock, press­ing this but­ton will drop out K5 and K6, stop­ping the same motions pro­tected by the safety mat. Since the relay can’t tell the dif­fer­ence between the e-​​stop but­ton and the mat being acti­vated, you may want to use the same approach and add a third con­tact to the e-​​stop but­ton, con­nect­ing it to the PLC for annunciation.

Component Selection

The com­po­nents used in the cir­cuit are crit­i­cal to the final PL rat­ing of the design. The final PL of the design depends on the MTTFd of the com­po­nents used in each chan­nel. No knowl­edge of the inter­nal con­struc­tion of the safety relays is needed, because the relays come with a PL rat­ing from the man­u­fac­turer. They can be treated as a sub­sys­tem unto them­selves. The selec­tion of the input and out­put devices is then the sig­nif­i­cant fac­tor. Component data sheets can be down­loaded from the Rockwell site if you want to dig a bit deeper.

What did you think about this arti­cle? What ques­tions came to mind that weren’t answered for you? I look for­ward to hear­ing your thoughts and questions!

Copyright secured by Digiprove © 2011
Acknowledgements: ISO for excerpts from ISO 13849–1 and more…
Some Rights Reserved

Understanding Risk Assessment

Posted by on January 31, 2011 10 comments

When peo­ple dis­cuss ‘Risk’ there are a lot of dif­fer­ent assump­tions made about what that means. For me, the study of risk and risk assess­ment tech­niques started in 1995. As a tech­nol­o­gist and con­trols designer, I had to some­how wrap my head around the whole con­cept in ways I’d never con­sid­ered. If you’re try­ing to fig­ure out risk and risk assess­ment this is a good place to get started!

What is risk?

From a machin­ery per­spec­tive, ISO 12100:2010 defines risk as:

“com­bi­na­tion of the prob­a­bil­ity of occur­rence of harm and the sever­ity of that harm”

Risk can have pos­i­tive or neg­a­tive out­comes, but when con­sid­er­ing safety, we only con­sider neg­a­tive risk, or events that result in neg­a­tive health effects for the peo­ple exposed.

The risk rela­tion­ship is illus­trated in ISO 12100:2010 Figure 3:


ISO 12100-2010 Figure 3

ISO 12100–2010 Figure 3


Where

R = Risk

S = Severity of Harm

P = Probability of Occurrence of Harm

The Probability of Occurrence of Harm fac­tor is often fur­ther bro­ken down into three sub-​​factors:

  • Probability of Exposure to the haz­ard
  • Probability of Occurrence of the Hazardous Event
  • Probability of Limiting or Avoiding the Harm

How is risk measured?

In order to esti­mate risk a scor­ing tool is needed. There is no one ‘cor­rect’ scor­ing tool, and there are flaws in most scales that can result in blind-​​spots where risks may be over or under-​​estimated.

At the sim­plest level are ‘screen­ing’ tools. These tools use very sim­ple scales like ‘High, Medium, Low’, or ‘A, B, C’. These tools are often used when doing a shop-​​floor inspec­tion and are intended to pro­vide a quick method of cap­tur­ing obser­va­tions and giv­ing a gut-​​feel assess­ment of the risk involved. These tools should be used as a way to iden­tify risks that need addi­tional, detailed assess­ment. To get an idea of what a good screen­ing tool can look like, have a look at the SOBANE Déparis sys­tem.

Every scor­ing tool requires a scale for each risk para­me­ter included in the tool. For instance, con­sider the CSA tool described in CSA Z434:

CSA Z434-03 Table 1As you can see, each para­me­ter (Severity, Exposure and Avoidance) has a scale, with two pos­si­ble selec­tions for each parameter.

When con­sid­er­ing selec­tion of a scor­ing tool, it’s impor­tant to take some time to really exam­ine the scales for each fac­tor. The scale shown above has a glar­ing hole in one scale. See if you can spot it and I’ll tell you what I think a bit later in this post.

