Safety-related control systems

The topic of safety-related electrotechnical control systems is covered in Chapter 13 where it is noted that such systems can comprise a mixture of 

This places much emphasis on the engineering of sufficient safety integrity into the safety-related systems to ensure that risks affected by those systems are reduced to a level that is as low as reasonably practicable (ALARP). There are many methods and techniques for achieving this. The lEC standard 61508 Functional safety of electrical/electronic/programmable electronic safety-related systems, for example, advocates a risk-based approach to determining the required safety performance of safety-related systems, and does so in the context of an overall safety life cycle. The success in the implementation of such an approach demands a suitable level of competence in the engineers involved in the determination of the safety requirements and in the realisation of such systems. 

There has not been much guidance available on the eompetencies required for working in this area. This was a deficiency that needed to be remedied as the progressive introduction of programmable elements into systems that performed safety functions, such as PLCs used in machinery interlocking circuits, resulted in the systems becoming more complex, and increasingly difficult to assure for safety. 

The document identifies the following 12 functional areas in which com- 

For each of these functions, the document provides an outline of the key responsibilities and describes the functional, as well as task-related, competencies. It does this for three levels of competence in increasing levels of competence these are the supervised practitioner, the practitioner, and the expert. The document also provides guidance on how a competence scheme can be operated in these functional areas, how competence can be assessed, and how the outcome of the competence assessment can be recorded. 

---

By analogy with expert analysis methodology for digital safety-related control systems SW verification [5,6], a number of criteria are used under A SW verification assessment. They correspond the systematized set of showings and rules in accordance with that the assessment is carried out and final conclusion concern A SW conformity to the presented safety requirements are eome about. The proposed criteria system for A SW verification includes the criteria of completeness, independence, conformity, documentation and intelligibility. 

B1 Standards. These apply to particular aspects, such as surface temperatures and safety distances. Some B1 examples are EN 418 (Emergency Stop Systems), EN 954-1 (Safety Related Control Systems), and EN 60204-1 (Electrical Requirements of Machinery). 

According to the book Out of Control (HSE, 2003) more than 60% of failures are manifest within safety related systems before they are placed into service. This means that greater than 60% of safety related control system failures are systematic failures, since the components have not yet been put into service. 

Figure 3 shows the typical breakdown of safety related control system errors. 

Build a sufficiently safe Safety-Related Control System (SRECS) for the mine hoist machine. 

The Safety Requirements Specification, SRS, is a specification of all Safety Related Control Functions, SRCFs, implemented by the Safety-Related Control System, SRECS. The SRECS could be the SIL3 Hoist Monitor system or the SIL3 Hoist Protector system. 

A Safety User Manual containing information pertaining to the installation, use and maintenance of the safety-related control system is required. 

Mine hoists safety-related control systems must be designed by competent persons that have worked with or work regularly with mine hoisting applications. 

There is possibility of confusion regarding use of two standards viz ISO 13489. lEC 62061. Normally when medium other than electrical system, ISO 13489 may be more appropriate. Whereas for customer demand for demonstrating safety lEC 62061 may appropriate. Fot safety-related control systems, standard components can be used as it is allowed as pet standard also. However, safety components offer the advantage of reducing workload as the safety-oriented assessment, and analysis of the components used, is carried out by the producer of the safety components. For functional safety, the systematic integrity of components is taken into account, in addition to the use of a suitable category, the implementation of necessary fault detection and the... 

See also, for example R.Bell and D.Reinert, Risk and system integrity concepts for safety-related control systems 7th Symposium on Microprocessor Based Protection Systems, Institute of Measurement and Control, London. 

Functional tests of safety-related control systems, such as emergency stops... 

The chapter describes the essential elements of electrotechnical safety-related control systems and identifies the principle CEN and CENELEC A ... 

As a general principle, safety-related control systems such as interlocks should be well designed, be of simple construction, and be sufficiently robust for the application. Furthermore, it should not be possible easily to defeat interlocking devices, yet where appropriate it should be possible for authorised persons to override them for tests or other necessary purposes. 

In the context of safety-related control systems, the Essential Health and Safety Requirements of the Supply of Machinery (Safety) Regulations 1992 lay down generic requirements that must be considered by suppliers for the safety and reliability of control systems control devices starting and stopping devices mode selection failure of the power supply and the control circuit software and movable guards. 

The interfacing arrangement between the electrosensitive protective equipment and the machinery control system is a particularly important facet of the safety system s design. It is the overall control system incorporating both the photoelectric guard and the machine s safety-related control system that determines the level of safety that can be achieved. Close attention therefore needs to be paid to the machine s control system and the way in... 

The standard is large and complex, and its contents are not easily absorbed. Whereas this may not be a particular issue for companies developing safety-related systems for the likes of major petrochemical companies, it may act as an impediment to its adoption by small and medium size machinery manufacturers. Moreover, it is generic in nature, meaning that it is not targeted at any particular applications, although the thrust of it is more appropriate for complex safety-related control systems in the process, nuclear, railway and similar industries than for simple non-complex machinery control systems. 

At lEC 61508 s core is the definition and explanation of a safety life cycle. The overall safety life cycle for safety-related control systems is depicted in Fig. 13.30. The important attribute of this concept is that it imposes a formal structure on the planning and management of the specification, development, installation, use, maintenance, modification and final disposal phases of the life of safety-related systems. 

In this chapter, the topic will be examined in the context of both electrical safety and the safety of electrotechnical control systems employing electrical, electronic and programmable electronic safety-related control systems. In addition, the increasingly common practice of using conformity assessment to demonstrate competence will be considered. 

One consequence of the increasing realisation that competence has a direct impact on health and safety has been the development of conformity assessment schemes covering competence. Conformity assessment, in its generality, is an activity concerned with determining directly or indirectly that relevant requirements have been met, and is most commonly used to determine if a product, system, process or a person s competence meets a defined specification. In the context of this chapter, conformity assessment relates to the process of determining whether people working in the electrical or safety-related control systems sectors can perform to the required level of competence. 

Turning to the field of safety-related control systems, a significant initiative in the UK is the development of a scheme known as the conformity assessment of safety-related systems (CASS), already mentioned in Chapter 13. The initiative, which is supported by the DTI under its sector challenge programme and which will be championed and implemented by a UKAS-accredited company known as CASS Scheme Ltd, is concerned with conformity assessment for systems based on the aforementioned standard lEC 61508. The scheme has a broad scope and covers all those involved in the design, development, manufacture, implementation, support and application of complete safety-related systems and their components. 

Risk and System Integrity Concept for R Ball and D Reinert - Butterworth Safety Related Control Systems" Heinemann... 

The other type of system is a safety-related control system, which controls the EUC (rather than shutting it down) such that the risk associated with EUC hazards is kept to a tolerable level. In this case the objective of the SRS is risk control. Version 2 of lEC 61508 is much clearer about the application of risk reduction to protection systems and risk control to continuously operating control systems. Of course, a given EUC could have both a safety-related control system and a protection system depending on the degree of risk presented by the EUC before the SRSs are put in place. 

Close attention to detail is essential in the design of all safety-related control systems, whether they are simple hard-wired systems, or complex systems implemented by software. It is important that safety analysis techniques are used to ensure that the requirements in the specification are met, and that the foreseeable failure modes of the control system do not compromise that specification. Issues of concern, which have been identified, include an over-optimistic dependence on the safety integrity of single channel systems, failure to adequately verify software, and poor consideration of human factors. Good design can also eliminate, or at least reduce, the chance of error on the part of the operator or maintenance technician. ... 

---