Safety Machine

Standards and Regulations
kapitel 1
1.1 General information
1.2 Regulations and Standards in the European Union (EU)
1.3 Legal requirements and Standards regarding safety
at work in the US
1.4 Safety requirements for machines in Japan
1.1 General information
Objectives even if the machine manufacturer (i.e. To realize this, proven technology is
OEM) is based in Europe. Even though required, which fulfills the demands
The goal of safety technology is to keep
the technical concepts with which safety specified by the relevant Standards. The
the potential hazards for man and the
is to be achieved, are subject to clear requirements to achieve functional safety
environment as low as possible by apply-
technical principles, it is still important to are based on the following basic goals:
ing and utilizing the appropriate technol-
observe as to whether legislation or spe-
ogy. However, this should be achieved • Avoid systematic faults,
cific restrictions apply.
without imposing unnecessary restric-
• Control systematic faults,
tions on industrial production, the use of Functional safety
machines and the production of chemi- • Control random faults or failures.
From the perspective of the object to be
cals. By applying internationally harmo-
protected, safety cannot be segregated. The measure for the level of achieved
nized regulations, man and the environ-
The causes of hazards and the technical functional safety is the probability of the
ment should be protected to the same
measures applied to avoid them can dif- occurrence of dangerous failures, the
degree in every country. At the same
fer widely. This means that a differentia- fault tolerance and the quality which
time, differences in competitive environ-
tion is now made between various types should be guaranteed by avoiding sys-
ments, due to different safety require-
of safety, e.g. by specifying the cause of tematic faults. In the Standards, this is
ments, should be eliminated.
the potential hazard. For instance, the expressed using various terms. In IEC
In the various regions and countries term “electrical safety” is used if protec- 61508: “Safety Integrity Level” (SIL), in
around the globe, there are different con- tion has to be provided against electrical EN 954: “Categories” and in DIN V
cepts and requirements when it comes hazards, or the term “functional safety” 19250 and DIN V VDE.
to guaranteeing safety. The legal con- is used if the safety is dependent on the 0801: “Requirement classes” (AK).
cepts and the requirements regarding correct function.
what has to be proven and how, as to Standardization goals
This differentiation is now reflected in
whether there is sufficient safety, are
the most recent Standards, in so much The demand to make plant, machines
just as different as the assignment of the
that there are special Standards which and other equipment as safe as possible
levels of responsibility.
are involved with functional safety. The using state-of-the-art technology comes
For example, in the EC, there are require-
area of machinery safety EN 954 deals from the responsibility of the manufac-
ments, placed both on the manufacturer
specifically with safety-relevant parts of turers and users of equipment for their
of a plant or system as well as the oper-
control systems and therefore concen- safety. All safety-significant aspects of
ating company which are regulated using
trates on the functional safety. The IEC using state-of-the-art technology are
the appropriate European Directives,
handles functional safety of electrical, described in the Standards. By maintain-
Laws and Standards.
electronic and programmable electronic ing and fulfilling these standards, it can
On the other hand, in the US, require-
systems, independent of any specific be ensured that state-of-the-art technol-
ments differ both at a regional and even
application in the pilot Standard IEC ogy is applied therefore ensuring that the
at a local level. However, throughout
61508 . company erecting a plant or the manu-
the US, there is a basic principle that an
facturer producing a machine or a device
employer must guarantee a safe place of In IEC 61508, functional safety is defined
has fulfilled his responsibility for ensuring
work. In the case of damage, as a result as “part of the overall safety relating to
safety.
of the product liability, the manufacturer the EUC* and the EUC control system
can be made liable due to the associa- which depends on the correct function- Note: The Standards, Directives and
tion with his product. On the other hand, ing of the E/E/PE** safety-related sys- Laws, listed in this Manual are just a
in other countries and regions, other prin- tems, other technology safety-related selection to communicate the essential
ciples apply. systems and external risk reduction facili- goals and principles. We do not claim
ties”. In order to achieve functional safety that this list is complete.
What is important for the manufacturers
of a machine or a plant, the safety-rele-
of machines and plant construction com-
vant parts of the protective and control
panies is that the legislation and rules of
devices must function correctly, and,
the location always apply in which the
when a fault or failure occurs, the plant
machine or plant is being operated. For
or system must remain in a safe condi-
instance, the control system of a
tion or be brought into a safe condition.
machine, which is operated and used in
the US, must fulfill US requirements,
* EUC: Equipment under control

** E/E/PE: Electrical, electronic,
programmable electronic
1/2 Safety Integrated Application Manual Siemens AG

1.2 Regulations and Standards
in the European Union (EU)
1
The EC Directives, which are associ- The list of EC Directives with the asso-
1.2.1 Basic principles of ated with implementing new products, ciated lists of harmonized standards is
European legislation* are based on a new global concept provided in the Internet under:
(“new approach” , “global approach”):
Legislation states that we must focus http://www.NewApproach.org/
our efforts “... on preserving and pro- • EC Directives only contain general
directiveList.asp
tecting the quality of the environment, safety goals and define fundamental
and protecting human health through safety requirements.
Low-Voltage Directive
preventive actions” (Council Directive • Standards Committees, which have
96/82/EC “Seveso II”). The Low-Voltage Directive (73/23/EC)
received an appropriate mandate
applies to electrical equipment with
It also demands “Health and safety at from the EC Commission (CEN,
rated voltages in the range between
the workplace” (Machinery Directive, CENELEC), can define technical
50 and 1000 V AC or between 75 and
workplace, health and safety legisla- details in the Standards. These
1500 V DC (for the revision presently
tion, ...).Legislation demands that this Standards are harmonized under a
being carried-out, it is possible that the
and similar goals are achieved for vari- specific Directive and are listed in the
lower voltage limits may be omitted).
ous areas (“Areas which are legis- Official Journal of the EC. When the
This is a New Approach Directive.
lated”) in the EC Directives. In order to harmonized standards are fulfilled,
EN 60204-1 is listed under the Low-
achieve these goals, legislation places then it is assumed that the associ-
Voltage Directive for “Electrical equip-
demands on the operators and users ated safety requirements of the
ment of machines” . This means, that if
of plant, and the manufacturers of directives are also fulfilled (for more
EN 60204-1 is fulfilled, then it can be
equipment and machines. It also detailed information, refer to Section
reasonably assumed that the Directive
assigns the responsibility for possible 1.2.3 “Safety of Machinery”)
is fulfilled.
injury or damage. • Legislation no longer specifies that
(Note: The requirements to fulfill the
The EC Directives specific standards have to be met.
Low-Voltage Directive are not dis-
However, it can be “reasonably
• Specify demands placed on plant cussed in any more detail in this Man-
assumed” that when specific stan-
and systems and their ual.)
dards are observed, the associated
operators/users to protect the health safety goals of the EC Directives are
and safety of personnel and environ- fulfilled.
mental quality; 1.2.2 Health and safety
• EC Directives specify that Member at the workplace in the
• Contain regulations about health and States recognize each other's
safety at the workplace (minimum national regulations and laws.
EC
requirements);
The EC Directives have the same
• Define product features and charac- The requirements placed on health and
degree of importance, i.e. if several
teristics to protect the health and safety at the workplace are based on
Directives apply for a specify piece of
safety of users; Article 137 (previously 118a) of the EC
equipment or device, then the require-
Contract. The Master Directive “Health
• Make a differentiation between ments of all of the relevant Directives
and Safety of Personnel at the Work-
requirements placed on the realiza- have to be met (e.g. for a machine
place” (89/391/EC) specifies minimum
tion and implementation of products with electrical equipment, the Machin-
requirements for safety at the work-
to guarantee free trade and the ery Directive, and Low-Voltage Direc-
place. The actual requirements are sub-
requirements regarding the use of tive apply).
ject to domestic legislation and can
products. Other regulations apply to equipment exceed the requirements of these
where the EC Directives are not applic- Master Directives. The requirements
able. They include regulations and crite- involve the operation of products (e.g.
ria for voluntary tests and certifica- machines), and not with their imple-
tions. mentation.
* Note: The EFTA countries have

decided to adopt the EC concept.
Safety Integrated Application Manual Siemens AG 1/3

