ISO/TC 127/SC 2/WG 24 - Control system functional safety

This document specifies general principles for the development and evaluation of the machine performance level achieved (MPLa) of safety-control systems (SCS) using components powered by all energy sources (e.g. electronic, electrical, hydraulic, mechanical) used in earth-moving machinery and its equipment, as defined in ISO 6165. The principles of this document apply to machine control systems (MCS) that control machine motion or mitigate a hazard; such systems are assessed for machine performance level required (MPLr) per ISO 19014-1 or ISO/TS 19014-5. Excluded from the scope of this document are the following systems: — awareness systems that do not impact machine motion (e.g. cameras and radar detectors); — fire suppression systems, unless the activation of the system interferes with, or activates, another SCS. Other systems or components whereby the operator would be aware of failure (e.g. windscreen wipers, head lights, etc.), or are primarily used to protect property, are excluded from this document. Audible warnings are excluded from the requirements of diagnostic coverage. In addition, this document addresses the significant hazards as defined in ISO 12100 mitigated by the hardware components within the SCS. This document is not applicable to EMM manufactured before the date of its publication.

This document provides normative tables of machine performance levels required (MPLr) by common function and type for earth-moving machinery (EMM) as defined in ISO 6165. These MPLr can then be mapped or applied to safety control systems (SCS) used to control or that affect the functions defined in the table. The MPLr in this document are determined through the machine control system safety analysis (MCSSA) process outlined in ISO 19014-1. A brief explanation of how the levels were derived and the associated assumptions are contained herein. This document is not applicable to EMM manufactured before the date of its publication.

This document specifies general principles for software development and signal transmission requirements of safety-related parts of machine-control systems (MCS) in earth-moving machinery (EMM) and its equipment, as defined in ISO 6165. In addition, this document addresses the significant hazards as defined in ISO 12100 related to the software embedded within the machine control system. The significant hazards being addressed are the incorrect machine control system output responses from machine control system inputs. Cyber security is out of the scope of this document. NOTE For guidance on cybersecurity, see an appropriate security standard. This document is not applicable to EMM manufactured before the date of its publication.

This document specifies the minimum requirements for environmental testing of electronic and electrical components identified as safety-related parts of the control system (SRP/CS) used on earth-moving machinery (EMM) as defined in ISO 6165 and their attachments.

This document specifies general principles for the development and evaluation of the machine performance level achieved (MPLa) of safety-control systems (SCS) using components powered by all energy sources (e.g. electronic, electrical, hydraulic, mechanical) used in earth-moving machinery and its equipment, as defined in ISO 6165. The principles of this document apply to machine control systems (MCS) that control machine motion or mitigate a hazard; such systems are assessed for machine performance level required (MPLr) per ISO 19014-1 or ISO/TS 19014-5. Excluded from the scope of this document are the following systems: — awareness systems that do not impact machine motion (e.g. cameras and radar detectors); — fire suppression systems, unless the activation of the system interferes with, or activates, another SCS. Other systems or components whereby the operator would be aware of failure (e.g. windscreen wipers, head lights, etc.), or are primarily used to protect property, are excluded from this document. Audible warnings are excluded from the requirements of diagnostic coverage. In addition, this document addresses the significant hazards as defined in ISO 12100 mitigated by the hardware components within the SCS. This document is not applicable to EMM manufactured before the date of its publication.

This document specifies general principles for software development and signal transmission requirements of safety-related parts of machine-control systems (MCS) in earth-moving machinery (EMM) and its equipment, as defined in ISO 6165. In addition, this document addresses the significant hazards as defined in ISO 12100 related to the software embedded within the machine control system. The significant hazards being addressed are the incorrect machine control system output responses from machine control system inputs. Cyber security is out of the scope of this document. NOTE For guidance on cybersecurity, see an appropriate security standard. This document is not applicable to EMM manufactured before the date of its publication.

This document provides normative tables of machine performance levels required (MPLr) by common function and type for earth-moving machinery (EMM) as defined in ISO 6165. These MPLr can then be mapped or applied to safety control systems (SCS) used to control or that affect the functions defined in the table. The MPLr in this document are determined through the machine control system safety analysis (MCSSA) process outlined in ISO 19014-1. A brief explanation of how the levels were derived and the associated assumptions are contained herein. This document is not applicable to EMM manufactured before the date of its publication.

This document provides a methodology for the determination of performance levels required for earth moving machinery (EMM) as defined in ISO 6165. A Machine Control System Safety Analysis (MCSSA) determines the amount of risk reduction of hazards associated with control systems, required for Safety Control Systems (SCS). This reduction is quantified by the Machine Performance Level (MPL), the hazards are identified using the risk assessment principles as defined in ISO 12100 or by other means. NOTE 1 Step 2 as shown in Annex A demonstrates the relationship between ISO 12100 and ISO 19014 as a complementary protective measure. NOTE 2 ISO 19014 can also be used to assess the functional safety requirements of other off-road mobile machinery. For those controls determined to be safety-related, the characteristics for architecture, hardware, software environmental requirements and performance are covered by other parts in ISO 19014. ISO 19014 covers the hazards caused by the failure of a safety control system and excludes hazards arising from the equipment itself (for example, electric shock, fire, etc.). Other controls that are not safety control systems (SCS), that do not mitigate a hazard or perform a control function and where the operator would be aware of a failure, are excluded from this standard (e.g. windscreen wipers, head lights, cab light, etc.). NOTE 3 A list of safety control systems is included in Annex D. NOTE 4 Audible warnings are excluded from the requirements of diagnostic coverage.