Safety in the remote diagnosis of manufacturing plant and equipment

Transcription

1 Health ad Safety Safety i the remote diagosis of maufacturig plat ad equipmet This is a free-to-dowload, web-friedly versio of HSG87 (First editio, published 1995). This versio has bee adapted for olie use from HSE s curret prited versio. You ca buy the book at ad most good bookshops. ISBN Price This guidace is issued by the Health ad Safety. Followig the guidace is ot compulsory ad you are free to take other actio. But if you do follow the guidace you will ormally be doig eough to comply with the law. Health ad safety ispectors seek to secure compliace with the law ad may refer to this guidace as illustratig good practice. HSE Books Page 1 of 35

2 Health ad Safety Crow copyright 1995 First published 1995 ISBN All rights reserved. No part of this publicatio may be reproduced, stored i a retrieval system, or trasmitted i ay form or by ay meas (electroic, mechaical, photocopyig, recordig or otherwise) without the prior writte permissio of the copyright ower. Applicatios for reproductio should be made i writig to: The Office of Public Sector Iformatio, Iformatio Policy Team, Kew, Richmod, Surrey TW9 4DU or licesig@opsi.gov.uk This guidace is issued by the Health ad Safety. Followig the guidace is ot compulsory ad you are free to take other actio. But if you do follow the guidace you will ormally be doig eough to comply with the law. Health ad safety ispectors seek to secure compliace with the law ad may refer to this guidace as illustratig good practice. Page 2 of 35

3 Health ad Safety Cotets Itroductio 4 Hazards from remote diagosis 7 Risk assessmet 9 Remote Passive Diagostics (RPD) 14 Remote Active Diagostics (RAD) 16 Remote Iteractive Diagostics (RID) 21 Example of remote diagostics facility 27 Flow chart: Remote diagostics operatig procedures 28 Glossary 32 Refereces 33 Safety i the remote diagosis of maufacturig plat ad equipmet Page 3 of 35

4 Health ad Safety Itroductio 1 This guidace cocers remote diagostic systems fitted to computercotrolled machiery ad associated equipmet. It does ot cover telemetry or remote cotrol, or does it deal with remote diagosis i idustries other tha maufacturig. It does ot, for example, deal with systems which may be ecoutered i process cotrol i the chemical, offshore, miig or uclear idustries. 2 Remote diagostic systems allow faults i machiery to be idetified by a diagosticia at a remote locatio. Remedial actio ca the be agreed betwee the diagosticia ad the user. The remote diagostic system may allow the diagosticia to operate the machie from the remote locatio, or eve correct the faults idetified i the software. For the purpose of this guidace, remote diagosis meas: the moitorig of program executio from a locatio remote from the machie or process; the moitorig of the coditio of computer-cotrolled plat from the remote locatio; operatig the machie for diagostic purposes from the remote locatio; idetifyig or correctig faults i the applicatio software by modifyig the software at the remote locatio ad dowloadig the ew versio to the machie. 3 The publicatio is iteded for cotroller maufacturers, desigers, suppliers ad users of computer-cotrolled machiery who are cosiderig icorporatig these facilities. It also questios the eed for a remote diagostic facility. It idetifies the risks which may arise from a remote diagostic facility ad describes how machie desig ad workig procedures ca elimiate or reduce them. The overall objective is that the additio of the remote diagostic facility should ot icrease risks or reduce the existig level of safety. 4 Depedig o the circumstaces, the user, desiger, maufacturer, supplier ad those providig diagostic services may have duties uder oe or more of the followig provisios, of which they should be aware: The Health ad Safety at Work etc Act 1974; The Provisio ad Use of Work Equipmet Regulatios 1992; The Maagemet of Health ad Safety at Work Regulatios 1992; ad The Supply of Machiery (Safety) Regulatios This guidace applies to remote diagosis used for corrective maiteace of machies icludig software i the applicatio program. It does ot deal with automatic diagostic facilities or packages, either o the machie or at a remote locatio. (Where these are provided as part of a remote diagostic system which does fall withi the scope of this guidace, they will eed to be icluded i the assessmet of the overall system ad coform with the appropriate stadards.) It is ot appropriate for: maiteace or modificatios to the executive software, software upgrades or for istallig software for ew requiremets; the commissioig ad acceptace testig of ew or modified machiery; makig software chages i primary safeguards, eg photoelectric protectio systems. Safety i the remote diagosis of maufacturig plat ad equipmet Page 4 of 35

