Risk Assessment Methodologies. Michele M. Silva Solution Architect, Safety & Security Functional Safety Engineer (TUV Rheinland)

Risk Assessment Methodologies Michele M. Silva Solution Architect, Safety & Security Functional Safety Engineer (TUV Rheinland)

North America and European Standards All functional safety standards are used to demonstrate compliance to global, regional and sometimes, national legal requirements Two examples we will discuss are: North America OSHA European Directives, specifically Machinery Directive Three types of Standards A Standards basic concepts principles for design general aspects B Standards B1 - safety distances, surface temps, noise B2 - components or devices C Standards vertical standards covering a single type of machine or group of machines. Use A and B standards to create C standards. PUBLIC Copyright 2018 Rockwell Automation, Inc. All Rights Reserved. 3

Standards Risk Assessment Risk Assessment standards and methodologies include: ANSI RIA R15.06-1999 (R2009) - Safety Requirements for Industrial Robots and Robot Systems ANSI / RIA TR R15.306-2016 (Technical Report) ANSI B11.TR3 - Risk Assessment Technical Report ANSI ISO 12100:2010 - Safety of machinery - General principles for design - Risk assessment and risk reduction IEC 61508 - Functional Safety ISO 13849 - Safety of Machinery - Safety Related Parts of Control Systems IEC 62061-2005 - Functional Safety of safety-related electrical, electronic and programmable control systems PUBLIC Copyright 2018 Rockwell Automation, Inc. All Rights Reserved. 4 4

Relationship of OSHA Standards Machine Maintenance Regulation: Lockout / Tagout per CFR 1910.147 Requirement: Release stored energy Tasks: Isolation of Mechanical / Electrical Equipment for Service and Maintenance Production Operation Regulation: Machine Guarding per CFR 1910 Subpart O Requirement: Protect operators from machine production hazards Tasks: Operator Interaction for Regular Machine Production Minor Service Exception to Lockout Tagout Must provide alternative Measures that offer effective protection Minor Servicing Exception Regulation: Machine Guarding per Subpart O Requirement: Protect operators from machine production hazards when performing minor servicing Tasks: Minor servicing such as clearing minor jams, minor tool changes & adjustments, exchange of work piece, etc. Minor servicing must be routine, repetitive and integral to the operation PUBLIC Copyright 2018 Rockwell Automation, Inc. All Rights Reserved. 5

EN 954 vs EN/ISO 13849 ISO 13849-1 Replaces EN 954 Qualitative Quantitative Structure (Categories) MTTF d Diagnostic Coverage (DC) Common Cause Failures (CCF) Software Systematic Failure Behavior Under Fault conditions Environmental EN 954 was basically a Qualitative approach. Time & Component Reliability are Quantitative aspects which must now be considered when developing a safety control system using EN/ISO 13849-1. PUBLIC Copyright 2018 Rockwell Automation, Inc. All Rights Reserved. 6

Are Risk Assessments Required? References other consensus standards for safety NFPA NFPA 79 Safety circuit based on Risk Assessment B11.19 Safeguarding shall be based on assessment OSHA ANSI ISO ISO 13849 Risk Assessment based Safety Parts of Control System design ANSI-RIA R15.06 Robotics controls require assessment PUBLIC Copyright 2018 Rockwell Automation, Inc. All Rights Reserved. 9

Risk Assessment Risk Assessment is the basis of risk reduction Process of risk analysis and risk evaluation A control system is a common risk reduction method When a control system is used, you must follow the iterative design process of the safety-related parts of a control system (SRP/CS) ISO 13849-1 is an iterative design process ISO 13849-1:2015; Figure 1 PUBLIC Copyright 2018 Rockwell Automation, Inc. All Rights Reserved. 10

