levels in different discrete levels corresponding for each one to a probability of dangerous failure per hour: > > The table below gives the relationship between the perforance level (PL) and the Safety Integrity Level (SIL). a No correspondance u - - b u - - c u - - d u - - e u - Annex A Non electrical, e.g. hydralics X Not covered B C Electroechanical, e.g. relays, or non-coplex electronics Coplex electronics, e.g. prograable Restricted to designated architectures (see Note ) and up to PL=e Restricted to designated architectures (see Note ) and up to PL=d All architectures and up to SIL All architectures and up to SIL D A cobined with B Restricted to designated architectures (see Note ) and up to PL=e E C cobined with B Restricted to designated architectures (see Note ) and up to PL=d X see Note All architectures and up to SIL F C cobined with A, or C cobined with A and B X see Note X see Note X indicates that this ite is dealt with by the standard shown in the colun heading. 0 /
Event: liit switch Guard contact Logic Representation of the safety function L Contactor Inputs Processing Outputs Action: otor stop > how a safety-related electrical control circuit ust behave under fault conditions. confority with the Machinery Directive. These two standards consider not only > builders ust be able to deterine whether their safety circuit eets the required safety integrity level (SIL) or perforance level (PL). Panel builders and designers should be aware that anufacturers of the coponents used in safety circuits (such as safety detection coponents, safety logic solvers and output This standard gives safety requireents and advice relating to principles for the design and integration of safety-related parts of control systes (SRP/CS), the perforance level, needed to achieve these safety functions. It applies to the SRP/CS of all types of achine, regardless of the technology and type of energy used (electric, hydraulic, pneuatic, echanical, etc.). reduction easures. If these easures depend on a control syste, then a : - Selection of the essential safety functions that SRP/CS ust perfor. For each safety function, specify the required characteristics - Deterine the required perforance level (PLr) - Design and technical creation of safety functions: identify the parts that perfor the safety function - Evaluate the perforance level PL for each safety-related part required level (PLr) severe injury can be caused by a trolley not stopping at the end of the Jib and thus causing the trolley to fall. A person can be exposed to this dangerous situation around the hoisting achine. The diagra opposite shows a safety function which consists of several parts: > The input actuated by opening of the guard (SRP/CSa) > The control logic, liited in this exaple to opening or closing of a contactor coil (SRP/CSb) > The power output that controls the otor (SRP/CSc) > The connections (Iab, Ibc) 0 Risk analysis Severity of the potential har Probability of occurrence: - Frequency and duration of exposure - Possibility of avoiding or liiting the probability of the occurrence of an event that could cause the har Considering our exaple of the person coing into area where the dangerous The paraeters to be considered are: > S Severity of the injury > S Slight injury, norally reversible > S Serious, norally irreversible, including death > Frequency and/or duration of exposure to the hazardous phenoenon > Rare to fairly frequent and/or short duration of exposure > Frequent to peranent and/or long duration of exposure > P Possibility of avoiding the hazardous phenoena or liiting the har > P Possible under certain circustances > P Virtually ipossible /
Starting point for the evaluation of the contribution to the risk reduction of a safety function Estiation of required perforance level S = Slight (norally reversible injury) S = Serious (norally irreversible) injury including death F = Seldo to less often and/or the exposure tie is short F = Frequent to continuous and/or the exposure tie is long P = Scarcely possible H Estiation Required perforance level PLr: H (continued) (continued) (continued) For our exaple: a serious injury S can be caused by being exposed near the hoisting achine as if there is no safe guarding to ensure the trolley stops the load and trolley will fall. After considering the severity of the injury we investigate the frequency and/or exposure to the hazard is low F (occasional presence) as there are restrictions to enter the area. The last step is based upon the possibility to avoid the hazard and liiting the the visibility around the dangerous achine is onitored by the operator and in this case At this point, we need to describe the PL calculation ethod. > Hardware and software syste structure (categories) > Mechanis of failures, diagnostic coverage (DC) > Coponents reliability, Mean Tie To dangerous Failure (MTTF d ) > Coon Cause Failure (CCF) > Categories (Cat.) and designated architectures The table below suarises syste behaviour in the event of a failure and the B A fault can lead to loss of the safety function As for category B but the probability of this occurence is lower than for the category B A fault can lead to loss of the safety function between