5 Health ad Safety 6 Where a remote diagostic system is beig cosidered for iclusio o machiery the guidace assumes that the machiery is desiged ad safeguarded i accordace with good practice, for example i accordace with the relevat iteratioal, Europea ad atioal safety stadards. These stadards iclude those which cocer guardig of dagerous parts, reliability ad safety of the programmable hardware, ad correctess ad safety of software. Whe a remote diagostic system is provided, the overall system (machie i combiatio with the diagostic system) should be reassessed to esure that the remote diagostic system does ot reduce the level of safety required at that machie. Note: Safe workig procedures form a importat part of the guidace but they are subordiate to the requiremet to make the machie safe by elimiatig hazards by desig ad by safeguardig agaist hazards which caot be elimiated. 7 There is a Glossary at the back of this publicatio which explais terms used. However, the followig defiitios should be uderstood before readig further: Mai/remote cotrol statio: the mai cotrol statio for a group of machies or cells from which supervisio or cotrol takes place i ormal operatio. It may be at some distace from the machiery it cotrols, o the same site or elsewhere. It may iclude diagostic ad reprogrammig facilities see remote diagosis. Local cotrol statio: the cotrol statio dedicated to a particular machie or cell which is part of a system govered by a mai cotrol statio. The local cotrol statio is i close proximity to the machie or cell, ad eables it to be take out of remote cotrol ad operated directly from the local cotrol statio. Remote cotrol: operatig coditio whe the machie or cell is uder the cotrol of the mai cotrol statio; ormally i automatic mode. Local cotrol: operatig coditio whe the machie or cell is removed from the cotrol of the mai cotrol statio ad cotrolled by the local cotrol statio. It does ot receive or respod to sigals from ay etwork, remote cotrol statio or plat exteral to the machie or cell. Note: 1 the facility to switch to local cotrol ca be used for settig, tool chages, maiteace, or special operatig coditios, eg ivolvig maual itervetio. The objective is to prevet uexpected start-up durig work of this ature, arisig from the machie respodig to remote sigals; 2 there may be a hierarchy of cotrol systems ivolvig several levels: machie, cell, lie, mai cotroller. I these circumstaces, the lie cotroller would be local i respect of the mai cotroller, ad remote i respect of the cell cotroller. The extet of direct cotrol from the remote statio may also vary accordig to the system desig. It may also vary betwee levels i the hierarchy, eg some levels may have a maily supervisory role, while others directly cotrol the movemet of materials aroud part of the system ad the operatio of machies. Software: itellectual creatio comprisig the program, procedure, rules, data ad ay associated documetatio pertaiig to the operatio of a computer system. Note: Software associated with machie cotrol ca be divided ito the followig broad categories: embedded/systems/executive software. Software geeric to a particular rage of microprocessors or cotrollers, ad a essetial part of a specific programmable electroic system ad fudametal to its proper fuctioig; applicatios software. Software to eable the machie to fuctio ad to perform a particular task or rage of tasks; Safety i the remote diagosis of maufacturig plat ad equipmet Page 5 of 35

6 Health ad Safety parts programme. Software i computer umerically cotrolled (CNC) machies which is depedet o the applicatio software ad which eables the machie to perform a specific task. Operator: The perso or people icludig setters ad programmers etc who operate the machie i the user s premises. Remote diagosis: See paragraph 2. Remote diagostic statio: the statio from which remote diagosis is carried out. It could be i the same premises, i aother part of the coutry, or abroad. Those at the remote service statio may be employees of the compay usig the machie, or of the suppliers of the machie or of a separate service compay. Note: this is a facility additioal to or separate from remote cotrol, ad allows the idetificatio of faults ad the alteratio of plat parameters, programs, etc, i a way which would ot be possible i ormal operatio from a mai cotrol cetre. Remote diagostic system: comprises all compoets ecessary to eable remote diagosis to take place, icludig hardware; software; operatig system routies; all iterfaces to the cotrol system ad safety system; ad commuicatios systems. Overall system: the combiatio of machie ad remote diagostic system. Cotrol system: a system whereby iput sigals from the machie ad/or from a operator geerate output sigals causig the machie to operate. Safety system: a system specifically iteded to esure safe operatio of the machie by techical meas, takig accout of all coditios of use ad reasoably foreseeable misuse. Safety-related system: ay part of the cotrol system or safety system which could affect the safe operatio of the machie. Safety device: a device which elimiates or reduces risk, aloe or i associatio with a guard. Categories of remote diagostic systems 8 Remote diagosis falls ito the followig mai categories: Remote Passive Diagostics (RPD): this is a form of coditio moitorig. The diagostic statio ca be used to moitor program executio, iputs ad outputs ad the state of sesors, relays, etc ad idetify the likely cause of a fault. There is o meas to alter the software or cotrol the machie; Remote Active Diagostics (RAD): i additio to coditio moitorig, the machie ca be operated from the diagostic locatio but there is o meas to alter the software via the remote diagostic system; Remote Iteractive Diagostics (RID): i additio to RAD there is access to the software from the diagostic locatio. This form of remote diagostics may: ivolve chages to the cotrol system which could affect the safe operatio of the machie (eg sequece of operatios, speeds); ad may allow chages to be made to safety features (reduced speed, thresholds). It is possible for the diagostic system to be costatly o lie, or coected oly whe required. See Figure 1 for guidace o the type of system ivolved, ad where to look for iformatio i this publicatio. Safety i the remote diagosis of maufacturig plat ad equipmet Page 6 of 35

7 Health ad Safety Hazards from remote diagosis 9 The potetial hazards from remote diagosis are partly depedet o the ature ad desig of the remote diagostic facility ad partly o the ature of the machie. Oe way of idetifyig the relevat hazards is to udertake a hazard aalysis specific to the applicatio. Such a aalysis will idetify those hazards specific to the machie. I additio the followig geeric hazards ad sources of hazards should be cosidered. Uexpected start-up: if the remote diagostic statio is capable of operatig the machie, it could start up whe someoe is i a positio of dager, eg whe carryig out repairs or adjustmets ukow to the diagosticia, or whe attemptig to act o the results of the diagosis. Figure 1 Remote Diagostics If Remote Diagostics is proposed: Has a hazard aalysis ad risk assessmet bee carried out to determie whether the machie presets a risk? No Carry out assessmet. See paragraphs Does the machie preset a risk of ijury or ill-health to ay perso? No Guidace does ot apply Yes Is Remote Passive Diagostics aloe proposed? Yes Are there ay circumstaces i which it could become active or iteractive? No See sectio o RPD No Yes Remote Active Diagostics of machie operatio? Yes Are software chages possible durig RAD? No See sectio o RAD Yes See sectios o RAD & RID Safety i the remote diagosis of maufacturig plat ad equipmet Page 7 of 35

