Documente Academic
Documente Profesional
Documente Cultură
Large inventory; same day shipping on stock items 95% or better on time delivery Order online, via EDI, Credit Card, Fax, or Phone 24 Hour emergency assistance Lunch & Learns, Seminars, and in-depth training classes
Generic Technology or Product application specific www.cesales.com 800-228-2790
page 2 Design with ISO 13849 110401
Contents
Background and safety with EN-954-1-1996 Basic Safety Circuit Structure from EN-954-1 Introduction to ISO13849-1 Component failure and MTTFd Evaluation of sub-systems and systems Explanation of DCavg and CCF Example of simplified PL evaluation Commercial PL Calculation programs Simplified example
Some Background
Safety of Machinery EN-954-1-1996 Was the Starting point
EN-954-1-1996
Defined five Level of Risk categories each of which described a safety control system with appropriate performance for its risk reduction It is considered Deterministic or Qualitative so that conformance to the requirement cannot not be positively established nor substantiated Resulted in a spectrum of acceptable system performance within a category Specifically defined the categories as Non Hierarchical
A system which meets the risk reduction requirements for one risk level, does not necessarily provide a greater risk reduction than one which meets the requirement for a lower risk level. In practice, the hierarchical approach has been quite successful when
Components of similar reliability are used Exclusions used in a lower category are valid Same preventive maintenance is applied Environmental conditions have the same effect on the devices
This system was adopted as a functional guide line in the US, as initially, there was no similar U.S. system
Control Reliable term was used but not well defined. RIA-15.06-1999 offered an alternative with both a risk assessment and risk reduction strategy, with some specific guidelines, modeled after EN-954-1. B11.0-2010 has a very qualitative description of the process.
page 7 Design with ISO 13849 110401
PLC Q1
SIM Cat 4
Using standard Photo Electric sensors, this circuit has been certified by TUV as meeting Cat 2 if monitored by a DEDICATED, but non Safety Rated, PLC The TYPE 2 Safety Light Curtain has been certified as meeting Cat 2 The probability of the TYPE 2 safety light screen failing UNSAFELY is incredibly small due to internal testing (per IEC 61496 Type 2) while the chances of a P.E. sensor failing to ON is much higher. The external testing of the P.E. by the standard PLC is less positive Both been certified as meeting the same Category risk reduction requirements. page 8
Design with ISO 13849 110401
For each Task/Hazard pair, qualify the three variables which together determine the level of risk
Seriousness of the potential injury
Serious Slight
The Level of Risk identifies a reasonable minimum safety systems functional performance appropriate to reduce that risk to a tolerable level
There are Five Risk Level Categories B, 1, 2, 3, and 4 Each has a functional description of the behavior of the safety system under fault conditions, and a suggested circuit architecture to attain such performance.