two periodic inspections and loss of the safety function is detected by the control syste at the next test. For a single fault, the safety function is always ensured. Only soe faults will be detected. The accuulation of undetected faults can lead to loss of the safety function. When faults occur, the safety function is always ensured. Faults will be detected in tie to prevent loss of the safety function I I L L TE O O OTE i I L O c i I L O I L O c I L O Key: i: Interconnecting eans : Monitoring c: Cross onitoring O, O, O: Output device, e.g. ain contactor I, I, I: Input device, e.g. sensor TE: Test equipent L, L, L: Logic OTE: Output of TE > MTTF d (Mean Tie To dangerous Failure) The value of the MTTF d of each channel is given in levels (see table below) and redundant syste) individually. Low Mediu High years y MTTF d y MTTF d y MTTF d A MTTF d of less than years should never be found, because this would ean that coponent. Additional easures such as redundancy and tests are required. 0 /
(continued) (continued) (continued > the ability to diagnose a dangerous failure For exaple, in the event of welding of a N/C contact in a relay, the state of the N/O contact could incorrectly indicate the opening of the circuit, unless the relay has The standard recognises four levels: Denotation Nil Low Mediu y y High y DC > Relationship between Categories, DC and MTTF d of each channel and the PL Perforance level PL a b c PFHD u - - u - - d e u - - u - Event: door opening Input Processing Output Input Processing Output Action: otor stop Cat. B Cat. Cat. Cat. Cat. Cat. Cat. DCavg = DCavg = DCavg = DCavg = DCavg = DCavg = DCavg = low ediu low ediu high MTTF d : low ediu high > Using the above chart we can now select the ost appropriate architecture, the required Diagnostic coverage as well as ensure the products selected have the right MTTF d values > As we require PL= c the chart states as a iniu a category architecture with a d of High is required. It is possible to use architectures with higher categories to solve the safety function needs > We start with deterining the architecture required to solve the function. We use the > In our exaple, to reach the PL = e, the solution will therefore have to correspond to category with redundant circuit; the function schee is shown opposite with two channels in parallel > a high diagnostic capability > a high MTTF d For our application, we could suggest a redundant relay schee but it is nowadays Open Functional diagra of the exaple 0 Closed Application schee of the exaple The process suggested by the standard is iterative and a few estiations are therefore necessary in order to obtain the expected result. In view of the required perforance level, we have chosen a solution with redundant circuit.
(continued) (continued) Based on the inforation in the supplier s catalogue and Annex E of the standard, we obtain the following values: B 0 (nuber of operations) dangerous failure SRP/CS a : Safety liit switches SRP/CS b : XPS AK safety odule -. SRP/CS c : LCK contactor For electroechanical products, the MTTF d is calculated on the basis of the total nuber of operations that the product can perfor, using B values: MTTF d = B B = B 0 For the safety switches, the MTTF d = For the contactors, the MTTF d The MTTF d for each channel will then be calculated using the forula: DC A siilar forula is used to calculate the diagnostic capability The result of the above calculations is suarised below: > a redundant architecture: category > d > level e is achieved: Perforance level PL a b c PFHD u - - u - - d e u - - u - Cat. B Cat. Cat. Cat. Cat. Cat. Cat. DCavg = DCavg = DCavg = DCavg = DCavg = DCavg = DCavg = low ediu low ediu high MTTF d : low ediu high Checking the PL The design of SRP/CS ust be validated and ust show that the cobination of 0
Safety-related electrical control systes in achines (SRECS) are playing an increasing role in ensuring the overall safety of achines and are ore and ore frequently using coplex electronic technology. of non-electrical control coponents in achines (for exaple: hydraulic, pneuatic). > A functional safety plan ust be drawn up and docuented for each design project. It ust include: > is in two parts: > Description of the functions and interfaces, operating odes, function priorities, frequency of operation, etc. > in ters of (Safety Integrity Level) > The structured and docuented design process for electrical control systes (SRECS) > The procedures and resources for recording and aintaining appropriate inforation > account organisation and authorised personnel > > Functional safety The decisive advantage of this approach is that of being able to offer a failure calculation ethod that incorporates all the paraeters that can affect the reliability of electrical systes, whatever the technology used. following paraeters: > The probability of a dangerous failure of the coponents (PFH d ) > The type of architecture; with or without redundancy, with or without diagnostic > Coon cause failures (power cuts, overvoltage, loss of counication > The probability of a dangerous transission error where digital counication is used > Electroagnetic interference (EMC) 0
