 |
中标分类
行业分类
ICS分类
最新标准
|
登录注册 |
| 您的位置: 标准明细 |
Codeofchina.com is in charge of this English translation. In case of any doubt about the English translation, the Chinese original shall be considered authoritative. GB/T 16855 consists of the following two parts under the general title Safety of machinery — Safety-related parts of control systems: ——Part 1: General principles for design; ——Part 2: Validation. This part is Part 1 of GB/T 16855. This part is developed in accordance with the rules given in GB/T 1.1-2009. This part replaces GB/T 16855.1-2008 Safety of machinery — Safety-related parts of control systems — Part 1: General principles for design. In addition to a number of editorial changes, the following technical changes have been made with respect to GB/T 16855.1-2008: ——The Chinese name of the standard is changed to “机械安全 控制系统安全相关部件 第1部分：设计通则” (the English name remains the same); ——Table 1 in the introduction is deleted (see the introduction in 2008 edition); ——The Chinese term "系统失效" is modified to "系统性失效" (the corresponding English term remains the same) (see 3.1.7; 3.1.7 of 2008 edition); ——The Chinese term "平均危险失效时间" is modified to "平均危险失效间隔时间" (the corresponding English term remains the same) and its abbreviation is modified to "MTTFD" (see 3.1.25; 3.1.25 of 2008 edition); ——The terms "high demand or continuous mode” and "proven in use" and their definitions are added (see 3.1.38 and 3.1.39); ——Figure 1 is modified (see Figure 1; Figure 1 of 2008 edition); ——The requirements of description of the output part of the SRP/CS by category are added (see 4.5.5); ——The calculation or estimation of MTTFD values for single components is modified (see Annex C; Annex C of 2008 edition); ——Annex I is redrafted (see Annex I; Annex I of 2008 edition). This part, by means of translation, is identical to ISO 13849-1:2015 Safety of machinery — Safety-related parts of control systems — Part 1: General principles for design. The Chinese documents consistent and corresponding with the normative international documents in this part are as follows: ——GB 28526-2012 Safety of machinery — Functional safety of safety-related electrical, electronic and programmable electronic control systems (IEC 62061:2005, IDT); ——GB/T 30175-2013 Safety of machinery — Guidance on the application of GB/T 16855.1and GB 28526 in the design of safety-related control systems (ISO/TR 23849: 2010, IDT). The following editorial modifications have been made in this part: ——Editorial errors in Table 1 are corrected, and “Table 3” is changed to “Table 2”, “Table 4” to “Table 3” and “Table 7” to “Table 6”. This part was proposed by and is under the jurisdiction of the National Technical Committee on Machinery Safety of Standardization Administration of China (SAC/TC 208). The previous editions of this part are as follows: ——GB/T 16855.1-1997, GB/T 16855.1-2005 and GB/T 16855.1-2008. Introduction The structure of safety standards in the field of machinery is as follows. a) Type-A standards (basis standards) give basic concepts, principles for design and general aspects that can be applied to machinery. b) Type-B standards (generic safety standards) deal with one safety aspect, or one type of safeguards that can be used across a wide range of machinery: ——Type-B1 standards on particular safety aspects (e.g. safety distances, surface temperature, noise); ——Type-B2 standards on safeguards (e.g. two-hands controls, interlocking devices, pressure sensitive devices, guards). c) Type-C standards (machinery safety standards) deal with detailed safety requirements for a particular machine or group of machines. This part is a type-B-1 standard as stated in GB/T 15706. This document is of relevance, in particular, for the following stakeholder groups representing the market players with regard to machinery safety: ——machine manufacturers; ——health and safety bodies. Others can be affected by the level of machinery safety achieved with the means of the document by the above-mentioned stakeholder groups: ——machine users; ——machine owner; ——service providers; ——consumers (in case of machinery intended for use by consumers). The above-mentioned stakeholder groups have been given the possibility to participate at the drafting process of this document. In addition, this document is intended for standardization bodies elaborating type-C standards. The