Risk Assessment Risk assessment performed as if existing safeguards are NOT in place A comprehensive risk assessment includes all hazard types and tasks Task based risk assessment identifies hazards based upon real machine interaction Shows Due Diligence and Global Compliance (Ref. ISO 12100) Provides Safety Performance Level Design Target Creates the Foundation of the Safety System Functional Requirements, System Design and Validation Protocol PUBLIC Copyright 2018 Rockwell Automation, Inc. All Rights Reserved. 11

Risk Definition Probability of Occurrence R I S K Is a function of Severity of Harm And - Exposure of Person to Hazard - Occurrence of Hazardous Event - Possibility to Avoid or Limit Harm Only changes with design ANSI/ISO 12100: 2012; Figure 3 PUBLIC Copyright 2018 Rockwell Automation, Inc. All Rights Reserved. 12

Risk Assessment Sources of Mechanical Hazard Conveyor Belt Bottle Side Belt Sleeve Indexer Sleeve Cutter Vacuum Pump Operator doing Normal Operating Tasks on the Machine Possible injuries the Operator may sustain and Risk Level for each Risk Reduction Methods are identified A Control System for Risk Reduction = Safety Function PUBLIC Copyright 2018 Rockwell Automation, Inc. All Rights Reserved. 14

Risk Estimation (ISO 13849-1) Severity and probability data from the Risk Assessment is needed ISO 13849-1, Annex A Risk Reduction by Safety Related Parts of the Control System Shows a risk graph scoring technique to identify Performance Levels (a, b, c, d & e) As risk increases, safety performance of the control system must increase S1 & S2 Severity of Injury (Slight or Serious) F1 & F2 Frequency and/or Exposure (Seldom or Frequent) P1 & P2 Possibility of Avoidance (Possible or Not Possible) RISK ISO 13849-1:2015; Figure A.1 PUBLIC Copyright 2018 Rockwell Automation, Inc. All Rights Reserved. 16

Risk Estimation (HRN system) There are numerous ways of assessing risk involved with a hazard, one of which is the Hazard Rating Number system. In this technique, numerical values are assigned to descriptive phrases relating to... The likelihood of occurrence (LO) of coming into contact with the hazard The frequency of exposure (FE) The degree of possible harm (DPH) The number of persons at risk (NP) A Hazard Rating Number is completed using the following calculation: LO x FE x DPH x NP = HRN PUBLIC Copyright 2018 Rockwell Automation, Inc. All Rights Reserved. 20

Possible Mitigation Techniques Hierarchy of Protective Measures Design it out Most Effective Fixed enclosing guard Safety-Related Parts of Control Systems (SRP/CS) Monitoring Access / Interlocked Gates Awareness Means, Training and Procedures (Administrative) Personal protective equipment Least Effective PUBLIC Copyright 2018 Rockwell Automation, Inc. All Rights Reserved. 22

Identify Safety Functions Safety Function = Control system for risk reduction List each hazardous energy source and triggering event possibility SF6 SF1-5 SF1 SF2 SF3 SF4 SF5 SF6 Guard Door 1 (op side) Protective stop and prevention of restart of the conveyor when opened Guard Door 1 (op side) Protective stop and prevention of restart of the bottle feed belts when opened Guard Door 1 (op side) Protective stop and prevention of restart of the sleeve feeder when opened Guard Door 1 (op side) Protective stop and prevention of restart of the cutter when opened Guard Door 1 (op side) Unlock with conditional time delayed unlock Guard Door 2 (dr side) Protective stop and prevention of restart of the sleeve feeder opened Guard Door 2 Drive Side PUBLIC Copyright 2018 Rockwell Automation, Inc. All Rights Reserved. 24

Performance Level (PL) The Risk Assessment determines Required Performance Level (PLr) Choose the most suitable combination of : Structure (Category), Reliability (MTTFd) and Diagnostics (DC) Odds (PFHd) 1 / 10,000 1 / 100,000 1 / 1,000,000 1 / 10,000,000 1 / 100,000,000 PUBLIC Copyright 2018 Rockwell Automation, Inc. All Rights Reserved. 25