SafeDesign: Machine Safety Validation

Today s Agenda 1. Review of 2010 SafeDesign Functional Safety Educational Series 2. Machine Safety Validation 3. Safety Community and Future Educational Opportunities 4. Questions Copyright 2010 Rockwell Automation, Inc. All rights reserved. 2

Today s Speaker Over 30 years of safety experience 5 yrs - machinery safety 10 yrs - material handling engineering 2 yrs Sheet metal stamping facility 4 yrs Oil exploration 6 yrs USAF Munitions Safety BSEET Certified Functional Safety Professional Exida Certificate No.: 090312002 Safety committee of PMMI - ANSI B155.1 Safety Requirements for Packaging Machinery and PackagingRelated Converting Machinery Wayne Solberg Global OEM Technical Consultant, CFSP Rockwell Automation Copyright 2010 Rockwell Automation, Inc. All rights reserved. 3

Recap - 2010 SafeDesign Functional Safety Educational Series Multimedia Archives of Webinars are Posted Online www.discoverrockwellautomation.com/safety Copyright 2010 Rockwell Automation, Inc. All rights reserved. 4

Copyright 2010 Rockwell Automation, Inc. All rights reserved. Standards - EN, ISO and IEC EXAMPLES: Type A EN ISO 12100 Safety of machinery. Basic terminology and methodology EN ISO 14121 Safety of machinery. Risk assessment Type B EN ISO 13849-1 - Safety related parts of control systems EN ISO 13850 - Emergency stop function EN / IEC 62061 - Functional safety of electrical control systems EN / IEC 60204-1 - Safety of machinery. Electrical Equipment EN 574 / ISO 13851 Two hand controls Type C EN ISO 2860 - Earth Moving Machinery EN ISO 8230 - Safety requirements for dry-cleaning machines

Functional safety standards Generic Electrical Control Systems Process Electrical Control Systems IEC/EN 61508 IEC/EN 61511 SIL Machinery Electrical Control Systems Machinery Control Systems (All technologies) IEC/EN 62061 EN ISO 13849-1: 2006 PL Commonality across sectors and geographies Copyright 2010 Rockwell Automation, Inc. All rights reserved. 6

Safety as a Core System Function Safety continues to emerge as core system function Value Safety as a Key Differentiator Global Compliance Common Designs Reduced Costs Increased Productivity Systematic MTTR Reduction Improved Competitiveness Reduced Floor Space and Direct Labor Improved Ergonomics Copyright 2010 Rockwell Automation, Inc. All rights reserved. 7

Solving the Problem 5. Maintain & Improve 1. Risk or Hazard Assessment Safety Life Cycle 4. Installation & Validation 2. Functional Requirements 3. Design & Verification System design based on integrating safety & machine functionality. Copyright 2010 Rockwell Automation, Inc. All rights reserved. 8

SafeDesign: Machine Risk Assessment The process serves as an effective tool for properly identifying and assessing the real hazards involved in operating a particular machine. Risk assessment provides a method for determining equivalent levels of protection when designing safeguards and stating OSHA s minor service exception. The process takes away the guesswork when estimating risk and prescribing safety system performance. Risk assessment is an active, documented process that can be filed and maintained for the entire life of the machine, and serves as documented proof of your due diligence. Risk assessment establishes the foundation and early framework for the design and implementation of an effective machine safety program. Copyright 2010 Rockwell Automation, Inc. All rights reserved. 9

Hierarchy of Risk Reduction Measures Design it out Fixed enclosing guard Interlocked guard and safety devices Awareness Means Training & supervision Personal protective equipment Copyright 2010 Rockwell Automation, Inc. All rights reserved. 10

Five Groups of Safeguards 1. Guards Fixed / Interlocked / Self-Adjusting / Adjustable 2. Devices Presence Sensing (Optical / mats / palm buttons) Safety Controls (two hand control / Limit Switches / Trip Wires) Safety Gates 3. Location and Distance 4. Feeding & Removal Methods 5. Miscellaneous Methods / Aids Location of Safety Devices (controls / guards / barriers) Automatic & Semi-automatic feed Automatic & Semi-automatic removal Robotic feed and removal Awareness barriers Protective shields Hand feeding tools Holding fixtures Copyright 2010 Rockwell Automation, Inc. All rights reserved. 11