requirements of this document can be supplemented or modified by a type-C standard. For machines which are covered by the scope of a type-C standard and which have been designed and built according to the requirements of that standard, the requirements of that type-C standard take precedence. This part is intended to give guidance to those involved in the design and assessment of control systems, and to Technical Committees preparing type-B or type-C standards. As part of the overall risk reduction strategy at a machine, a designer will often choose to achieve some measure of risk reduction through the application of safeguards employing one or more safety functions. Parts of machinery control systems that are assigned to provide safety functions are called safety-related parts of control systems (SRP/CS) and these can consist of hardware and software and can either be separate from the machine control system or an integral part of it. In addition to providing safety functions, SRP/CS can also provide operational functions (e.g. two-handed controls as a means of process initiation). The ability of safety-related parts of control systems to perform a safety function under foreseeable conditions is allocated one of five levels, called performance levels (PL). These performance levels are defined in terms of probability of dangerous failure per hour (see Table 2). The probability of dangerous failure of the safety function depends on several factors, including hardware and software structure, the extent of fault detection mechanisms [diagnostic coverage (DC)], reliability of components [mean time to dangerous failure (MTTFD), common cause failure (CCF)], design process, operating stress, environmental conditions and operation procedures. In order to assist the designer and facilitate the assessment of achieved PL, this document employs a methodology based on the categorization of structures according to specific design criteria and specified behaviours under fault conditions. These categories are allocated one of five levels, termed Categories B, 1, 2, 3 and 4. The performance levels and categories can be applied to safety-related parts of control systems, such as ——protective devices (e.g. two-hand control devices, interlocking devices), electro-sensitive protective devices (e.g. photoelectric barriers), pressure sensitive devices, ——control units (e.g. a logic unit for control functions, data processing, monitoring, etc.), and ——power control elements (e.g. relays, valves, etc.), as well as to control systems carrying out safety functions at all kinds of machinery——from simple (e.g. small kitchen machines, or automatic doors and gates) to manufacturing installations (e.g. packaging machines, printing machines, presses). This part is intended to provide a clear basis upon which the design and performance of any application of the SRP/CS (and the machine) can be assessed, for example, by a third party, in-house or by an independent test house. Information on the recommended application of IEC 62061 and this part of GB/T 16855 IEC 62061 and this part specify requirements for the design and implementation of safety-related parts of machine control systems. The use of either of these standards, in accordance with their scopes, can be presumed to fulfil the relevant essential safety requirements. ISO/TR 23849 gives guidance on the application of this part of GB/T 16855 and IEC 62061 in the design of safety-related control systems for machinery. Safety of machinery — Safety-related parts of control systems — Part 1: General principles for design 1 Scope This part of GB/T 16855 provides safety requirements and guidance on the principles for the design and integration of safety-related parts of control systems (SRP/CS), including the design of software. For these parts of SRP/CS, it specifies characteristics that include the performance level required for carrying out safety functions. It applies to SRP/CS for high demand and continuous mode, regardless of the type of technology and energy used (electrical, hydraulic, pneumatic, mechanical, etc.), for all kinds of machinery. It does not specify the safety functions or performance levels that are to be used in a particular case. This part of GB/T 16855 provides specific requirements for SRP/CS using programmable electronic system(s). It does not give specific requirements