There are more than 350 dif­fer­ent scales and method­olo­gies avail­able for assess­ing risk. You can find a good review of some of them in Bruce Main’s text­book “Risk Assessment: Basics and Benchmarks” avail­able from DSE online.

A sim­i­lar, although dif­fer­ent, tool is found in Annex 1 of ISO 13849–1. Note that this tool is pro­vided in an Informative Annex. This means that it is not part of the body of the stan­dard and is NOT manda­tory. In fact, this tool was pro­vided as an exam­ple of how a user could link the out­put of a risk assess­ment tool to the Performance Levels described in the nor­ma­tive text (the manda­tory part) of the standard.

Consider cre­at­ing your own scales. There is noth­ing wrong with deter­min­ing what char­ac­ter­is­tics (para­me­ters) you want to include in your risk assess­ment, and then assign­ing each para­me­ter a numeric scale that you think is suit­able; 1–10, 0–5, etc. Some scales may be inverted to oth­ers, for exam­ple: If the Severity scale runs from 0–10, the Avoidability scale might run from 10–0 (Unavoidable to Entirely Avoidable).

Once the scales in your tool have been defined, doc­u­ment the def­i­n­i­tions as part of your assessment.

Who should con­duct risk assessments?

Lake YogaIn many orga­ni­za­tions, I find that risk assess­ment has been del­e­gated to one per­son. This is a major mis­take for a num­ber of rea­sons. Risk assess­ment is not a solo activ­ity for a ‘guru’ in a lonely office somewhere!

Risk assess­ment is not a lot of fun to do, and since risk assess­ments can get to be quite involved, it rep­re­sents a sig­nif­i­cant amount of work to put on one per­son. Also, leav­ing it to one per­son means that the assess­ment will nec­es­sar­ily be biased to what that per­son knows, and may miss sig­nif­i­cant haz­ards because the asses­sor doesn’t know enough about that haz­ard to spot it and assess it properly.

Risk assess­ment requires mul­ti­ple view­points from par­tic­i­pants with var­ied exper­tise. This includes users, design­ers, engi­neers, lawyers and those who may have spe­cial­ized knowl­edge of a par­tic­u­lar haz­ard, like a Laser Safety Officer or a Radiation Safety Officer. The var­ied exper­tise of the peo­ple involved will allow the com­mit­tee to bal­ance the opin­ion of each haz­ard, and develop a more rea­soned assess­ment of the risk.

I rec­om­mend that risk assess­ment com­mit­tees never be less than three mem­bers. Five is fre­quently a good num­ber. Once you get beyond five, it becomes increas­ingly dif­fi­cult to obtain con­sen­sus on each haz­ard. Also, con­sider the cost. As each com­mit­tee mem­ber is added to the team, the cost of the assess­ment can esca­late exponentially.

Training in risk assess­ment is cru­cial to suc­cess. Ensure that the indi­vid­u­als involved are trained, and that at least one has some pre­vi­ous expe­ri­ence in the prac­tice so that they may guide the com­mit­tee as needed.

When should a risk assess­ment be conducted?


Risk Assessment Lifetime Flow Chart

Risk Assessment in the Lifetime of a Product


Risk assess­ment should begin at the begin­ning of a project, whether it’s the design of a prod­uct, the devel­op­ment of a process or ser­vice, or the design of a new build­ing. Understanding risk is crit­i­cal to the design process. Cost for changes made at the begin­ning of a project are min­i­mal com­pared to those that will be incurred to cor­rect prob­lems that might have been fore­seen at the start. Risk assess­ment should start at the con­cept stage and be included at each sub­se­quent stage in the devel­op­ment process. The accom­pa­ny­ing graphic illus­trates this idea.

Essentially, risk assess­ment is never fin­ished until the prod­uct, process or ser­vice ceases to exist.

What tools are available?

As men­tioned ear­lier in this post, the book ‘Risk Assessment: Basics and Benchmarks” pro­vides an overview of roughly 350 dif­fer­ent scor­ing tools. You can search the Internet and turn up quite a few as well. The key thing with all of these sys­tems is that you will need to develop any soft­ware based tools your­self. Depending on your com­fort with soft­ware, this might be a spread­sheet for­mat, a word pro­cess­ing doc­u­ment a data­base, or some other for­mat that works for your application.

