New Machine Safety Standards Usher in Era of Better Design Flexibility and Safety Performance

Transcription

1 New Machine Safety Standards Usher in Era of Better Design Flexibility and Safety Performance By Mike Miller, CFSE, Global Safety Market Development, and Wayne Solberg, Global Technical Consultant, Rockwell Automation Keeping up with changing safety standards is nothing new for machine builders. But the recent changes to the European Commission s new Machinery Directive, which took effect Dec. 29, 2009, will reshape how designers approach machine safety system design. As it relates to functional safety, EN 954-1, the standard that categorizes safety levels, is being superseded by two standards that will coexist. Machine builders and integrators can choose to conform to the requirements of either EN ISO or EN/IEC to demonstrate compliance with the machinery directive. The European Commission recently extended the deadline for transition from EN to EN/ISO until Dec. 31, This additional period of time should be viewed as an additional transition period not as an extension to EN With this adoption of these functional safety standards, designers will need to assess the reliability of the safety components by adding a quantitative calculation to the control safety system design. While this means more steps and procedures, it also offers benefits. Namely, these standards result in a methodical approach that can lead to machinery with more predictable performance, greater reliability and availability, and improved return on investment. EN ISO ( Safety of machinery, Safety-related parts of control systems ) builds on EN 954-1, specifying system reliability in one of five performance levels (PLs) based on a hardware-oriented structure; calculated mean time to dangerous failure; and diagnostic coverage of the safety function. A significant revision in the standard requires defining the statistical probability of an unwanted occurrence or failure. In other words, it forces the designer to validate that the control system does what is required of it. This

2 standard applies beyond electric/electronic systems to include mechanical, hydraulic and pneumatic safety related parts of the control systems. EN/IEC ( Safety of Machinery Functional safety of safety-related electrical, electronic and programmable electronic control systems ) describes both the amount of risk to be reduced and the ability of a control system to reduce that risk in terms of safety integrity level (SIL). The machinery sector uses three SILs; SIL 1 is the lowest and SIL 3 is the highest. A SIL applies to a safety function. The subsystem making up the system that implements the safety function must have an appropriate SIL capability. Less Complexity, Better Reliability Historically, standards mostly were prescriptive in nature and simply provided guidance on the structure of control systems to ensure safety requirements were met. In fact, some people considered EN to be an overly simplistic approach because it did not require designers to assess the reliability of safety components in relationship to time. Using the principles of redundancy, diversity and diagnostics, categories of safety system structures were created to help ensure that the safety function would be performed. But a very important element was missing time. Functional safety adds a time element to build on the existing safety structure (category) approach. This addition instills a reinforcing level of confidence that the safety system will perform properly today and tomorrow. In other words, designers have more information and therefore more confidence about the reliability of the safety function. The time element causes more upfront pain for safety component suppliers because of the increased product testing and performance documentation requirements. However, in the long run, it should result in less pain for machine operators and safety system designers due to the ability to quantify circuit reliability. The ability to define performance requirements will give designers more flexibility to tailor their circuits to meet the specific needs of the application, rather than generalizing the overall design based on the simpler, more prescriptive requirements of the past.

3 For example, in conducting a risk assessment under EN ISO , a designer may find that Performance Level d is required. Figure 1 reveals four alternatives. A Category 2 (zero fault tolerant) structure with a very high mean time to dangerous failure and low diagnostic coverage may be the least expensive solution. At the other end of the spectrum, a Category 3 (single fault tolerant) system with medium diagnostics may be the ideal solution. Rather than taking a conservative approach and potentially overcompensating on the design, this approach gives designers more flexibility to specify a more optimum level of safety to meet the individual application demands. Performance Level a b c d e Cat B DC avg none Cat 1 DC avg none Cat 2 DC avg low Cat 2 DC avg med Cat 3 DC avg low Cat 3 DC avg med Cat 4 DC avg high MTTF d low MTTF d medium MTTF d high FIGURE 1 Standard EN (IEC) offers similar flexibility. For example, a risk assessment performed in a different safety application may determine the need for a SIL 2 rating. Table 1 gives three options for achieving SIL 2. The trade-off is hardware fault tolerance with diagnostics. With zero fault tolerance (single channel), 90 to 99 percent of the failures that occur must be safe failures. If a single channel system with appropriate diagnostics is too difficult or expensive to achieve, then a single fault tolerant structure (dual channel) with a lower safe failure fraction can be used. The third alternative is a two fault tolerant system (two out of three channel) with little or no diagnostics (less than 60 percent safe failures).

4 Safe Failure Fraction (Diagnostics) Hardware Fault Tolerance < 60% ---- SIL 1 SIL 2 60% - < 90% SIL 1 SIL 2 SIL 3 90% - < 99% SIL 2 SIL 3 SIL 3 99% SIL 3 SIL 3 SIL 3 TABLE 1 In all instances, the ability to tailor the specific safety functions to the application helps reduce cost and complexity, improves machine sustainability, and helps achieve a more optimum level of safety for each particular safety circuit or function. This performance-based approach also makes it easier for designers to quantify and justify the value of safety. Previously, a designer may have had difficulty understanding or explaining why a costly or seemingly sophisticated safety system was needed for a particular application; it was simply required per the standard. Now, with the ability to quantify circuit reliability through specific performance and system integrity calculations, the designer can show the value in terms of actual risk reduction and thereby more easily justify safety expenditures. Laying the Groundwork To meet the new safety standards, each component in the safety system must have an assigned probability of dangerous failure or mean time to dangerous failure. Historically, this type of information has not been widely available, though it is now. Most manufacturers are recertifying their products to meet the new performance level requirements, as well as SIL ratings. This all takes time, but the results will mean better safety system designs with more quantifiable results. The current challenge for machine builders is two-fold. First, they need to understand what the requirements of the new Machinery Directive are and how this impacts design and component selection. Second, they need to understand the documentation

5 requirements and begin gathering the functional safety data needed from the component suppliers to support their safety designs with either an SIL or PL for the system. Many electronic component safety manufacturers are embracing the new standards by indicating the SIL level the system containing the safety component could achieve, and by supplying safety data for PL and SIL verification. This allows designers to take that information and perform the necessary calculations to meet the application requirements per the standards. Component suppliers also are offering education and training programs, and tools to help reduce the documentation complexity. Case in point: Rockwell Automation recently announced the release of a product library file designed for use with the SISTEMA calculation tool. The SISTEMA tool, developed by Germany s IFA organization, automates calculation of the attained PL of the safety-related parts of a machine s control system in the context of EN ISO The combination of the SISTEMA tool, along with new product libraries from component suppliers, will provide machinery and control system designers with comprehensive support in the evaluation of safety in the context of EN ISO Engineers are spared time-consuming consultation of tables and calculations of formulae since the software performs these tasks. The final results can be printed out in the form of a multiple-page report. (The SISTEMA tool is available for download free of charge by following the link on the Rockwell Automation Safety Portal at: The machine safety world continues to change and these new functional safety standards represent a giant leap forward. Ultimately, they will provide safer machine control systems and more flexibility to achieve and cost-justify safer designs. Though the deadline remains months away, machine builders should take steps now to evaluate the directive s impact on their equipment and prepare accordingly before the new directive becomes mandatory.