1.2.3 Safety of Machinery Machinery Directive
in Europe Application area, sel- Certification CE marking, Coming into
ling, marketing, free- procedure protection against force, transitional
Machinery Directive (98/37/EC)* dom of movement, arbitrary regulations,
health and safety fulfillment cancellation of
With the introduction of a common requirements the regulations
European market, a decision was Art.1 – Art. 7 Art. 8 – Art. 9 Art. 10 – Art. 12 Art. 13 – Art. 14
made to harmonize the national stan- Annex Article
dards and regulations of all of the EC
Member States. This meant that the Essential health and safety requirements relating to the
Machinery Directive, as an internal design and construction of machinery, and 3
• interchangeable equipment 5
Directive, had to be implemented in • safety components 10
the domestic legislation of the individ-
ual Member States. In Germany, the Contents of
contents of the Machinery Directive II 1. EC Declaration of Conformity for 4
were implemented as the 9th Decree machinery, and 5
• interchangeable equipment 8
of the Equipment Safety law. For the • safety components
Machinery Directive, this was realized
with the goal of having unified protec- 2. Manufacturer's declaration for 4
tive goals and to reduce trading barri- – specific components of the machinery
– non-functioning machines
ers. The area of application of the
Machinery Directive corresponds to its III CE marking 10
definition “Machinery means an
IV Types of machinery and
assembly of linked parts or compo- safety components, where
nents, at least one of which moves...” the procedure acc. to Article 8
which encompasses a wide scope. must be applied.
With the Change Directives, the area
of application has been subsequently V EC Declaration of conformity for
machinery, and 8
extended to “safety components” and • interchangeable equipment
“interchangeable equipment.” The • safety components
Machinery Directive involves the
implementation of machines. VI EC type examination for
machinery and 8
“Machinery” is also defined as an • interchangeable equipment
assembly of machines which, in order • safety components
to achieve the same end, are arranged VII Minimum criteria for testing bodies 9
and controlled so that they function as
an integral whole".. Fig. 1/1
Overview of the Machinery Directive
The application area of the Machinery
Directive thus ranges from a basic In selecting the most appropriate b) "When selecting the appropriate
machine up to a complete plant. methods, the manufacturer must apply solutions, the manufacturer must apply
The Machinery Directive has 14 Arti- the following principles, in the order the following basic philosophy, and
cles and 7 Annexes. given (Annex I Paragraph 1.1.2): more specifically in the specified
sequence:
The basic health and safety require- a) “The machine design must guaran-
ments in Annex I of the Directive are tee that operation, equipping and • Eliminate or reduce the risks as far as
mandatory for the safety of machinery. maintenance, when the machine is possible (integrating the safety con-
correctly used, does not represent any cept into the development and the
potential danger to personnel.” construction of the machine);
“The measures must exclude any risk • Take the necessary protective mea-
of accident...” sures against risks that cannot be
eliminated;
* replaces 89/392/EC, 91/368/EC,

93/44/EC, 93/68/EC.

1
• Inform users of the residual risks due
Types of machinery and safety components, for which the procedure
to any shortcomings of the protection
referred to in Article 8, Paragraph 2, Letters b) and c) must be applied.
measures adopted.
A. Machinery The protection goals must be responsi-
1. Circular saws (single or multi-blade) for working with wood and analogous materials bly implemented in order to fulfill the
or for working with meat and analogous materials demand for conformance with the
1.1. Swing machines with fixed tool during operation, having a fixed bed with Directive.
manual feed of the workpiece or with a demountable power feed.
1.2. Sawing machines with fixed tool during operation, having a manually The manufacturer of a machine must
operated reciprocating saw-bench carriage prove that the basic requirements have
1.3. Sawing machines with fixed tool during operation, having a built-in been fulfilled. This proof is made easier
mechanical feed device for the workpieces, with manual loading and/or unloading by applying harmonized standards.
1.4. Sawing machines with movable tool during operation, with a mechanical feed device
and manual loading and/or unloading A certification technique is required for
2. Hand-fed surface planing machines for woodworking machines listed in Annex IV of the
3. Thicknesses for one-side dressing with manual loading and/or Machinery Directive, which represent a
unloading for woodworking more significant hazard potential. (Rec-
4. Band-saws with fixed or mobile bed and band-saws with a mobile carriage, ommendation: Machinery, which is not
with manual loading and/or unloading, for working with wood and analogous materi- listed in Annex IV, can also represent a
als or for working with meat and analogous materials high potential hazard and should be
5. Combined machines of the types referred to in 1 to 4 and 7 for working with wood appropriately handled.) The precise
and analogous materials
“technique to define whether compli-
6. Hand-fed tenoning machine with several tool holders for woodworking
ance exists” with the goals, is defined
7. Hand-fed vertical spindle molding machines for working with wood in Chapter II of the Directive.
and analogous materials
8. Portable chain saws for woodworking
Standards
9. Presses, including press-brakes, for the cold working of metals, with manual loading
and/or unloading, whose movable working To sell, market or operate/use products,
parts may have a travel exceeding 6 mm and a speed exceeding 30 mm/s these products must fulfill the basic
10. Injection or compression plastic-molding machines with manual loading safety requirements of the EC Direc-
or unloading
tives. Standards can be extremely help-
11. Injection or compression rubber-molding machines with manual loading
or unloading ful when it involves fulfilling these
12. Machinery for underground working or the following types:
safety requirements. In this case, a dif-
– machinery or rails: Locomotives and brake-vans ferentiation must be made between
– hydraulic-powered roof supports harmonized European Standards and
– internal combustion engines to be fitted to machinery for underground working other Standards, which although are
13. Manually-loaded trucks for the collection of household refuse incorporating a com- ratified, they have still not been harmo-
pression mechanism nized under a specific Directive, as well
14. Guards and detachable transmission shafts with universal joints as described in Sec- as other technical rules and regulations
tion 3.4.7.. which are also known as “National
15. Vehicle-servicing lifts Standards” in the Directives.
16. Devices for the lifting of persons involving a risk of falling from a
vertical height of more than 3 meters Ratified Standards describe recognized
17. Machines for the manufacture of pyrotechnics state-of the-art technology. This means,
that by proving that he has applied
B. Safety components them, a manufacturer can prove that he
1. Sensor-controlled devices to detect persons has fulfilled what is a recognized state-
e.g. light barriers, sensor mats, electromagnetic detectors of-the-art technology.
2. Logic units which ensure the safety functions of bimanual
controls Generally, all Standards, which have
3. Automatic movable screens to protect the presses referred to been ratified as European standards,
in 9, 10 and 11 (Letter A) must be included, unchanged in the
4. Rollover protection structures (ROPS) domestic (national) Standards of the
5. Falling-object protective structures (FOPS)
Fig. 1/2
Annex IV of the Machinery Directive

Basic safety standards Type
A Standards
Basic design principles

and terminology for machines
Group safety standards Type

B Standards
B1 Standards B2 Standards
General safety Reference to special
aspects protective devices
Specialist Type C Standards

Standards
Special safety features for
individual machine groups
Fig. 1/3
European Standards for Safety of Machinery
Member States. This is independent of EN 61508. The German Draft Stan- ties. These Standards (EN Standards)
whether they are harmonized under a dards DIN V VDE 0801 and DIN V are then transferred into the national
particular Directive or not. Existing 19250 and 19251 will therefore be standards unchanged.
National Standards, handling the same withdrawn by August 2004.
They are used to fulfill the basic health
subject, must then be withdrawn.
and safety requirements and the pro-
Thus, within a period of time in Harmonized European Standards
tective goals specified in Annex I of
Europe, a unified set of regulations will
These are drawn up by the two stan- the Machinery Directive.
be created (without any contradic-
dards organizations CEN (Comité
tions). DIN and DKE are the contact
Européen de Normalisation) and CEN-
partners for CEN / CENELEC .
Note: IEC 61508 is an important Stan- ELEC (Comité Européen de Normalisa-
dard which has not been harmonized tion Électrotechnique) as mandate By fulfilling such harmonized stan-
under a particular EC Directive - “Func- from the EC Commission in order to dards, there is an “automatic presump-
tional safety of electrical/electronic/pro- fulfill the requirements of the EU tion of conformity,” i.e. the manufac-
grammable electronic safety-related Directives for a specific product, which turer can be trusted to have fulfilled all
systems”, as there is no appropriate must be published in the official Coun- of the safety aspects of the Directive
harmonized standard. It is ratified as cil Journal of the European communi- as long as they are covered in the par-

1
Note for users:
If harmonized C Standards exist for the particular product, then
the associated B and if relevant, also the A Standards can be
EN 292 considered as secondary.
Safety of Machinery
Basic terminology, general Type A
design principles Basic safety
standards
EN 1050
Safety of Machinery
Principles of risk assessment
Minimum Safety- Safety clear- Electrical Safety of

Type B1
clearances relevant ances against equipment machines Higher-level
to prevent parts of accessing of inter-latching safety aspects
parts of the control dangerous machines devices with
body being systems locations with and without
crushed the upper limbs tumbler
EN 349 EN 954 EN 294 EN 60204-1 EN 1088

Type B2
Requirements for
Two-hand Emergency stop equipment, functional Light barriers,
circuit aspects – design guidelines – light curtains safety related devices
EN 574 EN 418 EN 61496-1
Elevators Injection molding machines Presses + sheers Numerically Type

Typ-CC
EN 692 controlled lathes -–Specialist
Fachnormenstan-
–
EN 81-3 EN 201 EN 693 EN 12415, EN 12418
dards – Specific
Spezifische
requirements
Anforderungen
etc. on
an specific
bestimmte
machines
Maschinen
Also refer to Section 8 – List of harmonized standards
ticular Standard. However, not every • A Standards, Type A Standards primarily address
European Standard is harmonized in also known as Basic Standards. those parties setting B and C Stan-
this sense. The listing in the European dards. The techniques for minimizing
• B Standards,
documentation is definitive The latest risks, specified there, can, however,
also known as Group Standards.
versions can be found in the Internet also be helpful for manufacturers if
(address: • C Standards, there are no relevant C Standards.
http:// www.NewApproach.org/ also known as Product Standards.
Type B Standards/Group Standards
directiveList.asp).
The diagram above shows the struc-
These include all Standards with
The European Standards for the safety ture.
safety-related statements, which can
of machinery are hierarchically struc-
Type A Standards/Basic Standards involve several types of machines.
tured as follows
Type A Standards contain basic termi- Type B Standards also primarily
nology and definitions for all machines. address those parties setting C Stan-
This includes EN 292 “Safety of dards. However, they can also be help-
machinery - Basic concepts, general ful for manufacturers
principles for design.”