for the design of products which are parts of SRP/CS. Nevertheless, the principles given, such as categories or performance levels, can be used. Note 1: Examples of products which are parts of SRP/CS: relays, solenoid valves, position switches, PLCs, motor control units, two-hand control devices, pressure sensitive equipment. For the design of such products, it is important to refer to the specifically applicable standards, e.g. GB/T 19671, GB/T 17454.1 and GB/T 17454.2. Note 2: For the definition of required performance level, see 3.1.24. Note 3: The requirements provided in this part for programmable electronic systems are compatible with the methodology for the design and development of safety-related electrical, electronic and programmable electronic control systems for machinery given in IEC 62061. Note 4: For safety-related embedded software for components with PLr＝e, see IEC 61508–3:1998, Clause 7. 2 Normative references The following referenced documents are indispensable for the application of this document. For dated references, only the edition cited applies. For undated references, the latest edition of the referenced document (including any amendments) applies. GB/T 2900.13-2008 Electrotechnical terminology — Dependability and quality of service [IEC 60050(191):1990, IDT] GB/T 15706-2012 Safety of machinery — General principles for design — Risk assessment and risk reduction (ISO 12100:2010, IDT) GB/T 16855.2-2015 Safety of machinery — Safety-related parts of control systems — Part 2: Validation (ISO 13849-2:2012, IDT) GB 20438.3-2017 Functional safety of electrical/electronic/programmable electronic safety-related systems — Part 3: Software requirements (IEC 61508-3:2010, IDT); GB/T 20438.4-2017 Functional safety of electrical/electronic/programmable electronic safety-related systems — Part 4: Definitions and abbreviations (IEC 61508-4:2010, IDT) ISO/TR 22100-2:2013 Safety of machinery — Relationship with ISO 12100 — Part 2: How ISO 12100 relates to ISO 13849-1 ISO/TR 23849 Guidance on the application of ISO 13849-1 and IEC 62061 in the design of safety-related control systems for machinery IEC 62061:2012 Safety of machinery — Functional safety of safety related electrical, electronic and programmable electronic control systems 3 Terms, definitions, symbols and abbreviated terms 3.1 Terms and definitions For the purposes of this document, the terms and definitions given in GB/T 15706 and GB/T 2900.13 and the following apply. 3.1.1 safety-related part of a control system; SRP/CS part of a control system that responds to safety-related input signals and generates safety-related output signals Note 1: The combined safety-related parts of a control system start at the point where the safety-related input signals are initiated (including, for example, the actuating cam and the roller of the position switch) and end at the output of the power control elements (including, for example, the main contacts of a contactor). Note 2: If monitoring systems are used for diagnostics, they are also considered as SRP/CS. 3.1.2 category classification of the safety-related parts of a control system in respect of their resistance to faults and their subsequent behaviour in the fault condition, and which is achieved by the structural arrangement of the parts, fault detection and/or by their reliability 3.1.3 fault state of an item characterized by the inability to perform a required function, excluding the inability during preventive maintenance or other planned actions, or due to lack of external resources Note 1: A fault is often the result of a failure of the item itself, but may exist without prior failure. Note 2: In this part, “fault” means random fault. [GB/T 2900.13-2008, 191-05-01] 3.1.4 failure termination of the ability of an item to perform a required function Note 1: After a failure, the item has a fault. Note 2: “Failure” is an event, as distinguished from “fault”, which is a state. Note 3: The concept as defined does not apply to items consisting of software only. Note 4: Failures which only affect the availability of the process under control are outside of the scope of this part. [GB/T 2900.13-2008, Definition 191-04-01] 3.1.5 dangerous failure failure which has the potential to put the SRP/CS in a hazardous or fail-to-function state Note 1: Whether or not the potential is realized can depend on the channel architecture of the system; in redundant systems a dangerous hardware failure is less likely to lead to the overall dangerous or fail-to-function state. Note 2: It is derived from GB/T 20438.4-2017, Definition 3.6.7. 