8 Health ad Safety Machie malfuctio: the ature of the fault the diagosticia is seekig to idetify may make cotiued operatio of the machie, or certai operatios dagerous. This may ot be apparet at the diagostic statio. For example if a compoet is iadequately clamped, the diagosticia may be uaware of the risk because of false data from a sesor, faulty data trasmissio, or a failure to appreciate the sigificace of the iformatio. Software chage: chagig the software cocered with the productio process may create a hazard. Chagig the sequece of a process, cuttig speeds, clampig pressures, outputs from sesors, could all affect the safety of the machie. Experiece of accidets ad aalysis of available icidet data has show that eve apparetly mior chages ca have a sigificat effect o the behaviour of the equipmet the software is cotrollig. Failure to restore the software to its origial form after ay temporary chages made durig diagosis may therefore cause a subsequet hazard. For example, the diagosticia, ivestigatig a problem with workpiece clampig arragemets may deliberately amed the output from a clampig sesor so that it seems that the clamps have successfully closed, i order to advace the program ad test the theory. This could cause dager immediately if the workpiece is moved durig diagosis, or durig subsequet operatios after diagosis, if the sigal from the clampig sesor cotiues to be falsified. Ay permaet chages made as a result of diagosis could, if ot properly checked, create a hazard. Failure to record chages properly ca also lead to a hazard because ay further chages or checks would be based upo icorrect iformatio. Chages to the safety-related system: i curret desigs of computercotrolled machiery chages i software may affect safety fuctios. The diagosticia may wish to chage oly software related to the productio process, but because of the desig of the system software based safety features may also be chaged. For example: data chages ca alter safety features such as reduced speed; program chages could mea that a hold-to-ru butto becomes a cycle start butto. Eve where the software has bee separated ito safety-related ad o-safetyrelated modules there will, i most cases, be a eed to exchage data. Faults itroduced by iadequate cotrol of chages made to the o-safety-related modules could have a kock-o effect that could create a hazard. Software chage caused by data trasmissio fault or uauthorised access Plat operatio caused by data trasmissio fault or uauthorised access Failure or fault i the remote diagostic system ad statio: eg loss of power at diagostic ed durig diagosis, breach of commuicatios lik durig diagosis. Desig ad implemetatio errors i the remote diagostic system: these may create potetial hazards, eg a desig fault i the access cotrol software may permit a system iteded to be limited to passive operatio to become active or iteractive; a desig fault i the remote diagostic system or the way it iterfaces to the machie could alter the way the machie operates. See Figure 2 showig the hazards which may arise accordig to the type of remote diagostic system. Safety i the remote diagosis of maufacturig plat ad equipmet Page 8 of 35

9 Health ad Safety Risk assesmet How to assess risks 10 Risk assessmet of the machie ad of the overall system (machie ad diagostic system combied) is essetial to eable the supplier ad user to determie whether a remote diagostic system ca be used safely. If so, what safeguards should be adopted? How to assess risks 11 The risks arisig from remote diagosis will vary accordig to the ature of the machie itself. Before cosiderig a remote diagostic system, the supplier should carry out a risk assessmet of the machie. This should cosider: the hazards posed by the machie, ad the way it will be used, icludig ormal operatio, settig, adjustmet, cleaig, maiteace ad reasoably foreseeable misuse; iterfaces with, ad iteractios with, other machies ad the effect that chages could have o the safe workig of such machies; what safeguards are curretly fitted ad how they operate, i the various operatig modes, ad whether they are adequate. A essetial part of the assessmet is to idetify how the safeguards fuctio ad what cotributio to their correct fuctioig the programmable cotroller ad the software make. It is very importat that the safety-related systems ad associated iterfaces are clearly defied so that the potetial impact of software chages ca be assessed. The type of remote diagostic system, ad the effect that its use could have o the safety of the machie should the be cosidered. A assessmet should be made of the additioal failure modes ad risks itroduced by such a system. Although the safety of diagostic software packages is outside the scope of this guidace, if such packages are used it is importat to assess whether faults i them could propagate via the remote diagosis facility ad cause a dagerous failure of the overall system. Safety i the remote diagosis of maufacturig plat ad equipmet Page 9 of 35

10 Health ad Safety Figure 2 Type of diagostic system Uexpected start-up Machie malfuctio Software chage resultig i dager Chage i software based safety features Software chage from data trasmissio fault or uauthorised access RPD (Remote Passive Diagostics) RAD (Remote Active Diagostics capable * of causig machie movemet) RID (Remote Iteractive Diagostics capable of software chages to the cotrol system) * The above takes ito accout the possibility that a passive system could be operated i active mode, or a active system i iteractive mode, i the evet of a desig fault or omissio. Plat operatio from data trasmissio fault or uauthorised access * Malfuctio/ failure of remote diagostic facility Safety i the remote diagosis of maufacturig plat ad equipmet Page 10 of 35