when designing and constructing In order to provide a method to harmo- Risk evaluation/assessment
machinery if there are no relevant C nize the basic requirements of the
As a result of their general design and
Standards. Directive, with the mandate of the EC
functionality, machines and plants rep-
commission, harmonized standards
For B Standards an additional subdivi- resent potential risks. Therefore, the
were drawn-up in the technical com-
sion was made: Machinery Directive requires a risk
mittees of the CEN and CENELEC for
assessment for every machine and, if
Type B1 Standards for higher-level machinery or machinery groups for
relevant, risk reduction, so that the
safety aspects, e.g. ergonomic design almost all areas. Drawing-up the stan-
remaining risk is less than the tolerable
principles, safety distances from dards essentially involves representa-
risk. The following Standards should be
potential sources of danger, minimum tives of the manufacturer of the partic-
applied for the technique to assess
clearances to prevent crushing of body ular machinery, the regulatory bodies,
these risks:
parts. such as Trade Associations as well as
users. An overview of the most impor- • EN 292 “Safety of machinery – Basic
Type B2 Standards for safety equip-
tant type A, B and C standards is pro- concepts, general principles for
ment are specified for various machine
vided in Section 8. A complete list of design” and
types, e.g. EMERGENCY STOP equip-
all of the listed Standards as well as
ment, two-hand controls, • EN 1050 “Safety of machinery – Prin-
the activities associated with Stan-
interlocking/latching, non-contact pro- ciples for risk assessment”
dards - with mandate - are provided in
tective devices, safety-related parts of
the Internet under: EN 292 mainly handles the risks to be
controls.
evaluated and design principles to
http://www.NewApproach.org/ reduce risks. EN 1050 basically han-
Type C Standards/Product Stan-
directiveList.asp dles the iterative process with risk
dards
assessment and risk reduction to
Recommendation: Technology is pro-
These involve the machinery-specific achieve safety.
gressing at a tremendous pace which
Standards, e.g. for machine tools,
is also reflected in changes made to
woodworking machines, elevators, Risk assessment
machine concepts. For this reason,
packaging machines, printing machines
especially when using Type C Stan- Risk assessment is a sequence of
etc.
dards, they should be checked to steps, which allows hazards, which are
The European Standards are structured ensure that they are up-to-date. It caused by machines, to be systemati-
so that general statements which are should also be noted that it is not cally investigated. Where necessary,
already included in type A or type B mandatory to apply the standard but the risk assessment phase is followed
standards are not repeated. Refer- instead, the safety objective must be by risk reduction. The interactive
ences to these are made in type C achieved. process (refer to Graphic 1/5) is
Standards obtained by repeating this procedure.
National Standards This allows potential hazards to be
Product Standards include machinery-
removed as far as possible, and allows
specific requirements. These require- If harmonized European Standards are
the appropriate protective measures to
ments, under certain circumstances, not available, or they cannot be applied
be taken
deviate from the Basic and Group for certain reasons, then the manufac-
Standards. For machinery OEMs, type turer can utilize “National Standards.”All The risk assessment includes:
C Standard/Product standards have the of the other technical rules fall under
• Risk analysis
highest priority. They (the machinery this term, e.g. also the accident pre-
a) Determining the limits of the ma-
OEMs) can then assume that they ful- vention regulations and standards,
chine (EN 292, EN 1050 Paragraph 5)
fill the basic requirements of Annex I which are not listed in the European
b) Identification of hazards (EN 292,
of the Machinery Directive (automatic Council Journal (also IEC or ISO Stan-
EN 1050 Paragraph 6)
presumption of conformity). dards which were ratified as EN). By
c) Techniques to estimate risks (EN
If there is no Product Standard for a applying ratified standards, the manu-
1050 Paragraph 7)
particular machine, then Type B Stan- facturer can prove that recognized
dards can be applied for orientation state-of-the-art technology was ful- • Risk evaluation (EN 1050 Paragraph 8)
purposes when constructing machin- filled. However, when such standards
After risks have been estimated, a risk
ery. are applied, the above mentioned
evaluation is made as part of an itera-
“automatic presumption of confor-
tive process to achieve safety. In this
mity” does not apply.
case, a decision has to be made

1
Risk is a Severity and Probability of OCCURRENCE of
function that harm
related to the of of the possible
considered hazard harm for the Frequency and duration of
considered hazard exposure
Probability of occurrence of
hazardous event
Possibility to avoid or limit

the harm
Fig. 1/4
Risk elements
START
Determine the machine limits
Identify the hazard Risk analysis Risk assessment
Risk estimation
Risk evaluation
YES
Is the machine safe? END
NO
Reduce risk
Risk reduction and the selection of appropriate safety measures are not part of the risk assessment
For a further explanation, refer to Section 5 of EN 292-1 (1991) and EN 292-2.
Fig. 1/5
Iterative process to achieve safety in accordance with EN 1050

whether it is necessary to reduce a
risk. If the risk is to be further reduced,
suitable protective measures must be Category
selected and applied. The risk evalua- B 1 2 3 4
tion must then be repeated. S1
If the required degree of safety has
still not been reached, measures are Starting point for P1
estimating the risk F1
required to further reduce the risk. of the safety-related
The risk must be reduced by suitably part of the control P2
designing and implementing the S2
machine. For instance, using suitable P1
control or protective measures for the F2
P2
safety functions (also refer to the Sec-
tion “Requirements of the Machinery
Directive”). If the protective measures S Severity of the injury
S1 Slight (normally reversible) injury
involve interlocking or control func- S2 Severe (normally irreversible) injury including death
tions, then these must be configured F Frequency and/or exposure time to the hazardous condition
F1 Seldom up to quite often and/or the exposure time is short
in accordance with EN 954. When F2 Frequent up to continuous and/or the exposure time is long
using electronic controls and bus sys- P Possibility of avoiding the hazard
P1 Possible under specific conditions
tems to implement these protective P2 Scarcely possible
measures, then, in addition, IEC / EN Selecting the category
61508 must also be fulfilled. B, 1 to 4 Categories for safety-related parts of control systems
Preferred categories for reference points
Standard EN 1050 calls this operation Possible categories requiring further steps
an iterative process to achieve safety Measures which can be over-dimensioned for the relevant risk
(refer to Fig. 1/5).
Risk elements are defined as a sup- Fig. 1/6
port tool to evaluate risks. Graphic 1/4 Possible selection of the Categories in accordance with EN 954-1
shows the inter-relationship between
these risks elements.
are described in EN 954-1 and, for whether the requirements of the
Residual risk (EN 1050) complex control systems with pro- selected Category have been fulfilled.
grammable electronics, in IEC 61508. The control must be validated. The
Safety is a relative term in details of how this validation process
our technical environment. Unfortu- The requirements placed on safety-rel-
is actually carried-out and what has to
nately, it is not possible to implement evant parts of control systems are
be taken into account is described in
the so-called “zero risk guarantee” classified in categories according to
Section 2 of EN 954. Presently, this
where nothing can happen under any the level of risk. Techniques to select a
section is available as Draft prEN954-2.
circumstances. The residual risk is suitable Category as reference point
defined as: Risk, which remains after for configuring the various safety- The adjacent table shows a brief sum-
the protective measures have been related parts of a control system are mary of the requirements for the vari-
implemented. recommended in Annex B of EN 954-1 ous categories. The complete text of
In this case, protective measures rep- (refer to Fig. 1/6). A detailed concept to the requirements is contained in EN
resent all of the measures to reduce evaluate the risk and to determine the 954-1 “Safety-related parts of control
risks. necessary requirements placed on the systems”, Section 6 “Categories”. Basic
control system are presently drawn-up requirements for configuring control
Reducing risks in the form of Draft IEC 62061. It is systems are defined in the various cat-
important that all of the parts and com- egories. These are intended to make
In addition to applying structural mea- ponents of the controls, which are the systems tolerant to hardware fail-
sures, risk reduction for a machine can involved in implementing the safety- ures.
also be realized using safety-relevant relevant function fulfill these require-
control functions. For these control Additional aspects must be taken into
ments.
functions, special requirements must consideration for more complex control
be observed, which are classified After the control has been imple- systems, especially programmable
according to the level of risks. These mented, it is necessary to check electronic systems, so that