There are a num­ber of risk assess­ment soft­ware tools avail­able as well, includ­ing ISI’s CIRSMA™ and DSE’s DesignSafe. As with the scor­ing tools, you need to be care­ful when eval­u­at­ing tools. Some have sig­nif­i­cant blind spots that may trip you up if you are not aware of their limitations.

Remember too that the out­put from the soft­ware can only be as good as the input data. The old saw “Garbage In, Garbage Out” holds true with risk assessment.

Where can you get training?

There are a few places to get train­ing. Compliance InSight Consulting pro­vides train­ing to cor­po­rate clients and will be launch­ing a series of web-​​based train­ing ser­vices in 2011 that will allow indi­vid­ual learn­ers to get train­ing too.

The IEEE PSES oper­ates a Risk Assessment Technical Committee that is open to the pub­lic as well. See the RATC web site.

The Answer to the Scale Question

The Exposure Scale in the CSA tool has a gap between E1 and E2. Looking at the def­i­n­i­tions for each choice, notice that E1 is less than once per day or shift, while E2 is more than once per hour. Exposures that occur once per hour or less, but more than once per day can­not be scored effec­tively using this scale.

Also, notice the Severity scale: S1 encom­passes injuries requir­ing not more than basic first aid. One com­mon ques­tion I get is “Does that include CPR*?”. This ques­tion comes up because most basic first aid courses taught in Canada include CPR as part of the course. There is no clear answer for this in the stan­dard. The S2 fac­tor extends from injuries requir­ing more than basic first aid, like a bro­ken fin­ger for instance, all the way to a fatal­ity. Does it make sense to group this broad range of injuries together? This def­i­n­i­tion doesn’t quite match with the Province of Ontario’s def­i­n­i­tion of a Critical Injury found in Regulation 834 either.

All of this points to the need to care­fully assess the scales that you choose before you start the process. Choosing the wrong tool can skew your results in ways that you may not be very happy about.

*Cardio-​​Pulmonary Resuscitation

IEC/​TR 62061–1 Reviewed

Posted by on September 8, 2010 7 comments
This entry is part 2 of 2 in the series IEC/​TR 62061–1

Why You Need to Spend More Cash on Yet Another Document

Standards orga­ni­za­tions pub­lish doc­u­ments in a fairly con­tin­u­ous stream, so for those of us tasked with stay­ing cur­rent with a large num­ber of stan­dards (say, more than 10), the pub­li­ca­tion of another new stan­dard or Technical Report isn’t news — it’s busi­ness as usual. The ques­tion is always: Do we really need to add this to the library?

For those who are new to this busi­ness, hav­ing to pay for crit­i­cal design infor­ma­tion is a new expe­ri­ence. Finding out that it can cost hun­dreds, if not thou­sands, to build the library you need can be overwhelming.

This review aims to help you decide if you need IEC/​TR 62061–1 in your library.

The Problem

As a machine builder or a man­u­fac­turer build­ing a prod­uct designed to be inte­grated into machin­ery, how do you choose between ISO 13849–1 and IEC 62061?

IEC 62061–1 attempts to pro­vide guid­ance on how to make this choice.

History

When CENELEC pub­lished EN 954–1 in 1995, machine builders were intro­duced to a whole new world of con­trol reli­a­bil­ity require­ments. Prior to its pub­li­ca­tion, most machines were built with very sim­ple inter­locks, and no spe­cific stan­dards for inter­lock­ing devices existed. In the years since then, the EN 954–1 Categories have become well known and are applied inside and out­side the EU.

In the inter­ven­ing years, IEC pub­lished IEC 61508. This seven-​​part stan­dard intro­duced the idea of ‘Safety Integrity  Levels’ or SILs. This stan­dard is aimed at process con­trol sys­tems and could be used for com­plex machin­ery as well.

