intelligent safety design begins with a risk assessment

Copyright © 2011 Rockwell Automation, Inc. All rights reserved.

Session C

Intelligent Safety Design Begins with a Risk AssessmentMike Miller & Derek Jones


ISO 13849-1 IEC 62061

SustainabilityTime to market

Information Compliance

ProductivityPerformance

Development Costs Ops & Maintenance Costs

What is it? It’s NOT just about Equations,Standards and schematics…

It’s about ……………

What is functional safety?



• It is about things working safely and productively




• It is about evidence of due diligence, can we prove it is right…





• It is about implementing a solution that is both technically and commercially viable





• It is about implementing a solution that is both technically and commercially viable

• It is about a logical concept for design


What makes safety special

• Is a domestic float valve a safety device

?



• What happens if valve doesn’t work?

• How does it fail?• Does the valve fail In the

on/off/unknown state?• Do any of these states represent

a dangerous state?• In this case, most of the failures

are inconvenient rather than dangerous


• Process vessel – is a domestic float valve good enough?• How do we know• What do we need to do to check that it is good enough



How Good Is It??

• Valves could be anywhere between 0-100% reliable

• Relatively inexpensive plastic float valve to stainless steel

MTTFD = Mean time to a dangerous failure


• The same principle applies for electrical switches

• We could select an inexpensive plastic switch compared to a state of the art RFiD non-contact switch

Improve reliability

MTTFD = Mean time to a dangerous failure MTTFD = Mean time to a dangerous failure

Is this all we need?


Do We Need Two?

• What if our single valve fails?


Do We Need Two?

• Do we need 2 float valves?

• Increased risk – we might need two..

FT = Fault tolerant


Fault Tolerance - Redundancy

• Electrically we could have redundant switches to switch off the motor

• Is this all we need?

FT = Fault tolerant FT = Fault tolerant


What If One Fails

• If one fails – do we know?

• Do we need to know??

DC = Diagnostic Coverage


What If One Fails

• In this case we have no diagnostics and the fault is not detected



What If One Fails

• Without diagnostics we could get a subsequent fault.



How do we check

• Fault detection may be desirable



How do we check


• In this instance the fault is indicated


How to achieve DC

• Electrically we would wire the switches back to a monitoring safety relay


DC = Diagnostic Coverage DC = Diagnostic Coverage


What If They Both Fail

• Both fail together?

CCF = Common cause failure


What If They Both Fail

• One means of addressing CCF is to adopt diversity



Diversity using differing technologies


• Diversity reduces common cause failure




What If The Process Changes?

• Contents of vessel changes

• Change in pressure from 10-100PSi


SYS =Systematic integritySYS =Systematic integrity


Have we maintained the installation?

• Is the valve replaced every 5 years as per the installation sheet

• Do we have the sufficient competency

• Is this all we need???

FSM = Functional safety management FSM = Functional safety management


The Acronyms…

• MTTFd – Mean Time To Dangerous Failure

• HFT – Hardware Fault Tolerance• DCavg – Diagnostic Coverage• CCF – Common Cause Failure• SYS – Systematic Integrity• FSM – Functional Safety

Management

• If some of the points listed above aren’t dealt with properly we will fail to achieve our goal of a functionally safe system and the consequences can be significant


Safety Management – Roles and Responsibilities


What is Functional safety?“part of the overall safety that depends on a system or equipment operating correctly in response to its inputs.”

What is safety?“the freedom from unacceptable risk of physical injury or damage to the health of people, either directly, or indirectly as a result of damage to property or to the environment.”

Rockwell Automation EnhancementMore than compliance. It improves the functional operation of the machine. It also helps to increase worker safety,

efficiency and productivity, while reducing waste.

Recap - What is Functional Safety?



Introduction to ISO 13849

• Let’s begin by introducing some terms, definitions and requirements• All information is taken from the current version of:

Safety of machinery - Safety-related parts of control systems -Part 1: General principles for design (ISO 13849-1:2006)

What are Performance Level PL?

Hardware Fault Tolerance – Categories (structure)

B 1 2 3 4

Reliability of the HW: Mean Time To Failure (dangerous – MTTFd)

Quality of the diagnostic measures: DC (CAT. 2 and higher)

Sufficient measures against Common Cause Failures (CCF)

Performance Level (PL) acc. to ISO 13849-1

a b c d e

+

=

Mea

sure

s to

avo

id s

yste

mat

ical f

ailu

res

(QM

)



What is required for ISO 13849?

HFT

MTTFd

DCCCF

System

FSM


• Design according to relevant standards• Withstand expected influences• Hardware Fault Tolerance of zero, single fault will lead to the

loss of the safety function• Mainly characterized by selection of components

What are requirements for Category B?What are requirements for Category 1?


• Requirements for category B apply• Well-tried safety principles• SF has to be checked in suitable intervals• Hardware Fault Tolerance of zero, but the loss of the SF is detected• Mainly characterized by structure

What are requirements for Category 2?



• Requirements for category B apply• Well-tried safety principles• Hardware Fault Tolerance of one• Some but not all faults are detected• Accumulation of undetected faults can

lead to the loss of the SF• Mainly characterized by structure




HFT

MTTFd

DCCCF

System

FSM

MTTFd

Denotation of MTTFd Level of MTTFd

low 3 years MTTFd < 10 years

medium 10 years MTTFd < 30 years

high 30 years MTTFd < 100 years

D = 1/MTTFd

• MTTFd = Mean Time To Failure dangerous

• Average value of the operating time without dangerous failure in one channel

• Statistical value, no guaranteed lifetime!




