Risk Assessment Methodologies

Michele M. Silva – Solution Architect, Safety & Security

Functional Safety Engineer (TUV Rheinland)
 Agenda

Introduction to Standards

Functional Safety Design Process

Risk Assessment Methodology

PUBLIC Copyright © 2018 Rockwell Automation, Inc. All Rights Reserved. 2

 North America and European Standards
 All functional safety standards are used to demonstrate compliance to
global, regional and sometimes, national legal requirements
 Two examples we will discuss are:
 North America – OSHA
 European – Directives, specifically Machinery Directive
 Three types of Standards
 “A” Standards
 basic concepts
 principles for design
 general aspects
 “B” Standards
 B1 - safety distances, surface temps, noise
 B2 - components or devices
 “C” Standards
 vertical standards covering a single type of machine or
group of machines.
 Use A and B standards to create C standards.

PUBLIC Copyright © 2018 Rockwell Automation, Inc. All Rights Reserved. 3

 Standards – Risk Assessment
 Risk Assessment standards and methodologies include:
 ANSI RIA R15.06-1999 (R2009) - Safety Requirements
 for Industrial Robots and Robot Systems
 ANSI / RIA TR R15.306-2016 (Technical Report)
 ANSI B11.TR3 - Risk Assessment Technical Report
 ANSI ISO 12100:2010 - Safety of machinery - General
principles for design - Risk assessment and risk reduction
 IEC 61508 - Functional Safety
 ISO 13849 - Safety of Machinery - Safety Related Parts of
Control Systems
 IEC 62061-2005 - Functional Safety of safety-related
electrical, electronic and programmable control systems

PUBLIC 4
Copyright © 2018 Rockwell Automation, Inc. All Rights Reserved. 4
 Relationship of OSHA Standards
Machine Maintenance Production Operation
Regulation: Lockout / Tagout per CFR Regulation: Machine Guarding per CFR 1910
Subpart O
1910.147
Requirement: Protect operators from machine
Requirement: Release stored energy production hazards
Tasks: Isolation of Mechanical / Electrical Tasks: Operator Interaction for Regular Machine
Equipment for Service and Maintenance Production

Minor Service Must provide alternative

Exception to Lockout Tagout Measures that offer effective protection

Minor Servicing Exception

Regulation: Machine Guarding per Subpart O
Requirement: Protect operators from machine production
hazards when performing minor servicing
Tasks: Minor servicing such as clearing minor jams, minor tool
changes & adjustments, exchange of work piece, etc.
Minor servicing must be routine, repetitive and integral to the operation
PUBLIC Copyright © 2018 Rockwell Automation, Inc. All Rights Reserved. 5
 EN 954 vs EN/ISO 13849
ISO 13849-1 Replaces EN 954 Qualitative Quantitative
Structure (Categories)  
MTTFd 
Diagnostic Coverage (DC) 
Common Cause Failures (CCF) 
Software 
Systematic Failure 
Behavior Under Fault conditions 
Environmental 

EN 954 was basically a Qualitative approach. Time & Component

Reliability are Quantitative aspects which must now be considered
when developing a safety control system using EN/ISO 13849-1.
PUBLIC Copyright © 2018 Rockwell Automation, Inc. All Rights Reserved. 6
 Agenda

Introduction to Standards

Risk Assessment Process

Risk Assessment Methodologies

PUBLIC Copyright © 2018 Rockwell Automation, Inc. All Rights Reserved. 7

 Functional Safety Design Process

Safety Life Cycle

PUBLIC Copyright © 2018 Rockwell Automation, Inc. All Rights Reserved. 8

 Are Risk Assessments Required?
NFPA 79
Safety circuit based
on Risk Assessment
References other NFPA
consensus standards
for safety
ISO 13849
OSHA ISO Risk Assessment based
Safety Parts of
Control System design
B11.19
Safeguarding shall be ANSI
based on assessment
ANSI-RIA R15.06
Robotics controls
require assessment

PUBLIC Copyright © 2018 Rockwell Automation, Inc. All Rights Reserved. 9

 Risk Assessment
 Risk Assessment is the basis of risk reduction
 Process of risk analysis and risk evaluation
 A control system is a common risk reduction method
 When a control system is used, you must follow the iterative
design process of the safety-related parts of a control system
(SRP/CS)
 ISO 13849-1 is an iterative design process

ISO 13849-1:2015; Figure 1

PUBLIC Copyright © 2018 Rockwell Automation, Inc. All Rights Reserved. 10

 Risk Assessment
 Risk assessment performed as if existing safeguards are NOT in place

 A comprehensive risk assessment includes all hazard types and tasks

 Task based risk assessment identifies hazards based upon real machine
interaction

 Shows “Due Diligence” and Global Compliance (Ref. ISO 12100)

 Provides Safety Performance Level – Design Target

 Creates the Foundation of the Safety System Functional Requirements,

System Design and Validation Protocol

PUBLIC Copyright © 2018 Rockwell Automation, Inc. All Rights Reserved. 11

 Risk Definition

Probability of Occurrence
R
Is a - Exposure of Person to Hazard
I function
Severity of And
S of Harm - Occurrence of Hazardous Event
K - Possibility to Avoid or Limit Harm