Why the Confusion?

In 2006, IEC pub­lished a machin­ery sec­tor spe­cific stan­dard based on IEC 61508, called IEC 62061. This stan­dard offered a sim­pli­fied appli­ca­tion of the IEC 61508 method­ol­ogy intended for machine builders. The key prob­lem with this stan­dard is that it did not pro­vide a means to deal with pneu­matic or hydraulic con­trol ele­ments, which are cov­ered by ISO 13849–1.

ISO adopted EN 954–1 and reis­sued it as ISO 13849–1 in 1999. This edi­tion of the stan­dard was vir­tu­ally iden­ti­cal to the stan­dard it replaced from a tech­ni­cal require­ments per­spec­tive. EN 954–1/ISO 13849–1 did not pro­vide any means to esti­mate the integrity of the safety related con­trols, but did define cir­cuit archi­tec­tures (Categories B, 1–4) and spoke to the selec­tion of com­po­nents, intro­duc­ing the con­cepts of ‘well-​​tried safety prin­ci­ples’ and ‘well-​​tried com­po­nents’. A sec­ond prob­lem had long existed in addi­tion to this — EN 954–2, Validation, was never pub­lished by CENELEC except as a com­mit­tee draft, so a key ele­ment in the appli­ca­tion of the stan­dard had been miss­ing for five years at the point where ISO 13849–1 Edition 1 was published.

The first cut at guid­ing users in choos­ing an appro­pri­ate stan­dard came with the pub­li­ca­tion of IEC 62061 Edition 1.  Published in 2005, Edition 1 included a table that attempted to pro­vide users with some guid­ance on how to choose between ISO 13849–1 or IEC 62061.

…and then came 2007…

In 2007, ISO pub­lished the Second Edition of ISO 13849–1, and brought a whole new twist to the dis­cus­sion by intro­duc­ing ‘Performance Levels’ or PLs. PLs can be loosely equated to SILs, even though PLs are stated in fail­ures per year and SILs in fail­ures per hour. The same table included in IEC 62061 was included in this edi­tion of ISO 13849–1.

Table 1
Recommended appli­ca­tion of
IEC 62061 and ISO 13849–1(under revision)

(from the Second Edition, 2007)

Technology imple­ment­ing the
safety related con­trol function(s)		ISO
13849–1 (under revision)		IEC 62061
ANon elec­tri­cal, e.g. hydraulicsXNot cov­ered
BElectromechanical, e.g. relays, or
non-​​complex electronics		Restricted to des­ig­nated
archi­tec­tures (see Note 1) and up to PL=e

All archi­tec­tures and up to
SIL 3

CComplex elec­tron­ics, e.g. programmableRestricted to des­ig­nated
archi­tec­tures (see Note 1) and up
to PL=d		All archi­tec­tures and up to
SIL 3
DA com­bined with BRestricted to des­ig­nated
archi­tec­tures (see Note 1) and up
to PL=e		X
see Note 3
EC com­bined with BRestricted to des­ig­nated
archi­tec­tures (see Note 1) and up
to PL=d		All archi­tec­tures and up to
SIL 3
FC com­bined with A, or C com­bined with
A and B		X
see Note 2		X
see Note 3

“X” indi­cates that this item is dealt with by the stan­dard shown in the col­umn heading.

NOTE 1 Designated archi­tec­tures are defined in Annex B of EN ISO 13849–1(rev.) to give a sim­pli­fied approach for quan­tifi­ca­tion of per­for­mance level.

NOTE 2 For com­plex elec­tron­ics: Use of des­ig­nated archi­tec­tures accord­ing to EN ISO 13849–1(rev.) up to PL=d or any archi­tec­ture accord­ing to IEC 62061.

NOTE 3 For non-​​electrical tech­nol­ogy use parts accord­ing to EN ISO 13849–1(rev.) as subsystems.