page 9 Design with ISO 13849 110401
EN-954-1-1996
P1 F1 P2 P1 P2 P1 P2 P1 P2
SIL N/A 1
B B 1
S1
F2 F1
<3x10-6
2 3 4
Risk Category
page 10 Design with ISO 13849 110401
S2
F2
d e
<10-6
2 3
<10-7
CR1 CR1
CR1
Cat B
Safety Block Diagram
I
Input Signal
Output Signal
CR1
CR1
CR1
Cat 1
Safety Block Diagram
I
Input Signal
Cat 1 = Single Channel Cat 1 uses Better Stuff than B Components with longer mean time to DANGEROUS failure (MTTFd) and at least some are Safety Rated Postpone but not prevent the failure to danger
page 12 Design with ISO 13849 110401
Output Signal
Cat 2
I
Input Signal
L
Trigger Signal Monitoring
Control Signal
Cat 2 = Single Channel with monitoring Monitor at suitable interval May not always be able to shut down the hazard, but only warn and inhibit next hazardous cycle/situation
page 13 Design with ISO 13849 110401
TE
OTE
Cat 3
O1
L1
Cross Monitoring
Output Signal
Cat 3 = Dual Channel No Single Fault causes loss of the Safety Function w/ Conditional Monitoring (May not detect all failures)
page 14 Design with ISO 13849 110401
I2
Input Signal
L2
Output Signal
O2
10
Cat 4
O1
L1
Cross Monitoring
Output Signal
w/ Complete Monitoring Must detect first fault or continue to protect with this fault until the next fault, when it or the combination of faults, must be detected
page 15 Design with ISO 13849 110401
I2
Input Signal
L2
Output Signal
O2
Then came the new Machinery Directive 2006/42/EC which drove the need for a new Machinery Safety standard ISO 13849-1-1999 2006
Safety of Machines Safety Related Parts Of Control Systems General Design Principles Performance Defined in Performance Levels PL IEC 62061 Safety of Machines Functional Safety of Electrical, Electronic, and Programmable Electronic Control Systems Performance Defined in Safety Integrity Levels SIL CL
page 17 Design with ISO 13849 110401
Current Standing
To meet the safety performance required for sale and use in the European and some other International Markets, a machine must meet the current Machinery Directive When a standard is harmonized with the Machinery Directive, building the machine to that standard is presumed as proof of conformity to the Machinery Directive What is status ISO 13849-1 has been listed as a Harmonized Standard with the M.D.
When a standard is superseded it is retired and can no longer be used as proof of conformity EN 954-1 has been extended through Dec 2011
which means either may be used as presumption of conformity to M.D.
Machine Level C standards are still presumed to be in conformance, but require adherence to EN-954-1
At issue is can a machine be built to the C standard if its safety related parts of the control system are designed to ISO13849-1 Or Does a machine built to the C standard meet the Machinery Directive if built to EN-954-1
The data and Third Party certification to the new standard of many safety rated components are not available, which precludes their use in a system to the new standards
page 18 Design with ISO 13849 110401
Many organizations build machines for both markets, or purchase them there Although never part of our regulatory system, the Risk Categories of EN-954-1 have become engrained in our safety vocabulary and in the machinery safety design for the U.S. market EN-954-1 has influenced both ANSI B11.0 and RIA 15.06 RIA is looking at adoption of the Robotic standards ISO 10218-1 and -2 with National Deviations.
15
Based on safety circuits MTTFd performance requirement, permit simpler structure for some level of risk reduction which otherwise would not meet the qualitative definition under EN-954-1
Using components with varying individual MTTFd values, complete safety control systems may be capable of meeting system performance level with sub-systems of less complicated structures than is possible under EN-954-1
May permit use of sub-system with mixed structure, not possible in the qualitative evaluation
page 21 Design with ISO 13849 110401
Functional Safety
Divided into SIX steps Performed Sequentially
page 22 Design with ISO 13849 110401
The Process,
1 Definition of the safety-technological requirements
Safety function characteristics and interface to the basic machine control
3 Safety Design
Execution of the design requirements above with appropriate components
5 Verification 6 Validation
All Safety Functions meet risk reduction requirements PLr determined by the risk assessment All safety relevant parts meet the Qualitative reduction requirements
Editorial Comment
