Intelligent Safety Design Begins with a Risk Assessment

What is functional safety?What is it? It’s about ……………It’s NOT just about Equations,Standards and schematics… ISO 13849-1 IEC 62061 Performance Productivity Time to market Sustainability Information Compliance Development Costs Ops & Maintenance Costs Copyright © 2011 Rockwell Automation, Inc. All rights reserved.

What is functional safety?• It is about things working safely and productively• It is about evidence of due diligence, can we prove it is right… Copyright © 2011 Rockwell Automation, Inc. All rights reserved.

What is functional safety?• It is about things working safely and productively• It is about evidence of due diligence, can we prove it is right…• It is about implementing a solution that is both technically and commercially viable Copyright © 2011 Rockwell Automation, Inc. All rights reserved.

What is functional safety?• It is about things working safely and productively• It is about evidence of due diligence, can we prove it is right…• It is about implementing a solution that is both technically and commercially viable• It is about a logical concept for design Copyright © 2011 Rockwell Automation, Inc. All rights reserved.

What makes safety special• What happens if valve doesn’t work?• How does it fail?• Does the valve fail In the on/off/unknown state?• Do any of these states represent a dangerous state?• In this case, most of the failures are inconvenient rather than dangerous Copyright © 2011 Rockwell Automation, Inc. All rights reserved.

What makes safety special• Process vessel – is a domestic float valve good enough?• How do we know• What do we need to do to check that it is good enough Copyright © 2011 Rockwell Automation, Inc. All rights reserved.

How Good Is It??• Valves could be anywhere between 0-100% reliable• Relatively inexpensive plastic float valve to stainless steel MTTFD = Mean time to a dangerous failure Copyright © 2011 Rockwell Automation, Inc. All rights reserved.

Improve reliability• The same principle applies for electrical switches• We could select an inexpensive plastic switch compared to a state of the art RFiD non-contact switchIs this all we need? MTTFD = Mean time to a dangerous failure Copyright © 2011 Rockwell Automation, Inc. All rights reserved.

Fault Tolerance - Redundancy• Electrically we could have redundant switches to switch off the motor• Is this all we need? FT = Fault tolerant Copyright © 2011 Rockwell Automation, Inc. All rights reserved.

How to achieve DC• Electrically we would wire the switches back to a monitoring safety relay• Is this all we need? DC = Diagnostic Coverage Copyright © 2011 Rockwell Automation, Inc. All rights reserved.

What If The Process Changes?• Contents of vessel changes• Change in pressure from 10- 100PSi• Is this all we need? SYS =Systematic integrity Copyright © 2011 Rockwell Automation, Inc. All rights reserved.

Have we maintained the installation?• Is the valve replaced every 5 years as per the installation sheet• Do we have the sufficient competency• Is this all we need??? FSM = Functional safety management Copyright © 2011 Rockwell Automation, Inc. All rights reserved.

The Acronyms… • MTTFd – Mean Time To Dangerous Failure • HFT – Hardware Fault Tolerance • DCavg – Diagnostic Coverage • CCF – Common Cause Failure • SYS – Systematic Integrity • FSM – Functional Safety Management • If some of the points listed above aren’t dealt with properly we will fail to achieve our goal of a functionally safe system and the consequences can All rightssignificant Copyright © 2011 Rockwell Automation, Inc. be reserved.

Recap - What is Functional Safety? What is safety? Functional safety?Rockwell Automation Enhancement “the freedom from unacceptable risk “part of the overall safety thatMore than compliance. It improves the of physical injury or damage to the depends on a system or equipmentfunctional operation of the machine. It health of people, either directly, to its operating correctly in response or also helps to increase worker safety, indirectly as a result of damage to inputs.” efficiency and productivity, while property or to the environment.” reducing waste. Copyright © 2011 Rockwell Automation, Inc.Inc. rights reserved. Copyright © 2011 Rockwell Automation, All All rights reserved.