1
• random hardware failures can be
Category1) Summary of requirements System behavior2) Principles to
controlled, achieve safety
• systematic errors/faults in the hard-
ware and software are avoided B Safety-related parts of control The occurrence of a fault
systems and/or their protective- can lead to the loss of
• systematic errors/faults in the hard- equipment, as well as their com- the safety function
ware and software can be controlled, ponents, shall be designed, con-
structed selected, assembled and
and sufficient functional safety is combined in accordance with rele-
achieved for safety-critical tasks. The vant standards so that they can
withstand the expected influence. Mainly
necessary requirements are described characterized by
in the International IEC 61508 Standard selection of
(the previous DIN V VDE 0801 will be components
1 Requirements of B shall The occurrence of a
withdrawn in August 2004 as part of apply.Well-tried components and fault can lead
the European harmonization of well-tried safety principles to the loss of
shall be used. the safety function
EN 61508) and for contactless protec- but the probability
tive devices such as light arrays or of occurrence is
laser scanners IEC / EN 61496-1. The lower than for
Category B.
scope of the required measures is also
graded corresponding to the risk 2 Requirements of B and the use – The occurrence of a
reduction required. of well-tried safety principles fault can lead to the
shall apply. loss of the safety
In order to support the implementation The safety function shall be function between
and application of these systems, checked at suitable intervals by the checks.
the machine control system.
presently, other standards are being – The loss of the
developed with IEC 62061 “Safety of safety function
Machinery – Functional safety of is detected by
the check.
safety-related electrical, electronic and
programmable electronic control sys- 3 Requirements of B and the use – When the single
tems ” and IEC 61800-5-2 of well-tried safety principles fault occurs, the
“Adjustable speed electrical power shall apply. safety function is
Safety-related parts shall be always performed.
drive systems - functional safety designed, so that: – Some but not Mainly
requirements.” – a single fault in any of these all faults will characterized by
parts does not lead to the loss be detected. structure
Validation of the safety function, and – Accumulation
– whenever reasonably of undetected faults
The subject of “validation” is handled practicable, the single can lead to the loss
fault is detected. of the safety function
in the Draft Standard prEN954-2
“Safety of Machinery – Safety-related
parts of control systems”. In this case, 4 Requirements of B and the use – When the faults
validation means that the safety func- of well-tried safety principles occur, the safety
shall apply. function is always
tionality to be achieved is checked and Safety-related parts shall be performed.
evaluated. This Standard corresponds designed so that: – The faults will be
to the status of a B1 safety group – a single fault in any of these detected in time to
parts does not lead to a loss prevent the loss of
Standard (general safety aspects). The of the safety function and the safety function.
purpose of the validation is to confirm – the single fault is detected at or
the definitions and level of conformity before the next demand upon
the safety function. If this is not
of the safety-related parts of the con- possible, then an accumulation of
trols within the overall definition of faults shall not lead to a loss
safety requirements on the machinery. of the safety function
1)
The categories are not intended to be used in any given order or in any given hierarchy in respect of
safety requirements.
Fig. 1/7 2)
The risk assessment will indicate whether the total or partial loss of the safety function(s) arising from
Description of the requirements for the faults is acceptable.
Categories in accordance with EN 954-1

The validation must show that every
safety-related part or component ful- START
fills the requirements laid down in
EN 954-1. The following aspects are
described: Fault list Considerations when designing Validation plan Validation principle
• Validation using analysis

• Validation using testing Documents Analysis
• Fault lists
Is the analysis
• Validation of safety functions Criteria for excluding faults
adequate?
NO NO
• Validation of categories
• Validation of the environment Test
requirements YES
• Validation of the service/maintenance Is the test

complete?
requirements
YES
An overview of the validation tech-
nique in compliance with EN 954-2 is Validation report
shown in Fig. 1/8.

The validation plan must identify and
END
describe the requirements to carry-out
the validation technique for the defined
safety functions and their categories. Fig. 1/8
Where appropriate, it must also docu- Overview of the validation process (from prEN 954-2)
ment these. Fig. 1/9 illustrates the
Documentation requirements Category for which
requirements placed on the documen- documentation is required
tation corresponding to the various
Categories. B 1 2 3 4
Basic safety principles X X X X X

The requirements, described in EN
954-1, are not adequate for systems Stressing expected in operation X X X X X
utilizing programmable electronic sys-
Influence of the material being processed X X X X X
tems. This is the reason that EN 954-2
specifies that additional standards, e.g. Performance during other relevant external influences X X X X X
the IEC 61508 or contactless protec- Proven components – X – – –
tive devices, IEC 61496 are used for
validation. Proven safety principles – X X X X
These extensive requirements refer to The test technique for safety function(s) – – X – –
the development and implementation Defined test internals – – X – –
of controls, not to the application and
Individual faults which can be predicted and have been taken – – X X X
parameterization of certified systems, into account in the design and the detection technique applied
Simatic S7-300F, Sinumerik Safety Inte-
grated, Siguard Laser Scanner and All identified faults with a common cause and how they can – – – X X
be prevented
Light Curtains, PROFIsafe or AS-i
Safety at Work. How the safety function is maintained for each fault/error – – – X X
Faults which are to be detected – – X X X
Various fault groups which must be taken into account – – – X X

in the design
How the safety function should be maintained for all – – – – X

combinations of faults
Fig. 1/9
Documentation requirements (from prEN 954-2)

1
Safety Integrated Stop category 0 EMERGENCY SWITCHING-OFF
The measures which are required to Uncontrolled stop by immediately This is an intervention (action) in an
make a complex control adequately removing the power to the machine emergency situation, which discon-
and functionally safe for safety tasks drive elements. nects power to a complete
are extremely extensive and involve system or installation or part of it,
the complete development and manu- Stop Category 1 if there is a risk of electric shock or
facturing process. Therefore, controls another risk caused by electricity
Controlled stop; the power is only
have to be specifically designed to ful- (from EN 60204-1 Annex D).
removed after the machine has come
fill safety functions. SIMATIC S7-300F /
to a standstill. Functional aspects to disconnect the
S7 400F/FH and SINUMERIK “Safety
power in an emergency situation are
Integrated” are examples of such con-
Stop Category 2 defined in IEC 60364-4-46 (this is
trol systems. This also applies to the
identical to HD 384-4-46 and VDE 0100
communication systems PROFIsafe Controlled stop, where power is still
Part 460).
and AS-i Safety at Work, PROFIBUS fed to the machine at standstill.
and AS-i which are used to transfer Power must be disconnected in an
safety-related data. Emergency operations and actions emergency situation, where
EN 60204-1/11.98 has, harmonized - Protection against direct contact
Safety-related functions
with HD 384 (IEC 60364; VDE 0100) (e.g. with contact cables, slip ring
The safety-related functions include, defined the following possible actions assemblies, switchgear in electrical
in addition to conventional functions for emergency situations (EN 60204-1 rooms) is only achieved by maintain-
Annex D): ing a clearance or barrier;
• Stop
Action in an emergency situation - Other hazards or damage could occur
• Actions in an emergency situation
includes as a result of electric power.
• Preventing accidental starting
individually, or a combination of: Further, the following is specified in
and, in the meantime, even complex 9.2.5.4.3 of EN 60204-1:
- Stopping in an emergency situation
functions, such as
(EMERGENCY STOP); In an emergency situation, the power
• State-dependent interlocking supply is disconnected from the
- Starting in an emergency situation
machine, which results in a Category 0
• Speed limiting (EMERGENCY START);
Stop.
• Position limiting - Power-off in an emergency situation
If a Category 0 Stop is not permissible
(EMERGENCY SWITCHING-OFF);
• Speed deviation, to name just a few for a machine, then it may be neces-
- Power-on in an emergency situation sary to provide other protection,
The classic functions are defined
(EMERGENCY SWITCHING-ON). e.g. against direct contact, so that
in EN 60204-1 and were, up until
power does not have to be discon-
now, generally implemented using According to EN 60204-1 and EN 418,
nected in an emergency situation.
mechanical components. Electronic these functions are exclusively initi-
programmable systems can also be ated by a conscious manual interven-
used to implement more complex tion. This means that EMERGENCY
functions, if they fulfill the relevant In the following text, only “Power-off in SWITCHING-OFF should be used
Standards (IEC 61508, EN 954). Com- an emergency situation” and “stopping where the risk analysis indicates a
plex functions, e.g. which involve the in an emergency situation” will be hazard due to electric voltage/power
behavior of variable-speed drives, are discussed. The latter fully corresponds and therefore requires that the voltage
described in draft IEC 61800-5-2. to the same terminology in the EC is immediately disconnected from the
Machinery Directive. For reasons of complete machine.
Stop
simplicity, EMERGENCY SWITCHING-
Stop categories of EN 60204-1 OFF and EMERGENCY STOP will be
used in the following.
Three stop categories are defined in
EN 60204-1 (VDE 0113 Part 1) which
define the control sequence for stop-
ping, independent of an emergency
situation:

In the EC, EMERGENCY SWITCHING- Stopping in an emergency situation Devices for EMERGENCY SWITCH-
OFF devices fall under the Low-Voltage must either be effective as a Stop, Cat- ING-OFF and EMERGENCY STOP
Directive 73/23/EC if they are not used egory 0 or Category 1 (refer to 9.2.2).
Devices which are used to stop equip-
in conjunction with machines. If they The Stop Category in an emergency
ment and machinery in an emergency
are used in conjunction with machines, situation must be defined as the result
situation must be provided at every
then they come under the Machinery of the risk evaluation for the particular
operator control location and also at
Directive 98/37/EC as is true for all of machine.
other locations where it may be neces-
the other electrical equipment associ-
sary to initiate a stop in an emergency
ated with a machine.
situation (exception: operator control
To technically implement EMER-
stations which are not connected
EMERGENCY STOP GENCY STOP corresponding to
through cables). In order to fulfill the
the recommended application
This is an action, in an emergency protective goals, specified in
in the Foreword of EN 60204-1,
situation, which is defined to stop a EN 60204-1 as well as EN 418, the
either the requirements specified
process or movement which would following requirements apply for both
in EN 60204-1 or in EN 954 and
otherwise have potentially hazardous functions (also refer to 10.7 in
IEC 61508 can be applied.
consequences (from EN 60204-1 EN 60204-1):
EN 60204-1 primarily requires
Annex D).
that this is implemented using • When contacts switch even with just
Further, the following is defined in electromechanical components, a brief actuation, the control device
9.2.5.4.2 of EN 60204-1: as “basic” (programmable) elec- must positively latch.
tronic systems are not safe
• It is not permissible that the machine
Stop enough. By correctly applying
can be restarted from a remote main
In addition to the requirements for EN 954 and, if required, IEC
operator control station without the
Stop (refer to 9.2.5.3), the following 61508, electronic and program-
hazard or danger first having been
requirements apply for an emergency mable electronic components
removed. The emergency off device
stop: become functionally safe enough
must be consciously released again
that they can also be used to
– it must have priority over all other “locally”.
implement EMERGENCY STOP for
functions and actions in all operating all categories (German National Operator control stations which are
modes; Foreword: “... this therefore clearly connected without using cables must
– the power to the machine actuators, states that electronic equipment have a dedicated and clearly identified
which could cause a hazardous con- can also be used for EMERGENCY possibility of initiating the Stop
dition or conditions must be discon- STOP devices independent of the function of the machine. The operator
nected as quickly as possible without Stop Category ...”). section, which initiates this stop
creating other hazards (e. g. using function, may not be marked or labeled
mechanical stopping/braking devices, as a device to shut down the machine
which do not require an external in an emergency situation.
supply, by using counter-current
braking for Stop Category 1); Implementing safety-related
functions
– resetting may not initiate a restart.
When implementing safety-related
control functions using programmable
electronic systems, the requirements
of EN 954 and IEC 61508 must be
fulfilled. When the requirements of
these standards are taken into
account, it is possible, to even imple-
ment complex functions by using
electronics and programmable elec-
tronic systems, for example, a fail-safe
SIMATIC or SINUMERIK. These
functions can then be implemented in
a safety-related fashion.

1
Man – Machine Color Meaning Explanation Examples of application
In order to simplify the interaction RED Emergency Actuate in the event EMERGENCY STOP,
between man and machine, reference of a hazardous condi- Initiation of EMERGENCY STOP functions,
is made to Standards EN 60073 and tion or emergency conditional for STOP/OFF
DIN EN 60204. YELLOW Abnormal Actuate in the Intervention to suppress an abnormal
event of an condition,
Switches, pushbuttons and signaling abnormal Intervention to restart an interrupted
lamps are predominantly used as condition automatic cycle
machine components as the interface
GREEN Normal Actuate to START/ON,
between man and the machine. These initiate normal however WHITE should be
operator control elements are clearly conditions or preferably used
and uniformly identified using color normal status
coding, which has a very specific sig- BLUE Mandatory Actuate for a Reset function
nificance. This guarantees that the condition requiring
mandatory action
safety of operating personnel is
increased and it is easier to handle and WHITE No specific For general START/ON (preferred),
maintain the operating meaning initiation of functions STOP/OFF
assigned except for
resources/plants and systems. GREY EMERGENCY STOP START/ON,
(see STOP/OFF
The colors of pushbuttons, the signifi- note)
cance of these colors, explanations BLACK START/ON,
and application examples are shown in STOP/OFF (preferred)
Fig. 1/10. Note: Where a supplemental means of coding (e. g. shape, position, texture) is used for the
identification of pushbutton actuators, then the same color WHITE, GREY or BLACK may be
According to DIN EN 60204-1 used for various functions , e. g. WHITE for START/ON and for STOP/OFF actuators.
(VDE 0113 Part 1) the following
Fig. 1/10
information has to be observed: Colors for pushbuttons and their significance in accordance with EN 60204-1
The preferred colors for START/ON (VDE 0113 Part 1): 06.93
operator devices should be WHITE, Color Meaning Explanation Action by operator Examples of
GREY or BLACK - preferably WHITE. application
GREEN may be used, RED may not RED Emergency Hazardous condition Immediate action to Pressure/temperature
be used. deal with a hazardous outside safe limits,
condition (e.g. by voltage drop, voltage
RED must be used for EMERGENCY operating emergency interruption, passing
STOP devices.The colors for stop) through a stop posi-
tion
STOP/OFF operator control devices
should be BLACK, GREY or WHITE -
preferably BLACK. RED is also permit- YELLOW Abnormal Abnormal condition Monitoring and/or Pressure/ temperature
ted. It is not permissible to use Impending critical con- intervention (e.g. by outside normal opera-
GREEN. dition re-establishing the ting ranges
intended function) Tripping a protective
WHITE, GREY and BLACK are the pre- device
ferred colors for pushbuttons, which
can be used alternating as START/ON GREEN Normal Normal condition Optional Pressure/temperature
and STOP/OFF pushbuttons. It is not within the normal ope-
rating ranges, permis-
permissible to use RED, YELLOW or sive signal to continue
GREEN.
BLUE Mandatory Indication of a condition Mandatory action Prompt to enter
WHITE, GREY and BLACK are the that requires action by specified values
preferred colors for pushbutton control the operator
elements which initiate an operation
while they are being pressed and end WHITE Neutral Other conditions; may Monitoring General information
that operation when they are released be used whenever
doubt exists about the
(e. g. jogging). It is not permissible to application of RED,
use RED, YELLOW or GREEN. YELLOW, GREEN,
BLUE
Fig.1/11
Colors for indicator lamps and their significance in accordance with EN 60204-1
(VDE 0113 Part 1): 06.93
GREEN is reserved for functions which It is sufficient if terminals are num- Instead of many different colors, a
display a safe or normal operating con- bered, corresponding to the informa- single color can be used for the inter-
dition. tion in the circuit diagram if the cable nal wiring. It should be color-coded as
can be visually traced. For complex follows:
YELLOW is reserved for functions
controls, we recommend that the • Black for
which display an alarm or a non-stan-
internal cables used for wiring as well Main AC and DC circuits
dard (abnormal) condition.
as the outgoing cables are coded so
• Red for
BLUE is reserved for functions which that after the cable has been discon-
AC control circuits
require a specific action. nected from the terminal, it can be
easily re-connected to the same termi- • Blue for
Reset pushbuttons must be BLUE, nal. This is also recommended for ter- DC control circuits
WHITE, GREY or BLACK. If they also minal locations which have to be dis- • Orange for
act as STOP/OFF pushbuttons, WHITE, connected when the equipment is Interlocking circuits which are sup-
GREY or BLACK are permissible - but transported. plied from an external power source.
preferably BLACK. It is not permissible
to use GREEN. Using the formulation in IEC 60204-1 The above color assignment is recom-
1997, Paragraph 14.2.1 conductor core mended if a decision is made to just
The colors of the indicating lamps, coding/identification, the Standards use color coding. The only mandatory
their significance with reference to the Committee wanted to make the fol- specification is the color coding of the
status of the machine as well as their lowing statement: protective conductor and the neutral
handling and application examples are conductor. For all other cabling and
1. Each individual cable must be able
listed in Fig. 1/11. wiring, one of the methods listed in
to be identified, however, only in
For illuminated pushbuttons, the infor- conjunction with the documenta- 14.2.4 can be selected (color, numbers
mation in Figs. 1/10 and 1/11 applies. tion. It is not necessary that every or letters; or a combination of colors
If problems are encountered when cable can be identified without and numbers or colors and letters).
assigning suitable colors, WHITE must using the documentation.
be used. For EMERGENCY STOP Protective conductor marking
2. The type of coding and also the
devices, the color RED may not be identification technique should be The protective conductor must be able
dependent on the illumination state of agreed between the manufacturer to be uniquely identified as a result of
the device. and the owner/operating company. its shape, location, coding or color. If it
is only identified as a result of its color,
Coding cables It is not the intention of the Standard then a two color-combination of
The color coding of switches, pushbut- to specify a specific coding type world- green/yellow must be used along the
tons and indicator lamps has been wide. For instance, for safety reasons, whole length of the cable. The
discussed in the previous Section. factory-internal specifications may green/yellow color may only be used
EN 60204 offers a higher degree of have a higher priority in order to avoid for protective conductors.
flexibility when coding cables. confusion in specific areas which are
It specifies that, “
... cables at every handled by the same personnel. Neutral conductor marking
connection must be able to be identi- These definitions cannot be general-
ized due to the wide application range If a circuit has a color-coded neutral
fied in conformance with the technical
of the particular Standard - from small conductor, then light blue must be
documentation...” .
individual machines (high unit volume used. Light blue may not be used to
standard products) up to large, com- code other cables if there is a danger
plex plants (with unique equipment of accidentally interchanging them.
and systems). If a neutral conductor is not used, a
Primarily, appropriate testing should be light-blue conductor may be used for
used to avoid installation/assembly other purposes, but not as protective
faults. conductor.