3.1.6 common cause failure; CCF failures of different items, resulting from a single event, where these failures are not consequences of each other Note: Common cause failures should not be confused with common mode failures (see GB/T 15706-2012, Definition 3.36). [GB/T 2900.13-2008, Definition 191-04-23] 3.1.7 systematic failure failure related in a deterministic way to a certain cause, which can only be eliminated by a modification of the design or of the manufacturing process, operational procedures, documentation or other relevant factors Note 1: Corrective maintenance without modification will usually not eliminate the failure cause. Note 2: A systematic failure can be induced by simulating the failure cause. Note 3: Examples of causes of systematic failures include human error in ——the safety requirements specification; ——the design, manufacture, installation, operation of the hardware; ——the design, implementation, etc., of the software. [GB/T 2900.13-2008, Definition 191-04-19] 3.1.8 muting temporary automatic suspension of a safety function(s) by the SRP/CS 3.1.9 manual reset function within the SRP/CS used to restore manually one or more safety functions before restarting a machine 3.1.10 harm physical injury or damage to health [GB/T 15706-2012, Definition 3.5] 3.1.11 hazard potential source of harm Note 1: A hazard can be qualified in order to define its origin (e.g. mechanical hazard, electrical hazard) or the nature of the potential harm (e.g. electric shock hazard, cutting hazard, toxic hazard, fire hazard). Note 2: The hazard envisaged in this definition: ——either is permanently present during the intended use of the machine (e.g. motion of hazardous moving elements, electric arc during a welding phase, unhealthy posture, noise emission, high temperature); ——or may appear unexpectedly (e.g. explosion, crushing hazard as a consequence of an unintended/unexpected start-up, ejection as a consequence of a breakage, fall as a consequence of acceleration/deceleration). Note 3: It is derived from GB/T 15706-2012, Definition 3.6. 3.1.12 hazardous situation circumstance in which a person is exposed to at least one hazard Note: The exposure can result in harm immediately or over a period of time. [GB/T 15706-2012, Definition 3.10] 3.1.13 risk combination of the probability of occurrence of harm and the severity of that harm [GB/T 15706-2012, Definition 3.12] 3.1.14 residual risk risk remaining after protective measures have been taken Note 1: See Figure 2. Note 2: It is derived from GB/T 15706-2012, Definition 3.13. 3.1.15 risk assessment overall process comprising risk analysis and risk evaluation [GB/T 15706-2012, Definition 3.17] 3.1.16 risk analysis combination of the specification of the limits of the machine, hazard identification and risk estimation [GB/T 15706-2012, Definition 3.15] 3.1.17 risk evaluation judgement, on the basis of risk analysis, of whether risk reduction objectives have been achieved [GB/T 15706-2012, Definition 3.16] 3.1.18 intended use of a machine use of the machine in accordance with the information provided in the instructions for use [GB/T 15706-2012, Definition 3.23] 3.1.19 reasonably foreseeable misuse use of a machine in a way not intended by the designer, but which may result from readily predictable human behaviour [GB/T 15706-2012, Definition 3.24] 3.1.20 safety function function of the machine whose failure can result in an immediate increase of the risk(s) [GB/T 15706-2012, Definition 3.30] 3.1.21 monitoring safety function which ensures that a protective measure is initiated if the ability of a component or an element to perform its function is diminished or if the process conditions are changed in such a way that a decrease of the amount of risk reduction is generated 3.1.22 programmable electronic system; PES system for control, protection or monitoring dependent for its operation on one or more programmable electronic devices, including all elements of the system such as power supplies, sensors and other input devices, contactors and other output devices Note: It is derived from IEC 61508-4:1998, Definition 3.3.2. 