Amendment 1 - Safety of machinery - Functional safety of safety-related electrical, electronic and programmable electronic control systems

Amendement 1 - Securité des machines - Sécurité fonctionnelle des systèmes de commande électriques, électroniques et électroniques programmables relatifs à la sécurité

General Information

Status
Published
Publication Date
12-Nov-2012
Current Stage
DELPUB - Deleted Publication
Completion Date
22-Mar-2021
Ref Project

Buy Standard

Standard
IEC 62061:2005/AMD1:2012 - Amendment 1 - Safety of machinery - Functional safety of safety-related electrical, electronic and programmable electronic control systems
English and French language
18 pages
sale 15% off
Preview
sale 15% off
Preview

Standards Content (sample)

IEC 62061
Edition 1.0 2012-11
INTERNATIONAL
STANDARD
NORME
INTERNATIONALE
AMENDMENT 1
AMENDEMENT 1
Safety of machinery – Functional safety of safety-related electrical, electronic
and programmable electronic control systems
Sécurité des machines – Sécurité fonctionnelle des systèmes de commande
électriques, électroniques et électroniques programmables relatifs à la sécurité
IEC 62061:2005/A1:2012
---------------------- Page: 1 ----------------------
THIS PUBLICATION IS COPYRIGHT PROTECTED
Copyright © 2012 IEC, Geneva, Switzerland

All rights reserved. Unless otherwise specified, no part of this publication may be reproduced or utilized in any form

or by any means, electronic or mechanical, including photocopying and microfilm, without permission in writing from

either IEC or IEC's member National Committee in the country of the requester.

If you have any questions about IEC copyright or have an enquiry about obtaining additional rights to this publication,

please contact the address below or your local IEC member National Committee for further information.

Droits de reproduction réservés. Sauf indication contraire, aucune partie de cette publication ne peut être reproduite ni

utilisée sous quelque forme que ce soit et par aucun procédé, électronique ou mécanique, y compris la photocopie et les

microfilms, sans l'accord écrit de la CEI ou du Comité national de la CEI du pays du demandeur.

Si vous avez des questions sur le copyright de la CEI ou si vous désirez obtenir des droits supplémentaires sur cette

publication, utilisez les coordonnées ci-après ou contactez le Comité national de la CEI de votre pays de résidence.

IEC Central Office Tel.: +41 22 919 02 11
3, rue de Varembé Fax: +41 22 919 03 00
CH-1211 Geneva 20 info@iec.ch
Switzerland www.iec.ch
About the IEC

The International Electrotechnical Commission (IEC) is the leading global organization that prepares and publishes

International Standards for all electrical, electronic and related technologies.
About IEC publications

The technical content of IEC publications is kept under constant review by the IEC. Please make sure that you have the

latest edition, a corrigenda or an amendment might have been published.
Useful links:

IEC publications search - www.iec.ch/searchpub Electropedia - www.electropedia.org

The advanced search enables you to find IEC publications The world's leading online dictionary of electronic and

by a variety of criteria (reference number, text, technical electrical terms containing more than 30 000 terms and

committee,…). definitions in English and French, with equivalent terms in

It also gives information on projects, replaced and additional languages. Also known as the International

withdrawn publications. Electrotechnical Vocabulary (IEV) on-line.

IEC Just Published - webstore.iec.ch/justpublished Customer Service Centre - webstore.iec.ch/csc

Stay up to date on all new IEC publications. Just Published If you wish to give us your feedback on this publication

details all new publications released. Available on-line and or need further assistance, please contact the

also once a month by email. Customer Service Centre: csc@iec.ch.
A propos de la CEI

La Commission Electrotechnique Internationale (CEI) est la première organisation mondiale qui élabore et publie des

Normes internationales pour tout ce qui a trait à l'électricité, à l'électronique et aux technologies apparentées.