So how is a machine builder to choose the ‘cor­rect’ stan­dard, if both stan­dards are applic­a­ble and both are cor­rect? Furthermore, how do you assess the reli­a­bil­ity of the safety-​​related con­trols when inte­grat­ing equip­ment from var­i­ous sup­pli­ers, some of whom rate their equip­ment in PLs and some in SILs? Why are two stan­dards address­ing the same topic required? Will ISO 13849–1 and IEC 62061 ever be merged?

The Technical Report

In July this year the IEC pub­lished a Technical Report that dis­cusses the selec­tion and appli­ca­tion of these two key con­trol reli­a­bil­ity stan­dards for machine builders. This guide has long been needed, and pre­cedes a face to face event planned by IEC to bring machine builders and stan­dards writ­ers face-​​to-​​face to dis­cuss these same issues.

The guide, titled IEC/​TR 62061–1 — Technical Report — Guidance on the appli­ca­tion of ISO 13849–1 and IEC 62061 in the design of safety-​​related con­trol sys­tems for machin­ery pro­vides direct guid­ance on how to select between these two standards.

Download IEC stan­dards, International Electrotechnical Commission standards.

Merger

In the intro­duc­tion to the report the TC makes it clear that the stan­dards will be merged, although they don’t pro­vide any kind of a time line for the merger. Quoting from the introduction:

It is intended that this Technical Report be incor­po­rated into both IEC 62061 and ISO 13849–1 by means of cor­ri­genda that ref­er­ence the pub­lished ver­sion of this doc­u­ment. These cor­ri­genda will also remove the infor­ma­tion given in Table 1, Recommended appli­ca­tion of IEC 62061 and ISO 13849–1, pro­vided in the com­mon intro­duc­tion to both stan­dards, which is now rec­og­nized as being out of date. Subsequently, it is intended to merge ISO 13849–1 and IEC 62061 by means of a JWG of ISO/​TC 199 and IEC/​TC 44.

I added the bold face to the para­graph above to high­light the key state­ment regard­ing the even­tual merger of the two doc­u­ments.  If you’re not famil­iar with the stan­dards acronyms, a ‘JWG’ is a Joint Working Group, and a TC is a Technical Committee. TC’s are formed from vol­un­teer experts from indus­try and acad­e­mia sup­ported by their orga­ni­za­tions. So a JWG formed from two TC’s just means that a joint com­mit­tee has been formed to work out the details of the merger. Eventually.

The other key point in this para­graph relates to the replace­ment of Table 1. In the interim, IEC/​TR 62061–1 will be incor­po­rated into both stan­dards, replac­ing Table 1.

Eventually the con­fu­sion will be cleared up because only one stan­dard will exist in the machin­ery sec­tor, but until then, machine builders will need to fig­ure out which stan­dard best fits their products.

Comparing PL’s and SIL’s

The Technical Report does a good job of dis­cussing the dif­fer­ences between PL and SIL, includ­ing pro­vid­ing an expla­na­tion of how to covert one to the other, very use­ful if you are try­ing to inte­grate an SIL rated device into a PL analy­sis or vice-​​versa.

Selecting a Standard

Clause 2.5 gives some solid advice on select­ing between the two stan­dards based on the tech­nolo­gies employed in the design and your own com­fort level in using the ana­lyt­i­cal tech­niques in the two standards.

Another key point is that EITHER stan­dard can be used to ana­lyze com­plex OR sim­ple con­trol sys­tems. Some fans of IEC 62061 have been known to put ISO 13849–1 down as use­ful exclu­sively for sim­ple hard­wired con­trol sys­tems. Clause 3.3 makes it clear that this is not the case. Pick the one you like or know the best and go with that. As an addi­tional thought, con­sider which stan­dard your com­peti­tors are using, and also which your cus­tomers are using. For exam­ple, if your cus­tomers use ISO 13849–1 pri­mar­ily, qual­i­fy­ing your prod­uct under IEC 62061 might seem like a good idea, but may drive your cus­tomers to a com­peti­tor who makes their life eas­ier by using ISO 13849–1. If your com­peti­tors are using a dif­fer­ent stan­dard, try to under­stand the choice before climb­ing on the band­wagon. There may be a com­pet­i­tive advan­tage lurk­ing in being different.

