PABIAC Safety-related Control Systems Workshop

Transcription

1 Health and and Safety Executive PABIAC Safety-related Control Systems Workshop KEY STANDARDS FOR ELECTRICAL & FUNCTIONAL SAFETY OF PAPERMAKING MACHINES: APPLICATION & USE Steve Frost HM Principal Electrical Inspector Northern Specialist Group

2 What I ll I cover Background & introduction An overview of key standards Methodology & key principles Relationship between BS EN & BS EN Way forward

3 BACKGROUND & INTRODUCTION Traditionally interlocking schemes based on electromechanical technologies have been used to eliminate hazards at machinery; Advances in machinery and control systems design have led to the widespread introduction of complex electronics - to facilitate increased automation and implement safety functions; Important to deal effectively with functional safety of complex electrotechnical control systems technical framework set out in IEC 61508/EN

4 Functional safety applicable across the wide range of machinery used throughout Manufacturing Industry Legal requirement for machinery to be SAFE use of appropriate standards can help to provide a presumption of conformity

5 AN OVERVIEW OF KEY STANDARDS: ELECTRICAL SAFETY EDITION 5 OF BS EN :2006 PUBLISHED EARLIER THIS YEAR BS EN (Ed 5) New edition published in mid-2006 Retained status as a harmonised standard under the Machinery Directive Largely unchanged from 1997 (4 th ) edition But.there are some changes that will have significance

6 AN OVERVIEW OF KEY STANDARDS: ELECTRICAL SAFETY Some of these are: Machine isolating (disconnecting) device can be any device that conforms with isolation requirements set out in IEC /BS EN ; Changes to measures that can be applied for protection against electric shock; More detail on protective bonding circuit; Introduction of requirements for functional bonding protection against earth leakage currents; Emergency stop at Cat. 0 or 1 can be performed by electrical and/or electronic means need to satisfy requirements of sub-clause 9.4 (Control functions in the event of failure).

7 AN OVERVIEW OF KEY STANDARDS: FUNCTIONAL SAFETY Functional safety of control systems has been an important development EHSRs specifically cover this subject for machinery safety; Issue complicated by differing standards and their application by groups, such as Notified Bodies and 3 rd party assessors; In In practice practice only only BS BS EN EN 954-1: :1997 and and BS BS EN EN 62061: :2005 have have attained attained the the status status of of transposed transposed harmonised harmonised standards standards and and are are able able to to give give a a presumption presumption of of conformity conformity to to relevant relevant EHSRs EHSRs of of the the Machinery Machinery Directive Directive (98/37/EC) (98/37/EC) Presently the following standards can be applicable: BS EN 954-1:1997 (aka ISO :1999) BS EN ISO :2004 BS EN 62061:2005 BS EN series pren ISO (incorrectly)

8 AN OVERVIEW OF KEY STANDARDS: FUNCTIONAL SAFETY BS EN Published as a European Standard in May 2005 Harmonised under the Machinery Directive Sector implementation of IEC/EN Simplification of some aspects of IEC/EN for application to machinery and industrial automation Performance of safety-related E/E/PE control systems described in terms of SILs (only up to SIL3)

9 AN OVERVIEW OF KEY STANDARDS: FUNCTIONAL SAFETY Objectives of the development: To provide an unambiguous method for a meaningful quantitative/qualitative assessment of safety related electrical control systems on machines; To add to the existing structural approach (BS EN categories) by including RELIABILITY and SYSTEMATIC measures; To provide flexibility of functionality and technology to optimise safety AND productivity. Introduce concept of Safety Integrity Levels (SILs) and functional safety management into the Machinery Sector for the specification, design and integration of safety-related electrical control systems.

10 AN OVERVIEW OF KEY STANDARDS: FUNCTIONAL SAFETY BS EN (aka ISO :1999) Introduced in 1997 based on principles of earlier German national standards Based on parts of control systems Methodology uses fault resistance, architecture and reliability of components Performance of safety related parts described in in terms of Categories (B,1,2,3,4) Presently undergoing extensive revision

11 AN OVERVIEW OF KEY STANDARDS: FUNCTIONAL SAFETY BS EN (Advantages & limitations) Applicable to safety-related parts of control systems based on all operating media - electrical*, mechanical, pneumatic, hydraulic; Designated Categories Qualitative B, 1, 2, 3, 4 non-hierarchical described in terms of: component reliability fault avoidance system structure fault tolerance (redundancy) & fault detection (monitoring)