3.1.23 performance level PL discrete level used to specify the ability of safety-related parts of control systems to perform a safety function under foreseeable conditions Note: See 4.5.1. 3.1.24 required performance level PLr performance level (PL) applied in order to achieve the required risk reduction for each safety function Note: See Figures 2 and A.1. 3.1.25 mean time to dangerous failure MTTFD expectation of the mean time to dangerous failure Note: It is derived from GB 28526-2012, Definition 3.2.34. 3.1.26 diagnostic coverage DC measure of the effectiveness of diagnostics, which may be determined as the ratio between the failure rate of detected dangerous failures and the failure rate of total dangerous failures Note 1: Diagnostic coverage can exist for the whole or parts of a safety-related system. For example, diagnostic coverage could exist for sensors and/or logic system and/or final elements. Note 2: It is derived from IEC 61508-4:1998, 3.8.6. 3.1.27 protective measure measure intended to achieve risk reduction Example 1: Implemented by the designer: inherent design, safeguarding and complementary protective measures, information for use. Example 2: Implemented by the user: organization (safe working procedures, supervision, permit-to-work systems), provision and use of additional safeguards, personal protective equipment, training. Note: It is derived from GB 15706-2012, 3.19. 3.1.28 mission time TM period of time covering the intended use of an SRP/CS 3.1.29 test rate rt frequency of automatic tests to detect faults in a SRP/CS, reciprocal value of diagnostic test interval 3.1.30 demand rate rD frequency of demands for a safety-related action of the SRP/CS 3.1.31 repair rate rt reciprocal value of the period of time between detection of a dangerous failure by either an online test or obvious malfunction of the system and the restart of operation after repair or system/component replacement Note: The repair time does not include the span of time needed for failure-detection. 3.1.32 machine control system system which responds to input signals from parts of machine elements, operators, external control equipment or any combination of these and generates output signals causing the machine to behave in the intended manner Note: The machine control system can use any technology or any combination of different technologies (e.g. electrical/electronic, hydraulic, pneumatic, mechanical). 3.1.33 safety integrity level SIL discrete level (one out of a possible four) for specifying the safety integrity requirements of the safety functions to be allocated to the E/E/PE safety-related systems, where safety integrity level 4 has the highest level of safety integrity and safety integrity level 1 has the lowest [IEC 61508-4:1998, 3.5.6] 3.1.34 limited variability language; LVL type of language that provides the capability of combining predefined, application-specific library functions to implement the safety requirements specifications Note 1: Typical examples of LVL (ladder logic, function block diagram) are given in GB/T 15969.3. Note 2: A typical example of a system using LVL: PLC. Note 3: It is derived from GB 21109.1-2007, 3.2.81.1.2. 3.1.35 full variability language; FVL type of language that provides the capability of implementing a wide variety of functions and applications Example: C, C++, Assembler. Note 1: A typical example of systems using FVL: embedded systems. Note 2: In the field of machinery, FVL is found in embedded software and rarely in application software. Note 3: It is derived from GB 21109.1-2007, 3.2.81.1.3. 3.1.36 application software software specific to the application, implemented by the machine manufacturer, and generally containing logic sequences, limits and expressions that control the appropriate inputs, outputs, calculations and decisions necessary to meet the SRP/CS requirements 3.1.37 embedded software firmware system software software that is part of the system supplied by the control manufacturer and which is not accessible for modification by the user of the machinery Note: Embedded software is usually written in FVL. 3.1.38 high demand or continuous mode mode of operation in which the frequency of demands on a SRP/CS is greater than one per year or the safety related control function retains the machine in a safe state as part of normal operation Note: It is derived from IEC 62061:2012, 3.2.27. 