A propos des publications CEI

Le contenu technique des publications de la CEI est constamment revu. Veuillez vous assurer que vous possédez

l’édition la plus récente, un corrigendum ou amendement peut avoir été publié.
Liens utiles:

Recherche de publications CEI - www.iec.ch/searchpub Electropedia - www.electropedia.org

La recherche avancée vous permet de trouver des Le premier dictionnaire en ligne au monde de termes

publications CEI en utilisant différents critères (numéro de électroniques et électriques. Il contient plus de 30 000

référence, texte, comité d’études,…). termes et définitions en anglais et en français, ainsi que

Elle donne aussi des informations sur les projets et les les termes équivalents dans les langues additionnelles.

publications remplacées ou retirées. Egalement appelé Vocabulaire Electrotechnique

International (VEI) en ligne.
Just Published CEI - webstore.iec.ch/justpublished
Service Clients - webstore.iec.ch/csc
Restez informé sur les nouvelles publications de la CEI.

Just Published détaille les nouvelles publications parues. Si vous désirez nous donner des commentaires sur

Disponible en ligne et aussi une fois par mois par email. cette publication ou si vous avez des questions

contactez-nous: csc@iec.ch.
---------------------- Page: 2 ----------------------
IEC 62061
Edition 1.0 2012-11
INTERNATIONAL
STANDARD
NORME
INTERNATIONALE
AMENDMENT 1
AMENDEMENT 1
Safety of machinery – Functional safety of safety-related electrical, electronic
and programmable electronic control systems
Sécurité des machines – Sécurité fonctionnelle des systèmes de commande
électriques, électroniques et électroniques programmables relatifs à la sécurité
INTERNATIONAL
ELECTROTECHNICAL
COMMISSION
COMMISSION
ELECTROTECHNIQUE
PRICE CODE
INTERNATIONALE
CODE PRIX J
ICS 13.110; 25.040.99; 29.020 ISBN 978-2-83220-441-2

Warning! Make sure that you obtained this publication from an authorized distributor.

Attention! Veuillez vous assurer que vous avez obtenu cette publication via un distributeur agréé.

® Registered trademark of the International Electrotechnical Commission
Marque déposée de la Commission Electrotechnique Internationale
---------------------- Page: 3 ----------------------
– 2 – 62061 Amend. 1  IEC:2012
FOREWORD

This amendment has been prepared by IEC technical committee 44: Safety of machinery –

Electrotechnical aspects.
The text of this amendment is based on the following documents:
CDV Report on voting
44/655/CDV 44/663/RVC

Full information on the voting for the approval of this amendment can be found in the report

on voting indicated in the above table.

The committee has decided that the contents of this amendment and the base publication will

remain unchanged until the stability date indicated on the IEC web site under

"http://webstore.iec.ch" in the data related to the specific publication. At this date, the

publication will be
• reconfirmed,
• withdrawn,
• replaced by a revised edition, or
• amended.
_____________
INTRODUCTION
Delete the tenth paragraph of this clause.
Delete the following text below Figure 1:
Information on the recommended application of IEC 62061 and ISO 13849-1
(under revision)
Replace the text of the paragraph above Table 1 by the following:

IEC 62061 and ISO 13849-1 specify requirements for the design and implementation of

safety-related control systems of machinery. The use of either of these standards, in

accordance with their scopes, can be presumed to fulfil the relevant essential safety

requirements. IEC/TR 62061-1 provides guidance on the application of IEC 62061 and

ISO 13849-1 in the design of safety-related control systems for machinery.
Delete the note above Table 1.
Delete Table 1.
1 Scope
Replace the text of Note 2 by the following:

NOTE 2 In this standard, it is presumed that the design of complex programmable electronic subsystems or

subsystem elements conforms to the relevant requirements of IEC 61508 and uses Route 1 (see

IEC 61508-2:2010, 7.4.4.2). It is considered that Route 2H (see IEC 61508-2:2010, 7.4.4.3) is not suitable for

---------------------- Page: 4 ----------------------
62061 Amend. 1  IEC:2012 – 3 –

general machinery. Therefore, this standard does not deal with Route 2 . This standard provides a methodology for

the use, rather than development, of such subsystems and subsystem elements as part of a SRECS.

2 Normative references

Replace the references to ISO 12100-1:2003 and ISO 12100-2:2003 by the following new

reference:

ISO 12100:2010, Safety of machinery – General principles for design – Risk assessment and

risk reduction
Replace the existing reference to ISO 13849-1 by the following new reference:

ISO 13849-1:2006, Safety of machinery – Safety-related parts of control systems – Part 1:

General principles for design
3.2.5
subsystem
Replace definition 3.2.5 by the following new definition:
3.2.5
subsystem

entity of the top-level architectural design of the SRECS where a dangerous failure of any

subsystem will result in a dangerous failure of a safety-related control function

[IEC 61508-4, 3.4.4 modified]

NOTE 1 A complete subsystem can be made up from a number of identifiable and separate subsystem elements,

which when put together implement the function blocks allocated to the subsystem.