Risk Assessment

Clause 4 speaks directly to the indis­pens­able need to con­duct a method­i­cal risk assess­ment, and to use that to guide the design of the controls.

In my prac­tice, many clients decide that they would pre­fer to choose a con­trol reli­a­bil­ity level that they feel will be more than good enough for any of their designs, and then to ‘stan­dard­ize’ on that design for all their prod­ucts, thereby elim­i­nat­ing the need to thought­fully decide on the appro­pri­ate design for the appli­ca­tion. In other cases, end-​​users may choose to use a ‘stan­dard’ design through­out their facil­ity to assist main­te­nance per­son­nel by lim­it­ing their need to become tech­ni­cally famil­iar with a vari­ety of designs. This is done to speed trou­bleshoot­ing and reduce down time and spares stocks.

The prob­lem with this approach can be that some man­agers believe this approach can elim­i­nate the need to con­duct risk assess­ments, see­ing this as a fruit­less, expen­sive and often futile exer­cise. This is emphat­i­cally NOT the case. Risk assess­ments address much more than the selec­tion of con­trol reli­a­bil­ity require­ments and need to be done to ensure that all haz­ards that can­not be elim­i­nated or sub­sti­tuted are safe­guarded. A miss­ing or badly done risk assess­ment may inval­i­date your claim to a CE mark, or be the land­mine that ends a lia­bil­ity case — with you on the los­ing end.

Safety Requirement Specification (SRS)

Each safety func­tion needs to be defined in detail in a Safety Requirement Specification (SRS). A reli­a­bil­ity assess­ment needs to be com­pleted for each safety func­tion defined in the SRS. This point is dis­cussed in detail in IEC 62061, but is not dealt with in any detail in ISO 13849–1, so IEC/​TR 62061–1 once again bridges the gap by pro­vid­ing an impor­tant detail that is miss­ing in one of the two standards.

If you are unfa­mil­iar with the con­cept of an SRS, each safety func­tion needs to be described with a cer­tain min­i­mum amount of infor­ma­tion, including:

  • The name of safety function;
  • A descrip­tion of the function;
  • The required level of per­for­mance based on the risk assess­ment and accord­ing to either ISO 13849–1 (PLr a to e) or the required safety integrity accord­ing to IEC 62061 (SIL 1 to 3)

Once the safety func­tions are defined and ana­lyzed, each safety func­tion must be imple­mented by a con­trol cir­cuit. The selected PL will drive the design to one or two of the defined ISO 13849–1 archi­tec­tures, and then the com­po­nent selec­tions and other design details will drive the final fail­ure rate and PL. Alternatively, the SRS will drive the selec­tion of IEC 62061 archi­tec­ture (1oo1, 1oo2, 2oo2, etc.) and the rest of the design details will lead to the final fail­ure rate and SIL.

Table 1 in the Technical Report com­pares the levels.

Table 1 – Relationship between PLs and SILs based on the aver­age prob­a­bil­ity
of dan­ger­ous fail­ure per hour

Performance Level (PL)Average prob­a­bil­ity of a dan­ger­ous
fail­ure per hour (1/​h)		Safety integrity level (SIL)
a>= 10–5 to < 10–4No spe­cial safety requirements
b>= 3 x 10–6 to < 10–51
c>= 10–6 to < 3 x 10–61
d>= 10–7 to < 10–62
e>= 10–8 to < 10–73

This table com­bines ISO 13849–1 2007, Tables 3 & 4. No sim­i­lar tables exist in IEC 62061 2005.

Combining Equipment with PLs and SILs

Section 7 of the report speaks to the chal­lenge of inte­grat­ing equip­ment with rat­ings in a mix of PLs and SILs. Until the stan­dards merge and a sin­gle sys­tem for describ­ing reli­a­bil­ity cat­e­gories is agreed on, this prob­lem will be with us.