3.1.39 proven in use demonstration, based on an analysis of operational experience for a specific configuration of an element, that the likelihood of dangerous systematic faults is low enough so that every safety function that uses the element achieves its required performance level (PLr) Note: It is revised from GB/T 20438.4-2017, 3.8.18. Foreword i Introduction iii 1 Scope 2 Normative references 3 Terms, definitions, symbols and abbreviated terms 3.1 Terms and definitions 3.2 Symbols and abbreviated terms 4 Design considerations 4.1 Safety objectives in design 4.2 Strategy for risk reduction 4.3 Determination of required performance level (PLr) 4.4 Design of SRP/CS 4.5 Evaluation of the achieved performance level PL and relationship with SIL 4.6 Software safety requirements 4.7 Verification that achieved PL meets PLr 4.8 Ergonomic aspects of design 5 Safety functions 5.1 Specification of safety functions 5.2 Details of safety functions 6 Categories and their relation to MTTFD of each channel, DCavg and CCF 6.1 General 6.2 Specifications of categories 6.3 Combination of SRP/CS to achieve overall PL 7 Fault consideration, fault exclusion 7.1 General 7.2 Fault consideration 7.3 Fault exclusion 8 Validation 9 Maintenance 10 Technical documentation 11 Information for use Annex A (Informative) Determination of required performance level (PLr) Annex B (Informative) Block method and safety-related block diagram Annex C (Informative) Calculating or evaluating MTTFD values for single components Annex D (Informative) Simplified method for estimating MTTFD for each channel Annex E (Informative) Estimates for diagnostic coverage (DC) for functions and modules Annex F (Informative) Estimates for common cause failure (CCF) Annex G (Informative) Systematic failure Annex H (Informative) Example of combination of several safety-related parts of the control system Annex I (Informative) Examples Annex J (Informative) Software Annex K (informative) Numerical representation of Figure Bibliography 机械安全 控制系统安全相关部件 第1部分：设计通则 1 范围 GB/T 16855的本部分规定了包括软件设计在内的控制系统安全相关部件(SRP/CS)设计和集成的安全要求和指导原则。本部分规定了这些SRP/CS部件的特征，包括执行安全功能所需要的性能等级。本部分适用于所有种类机械上具有高要求和连续模式的SRP/CS，不管其采用何种技术和能量(电气、液压、气动、机械等)。 本部分未规定特殊应用中的安全功能或性能等级。 本部分给出了采用可编程电子系统的SRP/CS的具体要求。 本部分未给出SRP/CS的产品的具体设计要求，但可采用给出的类别或性能等级等原则。 注1：SRP/CS的产品示例：继电器、电磁阀位置开关、PLC、电机控制单元、双手操纵装置、压敏设备等。这类产品的设计需参考专门的标准.例如：GB/T 19671、GB/T 17454.1和GB/T 17454.2。 注2：所需性能等级的定义见3.1.24。 注3：本部分给出的关于可编程电子系统的要求与IEC 62061中给出的机械安全相关的电气、电子和可编程控制系统的设计和开发方法是一致的。 注4：用于PLr＝e的元件的安全相关嵌入式软件见IEC 61508-3：1998中第7章。 2 规范性引用文件 下列文件对于本文件的应用是必不可少的。凡是注日期的引用文件，仅注日期的版本适用于本文件。凡是不注日期的引用文件，其最新版本(包括所有的修改单)适用于本文件。 GB/T 2900.13—2008 电工术语 可信性与服务质量[IEC 60050(191)：1990，IDT] GB/T 15706—2012 机械安全 设计通则 风险评估与风险减小(ISO 12100：2010，IDT) GB/T 16855.2—2015 机械安全 控制系统安全相关部件 第2部分：确认(ISO 13849-2：2012，IDT) GB/T 20438.3—2017 电气/电子/可编程电子安全相关系统的功能安全 第3部分：软件要求(IEC 61508-3：2010，IDT) GB/T 20438.4—2017 电气/电子/可编程电子安全相关系统的功能安全 第4部分：定义和缩略语(IEC 61508-4：2010，IDT) ISO/TR 22100-2：2013 Safety of machinery—Relationship with ISO 12100—Part 2：How ISO 12100 relates to ISO 13849-1 ISO/TR23849 应用ISO13849-1和IEC 62061设计机械的安全相关控制系统的指南(Guidance on the application of ISO 13849-1 and IEC 62061 in the design of safety-related control systems for machinery) IEC 62061：2012 机械安全 安全相关电气、电子和可编程电子控制系统的功能安全(Safety of machinery—Functional safety of safety related electrical，electronic and programmable electronic control systems) 3 术语和定义、符号及缩略语 3.1 术语和定义 GB/T 15706和GB/T 2900.13界定的以及下列术语和定义适用于本文件。 3.1.1 控制系统安全相关部件 safety-related part of a control system； SRP/CS 控制系统中响应安全相关输入信号并产生安全相关输出信号的部件。 注1：控制系统安全相关部件的组成，以安全相关的输入信号被触发为起始点(例如：致动凸轮和位置开关的滚轮等)，以动力控制组件的输出(例如：接触器的主触点等)为终止点。 注2：如果监控系统用于诊断，也可认为是SRP/CS。 3.1.2 类别 category 控制系统安全相关部件在防止故障能力以及故障条件下后续行为方面的分类，它通过部件的结构布置、故障检测和/或部件可靠性来达到。 3.1.3 故障 fault 产品不能完成要求的功能的状态。预防性维修或其他计划的行动或因缺乏外部资源的情况除外。 注1：故障通常是产品自身失效后引起的，但即使失效未发生，故障也可能存在。 注2：本部分中，“故障”是指随机故障。 [GB/T 2900.13—2008，191-05-01] 3.1.4 失效 failure 产品完成要求的功能的能力的中断。 注1：失效后，产品处于故障状态。 注2：“失效(failure)”与“故障(fault)”的区别在于——失效是一次事件，故障是一种状态。 注3：这里定义的“失效”，不适用于仅由软件构成的产品。 注4：本部分不包括只影响控制器进程的失效。 [GB/T 2900.13—2008，定义191-04-01] 3.1.5 危险失效 dangerous failure 使控制系统安全相关部件(SRP/CS)有可能处于危险状态或功能丧失状态的失效。 注1：这种可能性是否成为事实取决于系统的通道架构；冗余系统中，危险硬件失效不太可能导致全面的危险状态或功能丧失状态。 注2：改写GB/T 20438.4—2017，定义3.6.7。 3.1.6 共因失效 common cause failure； CCF 由单一事件引发的不同产品的失效，这些失效不互为因果。 注：共因失效不宜与共模失效(见GB/T 15706—2012，定义3.36)相混淆。 [GB/T 2900.13—2008，定义191-04-23] 3.1.7 系统性失效 systematic failure 与某个原因必然有关的，只有通过修改设计或制造工艺、操作程序、文档或其他关联因素才能消除的失效。 注1：仅作修复性维修而无修改措施通常不能消除这种失效原因。 注2：这种失效可以通过模拟失效原因诱发。 注3：以下情况中系统性失效的原因包括人为错误： ——安全要求规范； ——硬件的设计、制造、安装和操作； ——软件的设计和实施等。 [GB/T 2900.13—2008，定义191-04-19] 3.1.8 抑制 muting 由SRP/CS实现的安全功能临时性自动暂停。 3.1.9 手动复位 manual reset 重新启动机器前，控制系统安全相关部件(SRP/CS)中用作手动恢复-.种或多种安全功能的功能。 3.1.10 伤害 harm 对健康产生的生理上的损伤或危害。 [GB/T 15706—2012，定义3.5] 3.1.11 危险 hazard 潜在的伤害源。 注1：“危险”一词可由其起源(例如：机械危险和电气危险)，或其潜在伤害的性质(例如：电击危险、切割危险、中毒危险和火灾危险)进行限定。 注2：本定义中的危险包括： ——在机器的预定使用期间，始终存在的危险(例如：危险运动部件的运动、焊接过程中产生的电弧、不健康的姿势、噪声、高温)； ——或者意外出现的危险(例如：爆炸、意外启动引起的挤压危险，泄漏引起的喷射，加速/减速引起的坠落)。 注3：改写GB/T 15706—2012，定义3.6。 3.1.12 危险状况 hazardous situation 人员暴露于具有至少一种危险的环境。 注：这类暴露可能立即或在一定时间之后对人员产生伤害。 [GB/T 15706—2012，定义3.10] 3.1.13 风险 risk 伤害发生概率和伤害发生的严重程度的组合。 [GB/T 15706—2012，定义3.12] 3.1.14 剩余风险 residual risk 采取保护措施之后仍然存在的风险 注1：见图2。 注2：改写GB/T 15706—2012，定义3.13。 3.1.15 风险评估 risk assessment 包括风险分析和风险评价在内的全过程。 [GB/T 15706—2012，定义3.17] 3.1.16 风险分析 risk analysis 机器限制的确定，危险识别和风险估计的组合。 [GB/T 15706—2012，定义3.15] 3.1.17 风险评价 risk evaluation 以风险分析为基础，判断是否已达到减小风险的目标。 [GB/T 15706—2012，定义3.16] 3.1.18 机器的预定使用 intended use of a machine 按照使用说明书提供的信息使用机器。 [GB/T 15706—2012，定义3.23] 3.1.19 可合理预见的误用 reasonably foreseeable misuse 不是按设计者预定的方法而是按照容易预见的人的习惯来使用机器。 [GB/T 15706—2012，定义3.24] 3.1.20 安全功能 safety function 其失效后会立即造成风险增加的机器功能。 [GB/T 15706—2012，定义3.30] 3.1.21 监控 monitoring 组件或元件执行其功能的能力下降或过程条件的改变而削弱风险减小能力时，确保保护措施被触发的安全功能。 3.1.22 可编程电子系统 programmable electronic system； PES 基于一个或多个可编程电子装置的控制、防护或监视系统，包括系统中所有的组件，如电源、传感器和其他输入装置，以及接触器及其他输出装置等。 注：改写IEC 61508-4：1998，定义3.3.2。 3.1.23 性能等级 performance level PL 用于规定控制系统安全相关部件在预期条件下执行安全功能的离散等级。 注：见4.5.1。 3.1.24 所需性能等级 required performance level PLr 每种安全功能为达到所需的风险减小所采用的性能等级(PL)。 注：见图2和A.1。 3.1.25 平均危险失效间隔时间 mean time to dangerous failure MTTFD 平均危险失效间隔时间期望。 注：改写GB 28526—2012，定义3.2.34。 3.1.26 诊断覆盖率 diagnostic coverage DC 诊断有效性的度量，可以是可诊断的危险失效的失效率与所有的危险失效的失效率之间的比率。 注1：诊断覆盖率存在于整个安全相关系统中或其部件中。例如：诊断覆盖率可存在于传感器、逻辑系统和/或执行组件中。 注2：改写IEC 61508-4：1998，定义3.8.6。 3.1.27 保护措施 protective measure 用于达到风险减小的措施。 示例1：通过设计者实现：本质安全设计、安全防护和附加保护措施、使用信息。 示例2：通过用户实现：组织(安全工作程序、监督、工作许可制度)、附加安全防护装置的提供和使用；个体防护装备的使用；培训。 注：改写GB/T 15706—2012，定义3.19。 3.1.28 任务时间 mission time TM SRP/CS预定使用的时段。 3.1.29 测试率 test rate rt SRP/CS中检测故障的自动检测频率，即诊断检测时间间隔的倒数。 3.1.30 要求率 demand rate rD 要求SRP/CS进行安全相关动作的频率。 3.1.31 维修率 repair rate rt 从在线检测发现危险失效或系统出现明显故障到系统/部件维修或替换后重启之间时间间隔的倒数。 注：维修时间不包括进行失效检测所需要的时间段。 3.1.32 机器控制系统 machine control system 响应来自机器元件、操作者、外部控制设备或它们的组合的输入信号，并产生输出信号使机器按照预定方式工作的系统。 注：机器控制系统可使用任何技术或各种技术的组合(例如：电气/电子、液压、气动、机械等)。 3.1.33 安全完整性等级 safety integrity level SIL 一种离散的等级(四种可能等级之一)，用于规定分配给E/E/PE安全相关系统的安全功能的安全完整性要求。在这里安全完整性等级4是最高的，安全完整性等级1是最低的。 [IEC 61508-4：1998，定义3.5.6] 3.1.34 有限可变语言 limited variability language； LVL 能够结合预定义和专用的库函数来实现安全要求规范的一种语言。 注1：GB/T 15969.3中给出了LVL(梯形逻辑、功能框图)的典型应用示例。 注2：采用LVL的典型系统示例：PLC。 注3：改写GB/T 21109.1—2007，定义3.2.81.1.2。 3.1.35 全可变语言 full variability language； FVL 能够实现多样功能和应用的一种语言。 示例：C，C＋＋、汇编语言。 注1：使用FVL的典型系统示例：嵌入式系统。 注2：在机械领域，FVL通常用在嵌入式软件中，很少用在应用软件中。 注3：改写GB/T 21109.1—2007，定义3.2.81.1.3。 3.1.36 应用软件 application software 由机器制造商完成的、面向应用的软件。通常包括逻辑序列、范围、表达式，它们控制着相应输入、输出计算和结果，以满足控制系统安全相关部件(SRP/CS)的要求。 3.1.37 嵌入式软件 embedded software 固件 firmware 系统软件 system software 由控制器制造商提供的作为系统的一部分，并且机器的使用者无法修改的软件。 注：嵌入式软件通常用FVL编写。 3.1.38 高要求或连续模式 high demand or continuous mode 一种操作模式，在该模式下，需要SRP/CS的频率大于每年一次，或者作为正常操作的一部分，安全相关控制功能使机器保持在安全状态。 注：改写IEC 62061：2012，定义3.2.27。 3.1.39 经使用证明 proven in use 以针对一个组件的特定配置既往运行的分析为基础，证明危险系统性失效的可能性足够低，以致每个使用该元件的安全功能都能达到所需性能等级(PLr)。 注：改写GB/T 20438.4—2017，定义3.8.18。 3.2 符号及缩略语 见表1。 表1 符号及缩略语 符号及缩略语 描述 定义或出处 a、b、c、d、e 性能等级的指标 表2 AOPD 有源光电保护装置（如光幕） 附录H B、1、2、3、4 类别的指标 表6 B10D 直到有10％元件危险失效时的周期数（针对气动元件和机电元件） 附录C Cat. 类别 3.1.2 CC 换流器 附录I CCF 共因失效 3.1.6 DC 诊断覆盖率 3.1.26 DCavg 平均诊断覆盖率 E.2 F、F1、F2 暴露于危险的频率和/或时间 A.2.2 FB 功能模块/功能块 4.6.3 FVL 全可变语言 3.1.35 FMEA 失效模式及影响分析 7.2 I、I1、I2 输入装置，例如：传感器 6.2 I、j 计算指数 附录D I/O 输入/输出 表E.1 iab、ibc 相互连接方式 图4 K1A、K1B 接触器 附录I L、L1、L2 逻辑单元 6.2 LVL 有限可变语言 3.1.34 M 电动机 附录I MTTF 平均失效间隔时间 附录C MTTF 平均危险失效间隔时间 3.1.25 n、N、 项目编号 6.3、D.1 Nlow 在SRP/CS组合中，性能等级为PLlow的SRP/CS的数量 6.3 nop 年平均操作次数 附录C O、O1、O2、OTE 输出装置，如：执行器 6.2 P、P1、P2 避免危险的概率 A.2.3 PES 可编程电子系统 3.1.22 PFHD 每小时平均危险失效概率 表2、表K.1 PL 性能等级 3.1.23 PLC 可编程逻辑控制器 附录I PLlow SRP/CS组合中SRP/CS的最低性能等级 6.3 PLr 所需性能等级 3.1.24 rD 要求率 3.1.30 rt 测试率 3.1.29 RS 旋转传感器 附录I S、S1、S2 伤害的严重程度 A.2.1 SW1A、SW1B、SW2 位置开关 附录I SIL 安全完整性等级 表3 SRASW 安全相关应用软件 4.6.3 SRESW 安全相关嵌入式软件 4.6.2 SRP 安全相关部件 一般要求 SRP/CS 控制系统安全相关部件 3.1.1 TE 测试设备 6.2 TM 任务时间 3.1.28 T10D 直到有10％元件危险失效时的平均时间 附录C 4 设计方面的考虑 4.1 设计中的安全目标 SRP/CS的设计和构造应充分考虑GB/T 15706中的原则(见图1和图3)。