W09 - Safety Risk Assessments

Transcription

1 W09 - Safety Risk Assessments Determining Machine Safety Performance Levels and Safety Integrity Levels Mike Duta & Derek Jones November 2012 Rev 5058-CO900C Copyright 2012 Rockwell Automation, Inc. All rights reserved.

3 Functional Safety Standards Generic Electrical Control Systems IEC Process Electrical Control Systems IEC SIL Machinery Electrical Control Systems Machinery Control Systems (All technologies) IEC ISO PL Automotive Road vehicles Functional safety ISO ASIL Copyright 2012 Rockwell Automation, Inc. All rights reserved. 3 3

4 4 4 EU Legislation European Directive Machinery Directive "Aim: Harmonization" European Regulations National Regulations EN ISO (i.e. Standards) "Each Country: Adoption" NF EN ISO France DIN EN ISO Germany UNI EN ISO Italy ÖNORM EN ISO Austria CE - Information

5 5 Directives vs. Standards Directive = Law: Machine Directive 2006/42/EC. EMC Directive 2004/108/CE. (Electromagnetic Compatibility) Low Voltage Directive 2006/95/CE (Low Voltage Directive) ATEX Directive 94/9/EC (Classified Area Explosives) Work Equipment Directive 89/655/EEC Framework Directive "worker protection" 89/391/EEC Essential Health and Safety Requirements Machine Directive - Annex 1 Standards (European Norms) = Technical Rules Standards contain compliance assumptions: EN ISO Risk Reduction and Risk Assessment methodology EN 62061, EN ISO Functional safety of control systems CE - Information

6 6 Common Essential Health and Safety Requirements Machinery Directive 2006/42/EC EHSR s 89/655/CEE Directive on "the use of work equipment" UWED EHSR s Essential Health and Safety Requirements CE - Information

7 7 Machinery Directive /42/EC Machinery Directive /42/EC For best info see: Clear requirement for Risk Assessment at design stage Full Quality Assurance Scheme for Annex IV machines No Certificate of Adequacy option for Annex IV Clarification and relevance updated Covers partly completed machinery Guide to Application of the Machinery Directive _application_directive_ ec-1st_edit _en.pdf

8 Essential Health and Safety Requirements In the Machinery Directive, Annex I the general principles for conformance are communicated A Risk Assessment must be carried out to determine the health and safety requirements which apply to the machinery. On Initial machines, the machine concept must be developed prior to the initial risk assessment being performed this would be an iterative process in the beginning stages of the project The machinery must then be designed and constructed taking into account the results of the risk assessment Steps Outlined for a Risk Assessment: Determine the limits of the machinery (intended use and reasonably foreseeable misuse) Identify the hazards Estimate the Risks Evaluate the risk with a view for determining if risk reduction is required Eliminate the hazard or reduce the risks by the application of protective measures Copyright 2012 Rockwell Automation, Inc. All rights reserved. 8

9 9 Essential Health and Safety Requirements Essential Health and Safety Requirements are comprised of 1 main section and 5 supplementary sections These sections outline requirements for the application and functional performance of the systems / machine / documentation Essential Health and Safety Requirements - (Main Section) Supplementary Essential Health and Safety Requirements: For certain categories of machinery To offset hazards due to the mobility of machinery To offset hazards due to lifting operations For Machinery intended for underground work For Machinery presenting particular hazards due to the lifting of persons

10 10 Essential Heath and Safety Requirements (EHSR s) EHSR s cover topics such as these (not all inclusive see Annex I) Definitions Principles of Safety Integration Materials utilized to construct machinery Lighting Ergonomics Control Systems (Safety and Reliability) General and specific requirements Control Devices Starting & Stopping of the machinery Selection of Control Modes Failure mode considerations component failure, machine breakup, etc. Risks related to a list of many aspects of the use of the machinery Guarding requirements Maintenance Information for use / Marking of machinery