Only changes with

design ANSI/ISO 12100: 2012; Figure 3

PUBLIC Copyright © 2018 Rockwell Automation, Inc. All Rights Reserved. 12

 Risk Assessment
 Sources of Mechanical Hazard
 Conveyor Belt
 Bottle Side Belt
 Sleeve Indexer
 Sleeve Cutter
 Vacuum Pump
 Operator doing Normal Operating
Tasks on the Machine
 Possible injuries the Operator may
sustain and Risk Level for each
 Risk Reduction Methods are
identified

A Control System for Risk Reduction = Safety Function

PUBLIC Copyright © 2018 Rockwell Automation, Inc. All Rights Reserved. 14
 Agenda

Introduction to Standards

Risk Assessment Process

Risk Assessment Methodologies

PUBLIC Copyright © 2018 Rockwell Automation, Inc. All Rights Reserved. 15

 Risk Estimation (ISO 13849-1)
 Severity and probability data from the Risk Assessment is needed
 ISO 13849-1, Annex A
 Risk Reduction by Safety Related Parts of the Control System
 Shows a risk graph scoring technique to identify Performance Levels (a, b, c, d & e)
 As risk increases, safety performance of the control system must increase

S1 & S2 – Severity of Injury (Slight or Serious)

F1 & F2 – Frequency and/or Exposure (Seldom or Frequent)

RISK
P1 & P2 – Possibility of Avoidance (Possible or Not Possible)

ISO 13849-1:2015; Figure A.1

PUBLIC Copyright © 2018 Rockwell Automation, Inc. All Rights Reserved. 16
 Risk Estimation – RIA TR15.306
RIA TR R15.306:2016 – Tasked Based Risk Assessment Methodology
PLr

PLc

PLc

PLd

PLd

PLd

PLe
PUBLIC Copyright © 2018 Rockwell Automation, Inc. All Rights Reserved. 17
 Risk Estimation – IEC 62061

PUBLIC Copyright © 2018 Rockwell Automation, Inc. All Rights Reserved. 18

 Risk Estimation – IEC 62061

Cl = Fr + Pr + Av

Fr = 4
Example: Se = 4 Pr = 3
Av = 5_
12
PUBLIC Copyright © 2018 Rockwell Automation, Inc. All Rights Reserved. 19
 Risk Estimation (HRN system)
There are numerous ways of assessing risk involved with a hazard, one of which is the Hazard Rating
Number system.

In this technique, numerical values are assigned to descriptive phrases relating to...
 The likelihood of occurrence (LO) of coming into contact with the hazard
 The frequency of exposure (FE)
 The degree of possible harm (DPH)
 The number of persons at risk (NP)

A Hazard Rating Number is completed using the following calculation:

 LO x FE x DPH x NP = HRN

PUBLIC Copyright © 2018 Rockwell Automation, Inc. All Rights Reserved. 20

 Bringing it all together

ISO 13849-1:2015

ANSI-RIA TR15.306-2016

PUBLIC Copyright © 2018 Rockwell Automation, Inc. All Rights Reserved. 21

 Possible Mitigation Techniques
Hierarchy of Protective Measures
Most
Design it out Effective

Fixed enclosing guard

Safety-Related Parts Monitoring Access /

of Control Systems
(SRP/CS)
Interlocked Gates

Awareness Means, Training and

Procedures (Administrative)
Least
Personal protective equipment
Effective
PUBLIC Copyright © 2018 Rockwell Automation, Inc. All Rights Reserved. 22
 Risk Reduction

ANSI-RIA TR15.306-2016

PUBLIC Copyright © 2018 Rockwell Automation, Inc. All Rights Reserved. 23

 Identify Safety Functions
 Safety Function = Control system for risk reduction
 List each hazardous energy source and triggering event possibility

SF6
SF1-5

SF1 Guard Door 1 (op side) Protective stop and prevention of restart of the conveyor when opened
SF2 Guard Door 1 (op side) Protective stop and prevention of restart of the bottle feed belts when opened
SF3 Guard Door 1 (op side) Protective stop and prevention of restart of the sleeve feeder when opened
SF4 Guard Door 1 (op side) Protective stop and prevention of restart of the cutter when opened
SF5 Guard Door 1 (op side) Unlock with conditional time delayed unlock Guard Door 2 Drive Side
SF6 Guard Door 2 (dr side) Protective stop and prevention of restart of the sleeve feeder opened

PUBLIC Copyright © 2018 Rockwell Automation, Inc. All Rights Reserved. 24

 Performance Level (PL)
The Risk Assessment determines Required Performance Level (PLr)
Choose the most suitable combination of :
Odds
Structure (Category), Reliability (MTTFd) and Diagnostics (DC) (PFHd)
1 / 10,000

1 / 100,000

1 / 1,000,000

1 / 10,000,000

1 / 100,000,000

PUBLIC Copyright © 2018 Rockwell Automation, Inc. All Rights Reserved. 25

 Functional Safety Design Process

Safety Life Cycle

PUBLIC Copyright © 2018 Rockwell Automation, Inc. All Rights Reserved. 26

Questions?

PUBLIC

www.rockwellautomation.com

Copyright © 2018 Rockwell Automation, Inc. All Rights Reserved. 27