11 Health ad Safety Is the remote diagostic system ecessary? 12 I the light of this assessmet, a decisio should be made as to whether a remote diagostic system of the iteractive type is justifiable o safety grouds, or i practical terms ecessary. Factors to be take ito accout iclude the level of risk, the cosequeces of failure, eg serious ijury, death, ad whether practical precautios ca be take to elimiate or miimise the risk. System desig 13 System desig is of fudametal importace. The machie itself should be desiged usig good egieerig priciples, as described i BS ad EN Iformatio cocerig the electrical cotrol system is provided i EN ad priciples for the desig of programmable electroic systems are i the HSE PES documets 4. Further Europea ad Iteratioal Stadards are also relevat 5. Future desigs of safety-related systems may eed to take ito accout the Iteratioal Stadards dealig with the topic. These are curretly beig prepared by the Iteratioal Electrotechical Commissio (IEC) 6. The overall system 14 Essetially, the priciples cotaied i these documets require the desiger, maufacturer or supplier to adopt the followig measures i the order give: desig the equipmet to prevet hazards arisig; modify the equipmet to elimiate hazards; provide safeguardig to segregate people from the remaiig hazards; provide iterlockig or other features to isolate people from hazards; list ay hazards which caot be elimiated or guarded agaist; ad iform the user of safe workig practices ad maagemet cotrols to avoid hazards. The effect of ay modificatio to a machie, such as the istallatio of a remote diagostic system i terms of creatio of ew hazards or icrease i risk, should be fully cosidered. The above stadards should be used whe desigig or icorporatig a remote diagostic system, to reassess the hazards ad risks preseted by the machie i cojuctio with the remote diagostic system ad to esure the remote diagostic system is itself properly desiged ad suitable for safety purposes. Security 15 Remote diagosis opes up potetial security risks. Security is cocered with: cofidetiality the prevetio of the uauthorised disclosure of iformatio; itegrity prevetio of the uauthorised modificatio of iformatio; availability prevetio of the uauthorised withholdig of iformatio or resources. Typical security safeguards iclude segregatio of vulerable resources, passwords, ecryptio, ad dial back modems. This guidace is cocered with security isofar as it affects safety, particularly uauthorised access. Further iformatio o security risks, coutermeasures ad assessmet criteria ca be foud i Whe a remote diagostic system is to be provided, specific safeguards, i additio to those ormally required for safe operatio of the machie, will eed to be icorporated. These are similar to those required whe complex automated Safety i the remote diagosis of maufacturig plat ad equipmet Page 11 of 35

12 Health ad Safety machiery has local cotrol paels ad a separate mai cotrol statio, i order to prevet risks to machiery operators, maiteace staff etc whe the machiery is operated remotely. Additioal safeguards are required for remote diagosis because of the ability to chage machie parameters, ad modify or elimiate certai safeguardig features etc as part of the diagostic operatio. The assessmet should idetify these additioal safeguards ad specify them i a safety pla. Safe workig procedures 17 The safety pla should iclude fuctioal ad performace requiremets, iterface specificatios (hardware, software ad huma), desig methodology, verificatio ad validatio requiremets ad operatio ad maiteace procedures. I particular, the extet ad limits of the diagostic operatios to be carried out should be specified. Cross referece should be made to the safety documetatio produced i the origial desig of the machie. 18 Wherever possible, safety should be esured by meas of desig chages rather tha procedural arragemets. Nevertheless, i RAD ad RID i particular, safe workig procedures at the user ed ad the diagostic ed are essetial. The system should therefore be desiged to eable safe workig procedures to be followed, ad to reiforce them. Ergoomic desig of the work statios, ad clarity of iformatio o scree or i supportig mauals are essetial. Where software chages are possible (RID) remote diagostics eed to be brought withi the software chage cotrol procedures of the user ad subject to assessmet, authorisatio, verificatio ad validatio. The documetatio should be accurate ad up-to-date. Safe workig procedures are dealt with i more detail i paragraphs 22 23, 30 43, but are ot exhaustive. See the flowchart, Figure 4, for a example of workig procedures for RPA, RAD ad RID. See Figure 3 for a summary of requiremets for RPD, RAD ad RID, coverig assessmets, safeguards ad procedures. The followig three sectios give recommedatios o potetial sources of dager, desig safeguards ad operatig procedures for remote diagostics. The advice give does ot replace the eed to apply the geeral requiremets of this sectio to the particular applicatio. Safety i the remote diagosis of maufacturig plat ad equipmet Page 12 of 35

13 Health ad Safety Figure 3 Summary of requiremets: Assessmet, safeguards, procedures for RPD, RAD ad RID RPD RAD RID Assessmet Active or iter-active mode possible? Assessmet Iteractive mode possible? Effects of failure of diagostic system. Assessmet Cofiguratio of machie cotrol system. Safety system extet of reliace o software. Effects of software chages o machie operatios. Effects of failure of diagostic system. Ca risks be elimiated or reduced by chages i desig? Safeguards Esure system operates i passive mode oly. Safeguards Machie caot respod to diagostic statio whe access is possible. No meas to become iteractive. No permaet lik. RAD via mode chage. Idicatio machie uder RAD. Meas to prevet coflictig commads, user ed ad diagostic ed. User veto. Commuicatios lik. Idetify break i lik/failure of RAD. Meas to cotrol access to RAD. Meas to idetify which machie is beig diagosed. Clear istructios user maual. Good message quality. Safeguards Machie will ot respod to diagostic statio whe access is possible. Protectio agaist software chages which could affect safe ruig of machie, eg: program structure esures safety fuctios are executed as iteded; software-based safety fuctios protected agaist iadvertet chage; safety-related software iaccessible; meas to idetify uauthorised chages; supervisory computer. No permaet lik. RID via mode chage. Idicatio machie uder RID. Meas to prevet coflictig commads, user ed ad diagostic ed. User veto. Idetify break i the lik/failure of RID. Commuicatios lik. Meas to idetify which machie is beig diagosed. Meas to record chages. Meas to cotrol access to RID. Clear istructios user maual. Good message quality. Procedures Safe system for access, maiteace, ad for dealig with break i commuicatios. Procedures Traiig user ad diagosticia. Authorised people. Access cotrol. Workig procedures. Workig log. Fuctioal tests. Procedures Traiig user ad diagosticia. Qualificatios diagosticia. Authorised perso. Access cotrol. Workig procedures. Software chage cotrol procedures. Procedures if diagostic system fails. Verificatio. Validatio, icludig fuctioal tests. Workig log. Documetatio. Safety i the remote diagosis of maufacturig plat ad equipmet Page 13 of 35