NOTE 2 This differs from common language where “subsystem” may mean any sub-divided part of an entity, the

term “subsystem” is used in this standard within a strongly defined hierarchy of terminology: “subsystem” is the first

level subdivision of a system. The parts resulting from further subdivision of a subsystem are called “subsystem

elements”.
3.2.7
low complexity component
Replace the reference above Note 1 by the following new reference:
[IEC 61508-4, 3.4.3 modified]
3.2.9
functional safety
Replace the reference by the following new reference:
[IEC 61508-4, 3.1.12 modified]
3.2.10
hazard (from machinery)
Replace the reference by the following new reference:
[ISO 12100, 3.6 modified]
3.2.11
hazardous situation
Replace the reference by the following new reference:
[ISO 12100, 3.10 modified]
---------------------- Page: 5 ----------------------
– 4 – 62061 Amend. 1  IEC:2012
3.2.12
protective measure
Replace the reference by the following new reference:
[ISO 12100, 3.19 modified]
3.2.13
risk
Replace the reference by the following new reference:
[ISO 12100, 3.12]
3.2.15
safety function
Replace the reference by the following new reference:
[ISO 12100, 3.30]
3.2.19
safety integrity
Replace the reference by the following new reference:
[IEC 61508-4, 3.5.4 modified]
3.2.20
hardware safety integrity
Replace the reference by the following new reference:
[IEC 61508-4, 3.5.7 modified]
3.2.21
software safety integrity
Replace the reference by the following new reference:
[IEC 61508-4, 3.5.5 modified]
3.2.22
systematic safety integrity
Replace the reference by the following new reference:
[IEC 61508-4, 3.5.6 modified]
3.2.23
Safety Integrity Level
SIL
Replace the reference by the following new reference:
[IEC 61508-4, 3.5.8 modified]
3.2.26
low demand mode
Replace the first paragraph by the following new paragraph:

mode of operation in which the frequency of demands on a SRECS is no greater than one per

year
3.2.27
high demand or continuous mode
Replace the first paragraph by the following new paragraph:
---------------------- Page: 6 ----------------------
62061 Amend. 1  IEC:2012 – 5 –

mode of operation in which the frequency of demands on a SRECS is greater than one per

year or the SRCF retains the machine in a safe state as part of normal operation
Replace the reference by the following new reference:
[IEC 61508-4, 3.5.16 modified]
3.2.28
Probability of dangerous Failure per Hour
PFH
Replace definition 3.2.28 by the following new definition:
3.2.28
Probability of dangerous Failure per Hour
PFH

average probability of a dangerous failure per hour of a safety related system/subsystem to

perform the specified safety function over a given period of time

NOTE PFH should not be confused with probability of dangerous failure on demand (PFD).

3.2.29
target failure value
Replace the reference by the following new reference:
[IEC 61508-4, 3.5.17 modified]
3.2.35
architecture
Replace the reference by the following new reference:
[IEC 61508-4, 3.3.4 modified]
3.2.37
proof test
Replace the first paragraph by the following new paragraph:

periodic test performed to detect dangerous hidden failures and degradation in a SRECS and

its subsystems so that, if necessary, the SRECS and its subsystems can be restored to an “as

new” condition or as close as practical to this condition
3.2.38
diagnostic coverage
Replace the first paragraph by the following new paragraph:
fraction of dangerous failures detected by automatic on-line diagnostic tests
Add, at the end of this subclause, new Note 2 as follows:

NOTE 2 The fraction of detected dangerous failures is computed to be the rate of dangerous failures that are

detected by automatic on-line diagnostic tests divided by the rate of total dangerous failures.