In order for the value of ISO13849-1 to be realized, one must accept the validity of Statistical Mathematics
FACT
MTTFd is a statistical value and in NO WAY MEANS Guaranteed Lifetime, or Failure-Free-Time, Time to First Failure or any other such concept It is a numerical value, usually stated in years, which permits the calculation of probability of failures in terms of % for a given period of use MTTFd in years can be converted to Failure Rate in terms of failures per hour d typically based on a 24/7 day 365 days per year
d(hr) = 1/(MTTFd(yr) *8760)hr/yr or MTTFd of one year of 24/7 is approximately a d of 10-4 failures per hour
page 24 Design with ISO 13849 110401
20
= tuse = 1/d
37% 63%
37% 63%
=1.9x10-5 PLb
=6.3x10-6 PLc
=1.9x10-6 PLd
%f(t) = 1-e-t
t=1/
30y
63.2%
100y
%f(t)
3
From A New Approach to Machine Safety Schmersal IPEC Industrial Controls Ltd
Channel MTTFd of 3 years and less is not acceptable for safety controls Channel MTTFd cap of 100 years is used to prevent overshadowing a lesser capable second channel
ISO 13849-2006
P1 F1 P2 P1 P2 P1 P2 P1 P2
EN954-1 ISO13849-1-2006
SIL
IEC 62061
B B 1
N/A 1
S1
F2 F1
<3x10-6
2 3 4
d <10-6 e <10-7 2
S2
F2
Note: Correlation of risk levels between EN-954-1 and ISO 13849 or IEC 62061 are not identities, but are given for relative comparisons only See also B11-TR4
System
SIL 1
< 3x10-6
SIL 2
Channel
< 10-6
SIL 3
< 10-7
CCF=>65
A Cat 3 structure, with Medium MTTFD a Low DCavg and a CCF score 65, can achieve a PLc
page 28 Design with ISO 13849 110401
The PL level describes the potential performance of the device when correctly used following the manufacturers recommendation Well Tried are listed with industry or manufacturer developed B10d or B10
page 29 Design with ISO 13849 110401
Device Failure
25
Mechanical Devices
Well Tried proven performance in similar applications Wear out typically driven by cycles under load B10 Life, level of use where 10% of the population has failed
Use 10xB10d or 2x10xB10 (assumes 50% of failures are to danger) to obtain Mean Cycles to Failure MCTF
MTTFd is calculated using the Use Profile (nop) of the device MTTFd = 10B10d / nop = 10 x B10d x tcycle(sec)
Days x Hours x 3600 sec Year Hour Day
Replace after usage reaches B10d life at T10d = B10d / nop or 20 Years page 30
Design with ISO 13849 110401
Limit Switch
Safety Controller
Note: These specifications certify the acceptable performance of specific logic safety functions
page 32 Design with ISO 13849 110401
Fault Exclusion
If a fault may be excluded, its occurrence does not need to detected, thereby decreasing the systems requirement to detect faults, DCavg
Technical improbability of certain faults Generally excepted technical experience Technical demands regarding the application and special hazards Design and construction may be used to exclude some faults
Excluded faults must have a documented explanation why the exclusion is valid
page 33 Design with ISO 13849 110401
Determination of PL
Determine the structure and components of the three functions for each sub-system
Input, Logic, Output Identify when failure occurs, which components will cause failure of the entire sub-system
30
Sensor Detect
Logic Process
Actuator Actuation
SRP/CS
iab
SRP/CS
iix
SRP/CS
PL
The design presented here is based on the simplifications to the statistical analysis allowed by the use of the structures required for given PL. Deviation from these structures will require full analysis using FMEA and full statistical methods. Any failure modes in the interconnection iix between sub systems must be included on one of the sub-systems
page 35 Design with ISO 13849 110401
Sub-Systems
I1 L1 I2 O2 O1
Simplification by Re-arrangement
I1 L1 I2
O1 O2
Note One of the advantages of ISO13849-1, allows the evaluation of mixed risk category solutions
MTTFdS
MTTFdL
MTTFdQ
i=1
1 MTTFdi Comp
The MTTFd of two channels, each with a MTTFd with no monitoring is: 1 MTTFdC1+MTTFdC2 1 MTTFdC1 + 1 MTTFdC2
MTTFd=
Ex: if MTTFdC1=50 years and MTTFdC2 =100 years MTTFd= 77.8 years
Determine the PL of each sub system connected in Series using MTTFd data Determine lowest PL=PLlow Count number of PLlow in the series string Use table 6.6 to determine PL of the string This table is a simplified method of the mathematical summation of the probabilities of failure using sub system mid-point 1/MTTFd values Or
1
N
MTTFd Chnl
i=1
1 MTTFd (Subsystem)i
The standards provide some guidance tables of the average achievable, given certain design considerations and features.
