Validation needed

With EN ISO 13849-1 having been in place for some time as the standard for the safety-related parts of machine control systems, it is concerning that comparatively little attention has been given to one important aspect of this standard - the requirement for validation.Paul Laidler explains

For many years, the applicable standard for the safety related parts of machine control systems has been EN 954-1.

However, in recent times, the shortcomings of this standard - which includes its inability to deal with programmable or software safety systems - have become increasingly significant. For this reason a new standard, EN ISO 13849-1, was developed and it was initially planned that this would replace EN 954-1 at the end of 2009.

In fact, the change of approach introduced with EN ISO 13849-1 was so radical that machine builders and other interested parties successfully petitioned for a stay of execution and, as a result, it was agreed that EN 954-1 could remain in use until the end of 2011.

That date is just months away, and it is unlikely there will be any further extension.

This means machine builders need to be ready to work with EN ISO 13849-1 from 1st January 2012 (if they are not already using this standard) and that includes being ready to meet the requirements of Section 8, which states that 'the design of the SRP/CS (safety related parts of the control system) shall be validated'. The standard goes on to advise that details of the validation are given in EN ISO 13849-2, which we will return to shortly.

The requirement for validation should not come as a surprise to machine builders as validation is, in fact, already required by EN 954-1. There are good reasons for this, as a quick perusal of the HSE publication 'Out of Control' will reveal. Available as a free download from the HSE website, this document includes, in Section 4, an analysis of incidents connected with safety-related parts of control systems. The analysis reveals that poor design and implementation, together with incorrect specification, accounted for 59% of the problems examined in the study.

These are exactly the types of problem that validation could have been expected to uncover before the control system went into service. In spite of this, the requirement for validation contained in EN 954-1 has sometimes been neglected with few apparent consequences. This situation is most unlikely to be allowed to continue when EN 954 is withdrawn.

So what exactly does validation involve? EN ISO 13849-2 spells out the basic requirements very clearly in Section 3.1, Validation Principles. In part, this states: 'The validation shall demonstrate that each safety-related part meets the requirements of ISO 13849-1, in particular: the specified safety characteristics of the safety functions provided by that part, as set out in the design rationale, and the requirements of the specified category (ISO 13849-1, clause 6).

Validation should be carried out by persons who are independent of the design of the safety-related part(s)'.

The standard goes on to explain that the use of the phrase 'independent person' does not necessarily mean that third party testing is needed, but that the degree of independence should reflect the safety performance of the safety related part.

Let's look at the validation process. As a preliminary design step, the engineer designing the machine will have carried out a risk analysis to identify the safety performance level (PL) appropriate to the hazards associated with the machine, a procedure covered by EN ISO 13849-1. The engineer will then have designed a control system to meet this PL, by considering the category, carefully selecting the components used and, with the introduction of the new standard, carrying out detailed calculations involving the mean time to dangerous failure for these components, along with diagnostic coverage and common cause failures.

The validation process must re-examine all of these steps. It's clear why independent validation is so important; engineers validating their own work could all too easily duplicate any mistakes they had made at the design stage. Validation doesn't finish with re-examining the design, however, it must also look at the implementation of the SRP/CS and, in some cases, verify its functionality by testing.

In fact, there is even more to be done, as validation must also take into account the environmental conditions in which the machine will operate, including the effects of shock and vibration to which it may be subjected, as well as temperature, humidity and, where applicable, the effects of lubricants and cleaning materials.

Electromagnetic compatibility must be considered, as must the effects of wear and other deterioration as the machine ages.

Finally, the validation process must be carefully and fully documented so that the machine maker can produce evidence, if called upon to do so, that validation has been properly carried out.

Many machine manufacturers may well lack the in-house resources needed to properly validate the SRP/CS in their products. In such cases, use of an expert consultant, such as Laidler Associates, will prove an excellent investment and will mean the requirement for validation to be carried out by persons who are independent of the design process will be automatically satisfied.

Laidler Associates is a division of TÃœV SÃœD Product Service.