1
⇒ Concept to prevent ⇒ Inspection
1.2.4 Process technology severe accidents
in Europe The regulatory bodies must set
The owner/operating company is up a system of inspections to system-
responsible for “… drawing-up a docu- atically check the operational, organiza-
Legislative
ment setting-out his major accident tional and management-specific sys-
requirements in Europe
prevention policy and appropriate steps tems of the operation which will allow
For process technology, essentially the to ensure that it is properly imple- these regulatory bodes to confirm that
following EC Directives must be mented. The major accident prevention the user/operating company can prove
applied: policy established by the owner/operat-
• that he has undertake measures to
ing company shall be designed to guar-
• Council Directive 96/82/EC from the prevent severe accidents,
antee a high level of protection for man
9th of December 1996 on the control
and the environment by applying appro- • he has provided adequate measures
of major accident hazards involving
priate means, structures and manage- to limit the results of any accidents.
dangerous substances (“Seveso
ment systems” (Article 7 Paragraph 1).
Directive” II). This EC Directive must be nationally
The document must also take into implemented.
• Low-Voltage Directive
account . the following basic principles: In Germany, this is realized using
• Machinery Directive (98/37/EC) the fault case regulations.
• The concept to prevent severe
• Pressure Equipment Directive accidents must be in written form. Note: The “Seveso Directive” is not a
(97/23/EC). The latter is only relevant Directive of the “New Approach." This
• A safety management system in
in so much that the devices used means that it cannot be automatically
which, among others, the following
must fulfill this directive. “The Direc- assumed that the goals of the Direc-
issues are regulated:
tive on the other hand does not apply tive are fulfilled if the harmonized Stan-
for assembling devices at the user's – determining an evaluating the risks dards are applied. The exact require-
plant, for example, in industrial sys- – defining and applying techniques ments are regulated at a national level.
tems under his responsibility.” to systematically determine haz-
ards.
At the same time, the Health and
Safety at Work and Accident Preven- – operation monitoring – defining and
tion Regulations must always be care- applying techniques for safe opera-
fully observed and adhered to. tion, including the maintenance and
service of the plants and systems.
“Seveso Directive” – quality assurance – defining and
This EC Directive specifies, corre- applying techniques to continu-
sponding to the principles explained in ously ensure that the goals are
the introduction, the safety goal, achieved.
⇒“
... preserving and protecting the ⇒ Safety report
quality of the environment, and pro- The owner/operating company is
tecting human health through pre- responsible in generating a safety
ventive action.” report, in which the following is
In order to achieve this goal, the follow- defined,
ing basic requirements have been • that a concept.... has been imple-
drawn-up, which the Member States mented,
must ensure are fulfilled.
• that the hazards have been identified
and all of the required measures to
prevent these types of accidents and
limit the impact for man and the envi-
ronment have been put in place, and
• the implementation, building/con-
struction, installation and operation
of all plant and systems, ... is ade-
quately safe and reliable.

Technical measures to ful- These standards will lose their validity
in 08.2004 due to the ratification of
fill legislative goals EN 61508. EN 61508 should then be
The first priority is to design the applied. The specific standard for the
process so that it is inherently safe. process industry is IEC 61511 “Func-
Where this is not possible, as a result tional safety: Safety instrumented sys-
of the process, then additional mea- tems for the process industry sector”
sures are required in order to reduce which was finally decided by vote in
the remaining risk to a tolerable level. 2002. IEC 61511 defines the require-
This can be realized using electronic ments of EN/IEC 61508, specifically
controllers if these are suitable for the for the process industry.
particular task. Electronic controllers
Beyond this, additional Standards
are suitable for securing the safety of
apply for the devices and equipment
the plant, if they have been specifically
used. These Standards involve the spe-
designed for this purpose. The require-
cific safety requirements. Also refer to
ments are described in the Standards.
Chapter Safety of Machinery (refer to
Chapter 1.2).
Relevant Standards for safety
measures using process control
technology
For safety measures using process
control technology, for example in
Germany, the following national
standards have been applied, so far.
• DIN V 19250 “Basic safety
issues for control and
instrumentation protective devices”
• DIN V 19251 “Instrumentation and
control protective devices - require-
ments and measures for safety-
related functioning”
• DIN V VDE 0801 “Basic rules for com-
puters in systems with safety-related
tasks”.

1
Reducing risks when using process
control technology
Prevention Mitigation
Measures are required to reduce risks,
if faults or disturbances in the basic
Safety instrumented Safety instrumented
prevention system mitigation system process control system and monitoring
devices can lead to a dangerous event
or can cause the plant or system to go
Safety-related into a hazardous condition and if the
resulting risk is unacceptably high.
Non-safety-relevant In this case, suitable protective mea-
sures must be taken, either to suffi-
Basic Process ciently reduce the probability of a haz-
Monitoring systems ardous event occurring, or to reduce
the extent of the damage. This can be
achieved using process control protec-
Basic Process tive equipment and systems if these
Control systems
fulfill the safety requirements.
Risk reduction
Fig. 1/12
Arrangement of process control systems in safety-related/non-safety-related configurations As it is not possible to completely
exclude certain risks - both from a
technical and cost-effective standpoint
- it is necessary not only to determine
the existing risk, but also to define and
Residual Tolerable EUC*
risk risk risk specify a risk which can be tolerated.
The measure for the safety integrity of
the risk-reducing functions is then
derived from the difference between
these two factors. EN 61508 defines
Increasing
Necessary risk reduction “Safety Integrity Level” (SIL) as a tar-
risk
get measure for the probability of fail-
ure when executing risk-reducing func-
Actual risk reduction
tions.
Risk reduction achieved by all safety-related systems

and e.g. organizational measures
Partial risk Partial risk Partial risk

covered by covered by covered by
other technol- electronic external risk
ogies and electrical reduction
(mechanical, safety-related facilities
optical etc.) systems
* Equipment under control
Fig. 1/13
Principle of risk reduction (acc. to IEC 61508)

Safety High demand or continuous Low demand mode of operation
Integrity mode of operation Evaluation
Level (probability of a (average probability of failure to perform Sensor Actuator
unit
dangerous failure per hour) its design function on demand)
4 ≥ 10-9 to < 10-8 ≥ 10-5 to < 10-4 Acquire Evaluate Execute

information information action
3 ≥ 10-8 to < 10-7 ≥ 10-4 to < 10-3
2 ≥ 10-7 to < 10-6 ≥ 10-3 to < 10-2

Safety function
1 ≥ 10-6 to < 10-5 ≥ 10-2 to < 10-1
Fig.1/14 Fig. 1/15

Safety Integrity levels according to IEC 61508: Target failure measure for a safety function, Evaluation unit, e.g. safety PLC
allocated to a safety-related system
Selecting the equipment The equipment involved, for example, • To be able to control a failure means
and basics of the required fail-safe PLCs, sensors and actuators that when the system detects a fault
features etc. must fulfill, as a total, the deter- or failure, the safety function, defined
mined SIL. for this particular case (e. g. shut
Safety function If a device is used at the same time for down the plant) is reliably executed.
various safety functions, it must fulfill
Risk reduction using electronic con- Similar requirements also apply for
the highest SIL of the individual func-
trollers is realized by defining functions complex field devices. Details on this
tions.
for each possible hazardous event or are described in IEC 61511.
each possible dangerous condition of Device characteristics and features
the plant or system, which prevents Application
If PLCs are used for information pro-
the dangerous event occurring. These
cessing, these must fulfill as “safety When using a fail-safe PLC, only the
so-called “safety functions” are to
PLC”, the requirements of the relevant conditions defined in the associated
maintain the plant or system in a safe
Standards (i.e. IEC 61508), and fulfill Safety Manual, and, if relevant, addi-
state or to re-establish this safe state
the specified SIL. They must also be tional conditions of the certificate,
if a dangerous event could occur due
certified by an independent tester. The must be maintained.
to a failure or a disturbance in the
essential characteristics and features
plant or system. This means that the In addition, for the peripheral devices
of a fail-safe PLC which are specified
safety function can also be used to which are to be connected (e.g. sen-
by the standards are:
reduce the extent of the damage due sors and actuators), the requirements
to a hazardous event. • When developing, manufacturing and in the Standards (IEC 61508 or IEC
servicing, specific measures and 61511) must also be taken into account
The definition of a safety function
techniques must be applied so that regarding the following aspects:
always includes the specification of
systematic faults can be avoided.
the function itself (e. g. inhibiting the • Systematic faults must be avoided,
feed to a container, if the level has • The PLC must be able to control sys- e. g. configuring, installation and
reached the upper limit), and the tematic failures which occur during handling faults.
“Safety Integrity (SIL)”, derived from operation.
• Random faults or failures must be
the risk analysis.
• The PLC must detect random hard- detected and controlled.
Implementing the safety functions ware failures during operation and
• Necessary fault tolerance. This
be able to control them.
Every safety function always includes depends on the proportion of faults
the complete chain, from information which go towards a safe condition.
acquisition, through information evalua-
• Required service/maintenance
tion up to executing the required
(repeated tests).
action.