11 11 Essential Heath and Safety Requirements (EHSR s) To meet the EHSR s there are standards. (See List in the Official European Journal) Part of resources EN Harmonized European Standards These standards are common to all EEA countries and are produced by the European Standardization Organizations CEN and CENELEC. Their use is voluntary but designing and manufacturing equipment to them is the most direct way of demonstrating compliance with the EHSR s. There are 3 types of Standards: Type A. Standards: Cover aspects applicable to all types of machines. Type B. Standards: Subdivided into 2 groups. Type B1 STANDARDS: Cover particular safety and ergonomic aspects of machinery. Type B2 STANDARDS: Cover safety components and protective devices. Type C. Standards: Cover specific types or groups of machines.

12 12 Standards - EN, ISO and IEC EXAMPLES Type A EN ISO Safety of machinery. Basic principles Risk assessment and risk reduction Type B EN ISO Safety related parts of control systems EN ISO Emergency stop function EN / IEC Functional safety of electrical control systems EN / IEC Safety of machinery. Electrical Equipment EN 574 / ISO Two hand controls Type C EN ISO Earth Moving Machinery EN ISO Safety requirements for dry-cleaning machines

13 13 Standards for Functional Safety Other safety type standards EN ISO Safety of machinery. Means of access to machinery ISO EN Safety of machinery --Guards EN Safety of machinery. Ergonomic design etc.,.etc... EN ISO EN ISO IEC EN EN EN ISO IEC/EN EN ISO &2 IEC ISO 23849

14 14 Design and Risk Assessment of the Machine EN ISO 12100: Safety of machinery -- General principles for design -- Risk Assessment and Risk Reduction

15 15 EN ISO and EN/IEC Design of Safety-related Control Systems for Machinery Methodology using: Safety related control functions System-based approach Qualitative Index of Safety: Safety Integrity Level (PL or SIL) PL/SIL assessment methodology Architecture orientated Quantitative indication of safety reliability Requirements for avoidance control of systematic failures

16 16 EN ISO Safety of machinery - General principles for design - Risk assessment and risk reduction Basic terminology, methodology and Technical principles Hazard types: Mechanical, electrical, thermal, noise, vibration, radiation, materials and substances, ergonomic, slips trips and falls, environment. Risk reduction Protective measures Inherently safe design measures Provisions for maintainability Preventing electrical hazards Minimizing the probability of failure of safety functions Safeguarding and protective measures Signals, signs and warning devices Indexes to more specific B type standards EN ISO provides the frame work for the design of the risk reduction elements:

17 17 Risk Reduction Safety System Design Time to use our brains!

18 18 EN ISO 12100: Safety of Machinery Risk Assessment and Risk Reduction PROBABILITY OF OCCURRENCE Risk IS A FUNCTION OF Severity of Harm AND Exposure to the hazard Occurrence of the hazardous event Possibility of avoidance General principles Risk estimation Checklists of hazard types, hazardous events and hazardous situations See ISO TR for worked examples of methodologies

19 19 Fundamental Process Define the Machine Characteristics and Limits (LOM) Risk Analysis (1) Hazard Identification (2) Risk Estimation Next Hazard Risk Assessment (3) Risk Evaluation Unacceptable Risk Reduction Acceptable Risk Tolerable

20 20 An Example The Starting Point Risk Assessment EN ISO Safety of machinery General principles for design Risk assessment and risk reduction ISO TR : Safety of machinery Risk assessment Part 2: Practical guidance and examples of methods OSHA 29 CFR 1910 Subpart O - Machinery and Machine Guarding ANSI B Safety of Machinery; General Requirements and Risk Assessment CSA Z Safeguarding of machinery ISO &2: Safety requirements for industrial robots Task Analysis Hazard Identification Risk Estimation Risk Evaluation

21 21 Risk Assessment and Risk Reduction Hierarchy of measures for risk reduction Inherently safe design measures Safeguarding and protective measures Information for use / training / PPE etc. Personal Protective Equipment