14 Health ad Safety Remote passive diagostics (RPD) 19 This is a system where the remote diagostic statio ca oly be used to receive data for iterrogatio ad aalysis, ad i which the diagosticia has o ability to alter the software or to operate the machie. The lik betwee the diagostic statio ad the machie may be permaetly made, or activated oly whe required. Potetial sources of dager (RPD) 20 A assessmet should be carried out of the additioal failure modes ad risks itroduced by the RPD. See paragraph 10 for further iformatio o assessmet. The followig particular matters should be cosidered i the assessmet, but are ot exhaustive: The system may have bee iteded to operate i the passive mode oly, but due to a desig fault may be capable of operatig i a active or iteractive mode i certai circumstaces such as misuse or uauthorised access; If the lik is permaet, or readily accessible, eg via a dial-up modem, uauthorised access ito the system may be possible. Depedig o the desig of the system, this could be used to chage diagostic modes; Operatio of the remote diagostic system idirectly iflueces the applicatio of a safety-related fuctio. For example, there is a delay i checkig the status of a guard because the cotrol system is attemptig to hadle a commuicatios process; Loss of the commuicatio lik could happe durig diagosis. If the user is relyig o advice from the diagosticia durig fault fidig or rectificatio, loss of commuicatio could iterrupt the procedure at a crucial poit. The supplier eeds to establish that the system ca oly operate i the passive mode, ad to idetify ay circumstaces icludig uauthorised chages or a fault i the diagostic system uder which the system could become active or iteractive. Safeguards 21 The overall system should be desiged so that there are o meas by which the diagostic system could become active or iteractive durig iteded operatio or foreseeable misuse. Alteratively, effective measures should be take to prevet it becomig active or iteractive. If this caot be doe see the sectios describig safeguards ad procedures for RAD ad RID. The use of a permaet or readily accessible (eg dial-up modem) lik should be avoided where there is ay possibility that the system could be operated i active or iteractive modes. Note: I some systems a permaet dedicated commuicatios lik is provided. More usually, public etworks are used. Auto aswer is a system by which the machie cotroller respods automatically to a appropriately coded message trasmitted over the public etwork. Auto call or call o fault ivolves the equipmet automatically diallig a preprogrammed umber, usually i respose to a fault coditio beig detected. I maual aswer the operator at the user ed has to authorise the use of the lik, eg the remote statio attempts to make cotact ad the user presses a butto to Safety i the remote diagosis of maufacturig plat ad equipmet Page 14 of 35

15 Health ad Safety coect the modem. Auto call back is implemeted (usually by a special modem) at the user ed. Its mai purpose is improved security compared with auto aswer. The call is iitiated by the diagosticia. The special modem at the user s ed aswers the call ad receives a code or password from the diagosticia, but does ot coect the call to the PLC at this time. The call is the cleared ad, after a short time delay, the user s special modem calls a pre-programmed umber (the diagosticia) ad coects this call to the PLC. The security improvemet results because the special modem oly coects the PLC to calls which it has origiated itself, to umber(s) pre-programmed by the user. The worst that a uauthorised caller could do would be to cause a uecessary call to the diagosticia s equipmet. Procedures 22 Depedig o the arragemets betwee the user ad the provider of the diagostic service, the safe workig procedures for access ad maiteace will vary, eg: The diagosticia may iform the user by telephoe lik of what eeds to be doe. Reliace is the placed o the user followig safe procedures for access to the machie ad for maiteace which would apply uder other circumstaces: usig correct access procedures, isolatig the machie etc. Further guidace o machiery desig ad maiteace features is give i BS 5304: ad HS(G)43 Idustrial robot safety 8. If the user udertakes software chages as a result of RPD, the user will eed to follow up appropriate chage cotrol procedures ad esure the diagosticia is iformed. Procedures similar to those described i paragraph 51 will be eeded. Alteratively the remote diagostic statio may idetify the fault ad sed its ow egieers to carry out the repair. The same requiremets for followig safe workig procedures for maiteace will apply. 23 If the commuicatios lik breaks dow durig diagosis, work at the user ed which is depedet o advice from the diagosticia should be suspeded, util commuicatios have bee restored ad the machie put ito a safe state. If commuicatios must be maitaied, a back-up lik should be available. Safety i the remote diagosis of maufacturig plat ad equipmet Page 15 of 35