HFT

MTTFd

DCCCF

System

FSM

Diagnostic Measures (DC)

Failure

safe (s)

dangerous (d)

dangerous, but detected beforeit can result in a hazard (dd)

dangerous, remains undetected (du)

DC = Failure rate of the detected dangerous failures (dd)

Failure rate of all dangerous failures (d)

Denotation of DC Level of DC

None DC < 60%

Low 60% DC < 90%

Medium 90% DC < 99%

High 99% DC


?

?

Estimation of the DC (Example: Output Device)




HFT

MTTFd

DCCCF

System

FSM

Common Cause (CC) Effects (only for multi-channel systems)

• Common Cause Failures (CCF) result from a single cause and affect more than one channel.

• One part of the failures in both channels reveals as CC failures; that means due to one cause a failure in one channel is followed by the same failure in the other channel, either at the same time or some time later.

• Common causes are:– External stress as excessive temperature, high EM-interferences, e.g.– Systematic design failures due to the high complexity of the product or

missing experience with the new technology– No spatial separation between channels, use of common cables, on one

PCB, etc.– Human errors during maintenance and repair

Failure channel 2

common causefailure

CCFFailure channel 1


Determination of CCF (Annex F ISO 13849-1)

Separation / Segregation Score

Physical separation between signal paths: Separation in wiring/piping, sufficient clearance and creepage distances on printed-circuit boards

15

Diversity

Different technologies/design or physical principles are used, for example: first channel programmable electronic and the second channel hardwired, etc.

20

Design / application / experience

Protection against over-voltage, over-current, over-pressure, etc. 15

Components used are well-tried 5

Assessment / analysis

Are the result of a failure mode and effect analysis taken into account to avoid common cause failures in design?

5

Competence / training

Have designers / maintainers been trained to understand the causes and consequences of common cause failures?

5

Environmental

Prevention of contamination and electromagnetic compatibility (EMC) against CCF in accordance with appropriate standards? Electric systems: Has the system been checked for electromagnetic immunity, e.g. as specified in relevant standards against CCF?

25

Other influences: Have the requirements for immunity to all relevant environmental influences such as temperature, shock, vibration, humidity (e.g. as specified in the relevant standards) been considered?

10




HFT

MTTFd

DCCCF

System

FSM

Measures against Systematic Failures

• Avoidance of systematic failures– Example:

• Avoidance of faults created through poor specification• Avoidance of faults due to poor process control

• Control of systematic failures:– Example:

• Through selection, structure, diagnostics, etc.

Systematic failures have deterministic, not probabilistic causes and can only be eliminated by changes in design, production, organization etc.


Measures for avoidance of Systematic Failures

• Use of suitable materials and adequate manufacturing• Correct dimensioning and shaping• Proper selection, combination, arrangements, assembly and installation of

components, including cabling, wiring and any interconnections• Compatibility• Withstanding specified environmental conditions• Use of components designed to an appropriate standard and having well-

defined failure modes.• In addition, one or more of the following measures should be applied,

taking into account the complexity of the SRP/CS and its PL:– Hardware design review (e. g. by inspection or walk-through)– Computer-aided design tools capable of simulation or analysis– Simulation


Measures for the control of Systematic Failures

• Use of de-energization• Measures for controlling the effects of voltage variation• Measures for controlling the effects of the physical environment• Program sequence monitoring (if software existing)• Measures for controlling the effects arising from data communication

processes• In addition, other measures may be applied, taking into account the

complexity of the SRP/CS and its PL:– failure detection by automatic tests and the use of redundancy and diversity– positive mode of operation– mechanically linked contacts and direct opening action– over-dimensioning.




HFT

MTTFd

DCCCF

System

FSM

Functional Safety Management

• Considers the aspect Quality Management, Quality Assurance and documentation

• Describes the process to guarantee quality and functional safety and the organizational measures undertaken (development process, production, installation, operation, maintenance etc.)

• Life cycle model: Over the entire life time (all phases in the life of a product) by appropriate quality assurance measures it shall be ensured, that:– Creation of systematic failures is avoided as much as possible– Systematic failures are recognized by testing/verification activities

• All phases in the life of the machine have to be sufficiently documented, both machine design and records of the test/verification activities

• Installation and application of a Functional Safety Management System (FSM)


Qualitative requirements (QM) over the Machine Life Cycle


HFT

MTTFd

DCCCF

System

FSM

• Requires structure or categories• Requires determination of reliability over time• Requires detection of dangerous faults• Requires consideration of Common Cause Failures and effects• Requires systematic review of systems• Requires Functional Safety Management System (FSM) through out the

life cycle of the machine• Requires documentation


Summary of ISO 13849?

Safety, performance, lower cost and higher productivity from your machine!

58

SISTEMA (available in multiple languages)

EN ISO 13849-1: SISTEMA Calculation Tool

• PL Calculation software for EN ISO 13849-1

• Free to use

• Data Libraries available

• Independent

• Maintained


Where Can You Find Data for SISTEMA and Functional Safety Information ?

Copyright © 2010 Rockwell Automation, Inc. All rights reserved. 59

Download SISTEMA and Rockwell Automation SISTEMA Data Library from the Safety Resource Center at: http://discover.rockwellautomation.com/SA_EN_Functional_Safety.aspx


http://discover.rockwellautomation.com/SA_EN_Functional_Safety.aspx

http://discover.rockwellautomation.com/EN_Safety_Solutions.aspx


Thank You.

intelligent safety design begins with a risk assessment

Technology