Towards Safe Machinery: Risk Assessment; Information About The Examples; Systematics Of The Examples; Technical Safety Measures - Emerson AVENTICS AV Notice D'instruction

own judgment and verification. It must be remembered that our products are
subject to a natural process of wear and aging.

3.2 Towards safe machinery: Risk assessment

Risk assessment
• Must be performed by machine manufacturer; results remain with the manu-
facturer
• Must account for both proper use and any foreseeable misuse of the machine
• Provides an important body of proof for the manufacturer for liability claims in
accident cases
Start
Identify limits of machinery
Identify hazards
Estimate risk
Design-related safety measures
Safe machine?
Yes

Technical safety measures

Safe machine?
Yes
Instructive measures exhausted?
Yes
End
Select safety function
Determine PL
r
Design and technical
implementation of safety function
Category MTTF DC
D
Fig. 1: Process for risk assessment and determination of PL
In these instructions, we focus on the implementation of technical safeguards to
mitigate risk, assessing the safety function, and determining its performance
level within the risk assessment process. The figure shows you the process re-
quired for risk assessment. Depending on the control architecture (category),
Mean Time To dangerous Failure (MTTF
mon Cause Failures (CCF), the Performance Level (PL) must be at least equal to
the required Performance Level (PL

3.3 Information about the examples

The following 3 examples show:
• Example 1: Hazard due to unexpected start-up, PL
• Example 2: Hazard due to unexpected start-up, remaining kinetic energy, PL
= c
• Example 3: Hazard due to unexpected start-up, PL

3.3.1 Systematics of the examples

The systematics of the examples is based on the key for the identification of parts
of the safety functions from the draft VDMA 66416:2016-01.
The general description is as follows:
Preliminary note
Description of the framework conditions:
• Machine type, operating mode, ...
• Hazard due to ...
• Risk parameters according to DIN EN ISO 13849-1:2016-06
• PL
r
Control measures (safety functions) and other risk reduction measures:
• Name of the safety function
• Name of the safety function
• ...
AVENTICS™ AV | R412018148-BAL-001-AB | English
No
E.g. inherent safety
No
E.g. guards and
safety function
No
User information at machine
and in manual
PL ≥ PL
CCF
r
r
), Diagnostic Coverage (DC) and Com-
D
).
r
= e
r
= d with fault exclusion
r
Input
Triggering event:
• Query of states of safety equipment and
• Monitoring of events
Examples: Enabling device, emergency stop, safety switch, key switch,
• Light grid, safety pressure switch, ...
Logic
Evaluation of the safety function:
• Switching off the energy supplies, safety relay, safety PLC
Output
Safety-directed response:
• Examples: Fluid valves, contactors, regulators, brakes, ...
3.3.2 Technical safety measures
If the safety of a machine depends on a correctly functioning control, this is re-
ferred to as "functional safety". The "active" parts of the control are the main fo-
cus, i.e. components that detect a dangerous situation (signal recording, "I" = in-
put), derive suitable reactions (evaluation, "L" = logic), and implement reliable
measures (execution, "O" = output). The term "control" thus refers to the entire
signal processing system.
"Safety-related parts of a control (SRP/CS)" are not necessarily "safety
components" as defined by the Machinery Directive. SRP/CS (Safety
Related Parts of a Control System) can, however, be such safety com-
ponents, e.g. 2-hand controls or logic units with safety function. Actu-
ators (cylinders), energy supply (e.g. pressure supply or maintenance
units) and connections are not directly factored into dangerous failure
rates.
1
SRP/CS
Sensor
Signal recording to
detect potential hazard
(Opto-)electronics
E.g. emergency OFF, two-hand circuit, safety
door, safety mat, light barrier, laser scanner,
enabling device, mode selector, camera
systems...
I Input
1 Start event, e.g. manual
L Logic activation of button,
O Output opening a safeguard
Fig. 2: Focus on safety-related parts of a control (SRP/CS acc. to ISO 13849-1)

3.4 Example 1 with PLr = e

Example 1, based on VDMA 66416:2016-01, number 2.1.1.1 and 2.2.1.1
Preliminary note
Description of the framework conditions:
r
• Operating mode: Automatic (BA1)
• Machine cycle time: 5 to 15 seconds
• Hazard due to unexpected start-up
• PL = e
r
Control measures (safety functions):
• Safe torque off (STO) or
• Safe disconnection of the energy supply (SEC)
• Prevention of unexpected start-up (PUS)
Input
Triggering event:
• Light grid interrupted or interlocked safety doors open or not kept closed
Logic
Evaluation of the safety function:
• Switching off the energy supplies
Output
Safety-directed response:
i i
ab bc
SRP/CS SRP/CS
a b c
I L O
Logic Actuator
Evaluation of hazard
Electronics Pneumatics
Safety relay, wiring, safety PLC, E.g. limited or safe speed, reduce pressure
safe pneumatic logic ... and force, release energy, safe direction of
travel, stop or block movement (see circuit
2 Machine actuators
2
"Active parts"
Execute reaction
15