16 Health ad Safety Remote active diagostics (RAD) 24 I this system it is possible for staff at the remote diagostic statio to iterrogate the machie cotrol system o the status of the machie ad its program ad, i additio, to operate the machie remotely, eg to start it up, stop it, execute certai routies etc. The machie may be coected via a dedicated lie or a telephoe lik ad there is likely to be a additioal telephoe lik which allows direct commuicatio betwee the user ad diagosticia. The diagostic statio may be at aother part of the same premises, or i a completely separate locatio. Potetial sources of dager 25 A assessmet should be carried out of the additioal failure modes ad risks itroduced by the RAD (see paragraph 10). The followig matters should be cosidered i the assessmet, but are ot exhaustive: The system may have bee iteded to operate i the active mode oly, but due to a desig fault may be capable of operatig i iteractive mode i certai circumstaces, such as misuse or uauthorised access; Uauthorised access ito the system may be possible; The desig of the machie may mea that certai types of remote operatio are dagerous; Operatio of the remote diagostic system idirectly iflueces the applicatio of a safety-related fuctio. For example, there is a delay i checkig the status of a guard because the cotrol system is attemptig to hadle a commuicatios process. 26 The supplier should establish that the machie ca oly be used for receivig data ad machie operatio. If software chages are possible, eg through chagig the privileges of the remote termial, either effective meas will be required to prevet such chage occurrig, or further precautios for RID will be required. 27 The effects of a diagostic system or commuicatios lik failure durig the diagostic operatio should be cosidered: Ca the machie be made to go automatically ito a safe state, or does actio eed to be take at the user ed? Also, how will the failure of the diagostic facility or the lik be idetified, ad how rapidly? Safeguards 29 This list of safeguards is ot exhaustive: Machie safeguards should be desiged so that whe guards are ope or safety devices such as photo-electric curtais or pressure sesitive mats activated, the machie will ot operate, whatever commads are set from the remote diagostic statio. Some machies have a setters override, which allows limited machie fuctios with the guard ope, or a teach pedat which allows the machies to be moved or programmed uder cotrolled coditios by a operator i the dager zoe. I these cases selectio of the override or use of the teach pedat should automatically preclude remote active diagostics takig place at the same time. Safety i the remote diagosis of maufacturig plat ad equipmet Page 16 of 35

17 Health ad Safety The RAD should either be desiged so that there is o way i which it could become iteractive durig iteded operatio or foreseeable misuse or effective measures should be take to prevet it becomig iteractive. If this caot be doe, see the RID sectio. Uauthorised electroic access to the machie via the lik should be preveted. For example, although the machie may be permaetly coected to the diagostic lik whe oly capable of passive diagosis, a permaet lik established i active mode is ot cosidered to be acceptable, because of the possibility of uauthorised access. Activatio of the lik should be subject to cotrol or coset from the user ed. Likig up to the remote diagostic system i active mode should oly be possible by a mode chage, eg to remote/service by meas of a key operated switch. The switch should be liked with the cotrols of the machie to prevet it beig left permaetly i the remote diagostic state. This will make it possible to switch to active diagostic mode oly whe the machie has bee switched out of automatic mode ad ito maual mode, or switched off. A key exchage system could be used, alog with a key or password held by a authorised perso. There should be a way of prevetig coflictig commads beig give to the machiery at the user ad diagostic ed. For example, whe the diagostic statio ca operate the plat directly, oce the active diagostic facility has bee activated, all commads from the local cotrol should be disabled, other tha the emergecy stop ad a cofirm fuctio key. There should be idicators statig machie uder remote diagostic cotrol for test/service wherever machie movemet ca be iitiated ad, i additio, o large machies, o a idicator board visible from all workig areas. The system should be desiged so that ay movemet of the machie will oly be possible after coset has bee give at the user ed, ad the user should have effective veto over ay actio the diagosticia proposes. For example: the diagostic statio may iform the user of the ecessary actio, ad the operator at the user ed carries it out; or the operator may cofirm every step of movemets proposed by the diagosticia i sigle step mode; or the operator may cofirm the proposed operatio of a sequece of movemets. Oe method of achievig this is to have a message o the scree at the user ed detailig the proposed actio. For the actio to be carried out, the user must press a cofirm key. A telephoe lik should be set up to eable the implicatios of the proposed actio to be discussed ad clarified. Movemet i automatic cycle should be avoided. If it is eeded, the chage from sigle step or maual RAD ito automatic mode should be uder the cotrol, or subject to a further veto, of the operator. There should be effective commuicatio liks betwee the diagostic ad user ed to eable the priciple described i (g) to operate. The commuicatio lik should iclude a telephoe lik, to eable user ad diagosticia to discuss the purpose ad the implicatios of the proposed actio. Operatig mauals should describe how to use the telephoe lie, eg stadard forms of words ad procedures such as the receiver repeatig the statemet. A text message o a scree ca also be used as part of the commuicatio system. Istructios or proposals o the scree ca be cofirmed by the operator, who takes the appropriate actio or cofirms the actio by the diagostic statio. There should be a way of recordig what has bee doe, eg the text message ca be recorded. There should be a way of idetifyig as rapidly as possible ay failure i the commuicatios lik or diagostic facility durig remote diagosis. There Safety i the remote diagosis of maufacturig plat ad equipmet Page 17 of 35