Introduction to ISO 13849• Let’s begin by introducing some terms, definitions and requirements• All information is taken from the current version of: Safety of machinery - Safety-related parts of control systems - Part 1: General principles for design (ISO 13849-1:2006) Copyright © 2011 Rockwell Automation, Inc. All rights reserved.

What are Performance Level PL?Hardware Fault Tolerance – Categories (structure) Measures to avoid systematical failures (QM) B 1 2 3 4+Reliability of the HW: Mean Time To Failure (dangerous – MTTFd)Quality of the diagnostic measures: DC (CAT. 2 and higher)Sufficient measures against Common Cause Failures (CCF)=Performance Level (PL) acc. to ISO 13849-1 a b c d e Copyright © 2011 Rockwell Automation, Inc. All rights reserved.

What are requirements for Category B? 1?• Design according to relevant standards• Withstand expected influences• Hardware Fault Tolerance of zero, single fault will lead to the loss of the safety function• Mainly characterized by selection of components Copyright © 2011 Rockwell Automation, Inc. All rights reserved.

What are requirements for Category 2?• Requirements for category B apply• Well-tried safety principles• SF has to be checked in suitable intervals• Hardware Fault Tolerance of zero, but the loss of the SF is detected• Mainly characterized by structure Copyright © 2011 Rockwell Automation, Inc. All rights reserved.

What are requirements for Category 3? 4?• Requirements for category B apply• Well-tried safety principles• Hardware Fault Tolerance of one• Some but not all faults are detected• Accumulation of undetected faults can lead to the loss of the SF• Mainly characterized by structure Copyright © 2011 Rockwell Automation, Inc. All rights reserved.

MTTFd• MTTFd = Mean Time To Failure dangerous• Average value of the operating time without dangerous failure in one channel• Statistical value, no guaranteed lifetime! Denotation of MTTFd Level of MTTFd low 3 years MTTFd < 10 years medium 10 years MTTFd < 30 years high 30 years MTTFd < 100 years D = 1/MTTFd Copyright © 2011 Rockwell Automation, Inc. All rights reserved.

Diagnostic Measures (DC) safe (s) dangerous, but detected beforeFailure it can result in a hazard (dd) dangerous (d) dangerous, remains undetected (du) Failure rate of the detected dangerous failures ( dd) DC = Failure rate of all dangerous failures ( d) Denotation of DC Level of DC None DC < 60% Low 60% DC < 90% Medium 90% DC < 99% High 99% DC Copyright © 2011 Rockwell Automation, Inc. All rights reserved.

Common Cause (CC) Effects (only for multi-channel systems)• Common Cause Failures (CCF) result from a single cause and affect more than one channel.• One part of the failures in both channels reveals as CC failures; that means due to one cause a failure in one channel is followed by the same failure in the other channel, either at the same time or some time later.• Common causes are: – External stress as excessive temperature, high EM-interferences, e.g. – Systematic design failures due to the high complexity of the product or missing experience with the new technology – No spatial separation between channels, use of common cables, on one PCB, etc. – Human errors during maintenance and repair Failure Failure CCF channel 2 channel 1 common cause Copyright © 2011 Rockwell Automation, Inc. All rights reserved. failure

Determination of CCF (Annex F ISO 13849-1)Separation / Segregation ScorePhysical separation between signal paths: Separation in wiring/piping, sufficient clearance and creepage 15distances on printed-circuit boardsDiversityDifferent technologies/design or physical principles are used, for example: first channel programmable 20electronic and the second channel hardwired, etc.Design / application / experienceProtection against over-voltage, over-current, over-pressure, etc. 15Components used are well-tried 5Assessment / analysisAre the result of a failure mode and effect analysis taken into account to avoid common cause failures in 5design?Competence / trainingHave designers / maintainers been trained to understand the causes and consequences of common cause 5failures?EnvironmentalPrevention of contamination and electromagnetic compatibility (EMC) against CCF in accordance with 25appropriate standards? Electric systems: Has the system been checked for electromagnetic immunity, e.g.as specified in relevant standards against CCF?Other influences: Have the requirements for immunity to all relevant environmental influences such as 10temperature, shock, vibration, humidity (e.g. as specified in the relevant standards) been considered? Copyright © 2011 Rockwell Automation, Inc. All rights reserved.