and number the existing note as Note 1.
3.2.40
dangerous failure
Delete the reference “[IEC 61508-4, 3.6.7 modified]”.
3.2.41
safe failure
Delete the reference “[IEC 61508-4, 3.6.8 modified]”.
---------------------- Page: 7 ----------------------
– 6 – 62061 Amend. 1  IEC:2012
3.2.43
Common Cause Failure
CCF
Replace, in the first paragraph, the word “coincident” by “concurrent”.
5.2.3 Functional requirements specification for SRCFs

Replace the existing text of this subclause (including 5.2.3.1 and 5.2.3.2) by the following:

The functional requirements specification for SRCFs shall describe details of each SRCF to

be performed including, as applicable:

– the condition(s) (e.g. operating mode) of the machine in which the SRCF shall be active or

disabled;

– the priority of those functions that can be simultaneously active and that can cause

conflicting action;
– the frequency of operation of each SRCF;
– the required response time of each SRCF;
– the interface(s) of the SRCFs to other machine functions;
– the required response times (e.g. input and output devices);
– a description of each SRCF;

– a description of fault reaction function(s) and any constraints on, for example, re-starting

or continued operation of the machine in cases where the initial fault reaction is to stop

the machine;

– a description of the operating environment (e.g. temperature, humidity, dust, chemical

substances, mechanical vibration and shock);
– tests and any associated facilities (e.g. test equipment, test access ports);

– rate of operating cycles, duty cycle, and/or utilisation category, for electromechanical

devices intended for use in the SRCF.

NOTE 1 In addition to the requirements of IEC 61000-6-2, when a SRECS is intended for use in an industrial

environment, electromagnetic (EM) immunity levels are given in IEC 61326-3-1. SRECS intended for use in another

EM environment (e.g. residential) should have immunity levels based on those specified in different EMC standards

(e.g., for a residential environment, IEC 61000-6-1).

NOTE 2 When specifying EM immunity levels it is necessary to consider whether the levels used in different EMC

standards cover cases which can occur in a SRECS application even with a low probability of occurrence.

NOTE 3 EM immunity performance criterion for functional safety of a SRECS is given in 6.4.3.

6.4 Requirements for systematic safety integrity of the SRECS
Delete the note.
6.4.2 Requirements for the control of systematic faults
Replace Note 2 by the following:
NOTE 2 Further information can be found in IEC 61784-3 and IEC 61508-2.
6.4.3 Electromagnetic (EM) immunity
Replace, in this subclause, “Annex E” by “IEC 61326-3-1”.
---------------------- Page: 8 ----------------------
62061 Amend. 1  IEC:2012 – 7 –
Replace, in the note of this subclause, “Annex E” by “IEC 61326-3-1”.
6.6.3.1 General
Replace the last sentence of this subclause by the following:

The SIL that can be achieved by the SRECS is less than or equal to the lowest SILCLs of any

of the subsystems that comprise the SRECS.
6.6.3.4 Systematic safety integrity
Delete subclause 6.6.3.4.
6.7.2.1
Replace this subclause by the following:

6.7.2.1 The subsystem shall be realised by either selection (see 6.7.3) or design (see 6.7.4)

in accordance with its safety requirements specification (see 6.6.2.1.7), taking into account all

the requirements of 6.2. Subsystem(s) incorporating complex components shall comply with

IEC 61508-2 and IEC 61508-3 as appropriate for the required SIL and the design shall use

Route 1 (see IEC 61508-2:2010, 7.4.4.2).
EXCEPTION: Where a subsystem design includes a complex component as a subsystem
element, 6.7.4.2.3 is applicable.

NOTE In this standard, it is presumed that the design of complex programmable electronic subsystems or

subsystem elements conforms to the relevant requirements of IEC 61508 and uses Route 1 (see IEC 61508-

2:2010, 7.4.4.2). It is considered that Route 2 (see IEC 61508-2:2010, 7.4.4.3) is not suitable for general

machinery. Therefore, this standard does not deal with Route 2H. This standard provides a methodology for the

use, rather than development, of such subsystems and subsystem elements as part of a SRECS.