1
Fig. 1/16
“Safe” Hardware fault tolerance Maximum permissible SIL for complex sub-
failure fraction (refer to Note 2) systems, dependent on their fault tolerance
and the “safe failure fraction” (acc. to IEC
0 (refer to Note 3) 1 2 61508-2)
< 60% not permissible SIL 1 SIL 2
90% SIL 1 SIL 2 SIL 3
99% SIL 2 SIL 3 SIL 4
≥ 99% SIL 3 SIL 4 SIL 4

EN 746 can be applied to industrial
Note 2: Hardware fault tolerance is the maximum number of faults, as a result of random
hardware failures, which can occur without resulting in a hazardous failure.
thermal-processing equipment, for
example
Note 3: A hardware fault tolerance of zero means that a single fault can result in a haz-
ardous failure. • Metal producing and processing
plants,
• Glassworks,
• Ceramic plants,
IEC 61508 defines the maximum per- • Cement, lime and gypsum plants,
missible SIL as a function of its fault 1.2.5 Furnace systems • Chemical plants,
tolerance and the safe failure fraction in Europe • Incinerators etc.
(also refer to Fig. 1/17). (“Safe failure” This refers to EN 60204-1 and
means all those failures where the sys- EC Directives EN 954-1 and for safety-relevant elec-
tem remains in a safe condition). This tronic systems, also to IEC 61508.
Furnaces and burners are subject to
can be achieved using fault detection
the relevant Directives as a result of Furnaces
and a defined response to the fault. A
their application and the devices and
required response must be performed For furnaces which do not belong to
equipment which are used (e.g. Machi-
within a suitably short time. These industrial thermal-processing equip-
nery Directive, Pressured Equipment
times are specified in IEC 61508-2. ment and are not used to heat process
Directive (...), Directive for gas burners
In order to detect faults or failures in (90/396/EEC)).There are no specific EC liquids and gases in the chemical
peripheral devices, test and monitor Directives for furnace systems. Fur- industry, there are the following gen-
functions can be integrated into the naces are subject, where relevant, to eral Standards for electrical equipment
safety PLC. application-specific Directives. Indus- - the European Draft Standard.
trial thermo-processing equipment is, • EN 50156 “Electrical equipment for
When using complex peripheral
for example, classified as machinery furnaces Part 1: Requirements for
devices (e.g. transmitters with micro-
under the Machinery Directive. application design and installation”
processor), it must be ensured that
these devices themselves fulfill the And the German Standard
Standards
relevant Standards (EN 61508 or IEC
61511). • DIN VDE 0116 “Electrical equipment
Industrial thermo-processing equip- for furnaces.”
The complete safety-instrumented sys- ment and systems
tem must be configured so that it ful- The following standards are presently
There is a European draft standard for in force for burners
fills the relevant standards for all of the
these systems, which was drawn-up
safety-relevant functions. EN 61508 or • EN 676 gas burners;
under a mandate of the Machinery
IEC 61511 are relevant regarding func-
Directive, and more precisely EN 746 • EN 230 oil vapor burner in a
tional safety.
“Industrial thermo-processing equip- monoblock design;
ment” with
• EN 267 oil burner;
Part 1: General safety requirements
of industrial thermo-processing • EN 298 automation equipment for
equipment furnaces for gas burners and bas
units with and without blower.
Part 2: Safety requirements for com-
bustion and fuel handling sys-
tems.

1.3 Legal Requirements and Standards
Regarding Safety at Work in the US
Note: The following information is only The requirements from the OSH Act (e)(2) If it is not possible for the
intended to provide an overview of the are administered and managed by the employer to comply immedia-
general principles and basic require- Occupational Safety and Health Admin- tely, what must the employer
ments. It may not be considered as a istration (also called OSHA). OSHA do? The employer must develop
complete description of the situation. uses regional inspectors which check a plan for coming into compli-
The reader of this document must, in whether the workplace (places of ance as promptly as possible,
addition, inform himself about the pre- employment) fulfill the applicable regu- which includes setting priorities
cise requirements as well as the lations. and deadlines and tracking pro-
domestic and local regulations for his gress in controlling hazards.
The regulations, relevant for safety at
particular application.
work of the OSHA are defined and Note: Any hazard identified by
A significant difference between the described in OSHA 29 CFR 1910.xxx the employer's hazard identifi-
legal requirements for Safety at Work (“OSHA Regulations (29 CFR) PART cation and assessment process
between the US and Europe is that in 1910 Occupational Safety and that is covered by an OSHA
the US there is no unified legislation, Health”). (CFR: Code of Federal Regu- standard or the General Duty
across the US, which is applicable for lations). Clause must be controlled as
the safety of machines, and which fully required by that standard or
covers the responsibility of the manu- Also refer to www.osha.gov. that clause, as appropriate."
facturer/supplier. In fact, there is a gen-
The following is stated at the begin- The application and use of various
eral requirement that the employer
ning of the regulations for the Safety Standards is regulated in 29 CFR
provides a safe place of work. This is
and Health Program (29 CFR 1900.1): 1910.5 “Applicability of standards.” The
regulated with the Occupational Safety
concept is similar to that in Europe.
and Health Act (OSHA) of 1970. The “(b)(1)What are the employer's basic
Product-specific standards have prior-
core requirements of OSHA are listed obligations under the rule?
ity over general standards as long as
in Section 5 “Duties”: Each employer must set up a
the associated aspects are actually
safety and health program to
handled there. When the standards are
manage workplace safety and
fulfilled, the employer can assume that
(a) Each employer -- health to reduce injuries, ill-
he has fulfilled the core requirements
nesses and fatalities by syste-
(1) shall furnish to each of his of the OSH Act regarding the aspects
matically achieving compliance
employees employment and actually handled in the standard.
with OSHA standards and the
a place of employment
General Duty Clause.” 1910.5 (f) “An employer who is in
which are free from recognized
compliance with any standard
hazards that are causing or are And later
in this part shall be deemed to
likely to cause death or serious
"(e) Hazard prevention and control. be in compliance with the
physical harm to his employees;
requirement of section 5(a)(1)
(e)(1) What is the employer's basic
(2) shall comply with occupational of the Act, but only to the
obligation? The employer's
safety and health standards extent of the condition, prac-
basic obligation is to systemati-
promulgated under this Act. tice, means, method, operation,
cally comply with the hazard
or process covered by the
prevention and control require-
standard.”
ments of the General Duty
Clause and OSHA standards.

1
mechanical, or electronic) shall meet ing companies to carefully observe and
1.3.1 Machine safety the requirements of paragraph (b)(13) maintain the regulations and are more
of this section, and shall default to a or less forced to fulfill the state-of-the-
predetermined safe condition in the art technology requirement".
Minimum requirements of the event of any single failure within the
Third-party insurance contracts gener-
OSHA system. Programmable controllers
ally demand that the parties fulfill the
which meet the requirements for con-
The OSHA Regulations under 29 CFR applicable standards of the standard-
trols with internally stored programs
1910 include general requirements for ization organizations. Companies who
stated above shall be permitted only if
machines and machinery (1910.121) are self-insured initially do not have
all logic elements affecting the safety
and a series of specific requirements this requirement. However, in the case
system and point of operation safety
for certain types of machines. The of an accident, they must prove that
are internally stored and protected in
requirements specified are extremely they had applied generally recognized
such a manner that they cannot be
specific but have little technical detail. safety principles.
altered or manipulated by the user to
Excerpt from 29 CFR 1910.212 “Gen- an unsafe condition." NPFA 70 (known as the National Elec-
eral requirements for all machines”: tric Code (NEC)) and NFPA 79 (Electri-
The OSHA regulations define mini-
cal Standard for Industrial Machinery)
mum requirements to guarantee safe
"(a)(1) are two especially important standards
places of employment. However, they
regarding safety in industry. Both of
Types of guarding. One or more meth- should not prevent employers from
these describe the basic requirements
ods of machine guarding shall be pro- applying innovative methods and tech-
placed on the features and the imple-
vided to protect the operator and other niques, e.g. “state of the art” protec-
mentation of electrical equipment. The
employees in the machine area from tive systems in order to maximize the
National Electric Code (NFPA 70) pre-
hazards such as those created by point safety for employees.
dominantly applies to buildings, but
of operation, ingoing nip points, rotat-
(Refer to, for example: www.osha.gov/ also for the electrical connections from
ing parts, flying chips and sparks.
...Standard Interpretations ... machines and parts of machines.
Examples of guarding methods are
06/05/2001 - Use of Electro Sensitive NFPA 79 applies to machines. This
barrier guards, two-hand tripping
Protection Equipment ...) results in a grey area (somewhat unde-
devices, electronic safety devices, etc."
fined) in the demarcation between
For specific applications, OSHA speci-
An example for the requirements both standards for large machines and
fies that all of the electrical devices
placed on the control of presses is machinery which comprise partial
and equipment, which are used to pro-
the following excerpt from 29 CFR machines. For instance, large conveyor
tect the employee, are authorized for
1910.217 “Mechanical Power systems can be considered to be part
the application by a nationally recog-
Presses”: of the building so that NFPA 70 and/or
nized testing laboratory (NRTL) which
NFPA 79 should be applied.
has been authorized by OSHA
"(b)(13)
NFPA 79
(For example, refer to: www.osha.gov/
Control reliability. When required by
...Standard Interpretations ... This standard is valid for the electrical
paragraph (c)(5) of this section, the
08/11/1994 - Presence sensing devices equipment of industrial machines with
control system shall be constructed so
(PSDs) for power presses.: “...OSHA rated voltages less than 600V. (A group
that a failure within the system does
requires that all electrical products of machines, which operate together in
not prevent the normal stopping action
used by employees must be treated a coordinated fashion, is considered as
from being applied to the press when
and approved for their intended use by a machine.)
required, but does prevent initiation of
an OSHA Approved Nationally Recog-
a successive stroke until the failure is The new Edition of NFPA 79 - 2002
nized Testing Laboratory (NRTL)....”).
corrected. The failure shall be includes some basic requirements for
detectable by a simple test, or indi- Application and use of additional programmable electronics and buses if
cated by the control system. This standards these are used to execute safety-rele-
requirement does not apply to those vant functions. If these requirements
In addition to OSHA Regulations, it is
elements of the control system which are fulfilled, electronic controls and
just as important to carefully observe
have no effect on the protection buses can also be utilized for Emer-
the current standards of organizations
against point of operation injuries." gency Stop functions of Stop Cate-
such as NFPA and ANSI as well as the
gories 0 and 1 (refer to NFPA 79 - 2002
extensive product liability legislation
"(h)(6)(xvii) 9.2.5.4.1.4). Contrary to EN 60204-1,
which is in force in the US. As a result
NFPA 79 specifies that, for Emergency
Controls with internally stored proof the product liability, it is in the inter-
Stop functions, the electrical power
grams (e.g., mechanical, electro- ests of the manufacturers and operat-