还应考虑所有预定使用和可合理预见的误用。 开始 确定机械的限制(见5.3a) 危险识别(见第4章和5.4a) 风险估计(见5.5a) 风险评价(见5.6a) 根据GB/T 15706进行的风险评估 是 否 是否产生其他危险? 结束 风险减小是否已足够? 危险的风险减小过程： 1)通过本质安全设计； 2)通过安全防护装置； 3)通过使用信息。 (见图1a) 所选的保护措施是否依靠控制系统? 控制系统安全相关部件(SRP/CS)的迭代设计过程(见图3b) a 参见GB/T 15706—2012。 b 参见本部分。 图1 风险评估/风险减小概况 4.2 风险减小策略 4.2.1 概述 GB/T 15706—2012中6.1给出了关于机器风险减小的策略。GB/T 15706—2012中6.2(本质安全设计措施)及6.3(安全防护和附加保护措施)给出了更进一步的指导。风险减小策略涵盖了机器的全生命周期。 机器的危险分析和风险减小过程要求通过以下措施逐步消除或减小危险： ——通过设计消除危险或减小风险(见GB/T 15706—2012中6.2)； ——通过防护装置和可能的附加保护措施减小风险(见GB/T 15706—2012中6.3)； ——通过使用信息中关于剩余风险的规定减小风险(见GB/T 15706—2012中6.4)。 4.2.2 控制系统对风险减小的作用 遵循机器总体设计程序的目的是达到安全目标(见4.1)。设计可提供所需风险减小的SRP/CS是机器总体设计过程的子过程。 SRP/CS以能达到所需的风险减小的PL来提供安全功能。就提供安全功能来说，无论作为本质安全设计的一部分，还是作为联锁防护装置或保护装置的控制器，SRP/CS的设计都是风险减小策略的一部分。该设计过程是一个迭代的过程，见图1和图3。 注：控制系统的非安全相关部件或机器的纯功能性元件无需采用此风险减小策略(见GB/T 35081—2018中第3章)。 对于每种安全功能，应在安全要求规范中规定和记录其特征(见第5章)和所需性能等级。 本部分中的性能等级定义为每小时危险失效的概率。性能等级分为5级，从最低PL＝a到最高PL＝e，各自对应一个明确的每小时危险失效概率范围(见表2)。 为了实现一个PL，除了定量因素外，也需满足PL在定性方面的相关要求(见4.5)。 表2 性能等级(PL) PL 平均每小时危险失效概率(PFHD) 1/h a ≥10－5～＜10－4 b ≥3×10－6～＜10－5 c ≥10－6～＜3×10－6 d ≥10－7～＜10－6 e ≥10－8～＜10－7 从对机器进行风险评估(见GB/T 15706)开始，设计者应确定需要由SRP/CS执行的每一种相关的安全功能对风险减小的作用。这种对风险减小的作用并不涵盖受控机器的全部风险，例如：并不考虑机械压力机或清洗机的全部风险，而是考虑采用特定的安全功能减小的那一部分风险。此类功能的示例，如压力机上的电敏保护装置或清洗机门锁功能触发的停止功能。 风险减小可通过采用各种保护措施(SRP/CS及非SRP/CS)来实现，最终达到安全状态(见图2)。 说明： Rh——对于特定危险状况，采用保护措施前的风险； Rr——需要保护措施减小的风险； Ra——保护措施实际减小的风险； 1——方案1：绝大部分风险减小由保护措施(如机械措施)实现，小部分由SRP/CS实现； 2——方案2：绝大部分风险减小由SRP/CS(如光幕)实现，小部分由保护措施(如机械措施)实现； 3——充分减小的风险； 4——没有充分减小的风险； R——风险； a——实施方案1和方案2后的剩余风险； b——充分减小的风险； R1SRP/CS R2SRP/CS——SRP/CS的安全功能实现的风险减小； R1M、R2M——SRP/CS之外的保护措施实现的风险减小(如机械措施)。 注：关于风险减小的更多信息见GB/T 15706。 图2 每种危险状况的风险减小过程概况 自图1 识别由SRP/CS执行的安全功能 规定每种安全功能所要求的特征(见第5章) 针对选取的每种安全功能 确定所需性能等级PLr(见4.3和附录A) 安全功能的设计和技术实现：识别执行安全功能的安全相关部件(见4.4) 考虑以下因素评估性能等级PL(见4.5)： ——类别(见第6章)； ——MTTFD(见附录C和附录D)； ——DC(见附录E)； ——CCF(见附录F)； ——系统性失效(见附录G)； ——如果有软件：以上安全相关部件的软件(见4.6和附录J)； 验证安全功能的PL：PL≥PLr(见4.7) 否 是 确认(见第8章a)：是否满足所有要求? 是否分析了所有安全功能? 至图1 a GB/T 16855.2提供了确认的附加帮助。 图3 控制系统安全相关部件(SRP/CS)的迭代设计过程 4.3 确定所需性能等级(PLr) 对于选取的每种由SRP/CS执行的安全功能，应确定和记录所需性能等级(PLr)(确定PLr的指南见附录A)。所需性能等级的确定是风险评估的结果，并且参考了控制系统安全相关部件实现的风险减小的量(见图2)。 要求SRP/CS实现的风险减小的量越大，PLr就越高。 4.4 SRP/CS的设计 确定机器安全功能是风险减小过程的一部分，这也包括确定控制系统的安全功能，例如：防止意外启动。 一种安全功能可能由一个或多个SRP/CS来实现，几种安全功能可能由一个或多个SRP/CS来共同实现(例如：逻辑单元、动力控制组件)。单个SRP/CS也可能执行多种安全功能及标准控制功能。设计者可能会单独使用或组合使用任何可用的技术。SRP/CS也可能提供操作功能(例如：AOPD作为循环启动的一种方式)。 图4中给出的典型安全功能图示说明了控制系统安全相关部件(SRP/CS)由以下几方面组成： ——输入(SRP/CSa)； ——逻辑/处理(SRP/CSb)； ——输出/动力控制组件(SRP/CSc)； ——相互连接方式(iab，ibc)(例如：电学的、光学的)。 注1：在同一机器内，重要的是区别不同安全功能以及执行这些安全功能的SRP/CS。 识别控制系统的安全功能之后，设计者应识别出SRP/CS(见图1和图3)，必要时还应把它们分配给输入、逻辑和输出，以及有冗余时的某具体通道，然后评估性能等级PL(见图3)。 注2：指定架构在第6章中给出。 注3：安全相关部件包括所有的相互连接方式。 说明： I——输入(例如：限位开关、传感器、AOPD)； L——逻辑； O——输出(例如：阀、接触器、换流器)； 1——触发事件(例如：手动致动按钮、打开防护装置、中断AOPD光束)； 2——机器执行器(例如：电动机、气缸)。 图4 处理典型安全功能的控制系统安全相关部件组合的示意图 4.5 所需性能等级PL的评估及其与SIL的关系 4.5.1 性能等级PL 在本部分中，安全相关部件执行安全功能的能力通过确定性能等级PL来表示。 对于所选的执行安全功能的每个SRP/CS和/或SRP/CS组合，都应完成其PL的估计。 应通过估计以下参数来确定SRP/CS的PL： ——单个元件MTTFD的值(见附录C和附录D)； ——DC(见附录E)； ——CCF(见附录F)； ——结构(见第6章)； ——安全功能在故障条件下的表现(见第6章)； ——安全相关软件(见4.6和附录J)； ——系统性失效(见附录G)； ——预期环境条件下，执行安全功能的能力。 注1：其他参数，例如：运行情况、要求率、测试率等都有一定的影响。 这些参数可按照与评估过程的关系分为以下两组： a) 可定量的参数(单个元件的MTTFD值、DC、CCF、结构)； b) 影响SRP/CS表现的不可定量参数(故障条件下安全功能的行为、安全相关软件、系统性失效以及环境条件)。 可定量的参数中，可靠性(如MTTFD、结构)的影响随所采用的技术而变化。例如：采用某种技术的具有高可靠性的单通道安全相关部件，相比采用其他技术、但具有较低可靠性的容错结构中，(在一定限制下)可能提供相同或更高的PL。 任何类型系统(例如：复杂结构)PL的可定量参数有几种方法来估计，例如：马尔可夫模型、广义随机Petri网(GSPN)、可靠性方框图(见GB/T 20438等)。 为更容易评价PL的可定量参数，本部分给出了一种基于5种指定架构定义的简化的方法，这些指定架构满足特定设计准则和故障条件下的表现(见4.5.4)。 对于按照第6章设计的SRP/CS或SRP/CS组合，危险失效的平均概率可根据图5的方法和附录A～附录H、附录J和附录K给出的程序来估计。 对于偏离指定架构的SRP/CS，应提供详细计算以证明其达到了所需性能等级(PLr)。 在SRP/CS被当作简单结构，且所需性能等级为a～c的应用中，可采用设计基本原理来定性估计PL(也可见4.5.5)。 注2：对于复杂控制系统的设计，例如：设计用于执行安全功能的PES，可适当采用其他相关标准(例如：GB/T 19436或GB/T 20438)。 |
联系我们
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
微信联系客服
|
| 关于我们 | 联系我们 | 收费付款 |
| 服务热线：400-001-5431 | 电话：010-8572 5110 | 传真：010-8581 9515 | Email: bz@bzfyw.com | |
版权所有： 北京悦尔信息技术有限公司 2008-2020 京ICP备17065875号-1
51La
|
| 本页关键词： |
| GB/T 16855.1-2018, GB 16855.1-2018, GBT 16855.1-2018, GB/T16855.1-2018, GB/T 16855.1, GB/T16855.1, GB16855.1-2018, GB 16855.1, GB16855.1, GBT16855.1-2018, GBT 16855.1, GBT16855.1 |