EN 16590-2:2014

2003-01.Slovenski inštitut za standardizacijo. Razmnoževanje celote ali delov tega standarda ni dovoljeno.Traktorji ter kmetijski in gozdarski stroji - Varnostni deli krmilnih sistemov - 2. del: Faza koncepta (ISO 25119-2:2010, spremenjen)Sicherheit von Land- und Forstmaschinen - Sicherheitsbezogene Teile von Steuerungen - Teil 2: Konzeptphase (ISO 25119-2:2010 modifiziert)Tracteurs et matériels agricoles et forestiers - Parties des systèmes de commande relatives à la sécurité - Partie 2: Phase de projet (ISO 25119-2 modifié)Tractors and machinery for agriculture and forestry - Safety-related parts of control systems - Part 2: Concept phase (ISO 25119-2:2010 modified)65.060.01Kmetijski stroji in oprema na splošnoAgricultural machines and equipment in general35.240.99IT applications in other fieldsICS:Ta slovenski standard je istoveten z:EN 16590-2:2014SIST EN 16590-2:2014en,fr,de01-julij-2014SIST EN 16590-2:2014SLOVENSKI
STANDARD
EUROPEAN STANDARD NORME EUROPÉENNE EUROPÄISCHE NORM
EN 16590-2
April 2014 ICS 35.240.99; 65.060.01 English Version
Tractors and machinery for agriculture and forestry - Safety-related parts of control systems - Part 2: Concept phase (ISO 25119-2:2010 modified)
Tracteurs et matériels agricoles et forestiers - Parties des systèmes de commande relatives à la sécurité - Partie 2: Phase de projet (ISO 25119-2:2010 modifié)
Sicherheit von Land- und Forstmaschinen - Sicherheitsbezogene Teile von Steuerungen - Teil 2: Konzeptphase (ISO 25119-2:2010 modifiziert) This European Standard was approved by CEN on 23 February 2014.
CEN members are bound to comply with the CEN/CENELEC Internal Regulations which stipulate the conditions for giving this European Standard the status of a national standard without any alteration. Up-to-date lists and bibliographical references concerning such national standards may be obtained on application to the CEN-CENELEC Management Centre or to any CEN member.
This European Standard exists in three official versions (English, French, German). A version in any other language made by translation under the responsibility of a CEN member into its own language and notified to the CEN-CENELEC Management Centre has the same status as the official versions.
CEN members are the national standards bodies of Austria, Belgium, Bulgaria, Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, Former Yugoslav Republic of Macedonia, France, Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, Netherlands, Norway, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, Sweden, Switzerland, Turkey and United Kingdom.
EUROPEAN COMMITTEE FOR STANDARDIZATION
COMITÉ EUROPÉEN DE NORMALISATION EUROPÄISCHES KOMITEE FÜR NORMUNG
CEN-CENELEC Management Centre:
Avenue Marnix 17,
B-1000 Brussels © 2014 CEN All rights of exploitation in any form and by any means reserved worldwide for CEN national Members. Ref. No. EN 16590-2:2014 ESIST EN 16590-2:2014

Designated architectures for SRP/CS . 18 A.1 General . 18 A.2 Category B (basic) . 18 A.3 Category 1 . 19 A.4 Category 2 . 19 A.5 Category 3 . 20 A.6 Category 4 . 22 Annex B (informative)
Simplified method to estimate channel MTTFdC . 24 SIST EN 16590-2:2014

Determination of diagnostic coverage (DC) . 27 C.1 General . 27 C.2 Estimation of the required DC . 27 C.3 Estimation of channel DC . 29 C.4 Calculation of channel DC . 30 C.5 Calculation of DC . 30 Annex D (informative)
Estimates for common-cause failure (CCF) . 31 Annex E (informative)
Systematic failure . 33 E.1 General . 33 E.2 Procedure for the control of systematic failures . 33 E.3 Procedure for the avoidance of systematic failures . 33 Annex F (informative)
Characteristics of safety functions . 36 F.1 General . 36 F.2 Start interlock . 36 F.3 Stop function . 36 F.4 Manual reset . 36 F.5 Start and restart . 37 F.6 Response time . 37 F.7 Safety-related parameters . 37 F.8 External control function . 37 F.9 Muting (manual suspension of safety functions) . 37 F.10 Operator warning . 37 Annex G (informative)
Example of a risk analysis . 38 G.1 Workflow. 38 G.2 Example risk analysis of an electro-hydraulic transmission for a self-propelled working machine (forage harvester) — Extract from a complete risk analysis . 38 G.2.1 System description . 38 G.2.2 Surrounding conditions . 39 G.2.3 System states and transitions . 39 G.2.4 System failures . 40 G.3 Assessment . 41 G.3.1 System failure — Stops unintentionally . 41 SIST EN 16590-2:2014