must be disconnected using electro- OSHA provides guidelines on this
mechanical devices. 1.3.2 Process industry with: CPL 2-2.45A "Process Safety
Management of Highly Hazardous
The core requirements placed on
Chemicals-- Compliance Guidelines
programmable electronics and buses
The basic safety requirements of the and Enforcement Procedures.
include:
OSHA for the process industry are
OSHA demands that the process
System requirements defined in OSHA's Process Safety
instrumentation is implemented in
(refer to NFPA 79 - 2002 9.4.3) Management of Highly Hazardous
accordance with generally accepted
Chemicals, Explosives and Blasting
• Control systems, which must contain “good engineering practice.” With a
Agents Standard (PSM),
software-based controllers, letter, dated March 2000, OSHA clari-
29 CFR 1910.119.
(1) if a single fault/error occurs, fied an inquiry from ISA, that
(Refer to www.osha.gov ).
- the system must be shutdown and ANSI/ISA 84.01 is a standard which
brought into a safe state Excerpt from 29 CFR 1910.119: is applicable nationwide and which
- restart must be prevented until the OSHA recognizes as generally
Purpose. This section contains
fault has been removed accepted “good engineering prac-
requirements for preventing or mini-
- Unexpected starting must be tice.” However, in the same letter,
mizing the consequences of cata-
prevented OSHA clearly stated that ISA 84.01
strophic releases of toxic, reactive,
is not the only standard which is
(2) must offer a comparable degree of flammable, or explosive chemicals.
considered when fulfilling the
protection to hard-wired control These releases may result in toxic,
requirements of 1910.119 (PSM).
systems fire or explosion hazards.
CFR 1910.119 doesn't clearly state
(3) must be implemented in accord- Section (d) with its sub-sections con-
whether the requirements refer to
ance with a recognized Standard tains the basic requirements placed
the complete instrumentation. Two
which defines the requirements on process instrumentation.
types of instrumentation are gener-
for such systems.
1910.119(d) ally used in the process industry.
In a Note, it is stated that “Safety Instrumented Systems” (SIS)
Process safety information. ... the
IEC 61508 is a suitable standard. and “Basic Process Control System”
employer shall complete a compila-
(BPCS). ANSI/ISA 91.01 defines that
Requirements placed on programma- tion of written process safety infor-
only the SIS is to be handled under
ble equipment and devices (refer to mation ... This process safety infor-
the OSHA regulations.
NFPA 79 - 2002 11.3.4) mation shall include information
pertaining to the hazards of the IEC 61511 “Functional safety: Safety
• Software and firmware-based con-
highly hazardous chemicals used or Instrumented Systems for the
trollers, which are used for safety-rel-
produced by the process, information process industry sector” is the IEC
evant functions, must be listed for
pertaining to the technology of the standard with the same scope as ISA
such an application (this means, certi-
process, and information pertaining 84.01. It was developed with signifi-
fied by an NRTL).
to the equipment in the process. cant ISA participation and contains
In a Note, a statement is made that
the same principles as ISA 84.01.
IEC 61508 specifies the requirements 1910.119(d)(3)
to design such controllers. A large proportion of processes falls
Information pertaining to the
within the scope of ISA 84.01, but
equipment in the process.
ANSI B11 does not formally fall under 29 CFR
1910.119(d)(3)(i)(F) 1910.119 (PSM). Also in this case, the
There is a series of additional stan-
Standard should be applied in order
dards on safety in industry, specified Design codes and standards
not to violate the basic requirements
under ANSI B11, which offer additional employed;
of the “Duties” section of the Occu-
instructions to achieve the required
1910.119(d)(3)(ii) pational Safety and Health Act
degree of safety.
(OSHA).
The employer shall document
that equipment complies
with recognized and generally
accepted good engineering
practices.
1/24 Siemens AG Safety Integrated Application Manual

1.4 Safety Requirements for Machines in Japan
1
For applications in Japan For machinery OEMs and users
operating worldwide
The situation in Japan is different than
in Europe and the US. Comparable Machinery OEMs who do a lot of
legal requirements regarding functional export business are extremely inter-
safety, which exist in Europe, do not ested in fulfilling European and Ameri-
apply here. The product liability does can requirements, so that their prod-
not play such a role as in the US. ucts fulfill the requirements and
specifications of the various target
There is no legal requirement to apply
markets. Companies with globally dis-
standards, however, an administrative
tributed production facilities also align
recommendation to apply JIS (Japan-
themselves to the European and
ese Industrial Standards):
American requirements in order to
Japan bases its standards on the Euro- have, as far as possible, standard
pean concept and has included basic safety concepts in all of their plants.
standards as national standards (refer
to the Table))
ISO/IEC number JIS number Note
ISO12100-1 (EN292-1) TR B 0008 JIS number will be given after ISO12100-1 is

approved as IS
ISO12100-2 (EN292-2) TR B 0009 JIS number will be given after ISO12100-2 is
approved as IS
ISO14121 (EN1050) JIS B 9702
ISO13849-1 (EN954-1) JIS B 9705-1
IEC60204-1 JIS B 9960-1
IEC1508-1 to 7 JIS C 0508
Siemens AG Safety Integrated Application Manual 1/25

Safety Machine

Uploaded by

Copyright:

Available Formats

Safety Machine

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Safety Machine

Uploaded by

Copyright:

Available Formats

Standards and Regulations

* EUC: Equipment under control

1/2 Safety Integrated Application Manual Siemens AG

* Note: The EFTA countries have

Safety Integrated Application Manual Siemens AG 1/3

* replaces 89/392/EC, 91/368/EC,

1/4 Safety Integrated Application Manual Siemens AG

Safety Integrated Application Manual Siemens AG 1/5

Basic design principles

Group safety standards Type

Specialist Type C Standards

1/6 Safety Integrated Application Manual Siemens AG

Minimum Safety- Safety clear- Electrical Safety of

EN 349 EN 954 EN 294 EN 60204-1 EN 1088

Elevators Injection molding machines Presses + sheers Numerically Type

Also refer to Section 8 – List of harmonized standards

Safety Integrated Application Manual Siemens AG 1/7

1/8 Safety Integrated Application Manual Siemens AG

Possibility to avoid or limit

Determine the machine limits

Identify the hazard Risk analysis Risk assessment

Safety Integrated Application Manual Siemens AG 1/9

1/10 Safety Integrated Application Manual Siemens AG

Safety Integrated Application Manual Siemens AG 1/11

• Validation using analysis

• Validation of the service/maintenance Is the test

shown in Fig. 1/8.

Basic safety principles X X X X X

Faults which are to be detected – – X X X

Various fault groups which must be taken into account – – – X X

How the safety function should be maintained for all – – – – X

1/12 Safety Integrated Application Manual Siemens AG

Safety Integrated Application Manual Siemens AG 1/13

1/14 Safety Integrated Application Manual Siemens AG

1/16 Safety Integrated Application Manual Siemens AG

Safety Integrated Application Manual Siemens AG 1/17

1/18 Safety Integrated Application Manual Siemens AG

Risk reduction achieved by all safety-related systems

Partial risk Partial risk Partial risk

* Equipment under control

Safety Integrated Application Manual Siemens AG 1/19

4 ≥ 10-9 to < 10-8 ≥ 10-5 to < 10-4 Acquire Evaluate Execute

2 ≥ 10-7 to < 10-6 ≥ 10-3 to < 10-2

Fig.1/14 Fig. 1/15

1/20 Safety Integrated Application Manual Siemens AG

< 60% not permissible SIL 1 SIL 2

90% SIL 1 SIL 2 SIL 3

99% SIL 2 SIL 3 SIL 4

≥ 99% SIL 3 SIL 4 SIL 4

Safety Integrated Application Manual Siemens AG 1/21

1/22 Safety Integrated Application Manual Siemens AG

Safety Integrated Application Manual Siemens AG 1/23

1/24 Siemens AG Safety Integrated Application Manual

ISO/IEC number JIS number Note

ISO12100-1 (EN292-1) TR B 0008 JIS number will be given after ISO12100-1 is

Siemens AG Safety Integrated Application Manual 1/25

You might also like