18 Health ad Safety should also be a way of puttig the machie ito a safe state automatically, or if appropriate a error message should be geerated ad displayed, which will eable the user to take the appropriate actio. Access via remote diagostic termials should be capable of beig cotrolled ad restricted to authorised people oly. The fuctios which a remote diagostic termial ca perform should be strictly limited to what is ecessary ad the meas to icrease the rage of fuctios available should either be iitiated or made effective solely from the user ed. There should be a way of idetifyig which machie has bee coected to the diagostic statio. This should appear o the diagostic scree. If a priter is available at the diagostic ed this iformatio should be recorded o it. Istructios which appear o the user s VDU should be clear, uambiguous ad sufficiet for the istructio or proposed actio to be uderstood by the user, so that they ca either cofirm or carry out a actio proposed by the diagosticia. Ay ambiguity, for example whe a user is beig asked to cofirm a commad to operate the machie, could lead to the operator uwittigly creatig a dagerous situatio. I additio to istructios o the scree beig clear ad uambiguous, there eeds to be a comprehesive user s maual explaiig the istructios ad their effects. The performace of the data lik (icludig the modems) should be such that the overall data error rate betwee the user termial ad remote diagostic statio is acceptable ad does ot lead to potetially dagerous data or program corruptios. The use of modems which implemet a effective error detectio ad correctio techique to protect agaist iterferece is advised. Procedures This list of procedures is ot exhaustive. Traiig 30 The user should esure that ayoe who has to iitiate active diagostic mode ad respod to the remote diagostic statio is fully traied ad competet. The traiig should iclude direct practical experiece. Depedig o the complexity of the machie ad the type of work which eeds to be doe, there may eed to be a team of traied people, icludig fitters ad electricias uder the geeral supervisio of a authorised perso who iitiates iteractive diagostic mode, ad is i geeral charge of the diagostic ad repair work at the user ed. 31 O simpler istallatios, a supervisor, fitter, or plat operator may be traied ad authorised to iitiate active diagostic mode. Staff at the user ed eed to kow i detail how the machie operates, what hazards it presets, ad how the diagostic system is operated at the user ed, ad how they are expected to respod to the diagosticia. I additio to a diagostic user s maual, the supplier should provide a descriptio of the operator s duties, ad may eed to be ivolved i traiig the user s staff. 32 The diagosticia eeds to kow the machie i questio ad have first had experiece of it, ad how it operates. They must kow the hazards it presets so that they do ot propose usuitable actios to the user. The diagosticia should be competet i software egieerig ad capable of iterpretig the program ad the associated documetatio. 33 A system of amed authorised people is recommeded at the diagostic ad user ed, so that people at each ed kow that they are dealig with someoe familiar with the machie ad authorised to propose or cofirm actio. Safety i the remote diagosis of maufacturig plat ad equipmet Page 18 of 35

19 Health ad Safety Access cotrol 34 Before the machie is put ito diagostic mode: it should be put ito a kow state, as set dow i the remote diagostics operatig istructios; the area should be cleared of staff; ad all safeguards which may have bee removed or suspeded for ay reaso before the decisio to ivoke remote diagosis should be reistated. A authorised perso should carry out these resposibilities. Note: If a fault has occurred it may be that maiteace staff have already bee workig o the machie ad have removed guards ad are i a positio of dager. The authorised perso switches to diagostic mode or makes the physical coectio which liks the remote diagostic termial to the machie. The authorised perso or someoe uder their direct supervisio the has the task of cofirmig the actios proposed by the diagosticia, if ecessary after cosultatio with others with a more specialist kowledge of the machie. 35 Operatio of the diagostic system should be cotrolled, eg: access to the termials should be restricted, (a key or idetity card should be eeded to eter the cotrol room); or a password should be required to activate the termial (user ed computer deies access from ay termial uless the correct password is used). The priciple of the system should be that the likig up of a particular machie to the active diagostic mode is depedet o actios of the user (machie) ed. Procedures at the diagostic ed should esure that the machie to be diagosed is correctly idetified. Ruig the machie from the remote locatio 36 There may be a eed for the diagosticia to operate the machie as part of the fault idetificatio procedure. It should oly be possible to do so after cofirmatio by the user. The diagosticia should, where possible, operate the machie at the lowest practicable parameters, eg speed ad pressure, ad limit the extet of the movemet, ad oly operate the machie at ormal speeds whe the machie dyamics affect fault idetificatio. Operatig the machie o automatic cycle should be avoided except whe this is foud to be essetial for fault idetificatio. Fault rectificatio 37 The fault fidig process may ivolve some physical repairs or modificatios to the machie, eg adjustig limit switches, photo cells, alterig clearaces. Such work would be followed by aother diagostic test from the remote statio. The implicatios of these chages eed to be cosidered before they are tried out o the machie. Ay chages eed to be recorded (see paragraph 42). This also eables a check to be made as the machie is put back to its ormal state. See Figure 4. (This also covers remote iteractive diagostics.) This may ivolve staff at the user ed workig o the machie durig the diagostic operatio. 38 Before such work begis the system should be switched from active diagostic mode to passive mode or if there is ay possibility of the diagostic system idirectly ifluecig the operatio of the safety fuctios, the diagostic lik should be broke. This should be part of the access procedure. If the repair work eeds to be carried out with power o, it is essetial that the active diagostic lik is broke. Safety i the remote diagosis of maufacturig plat ad equipmet Page 19 of 35

20 Health ad Safety 39 After the work has bee carried out at the user ed, with guards replaced ad safety devices activated, the machie ad its cotrol system ca be restored to ormal operatig coditio, before the diagosis proceeds. The diagosticia ca the check the effectiveess of the work. 40 If the commuicatios lik breaks dow durig diagosis, work at the user ed which is depedet o advice from the diagosticia should be suspeded util commuicatios have bee restored ad the machie should be put ito a safe state. 41 If the RAD breaks dow durig diagosis or operatio of the machie from the remote locatio, the safe workig procedures outlied i the operatig maual should be followed to esure the machie ca be made safe. Eve though RAD operatio of the machie should oly be possible with all safety devices operatig, attemptig to resume or cotiue rectificatio work at the user ed could be dagerous if the machie has stopped mid-cycle. If software chages are implemeted as a result of the RAD procedure, it will be ecessary to follow appropriate chage cotrol procedures, similar to those described i paragraph 51. Workig log 42 A workig log should be kept at the user ad diagostic eds. The workig log is particularly importat for the user, sice it summarises for the beefit of the ext shift, or the ormal machie operator, the faults which have bee dealt with ad the physical chages made to the machie. A authorised perso should check it regularly. Fuctioal tests 43 After chages have bee made the machie should be retured to ormal operatig mode, ad fuctioal tests o safeguards, machie operatio etc carried out. These should be outlied i the operatig maual. The remote diagostic statio may cotiue to moitor the state of the machie, i passive mode oly. Safety i the remote diagosis of maufacturig plat ad equipmet Page 20 of 35