When design­ing sys­tems using either sys­tem the designer has to deter­mine the approx­i­mate rate of dan­ger­ous fail­ures. In ISO 13849–1, MTTFd is the com­po­nent fail­ure rate para­me­ter, while in IEC 62061, PFHd is the sub­sys­tem fail­ure rate para­me­ter. MTTFd does not con­sider diag­nos­tics or archi­tec­ture, only the com­po­nent fail­ure rate per year, while PFHd does include diag­nos­tics and archti­tec­ture, and it speaks to the sys­tem fail­ure rate per hour. To com­pare these rates, ISO 13849–1 Annex K describes the rela­tion­ship between MTTFd and PFHd for dif­fer­ent architectures.

In the design process only one method can be used, so where equip­ment with dif­fer­ent rat­ings must be com­bined the fail­ure rates must be con­verted to either MTTFd or to PFHd, depend­ing on the sys­tem being used to com­plete the analy­sis. Mixing require­ments within the design of a sub­sys­tem is not per­mit­ted (See Clause 7.3.3).

Fault Exclusions

Fault exclu­sions are per­mit­ted under both stan­dards with some lim­i­ta­tions: up to IEC 62061 SIL 2. No fault exclu­sions are per­mit­ted in SIL 3. Properly jus­ti­fied fault exclu­sions can be used up to PLe. “Properly jus­ti­fied” fault exclu­sions are those that can be shown to be valid through the life­time of the SRP/​CS.

In gen­eral, fault exclu­sions for mechan­i­cal fail­ures of electro­mechan­i­cal devices such as inter­lock devices or emer­gency stop devices are not per­mit­ted, with a few excep­tions given in ISO 13849–2, (See Clauses 7.2.2.4 and 7.2.2.5).

This approach is con­sis­tent with the cur­rent approach taken in Canada, as described in CSA Z432 & Z434. Fault exclu­sions are gen­er­ally not per­mit­ted under ANSI standards.

Worked Examples

Section 8 of the Technical Report gives a cou­ple of worked exam­ples, one done under ISO 13849–1, and one under IEC 62061. For some­one look­ing for a good exam­ple of what a prop­erly com­pleted analy­sis should look like, this sec­tion is the gold at the end of the rain­bow. Section 8.2 pro­vides a good, clear exam­ple of the appli­ca­tion of the stan­dards along with a nice, sim­ple exam­ple of what a safety require­ment spec­i­fi­ca­tion might look like.

Understanding the Differences

One area where pro­po­nents of the two stan­dards often dis­agree is on the ‘accu­racy’ of the ana­lyt­i­cal pro­ce­dures given in the two stan­dards. The Technical Report pro­vides a detailed expla­na­tion of why the two tech­niques pro­vide slightly dif­fer­ent results and pro­vides the ratio­nale explain­ing why this vari­a­tion should be con­sid­ered acceptable.

To Buy or Not to Buy…

At the end of the day, the ques­tion that needs to be answered is whether to buy this doc­u­ment or not. If you use either of these stan­dards, I strongly rec­om­mend that you spend the money to get this Technical Report, if for noth­ing more than the worked exam­ples. Until the two stan­dards are merged, and that could be a few years, you will need to be able to effec­tively apply these approaches to PL and SIL rated equip­ment. This Technical Report will be an invalu­able aid.

It also pro­vides some guid­ance on the direc­tion that the new merged stan­dard will take. Some old argu­ments can be set­tled, or at least re-​​directed, by this document.

Finally, since the TR is to be incor­po­rated in both stan­dards and con­tains mate­r­ial replac­ing that in the cur­rent edi­tions of the stan­dard, you must buy a copy to remain current.

For all of these rea­sons, I would spend the money to acquire this doc­u­ment, read and apply it.

Download IEC stan­dards, International Electrotechnical Commission standards.

Download ISO Standards

If you’ve bought the report and would like to add your thoughts, please add a com­ment below. Got ques­tions? Contact me!

All original content on these pages is fingerprinted and certified by Digiprove
Performance Optimization WordPress Plugins by W3 EDGE