Risk Mitigation Techniques How Standards can help Standard may provides performance requirements for the design, construction, installation, operation and maintenance of the safeguarding listed below when applied to machine tools. Guards Safeguarding devices Awareness devices Safeguarding methods Safe work procedures ANSI Z244.1 2003 Control of hazardous energy Lockout/tagout and alternative methods 29 CFR 1910.147: Control of hazardous energy ( lockout/tagout ) (For more info, www.osha.gov ) ANSI B11.19 2003 Performance Criteria for Safeguarding ISO 14119 Safety of machinery Interlocking devices associated with guards Principles for design and selection ISO 14120 Safety of machinery - Guards - General requirements for the design and construction of fixed and movable guards Type C machine specific standards examples: ANSI B11.1 2001 Safety Requirements for Mechanical Power Presses ANSI B11.6 2001 Safety Requirements for Manual Turning Machines ASME B20.1-2003, Safety Standard for Conveyors and Related Equipment Copyright 2010 Rockwell Automation, Inc. All rights reserved. 12

SafeDesign: Safeguarding Technologies CONVENTIONAL PRIOR CAPABILITY SOLUTIONS Electro-mechanical devices Dedicated functionality Device specific relays/controllers Separate standard and safety controllers Fixed I/O configurations Limited diagnostics Hardwired safety for motion CONTEMPORARY PRESENT CAPABILITY SOLUTIONS Safety-rated solid-state devices Multi-function with application-specific functions Configurable or programmable safety controllers Fully integrated Programmable Automation Controllers (PACs) Expandable & distributed I/O via safety networking Robust diagnostics and security features Embedded safety for safe-off and speed monitor in drives Improved productivity and lowered total cost for even the most basic devices. Copyright 2010 Rockwell Automation, Inc. All rights reserved. 13

Where does Validation fall in the design process? Validation according to IEC 61508 Validation according to ISO 13849 Validation according to IEC 62061 Copyright 2010 Rockwell Automation, Inc. All rights reserved. 17

What is Validation? Definition: Validation comprises testing and analysis (e.g. static, dynamic or failure analysis) to show that all parts interact correctly to perform the safety function and that unintended functions do not occur. (EN ISO 12100-2: 2008) Per EN ISO 13849-2: 2008 the validation process, including both analysis and testing, for the safety functions and categories for the safety related parts of control systems. Descriptions of the safety functions and the requirements for the categories are given in EN 954-1 (ISO 13849-1) which deals with the general principles for design. Some requirements for validation are general and some are specific to the technology used. EN ISO 13849-2 also specifies the conditions under which the validation by testing of the safety-related parts of control systems should be carried out. Copyright 2010 Rockwell Automation, Inc. All rights reserved. 18

Validation according to ISO 13849-2 Validation is a process that uses both static and dynamic testing and other methodologies to show that all parts interact correctly to perform the intended safety function and that unintended functions do not occur. You want to test the circuit or design to determine, not that it works but rather that it works correctly. Must be completed for all identified safety functions. Safety function the protection method, circuit, components, that provide the mitigation methodology for identified hazards. Copyright 2010 Rockwell Automation, Inc. All rights reserved. 19

Per ISO 13849-2 Validation The validation shall demonstrate that each SRP/CS meets the requirements of ISO 13849-1, in particular: the specified safety characteristics of the safety functions provided by that part, as set out in the design rationale; the requirements of the specified performance level (see ISO 13849-1:2006, 4.5); the requirements of the specified category (see ISO 13849-1:2006, 6.2); the measures for control and avoidance of systematic failures (see ISO 13849-1:2006, Annex G); and if applicable, the requirements of the software (see ISO 13849-1:2006, 4.6); the ability to perform a safety function under expected environmental conditions. ISO 13849-2 Validation, defines specific requirements for the validation plan, validation of the safety function, validation of environmental requirements, validation of maintenance requirements and general tools that can be used for mechanical, pneumatic, hydraulic and electrical systems. Copyright 2010 Rockwell Automation, Inc. All rights reserved. 20