These allow for the DCavg groupings of 60% to 90%, 90% to 99%, and greater than 99%
i=1
CCF are Failures of different devices, resulting from the same single event Failures are not consequences of each other ISO 13849-1-2006
Clause 1 2 3 3.1 3.2 4 5 6 6.1 Measure Against CCF Separation/Segregation Diversity Design/application/experience Protection against over-voltage, over-pressure, overcurrent etc Components used are WELL TRIED Assessment/analysis Competence/training Environmental
Pertaining to the power source for electrical and fluid power EMI, RFI, Filtration, Drainage, Dirt Entry (All according to Manufacturers Specifications)
Score 15 20 15 5 5 5
25 10
From ISO 13849-1:2006 Table F.1 page 42 Design with ISO 13849 110401
6.2 Temperature, Humidity, Dust, Shock, Vibration Must reach a score of at least 65 for Cat 2, 3, or 4 structure
All devices/components in channel must meet requirement to get score >0 No partials
OR
This statistical treatment of failure and detection results in complete systems whose performance exceeds that of the individual components or channels Means available to the average, non-mathematician, user
Use of PL estimation wheel Commercial and Free SIL and PL Computer Programs
Vendors contain library of components of their products SIL, PL, or MTTFd Most will permit import of user library data
page 43 Design with ISO 13849 110401
35
ISO 13849-1-2006
1 d
1 MTTFd Sys
% failure @ time t
f(t)=1-e- d t
d 1/h
System
SIL 1
< 3x10-6
SIL 2
< 10-6
SIL 3
Years 1/Hour -5 3<=MTTFd<10 4*10 > > 10-5 10<=MTTFd<30 10-5 > > 4*10-6
DC avg probability of fault discovery as = % of occurrence Low 60% <= DC < 90% Med 90% <= DC < 99% High 99% <= DC
[(D* di
i-1
(t)
Ddi) di]
i-1
di
1 MTTFd Chnl
i=1
1 MTTFdi Comp
Circular Calculator
Align 30 years in disks bottom window Locate Characteristic in slot Cat 4 DC High 9.54 Identify color and locate Exponent 10-8 Control System is : 9.54x10-8 equal to PLe
from BGIA
Required Achieved
page 47 Design with ISO 13849 110401
40
PLC Q1
The dedicated PLC monitors the function of the three photoelectric sensors and the follower relay K1 Since the PLC is not a Serial device in the system, i.e. its failure does not result in the loss of the safety function, its MTTFd is not included in the safety channel calculation MTTFd of the PLC is 50 years and is >2x the MTTFd of the system being monitored, it meets the minimum requirement for a test component for this system The Type 2 Safety Light Curtain is certified by a Third Party Test Laboratory to meet the required standards and is certified as a PLd safety component. The Safety Interface module is a certified PLe safety component The solenoid valve is a Well Tried component with a MTTFd of 100 years at this operation rate
SIM Cat 4
System Performance Level Comparison of Three P.E. and PLC vs. Type 2 SLC and SIM
3 P.E. with PLC monitor.
At the end of 20 years of use, the P.E. and PLC has a 44% chance of failure to danger, while the Type 2 SLC with SIM has a 6.6% failure rate Note: Some of the data is estimated and is intended only as an example of the impact of multiple series components and DC coverage in a Cat 2 configuration.
page 50 Design with ISO 13849 110401
Appendix A
References
BGIA Report 2/2008e ISO 13849-1-2006 BGIA Report 6/2004 Untersuchung des Alterungsprozesses von hydraulischen Vegeventilen (Study of the ageing process of hydraulic valves)
BGIA FIA SISTEMA Safety Integrity Software Tool for the Evaluation of Machine Applications
http://www.dguv.de/ifa/en/pra/softwa/sistema/index.jsp