Relationship between this European Standard and the Essential Requirements of EU Machinery Directive 2006/42/EC . 43 Bibliography . 44
Key S severity E exposure to hazardous event C controllability QM quality measures a, b, c, d, e required agricultural performance level (AgPLr) Figure 1 — Determination of AgPLr SIST EN 16590-2:2014

Key
low MTTFdc
medium MTTFdc
high MTTFdc Figure 2 — Relationship between agricultural performance level, categories, DC, MTTFdC and SRL The AgPLr is shown on the vertical axis of Figure 2. The hardware categories are listed on the horizontal axis. Each category has an associated diagnostic coverage (DC), mean time to dangerous failure (MTTFdC) and software requirement level (SRL) for a given performance level. For the required AgPLr the designer shall select one hardware category. NOTE Choosing a higher category for a given AgPL could allow lower MTTFd and/or SRL. 7.3.2 Achieving the required AgPLr The system design requirements shall be derived from the safety goals and, if necessary, from information about the safe state defined in the risk analysis (e.g. switching off or maintain function). The selected design shall be verified in an appropriate manner for effectiveness. NOTE The effectiveness can be verified, for example, in clinics, studies, by test subjects, or by simulation. The measures can also be defined in standards. A safety function may be implemented by one or more safety-related parts of the control system. The designer may use any of the technologies available singularly, or in combination. A safety E/E/PES can be combined with a mechanical function (e.g. mechanically linked contacts). SIST EN 16590-2:2014

Key I input device (e.g. sensor) L logic O output device (e.g. actuator) SI interconnecting signal input SO interconnecting signal output Figure 3 — Diagram of combination of safety-related parts All interconnecting means are included in the safety-related parts. Each safety-related part of a safety-function control channel can consist of a different technology or technologies. Different technologies can be used for implementing within each safety-related part. EXAMPLE Input comprising a speed sensor linked to a light-activated signal converter. 7.3.3 Achievement of the performance level The selection of SRP/CS shall be made to achieve the required performance level characteristics. 7.4 Work products The work product of system design is the assignment of AgPL for the covered safety function, comprising the — selected category (see Annex A), — resulting MTTF (see Annex B), — resulting DC (see Annex C), — resulting SRL, — resulting CCF for categories 3 and 4 architectures (see Annex D), — consideration of systematic failure (see Annex E), and — consideration of other typical functions (see Annex F). SIST EN 16590-2:2014

Designated architectures for SRP/CS A.1 General Figure 3 and Figures A.1 to A.3 define the architecture required for each respective hardware category. All architectures apply well-tried safety principles, including — avoidance of certain faults, e.g. avoidance of short circuit by separation, — reducing the probability of faults, e.g. over-dimensioning or underrating of components, — controlling the fault mode, e.g. by ensuring an open circuit when it is vital to remove power in the event of fault (normally open contact), and — detecting faults very early. The use of well-tried components is recommended. A well-tried component for a safety-related application shall be a component which has been a) widely used in the past with successful results in similar applications, or b) made and verified using principles which demonstrate suitability and reliability for safety-related applications. Newly developed components may be considered as being equivalent to well-tried components if they correspond to b), above. NOTE 1 The figures do not show examples but general architectures. A deviation from these architectures is always possible. Nevertheless, any deviation from these categories will require justification, by means of appropriate analytical tools, that the architecture meets the required category. NOTE 2 Redundancy, e.g. redundant sensors, can be used to improve diagnostic coverage. A.2 Category B (basic) See Figure 3 for the designated architecture. Properties — DC = low. — MTTFdC for channel = low to medium, the use of well-tried components is recommended. — The consideration of common-cause failure is not relevant. — The occurrence of a single fault can lead to the loss of the safety function. — Not suitable for a single-point fail operational system. SIST EN 16590-2:2014

Key I input device (e.g. sensor) L logic O output device (e.g. actuator) TE test equipment (additional to logic) OTE output of test equipment SI interconnecting signal input SO interconnecting signal output m monitoring a Required to provide diagnostic coverage on logic, but not necessarily a separate channel. Figure A.1 — Designated architecture for category 2 SIST EN 16590-2:2014

Key I1, I2 input device (e.g. sensor) L1, L2 logic O1, O2 output device, e.g. actuator SI interconnecting signal input SO interconnecting signal output m monitoring c cross-monitoring Figure A.2 — Designated architecture for category 3 Properties — Input sensor, logic and output actuator faults are detected in the control logic. — DC = medium. — MTTFdC for channel
...