Validation according to IEC 62061 (clause 8) Clause 8: Validation of the safety related electrical control system - specifies the requirements for the validation process to be applied to the SRECS. This includes inspection and testing of the SRECS to ensure that it achieves the requirements and functionality stated in the safety requirements specification. IEC 62061 defines validation as: 3.2.52 validation is the confirmation by examination (e.g. tests, analysis) that the SRECS meets the functional safety requirements of the specific application [IEC 61508-4, 3.8.2 modified] The validation plan should comprise: details of when the validation shall take place; identification of the relevant modes of operation of the machine (e.g. normal operation, setting); requirements against which the SRECS is to be validated; the technical strategy for validation, for example analytical methods or statistical tests; acceptance criteria; and actions to be taken in the event of failure to meet the acceptance criteria. Note: The validation plan should indicate whether the SRECS and its subsystems are to be subject to routine testing, type testing and/or sample testing. Note: Validation according to IEC 62061(and IEC 61508) applies both to hardware and software implementing the safety function. Copyright 2010 Rockwell Automation, Inc. All rights reserved. 21

Validation according to IEC 62061 (clause 8) The validation of the SRECS shall be carried out in accordance with a prepared plan (see 4.2). NOTE 2 Validation of a programmable SRECS comprises validation of both hardware and software. The requirements for validation of software are contained in 6.11.3. Each SRCF specified in the SRECS requirements specification (see 5.2), and all the SRECS operation and maintenance procedures shall be validated by test and/or analysis. Appropriate documentation of the SRECS safety validation testing shall be produced, which shall state for each SRCF: the version of the SRECS safety validation plan being used and the version of the SRECS tested; the SRCF under test (or analysis), along with the specific reference to the requirement specified during the SRECS safety validation planning; tools and equipment used, along with calibration data; the results of each test; discrepancies between expected and actual results. When discrepancies occur, corrective action and re-testing shall be carried out as necessary and documented. Copyright 2010 Rockwell Automation, Inc. All rights reserved. 22

Validation according to IEC 62061 (clause 8) Validation of SRECS systematic safety integrity -The following shall be applied: functional testing to reveal failures during the specification, design and integration phases, and to avoid failures during validation of SRECS software and hardware shall be applied. interference immunity testing to ensure that the SRECS is able to satisfy 5.2.3. fault insertion testing shall be performed. These tests shall introduce or simulate faults in the SRECS hardware and the response documented. In addition, one or more of the following groups of analytical techniques should be applied taking into account the complexity of the SRECS and the assigned SIL: static and failure analysis; static, dynamic and failure analysis; simulation and failure analysis. Copyright 2010 Rockwell Automation, Inc. All rights reserved. 23

Validation review So what have we learned about validation? Validation of the safety system requires a plan Validation is a process the verifies that the safety circuit not only works but works correctly Validation requires fault injection in all the identified modes of operation Validation also requires circuit evaluation using analytical tools to verify circuit design compliance, component selection verification, and systematic analysis Validation also include environmental, operation, maintenance consideration Validation is a documented process Copyright 2010 Rockwell Automation, Inc. All rights reserved. 24

Examples of a safety function consideration Dual Channel E-Stop Using Redundant Control Relays installation E-Stop Reset CR1 CR1 CR2 CR1 CR2 CR2 Non-hazardous Portion of Machine Hazardous Portion of Machine Copyright 2010 Rockwell Automation, Inc. All rights reserved. 25

Join our Safety Community Rockwell Automation Safety Portal http://discover.rockwellautomation.com/safety RAGuard http://www.twitter.com/raguard Safety Automation Forum group http://www.linkedin.com/groups?gid=1950912 Rockwell Automation Safety Solutions Copyright 2010 Rockwell Automation, Inc. All rights reserved. 28