Severity of the potential har Se s coponents Probability of the har occurring Frequency and duration of exposure Probability of an event occurring Pr Probability of avoiding or liiting the har Av Stage : Basic structure of the electrical control syste (continued) Designing a syste is split into stages after having drawn up the functional safety plan: (SIL) and identify the basic structure of the electrical control syste (SRECS), describe each related function (SRCF) - Select the coponents for each sub-syste achieved. > Severity Se reversible injuries, irreversible injuries and death. Irreversible: death, loss of an eye or an ar Reversible: requires the attention of a edical practitioner > Probability of the har occurring Each of the three paraeters Fr, Pr, Av ust be estiated separately using the used in order to ensure that estiation of the probability of the har occurring is > Frequency and duration of exposure Fr operation, aintenance,...) and the type of access (anual feeding, adjustent,...). It ust then be possible to estiate the average frequency of exposure and its duration. y hour > hour... y day > day... y y year > year > Probability of occurrence of a hazardous event Pr. > the predictability of the dangerous coponents in the various parts of the achine in its various operating odes (noral, aintenance, troubleshooting), paying particular attention to unexpected restarting > behaviour of the persons interacting with the achine, such as stress, fatigue, inexperience, etc. Very high Probable Possible Alost ipossible Negligible Pr 0 /
Function Function Motor Function Stage : Break down into function blocks (continued) (continued) (continued) > Probability of avoiding or liiting the har Av suddenness of the occurrence of the hazardous event, the nature of the dangerous coponent (cutting, teperature, electrical) and the possibility for a person to identify a hazardous phenoenon. Ipossible Alost ipossible Probable > Assignent of the Estiation is ade with the help of the table below. All the other paraeters ust be added together in order to select one of the classes (vertical coluns in the table below), which gives us: > Fr = accessed several ties a day > Pr = hazardous event probable > Av = probability of avoiding alost ipossible Therefore a class CI = + + = A level of SIL ust be achieved by the safety-related electrical control syste(s) () on the achine. Se - - - - SIL SIL SIL SIL SIL - - SIL SIL SIL - - - SIL SIL - - - - SIL > Basic structure of the Without going into detail about the hardware coponents to be used, the syste is this stage, using the terinology given in the standard. function. safety requireents of the syste s function. Av Safety liit switch Safety liit switch Motor Contactor Contactor failure of any sub-syste will lead to the failure of the safety-related control sub-syste ay include sub-syste eleents and, if necessary, diagnostic functions in order to ensure that anoalies can be detected and the appropriate These diagnostic functions (D) are considered as separate functions; they ay be perfored within the sub-syste, by another internal or external sub-syste. coponents Stage : Assignent of function blocks 0 /
SS SS Stage : Coponent selection Motor SS (continued) (continued) The products shown in the illustration opposite are selected. If the sensors and contactors are the sae as in the previous exaple, a safety odule XPS AK will C As the safety integrity level required for the entire syste is SIL, each of the coponents ust achieve this level. The anufacturer s catalogue gives the following values: Safety liit switches and : B > Safety odule: PFH d > Contactors and : B eleent type A eleent n The SIL of the sub-syste depends not only on the coponents, but also on the architecture selected. For our exaple, we will choose architectures B and D of the standard. In our architecture, the safety odule perfors diagnostics not only on itself, but also on the safety liit switches. eleent eleent Coon cause failure We have three sub-systes for which the safety levels ust be deterined: > SS: two redundant safety liit switches in a sub-syste with a type D architecture > SS: a SIL safety odule (obtained on the basis of the PFH provided by the anufacturer) > SS: two redundant contactors built in accordance with a type B architecture type B eleent type C eleent Diagnostic function(s) eleent n The calculation ethod can be found in the achine safety guide, so we will only > B 0 > C: Duty cycle (nuber of operations per hour) > D : rate of dangerous failures ( D = > case: see Annex F > : Proof Test Interval or life tie whichever is saller, as provided by the supplier > : diagnostic test interval > DC: Diagnostic coverage rate = DD / D, ratio between the rate of detected failures and the rate of dangerous failures Diagnostic function(s) eleent type D Types of sub-syste architecture Coon cause failure We obtain: > for SS PFH d =. E > for SS PFH d - The total probability of dangerous failures per hour is: > = DSS + DSS + DSS > + - =. E - SS SS Motor SS Which corresponds to the expected result (table below) of a SIL =. Coent: A level of SIL could have been achieved by using irror contacts to SS SS Architecture D Architecture B u - u 0 u - - 0 Stage : Design of the diagnostic function /