Measures against Systematic Failures • Avoidance of systematic failures – Example: • Avoidance of faults created through poor specification • Avoidance of faults due to poor process control • Control of systematic failures: – Example: • Through selection, structure, diagnostics, etc.Systematic failures have deterministic, not probabilistic causes and canonly be eliminated by changes in design, production, organization etc. Copyright © 2011 Rockwell Automation, Inc. All rights reserved.

Measures for avoidance of Systematic Failures• Use of suitable materials and adequate manufacturing• Correct dimensioning and shaping• Proper selection, combination, arrangements, assembly and installation of components, including cabling, wiring and any interconnections• Compatibility• Withstanding specified environmental conditions• Use of components designed to an appropriate standard and having well- defined failure modes.• In addition, one or more of the following measures should be applied, taking into account the complexity of the SRP/CS and its PL: – Hardware design review (e. g. by inspection or walk-through) – Computer-aided design tools capable of simulation or analysis – Simulation Copyright © 2011 Rockwell Automation, Inc. All rights reserved.

Measures for the control of Systematic Failures• Use of de-energization• Measures for controlling the effects of voltage variation• Measures for controlling the effects of the physical environment• Program sequence monitoring (if software existing)• Measures for controlling the effects arising from data communication processes• In addition, other measures may be applied, taking into account the complexity of the SRP/CS and its PL: – failure detection by automatic tests and the use of redundancy and diversity – positive mode of operation – mechanically linked contacts and direct opening action – over-dimensioning. Copyright © 2011 Rockwell Automation, Inc. All rights reserved.

Functional Safety Management• Considers the aspect Quality Management, Quality Assurance and documentation• Describes the process to guarantee quality and functional safety and the organizational measures undertaken (development process, production, installation, operation, maintenance etc.)• Life cycle model: Over the entire life time (all phases in the life of a product) by appropriate quality assurance measures it shall be ensured, that: – Creation of systematic failures is avoided as much as possible – Systematic failures are recognized by testing/verification activities• All phases in the life of the machine have to be sufficiently documented, both machine design and records of the test/verification activities• Installation and application of a Functional Safety Management System (FSM) Copyright © 2011 Rockwell Automation, Inc. All rights reserved.

Summary of ISO 13849?• Requires structure or categories• Requires determination of reliability over time• Requires detection of dangerous faults HFT FSM• Requires consideration of Common Cause Failures and effects• System Requires systematic review of systems MTTFd• Requires Functional Safety Management System (FSM) through out the life cycle of the machine CCF DC• Requires documentation Safety, performance, lower cost and higher productivity from your machine! Copyright © 2011 Rockwell Automation, Inc. All rights reserved.

EN ISO 13849-1: SISTEMA Calculation ToolSISTEMA (available in multiple languages)• PL Calculation software for EN ISO 13849-1• Free to use• Data Libraries available• Independent• Maintained Copyright © 2011 Rockwell Automation, Inc. All rights reserved. 58

Where Can You Find Data for SISTEMA and Functional Safety Information ?Download SISTEMA and Rockwell Automation SISTEMA Data Library from the Safety ResourceCenter at: http://discover.rockwellautomation.com/SA_EN_Functional_Safety.aspx Copyright © 2010 Rockwell Automation, Inc. All rights reserved. 59

Intelligent Safety Design Begins with a Risk Assessment

by Rockwell Automation

Accessibility

Categories

Upload Details

Usage Rights

Statistics