12 AN OVERVIEW OF KEY STANDARDS: FUNCTIONAL SAFETY BS EN (Advantages & limitations) contd. Some limitations are: Categories not a comprehensive measure of safety integrity Not suitable for complex control systems such as those based on programmable electronic technology Emphasis on satisfying category requirements rather than achieving safety Lack of guidance on management of functional safety Considered most applicable to low complexity systems, in which the failure modes of components are well defined and the behaviour of the system under fault conditions can be completely determined. Also see EN (validation) & PD CR (Guidance)

13 AN OVERVIEW OF KEY STANDARDS: FUNCTIONAL SAFETY WILL REPLACE BS EN ALTHOUGH TIMESCALE REMAINS UNCLEAR Revision of BS EN (pren ISO ) Substantial revision of the existing standard Categories remain but are defined in terms of designated architectures Software development included that refers in part to BS EN Performance of safety related parts described in in terms of Performance Levels (a,b,c,d,e)

14 METHODOLOGY & KEY PRINCIPLES Both BS EN and BS EN start from a similar point: 1. Risk assessment using EN 1050/ISO Risk reduction by safety-related control function? Yes IMPORTANT TO RECOGNISE THAT SAFETY PERFORMANCE TARGET APPLIES TO SAFETY-RELATED CONTROL FUNCTION 3. Risk assessment for safety performance target (Category to BS EN or SIL to BS EN 62061) 4. Develop and validate safety requirements specification No No need to use key standards 5. Design of safety-related control system using appropriate standard(s)

15 BS EN Risk graph

16 BS EN SIL Assignment Risk assessment and safety measures Document No.: Part of: Product: Issued by: Date: Black area = Safety measures required Pre risk assessment Intermediate risk assessment Follow up risk assessment Grey area = Safety measures recommended Consequences Severity Class Cl Frequency and Probability of hzd. Avoidance Se duration, Fr event, Pr Av Death, losing an eye or arm 4 SIL 2 SIL 2 SIL 2 SIL 3 SIL 3 <= 1 hour 5 Common 5 Permanent, losing fingers 3 OM SIL 1 SIL 2 SIL 3 > 1 h - <=day 5 Likely 4 Reversible, medical attention 2 OM SIL 1 SIL 2 >1day - <= 2wks 4 Possible 3 Impossible 5 Reversible, first aid 1 OM SIL 1 > 2wks - <= 1 yr 3 Rarely 2 Possible 3 > 1 yr 2 Negligible 1 Likely 1 Ser. Hzd. Hazard Se Fr Pr Av Cl Safety measure Safe No. No. Comments

17 CORRELATION BETWEEN REQUIRED CATEGORIES AND SILS: MPS PART 6 (EDITION 2:2005) As an approximation, the relationship between the required Categories and SILs assigned to safety-related control functions to be implemented by electrical, electronic or programmable electronic safety-related control systems at a typical machine may be considered. Category of safety-related control function in accordance with BS EN or Target failure measure for safety-related control function in accordance with BS EN 61508/BS EN SIL 1 SIL 2 SIL 3

18 SELECTION OF STANDARDS Mechanical Pneumatic Hydraulic Electrical/Electronic/ Programmable Electronic Systems Low complexity systems* Systems of higher complexity Select Standard * "Low complexity" systems are those in which failure modes of components are well defined and the behaviour of the system under fault conditions can be completely determined. Design using BS EN Hardware Design using BS EN Validation Software

19 BS EN 62061: METHODOLOGY & KEY PRINCIPLES System Subsystem element INPUT LOGIC SOLVING OUTPUT Subsystem an element in the top-level architectural design of the SRECS where a failure of any subsystem will result in a failure of the safety-related control function

20 BS EN 62061: METHODOLOGY & KEY PRINCIPLES What is involved in designing to achieve a SIL? At system level 1) Requirements to achieve SYSTEMATIC INTEGRITY 2) Probability of RANDOM HARDWARE FAILURE (PFH D ) 3) ARCHITECTURAL CONSTRAINTS 4) Requirements for BEHAVIOUR ON DETECTION OF A FAULT INPUT LOGIC SOLVING OUTPUT

21 BS EN 62061: METHODOLOGY & KEY PRINCIPLES (EXAMPLE FOR PFH D ) Probability of DANGEROUS RANDOM HARDWARE FAILURE (PFH D ) Example for SIL 2 System PFH D requirements = <10-7 to >10-6 (Using data provided by subsystem manufacturers) Subsystem 1 Subsystem 2 Subsystem 3 Subsystem 4 PFH D = 1x10-7 PFH D = 2x10-7 PFH D = 1x10-7 PFH D = 2x10-7 (1x10-7 )+ (2x10-7 ) + (1x10-7 ) + (2x10-7 ) = 6 x 10-7