6.7.2.2
Replace Note 1 of item b) by the following:

NOTE 1 For electromechanical subsystems, the probability of failure should be estimated taking into account the

number of operating cycles declared by the manufacturer and the duty cycle (see 5.2.3). This information should be

based upon a B10 value (see IEC 61649) under the operating conditions stated by the manufacturer. See for

example IEC 60947-4-1, Annex K.
6.7.3.2
Add the following text at the end of the first sentence:
and the design shall use Route 1 (see IEC 61508-2:2010, 7.4.4.2).
Add the following note at the end of the subclause:

NOTE In this standard, it is presumed that the design of complex programmable electronic subsystems or

subsystem elements conforms to the relevant requirements of IEC 61508 and uses Route 1 (see

IEC 61508-2:2010, 7.4.4.2). It is considered that Route 2 (see IEC 61508-2:2010, 7.4.4.3) is not suitable for

general machinery. Therefore, this standard does not deal with Route 2 . This standard provides a methodology for

the use, rather than development, of such subsystems and subsystem elements as part of a SRECS.

6.7.4.2.2

Replace, in the second dashed item of item b), “7.4.7.5 to 7.4.7.12” by “7.4.10”.

6.7.4.2.3
Replace this subclause by the following:
---------------------- Page: 9 ----------------------
– 8 – 62061 Amend. 1  IEC:2012
6.7.4.2.3 Where the design of a subsystem incorporates a complex component (as a
subsystem element) which satisfies all relevant requirements of IEC 61508-2 and

IEC 61508-3 in relation to the SILCL and uses Route 1 (see IEC 61508-2:2010, 7.4.4.2), it

can be considered as a low complexity component in the context of a subsystem design since

its relevant failure modes, behaviour on detection of a fault, rate of failure, and other safety-

related information are known. Such components shall only be used in accordance with their

specification and the relevant information for use provided by their supplier.

NOTE In this standard, it is presumed that the design of complex programmable electronic subsystems or

subsystem elements conforms to the relevant requirements of IEC 61508 and uses Route 1 (see

IEC 61508-2:2010, 7.4.4.2). It is considered that Route 2 (see IEC 61508-2:2010, 7.4.4.3) is not suitable for

general machinery. Therefore, this standard does not deal with Route 2 . This standard provides a methodology for

the use, rather than development, of such subsystems and subsystem elements as part of a SRECS.

6.7.4.4.2
Replace the note of item c) by the following:

NOTE For electromechanical subsystems, the probability of failure should be estimated taking into account the

number of operating cycles declared by the manufacturer and the duty cycle (see 5.2.3). This information should be

based upon a B10 value (see IEC 61649) under the operating conditions stated by the manufacturer. See for

example IEC 60947-4-1, Annex K.
6.7.6.5
Delete this entire subclause and Table 6.
6.7.7.2
Delete the following text at item b):
(see references in Annex D)
Delete item c).
Existing item d) becomes item c).
Add the following new notes at the end of the subclause:

NOTE 1 Information of the failure mode ratios for electrical/electronic component can be found in several sources

including:

– MIL-HDBK 217F(Notice 2) Reliability Prediction of Electronic Equipment (28-02-95), Parts Stress Analysis

– MIL-HDBK 217F(Notice 2) Reliability Prediction of Electronic Equipment (28-02-95), Appendix A, Parts Count

Reliability Prediction

– SN 29500 Part 7, Failure Rates of Components, Expected Values for Relays, April 1992

– SN 29500 Part 11, Failure Rates of Components, Expected Values for Contactors, August 1990

– The documents in the SN 29500 series are publicly available and can be obtained from:

• Siemens AG, CT SR SI
Otto-Hahn-Ring 6
D-81739 München:

– UTE C 80-810 RDF 2000: Reliability data handbook – A universal model for reliability prediction of electronic

components, PCBs and equipment
– Failure mode/mechanism distributions FMD-91, RAC 1991.

NOTE 2 It is recommended to use failure rate data and failure mode ratio data provided by manufacturers.

NOTE 3 Some component standards have relevant data (e.g. Annex K of IEC 60947-4-1).

NOTE 4 Where a detailed analysis of each failure mode is not practically possible, a division of failures into 50 %

safe, 50 % dangerous is generally accepted.

NOTE 5 Lists of faults to be considered for mechanical, pneumatic, hydraulic and electrical technologies are

given in Annexes A, B, C and D of ISO 13849-2.
---------------------- Page: 10 ------------------
...

Questions, Comments and Discussion

Ask us and Technical Secretary will try to provide an answer. You can facilitate discussion about the standard in here.