22 22 Protective Measures and Safety Related Control Systems - EN ISO Protective measures hazards that will be addressed by a safety related control system Requirements for access into robot enclosure Cleaning Teaching Maintenance

23 23 Protective Measures and Safety Related Control Systems - EN ISO Functional requirements specification 1. Automatic mode Lock the guard door when closed unless power is OFF and motion is stopped. 2. Automatic Mode - Isolate power if guard door is not closed. 3. Teach Mode - Allow power for robot teaching only with safe limited speed conditions and with local control enabling device activated and guard door open

24 24 EN ISO Recommendations for its Practical Use Robot axis power status Robot axis motion status Release of stored energy Lock release request Robot in home position ON NOT STOPPED NOT RELEASED OFF Guard unlock Command Status ON NOT STOPPED RELEASED OFF ON STOPPED NOT RELEASED OFF ON STOPPED RELEASED OFF OFF NOT STOPPED NOT RELEASED OFF OFF NOT STOPPED RELEASED OFF OFF STOPPED NOT RELEASED OFF OFF STOPPED RELEASED ON 1 Automatic mode - Lock the guard door when closed unless power is OFF and motion is stopped.

25 25 EN ISO Recommendations for its Practical Use Guard Door Status Guard Lock Status OPEN UNLOCKED OFF Output Actuators Status OPEN LOCKED OFF CLOSED UNLOCKED OFF CLOSED LOCKED ON 2 - Automatic Operation Mode - Isolate power if guard door is not closed and locked

26 26 EN ISO Recommendations for its Practical Use Safe Speed Guard Door Status Manual Local Control Priority Enabled NO CLOSED NO OFF Output Actuators Status NO CLOSED YES OFF NO OPEN NO OFF NO OPEN YES OFF YES CLOSED NO OFF YES CLOSED YES OFF YES OPEN NO OFF YES OPEN YES ON 3 - Teach Mode - Allow power for robot teaching only with safe limited speed conditions and with local control enabling device activated and guard door open

27 EN ISO Recommendations for its Practical Use What is the required Performance Level (PL)? Teach Mode Safety Function: Allow power for robot teaching only with safe limited speed conditions and with local control enabling device activated and guard door open Safe Speed Sensing Door Closed Sensing Manual Local Control Logic Solving Output Actuation Shaft Encoders Guard Interlock Switch 3 Position Enabling Device Safe Speed Control Unit Contactors Safe Speed Guard Door Status Manual Local Control Priority Enabled NO CLOSED NO OFF NO CLOSED YES OFF NO OPEN NO OFF NO OPEN YES OFF YES CLOSED NO OFF YES CLOSED YES OFF YES OPEN NO OFF YES OPEN YES ON Output Actuators Status Safety Related Electrical Control System: Safe Limited Speed Fully decompose the safety function Copyright 2012 Rockwell Automation, Inc. All rights reserved. 27

28 28 EN ISO Recommendations for its Practical Use Decomposition of Teach mode safety function Teach Mode Safety Function: Allow power for robot teaching only with safe limited speed conditions and with local control enabling device activated and guard door open Safe Speed Sensing Door position Sensing Manual Local Control Logic Solving Output Actuation Shaft Encoders Guard Interlock Switch 3 Position Enabling Device Safe Speed Control Unit Contactors Safe Speed Guard Door Status Manual Local Control Priority Enabled NO CLOSED NO OFF Output Actuators Status c Guard door closed sensing b Enabling function NO CLOSED YES OFF NO OPEN NO OFF NO OPEN YES OFF YES CLOSED NO OFF a - Safe Limited Speed YES CLOSED YES OFF YES OPEN NO OFF YES OPEN YES ON

29 29 EN ISO Recommendations for its Practical Use What is the required Performance Level (PLr)? Teach Mode Safety Function 1: Safe Limited Speed. Safe Speed Sensing Logic Solving Output Actuation Shaft Encoders Safe Speed Control Unit Contactors Safe Speed Guard Door Status Manual Local Control Priority Enabled NO CLOSED NO OFF NO CLOSED YES OFF NO OPEN NO OFF NO OPEN YES OFF YES CLOSED NO OFF YES CLOSED YES OFF YES OPEN NO OFF YES OPEN YES ON Output Actuators Status Safety Related Electrical Control System: Safe Limited Speed

30 30 EN ISO PL allocation EN ISO risk graph PLr allocation for each safety function For example PLr for safe limited speed function = PL?