22 BS EN 62061: METHODOLOGY & KEY PRINCIPLES ARCHITECTURAL CONSTRAINTS Architectural constraints The SIL achieved by the SRECS according to the architectural constraints is less than or equal to the lowest SILCL of any subsystem (see 6.7.6) involved in the performance of the SRCF. Safe failure fraction Hardware fault tolerance (see note 1) < 60 % Not allowed (see note 3) SIL1 SIL2 60 % - < 90 % SIL1 SIL2 SIL3 90 % - < 99 % SIL2 SIL3 SIL3 (see note 2) 99 % SIL3 Provided by subsystem manufacturer NOTE 1 A hardware fault tolerance of N means that N+1 faults could cause a loss of the safety function. NOTE 2 A SIL 4 claim limit is not considered in this standard. For SIL 4 see IEC NOTE 3 Exception see SIL3 (see note 2) SIL3 (see note 2)

23 RELATIONSHIP BETWEEN BS EN & BS EN BS EN BS EN BS EN Category Hardware fault tolerance >1 1 DC It is assumed that subsystems with the stated category have the characteristics given below. 0% % % % > 90% P DF threshold (per hour) that can be claimed for the subsystem P DF (MTTF subsystem, T test, DC) 1 To be provided by supplier or use generic data (see Annex E)

24 WAY FORWARD BS EN provides a complete explanation of functional safety rationale and has been developed to take account of BS EN Structured and systematic design approach from concept to reality has to be applied regardless of standard selected. System designers/integrators should look for subsystems packaged for functional safety. Not just logic solvers also input sensors and output actuators.

25 WAY FORWARD Links to other existing and developing standards. Essential guidance on issues related to safety-related control systems at papermaking machinery provided in PABIAC publication Making paper safely Part 6: Managing safety in the papermaking process (Edition 2:2005). Liaison established between and to align approaches to facilitate possible future integration of both standards into a single publication (more on this later).

26 BEFORE FINISHING IF TIME ALLOWS.. A QUICK WORD ON SIL ASSIGNMENT

27 PRACTICAL EXAMPLE OF SIL ASSIGNMENT METHODOLOGY FROM ANNEX A OF BS EN Consider the following situation at a papermaking machine

28

29

30 PRACTICAL EXAMPLE OF SIL ASSIGNMENT METHODOLOGY FROM ANNEX A OF BS EN Description of hazard: Trapping/entanglement in the event of unexpected start-up whilst personnel attempting to remove broken paper Description of SRCF: If the guard door is open, the speed of shaft rotation shall not be higher than specified

31 PRACTICAL EXAMPLE OF SIL ASSIGNMENT METHODOLOGY FROM ANNEX A OF BS EN Risk estimation: Severity (Se) Se = death/loss of limb = 4 Frequency and duration of exposure (Fr) Fr = > 1 day to 2 weeks = 4 Probability (Pr) Pr = possible = 3 Probability of avoiding or limiting harm (Av) Av = rarely = 3

32 PRACTICAL EXAMPLE OF SIL ASSIGNMENT METHODOLOGY FROM ANNEX A OF BS EN SIL assignment Probability of occurrence of harm Cl = Fr + Pr + Av Cl = = 10

33 PRACTICAL EXAMPLE OF SIL ASSIGNMENT METHODOLOGY FROM ANNEX A OF BS EN SIL assignment Severity (Se) Class (Cl) SIL 2 SIL 2 SIL 2 SIL 3 SIL 3 3 SIL 1 SIL 2 SIL 3 2 SIL 1 SIL 2 1 SIL 1

34 PRACTICAL EXAMPLE OF SIL ASSIGNMENT METHODOLOGY FROM ANNEX A OF BS EN SIL assignment Probability of occurrence of harm Cl = Fr + Pr + Av Cl = = 10 If the guard door is open, the speed of shaft rotation shall not be higher than specified Safety integrity requirement: SIL 2

35 PRACTICAL EXAMPLE OF SIL ASSIGNMENT METHODOLOGY FROM ANNEX A OF BS EN What next? Risk estimation is an iterative process, this means that the process will need to be carried out more than once. This should ensure that residual risk is effectively minimised.

36 Thank-you..ANY QUESTIONS??