Equipment under Control

There is equipment under control (EUC), which, with its control system (which is the safety-related PE System) poses a (potential) threat to its environment (in case of security, the system is threatened by its (may be far remote) environment, what, in turn, might pose a threat to its close environment). 

Figure 2. IEC 61508—Equipment Under Control To fulfill these goals, the standard requires ...

Sinclair, C.S. Tallentire, A. Performance of blow-fill-seal equipment under controlled airbourne microbial challenges. J. Pharm. Sci. Tech. 1995, 49 (6). 

Minimising machinery breakdowns by running the equipment under control... 

In order to determine the required SIL level, a detailed hazard analysis is performed for the equipment under control (EUC). From the hazard analysis, all safety functions are identified (example—Detect failure of braking). A target safety integrity level is assigned to each of the safety functions (example—detect failure of braking—SIL 3) in order to ensure the residual risk is lower than the acceptable risk (in other words, the risk is sufficiently reduced). The outcome will be an EUC safety function specification detailing the function and target SIL level (between 1 to %) required for each safety function identified in the hazard analysis. 

Second, there is a distinction between safety-related functions and systems. A function is described in words, along the lines of If this particular set of conditions is detected as occurring, then act to bring the equipment under control to a safe state. This brief description is... 

One of the first steps recommended in lEC 61508 is to determine the boundary of the Equipment Under Control (EUC) and the EUC control system. Since lEC 61508 is directed towards programmable electronics systems, it is natural to think of the road and its users as the EUC and the ITS as the control system. Under such a model, it is also natural to consider modelling hazards at the boundary of the control system, e.g. at the level of errors in the display of signs and signals. 

Definition of physical equipment including equipment-under-control, control systems and procedures The normal transport system has both traffic control systems and plant control systems, including ventilation in undersea tunnels... 

EUC Process lEC 61508 refers to EUC (equipment under control) while lEC 61511 ANSI/ISA-84.00.01-2004 flEC 61511 Mod) refers to orocess... 

Function to be implemented by an E/E/PE safety-related system (i.e., SIS), other technology safety-related system, or external risk-reduction facilities, which is intended to achieve or maintain a safe state for the equipment under control, in respect of a hazardous event. (lEC 61508 Part 4 Clause 3.5.1). 

Process and its associated equipment/lEC 61508 Process and its equipment/ANSI/ISA-84.01-1996 Clause 3.1.5 makes numerous references to Equipment Under Control(EUC)... 

The demand rate is determined by the characteristics of the associated equipment under control (EUC) in combination with the reliability of the EUC control system. The hazard rate is determined by the risk considered to be tolerable in the particular application, taking into account the risk reduction provided by any other safety-related systems or risk reduction measures relevant to the hazard being considered. 

The analysis suggests fliat most control system failures may have their root cause in an inadequate specification. In some cases this was because insufficient hazard analysis of the equipment under control had been carried out in others it was because the impact on the specification of a critical failine mode of the control system had not been assessed. 

IFC 61508 Originally functional safety was defined as part of the overall safety relating to the equipment under control (FUC, see Clause 8.1.2), and the EUC control system which depends on the correct functioning of the E/E/PE safely-related systems, other technology safety-related systems and external risk reduction facilities. Later came the generalized definition of functional safety, which is part of the overall safety that depends on a system or equipment operating correctly in response to its inputs. Functional safety is achieved when every specified safety... 

The scope definition section requires the definition of the boundary of the process and equipment under control being assessed, together with its control system. Since in the majority of cases the input to LOPA is taken from preliminary hazard analysis or HAZOP, the scope is more or less otherwise developed from previous analysis. It is necessary to ensure that equipment under control and its environment are sufficiently understood along with scope and boundary including interface before detailed assessment commences. 

Low demand mode Where safety function is only performed on demand to transfer equipment under control (EUC) into a specified safe state and the frequency of demand is less than one per year. Fig. VII/1.4-1 is an example of demand mode of operation. This is because normally the level in the tank will be maintained by sensors Sn and control valve Cy, but in case of a high level to avoid a hazardous situation, separate protection sensors will come into play and close the shutdown valve Sy. So safety comes on demand. 

EUC control The system that responds to input signal from process/facility and/or from an operator and generates output signal causing equipment under control (EUC) to operate in the desired manner. 

Defines exactly what is the EUC (equipment under control) and the part(s) being controlled. Understands the EUC boundary and its safety requirements. Scopes the extent of the hazard and identification techniques (e.g., HAZOP). Requires a safety plan for all the life-cycle activities. 

This is an example of a low-demand safety-related system in that it is only called upon to operate at a frequency determined by the frequency of failure of the equipment under control (EUC)—in this case 2 x 10 pa. Note, also, that the target E in the above paragraph is dimensionless by virtue of dividing a rate by a rate. Again, this is consistent with the right-hand column of Table 1.1 in Chapter 1. 

EUC, equipment under control SRS, safety requirement specification CAS, computer algebra system SR, safety related. 

Clear text. Describes safety-related functions (SIFs) and separation of Equipment under control (EUC)/SIS, responses, performance requirements, well defined interfaces, modes of operation ... 

Figure 13.1 shows the same equipment under control (EUC) as was used in Chapter 11. In this case, however, the additional protection is provided by means of additional K2 pilot valves, provided for each valve, V. This implies that failure of the valves, V, was (wrongly) not perceived to be significant. Closing the K2 pilot valve (via the PES and an I/P converter) has the same effect as closing the K1 pilot. The valve, V, is thus closed by either K1 or K2. This additional safety-related protection system (consisting of PES, I/P converters, and K2 pilots) provides a backup means of closing valve V. ... 

EUC (equipment under control) refers to the items of equipment which die safety-related system being studied actually controls. It may well be, however, that the EUC is itself safety-related and this will depend upon the SIL calculations described in Chapter 2. 

In general, the risk is the result of a combination of consequence of the hazardous event and the probability of occurrence of these hazardous events. This combination influences the equipment under control risk. If this risk is higher than the tolerable risk, than necessary risk reduction measures are to apply to reach the tolerable risk level. To reach the tolerable risk level external risk reduction measures, the implementation of safety-related systems and the application of non electrical safety reduction systems are to be considered. 

ISO 26262 defines the relalion of risk, danger and safety integrity differently. The term safety integrity is not directly used in ISO 26262. In particular the term EUC (Equipment under Control) is not used at aU. EUC could be explained as device or system, which should be controlled by means of functional safety measures . Under certain limiting conditions ISO 26262 admits to develop a desired vehicle function that is safety-related on its own. In this case, the system does not receive safety through EUC itself. Technically, according to lEC 61508, EUC and the safety functions have to cause an error at the same time in order to create a hazardous situation. If for example a hydraulic braking system was the... 

The reduction of risk cannot be achieved with the activities and methods mentioned in ISO 26262 if a function is not suitable, inadequate suitable, inadequate or falsely indicated for certain safety related functions. This represents a special challenge, considering that ISO 26262 does not directly addresses a EUC (Equipment under Control, e.g. a system, machinery or vehicle, which should be controlled safety-related systems) or the distinction between safely functions of designated safety requirements for on-demand (low demand) or continuous mode (high demand) safety systems. How is it possible to find out whether or not reactions of a vehicle system or certain measurements are sufiftcient, tolerable or safety-related appropriate ... 

Part of the overall safety relating to the equipment under control (EUC) and the EUC control system which depends on the correct functioning of the electrical/electronic/programmable electronic safety-related systems, other technology safety-related systems and external risk reduction facilities. 

---