31 31 EN ISO Safety of Machinery Safety Related Parts of Control Systems Then we choose the most suitable combination of Structure (Category), Reliability (MTTFd) and Diagnostics (DC) To achieve that Performance Level (PL) Shaft Encoders Safe Speed Control Unit Safety Related Electrical Control System: Safe Limited Speed Contactors

32 32 EN ISO Safety of Machinery Safety Related Parts of Control Systems See annex K Shaft Encoders Safe Speed Control Unit Contactors Safety Related Electrical Control System: Safe Limited Speed

33 33 EN ISO Recommendations for its Practical Use Shaft Encoder 1 Safe Speed Control Unit 1 Contactor 2 MTTFd of Channel 1 Shaft Encoder 2 Safe Speed Control Unit 2 Contactor 2 MTTFd of Channel 2 Shaft Encoder 1 Contactor 2 Shaft Encoder 2 Safe Speed Control Unit Contactor 2 PFHd or MTTFd at Subsystem level Shaft Encoders Safe Speed Control Unit Contactors Safety Related Electrical Control System: Safe Limited Speed

34 34 EN ISO Recommendations for its Practical Use Derek Jones 09/09/2010

35 35 EN ISO : SISTEMA Calculation Tool SISTEMA (available in multiple languages) PL Calculation software for EN ISO Free to use Data Libraries available Independent Maintained

36 36 Where can you download SISTEMA and Data? Rockwell Automation Safety Resource Center at: :

37 37 Overview of SISTEMA

38 38 IEC Machinery safety related E/E/PE control systems IEC EN risk chart Safety Integrity Level SIL allocation for each safety function For example safe limited speed function = SIL?

39 IEC Machinery safety related E/E/PE control systems Copyright 2012 Rockwell Automation, Inc. All rights reserved. 39 SIL 3 required for the Safety Function: Teach mode Safe limited speed Shaft Encoders Safe Speed Control Unit Contactors Safety Related Electrical Control System: Safe Limited Speed

40 IEC Machinery safety related E/E/PE control systems Copyright 2012 Rockwell Automation, Inc. All rights reserved. 40 SIL 3 required for the Safety Function: Teach mode Safe limited speed Subsystem SIL CL = 3 PFH D = 4.3 x 10-8 Subsystem SIL CL = 3 PFH D = 3.38x 10-9 Subsystem SIL CL = 3 PFH D = 1.50 x 10-9 Shaft Encoders Safe Speed Control Unit Contactors Safety Related Electrical Control System: Safe Limited Speed Total PFH D = x 10-8 SIL achieved = 3

42 42 Did I The real world increase or - reduce HRN From Risk The assessment original HRN? to PL Severity? Probability? Risk Assessment of overall machine Hazard Identities HRN Hazard rating number Qualitative information Risk Reduction of overall machine By inherently safe design of machine and its control system Guards & protective devices Information & PPE Design of safety Function(s) ISO Or IEC SISTEMA Map HRN to ISO13849 / IEC Risk Graph Safety Functional Requirement PLr / SIL Safety Integrity Requirement

43 43 Did I The real world increase or - reduce HRN From Risk The assessment original HRN? to PL Severity? Probability? Risk Assessment of overall machine Hazard Identities HRN Hazard rating number Qualitative information Risk Reduction of overall machine By inherently safe design of machine and its control system Guards & protective devices Information & PPE Design of safety Function(s) ISO Or IEC SISTEMA Map HRN to ISO13849 / IEC Risk Graph Safety Functional Requirement PLr / SIL Safety Integrity Requirement