21 Health ad Safety Remote iteractive diagostics (RID) 44 Some systems allow software chages to be made from the remote diagostic statio, as well as moitorig ad machie operatio already detailed. The chages may be to data, or programs, or, usually, both. Potetial sources of dager 45 A assessmet should be carried out of the additioal failure modes ad risks itroduced by the RID (see paragraphs 10 to 18 for further iformatio o assessmet). The followig matters should be cosidered i the assessmet, but are ot exhaustive. 46 I additio to the poits oted i the assessmet of RPD ad RAD, the supplier should cosider the followig: (a) Is the system suitable for RID? Systems which have a high level of complexity or which rely extesively o software for their safety may ot be suitable for RID. A assessmet should be carried out of the cofiguratio of the machie cotrol system to establish: how may chaels are there? are they all PES based, or are ay hard-wired? is there cross moitorig? what degree of iterdepedece is there? For example, if ay part of the safety-related system relies o a sigle chael PES, software chages could affect the safety of the machie. If there is a dual chael PES based system, a chage could be itroduced o oe or both chaels which could affect the safety of the machie. If a fault o oe chael is ot detected by the other chael, eg via cross moitorig, the system becomes sigle chael. Depedig o the level of iterdepedece of the chaels, a chage to oe chael could affect both. Fuctioal testig of a dual chael system after software chages have bee made may ot be eough: a safety feature may be deleted o oe chael ad masked by the correct performace of the other ad the system may, as a result, become sigle chael for that feature. This assessmet may reveal that the safety-related software is more extesive tha was origially believed. It may also reveal a level of complexity which calls ito questio the suitability of the system for RID. Iadvertet chages to safety-related software may degrade safety fuctios or prevet them from beig correctly implemeted. Eve whe measures (eg use of o-volatile memory) are take to protect safety-related software, there ca be a risk resultig from chages elsewhere i the system which prevet the correct implemetatio of the safety routies. Is there a separate hard-wired safety system which i the evet of a failure of the software-based system will carry out the appropriate safety fuctios? It is importat that this chael has sufficiet safety itegrity to esure these Safety i the remote diagosis of maufacturig plat ad equipmet Page 21 of 35

22 Health ad Safety fuctios are performed. It is importat to cosider that eve whe a separate system of this sort exists, there may still be safety fuctios (eg reduced speed) which are software based. Are there safety features applicable i certai modes which are software- based? Eve a machie which has a totally idepedet hard-wired safety system for ormal operatio may use software-based safety features i certai modes, eg software-based speed reductio ad hold-to-ru butto durig teachig. These software-based features could be deleted or radically altered durig software chages. What effect could chages to the software goverig the operatio of the machie have o its safe operatio, i ormal operatig mode, i teachig, settig, cleaig or maiteace? Eve with a totally idepedet safety system which caot be altered from the diagostic statio, there may be some aspects of the machie s performace which, if wrogly ameded, could lead to dager. These iclude speeds, feed rates, outputs from sesors, sequecig (which could result i collisios ad ejectios of parts if chaged wrogly). Where cotrol ad safety systems are combied or overlap, great care will be required i assessig what the possible cosequeces of erroeous chages would be. I such cases, safe procedures for software chage cotrol will be particularly importat. Note: Maiteace staff may have to carry out some fault-fidig ad adjustmet with the machie uder power. If the machie behaves i a way cotrary to that expected, they could be at risk. What effects could a failure of the diagostic system, or the commuicatios lik cause durig the diagostic operatio? Ca the machie be made to go automatically ito a safe state, or does actio eed to be take at the user ed? How will failure of the diagostic facility or the lik be idetified, ad how rapidly? 47 If potetial problems are idetified, the supplier will have to determie: whether the risks ca be elimiated by a chage i desig of the cotrol or safety systems; whether they ca be reduced by such chages, ad by adoptig safe workig procedures, icludig software chage cotrol measures. Safeguards 48 I additio to the safeguards listed for passive ad active systems (types RPD ad RAD) the followig safeguards should be icorporated. They are ot exhaustive. The safety system should be desiged ad be sufficietly reliable to esure that whe guards are ope, or safety devices such as photo-electric devices activated, the machie will ot operate, eve whe software chages are made at the remote diagostic statio. This ca oly be assured whe the safety fuctios are hard-wired, or have a hard-wired back-up. This will ot esure absolute safety, as there are, o may machies, safety-related features which are part of the cotrol system or which, although separate, are realised i software, ad which are susceptible to deliberate or accidetal chages. Nevertheless, properly desiged safety systems ivolvig hard-wired iterlocked meas of access provide greater safety for maiteace staff who have to carry out repairs to the plat durig the diagostic exercise tha safety systems which rely solely o the correct operatio of the PES. Safety i the remote diagosis of maufacturig plat ad equipmet Page 22 of 35