Rockwell Automation Allen-Bradley Kinetix 6000, Руководство пользователя

Страница: 242 / 268

Publication 2094-UM001A-EN-P — September 2006
242 Integrating Resistive Brake Modules with Kinetix 6000 Drives
Risk Assessment
The European safety standard (EN 1050) and U.S. technical report
(ANSI B11.TR3) explain the process of risk assessment, which must be
conducted by the machine builder. This is done by analyzing the tasks
that people perform on and around the machine. This includes
functions such as operation, set up, and maintenance. For the purpose
of this appendix, the light curtain or gate interlock is intended to focus
on the operation and perhaps loading/unloading of a machine.
Additional protective measures must be identified by the risk
assessment.
Machinery Directive EN 954-1 Safety Related Parts of Control Systems
defines how to determine the safety requirements by categorizing the
risk. This standard outlines the design of fail-safe control circuits by
categorizing five levels of risk. It is deemed the machine designers
responsibility to objectively identify a risk level for a particular
machine and design all safety related systems to that level. The five
categories are as follows:
Category B : Safety devices and control systems, as a minimum, must
be designed, selected, and assembled to meet the operational
requirements of design limits and influence of the processed materials
and other external influences listed as: effects of vibration, loss of
power supply, and external fields.
Category 1 : All conditions of Category B apply, but the safety related
part of the control system must use well tried principles and
components (refer to 7.2.2: prEN951-1). The use of single electronic
components, electronic logic or software is not considered adequate,
even at this level.
Category 2 : All conditions of Category B apply, but in addition, the
machine shall be prevented from starting if a fault is detected upon
power up. This suggests the use of an interface relay with redundancy
and self-checking on energization. Single channel operation is
permitted providing that the input devices (E-Stop buttons, gate
switches, etc.) are tested for operation on a regular basis. If regular
testing cannot be guaranteed, then the designer has little choice but to
opt for two channel control.
Category 3 : All conditions of Category B apply, but the complete
safety control system shall be designed so that any single fault shall
not lead to the loss of the safety function and, where practical, the
single fault shall be detected. This now calls for not only redundancy
in the interface relay but also in the input devices pointing to dual
channel systems.