ISO 19014-1:2018 土木機械—機能安全—パート1：制御システムの安全関連部分と性能要件を決定するための方法論 | ページ 6

3.1

Machine Performance Level

MPL

discrete level to specify the ability of safety-related parts of control systems (3.3.2) to perform a safety function under reasonably foreseeable conditions

Note 1 to entry: The term MPL is used to describe the performance level required from a safety-related part of a control system. The ‘M’ refers to machine and denotes Earth Moving Machinery covered by the scope of this document and is used to differentiate from other functional safety standards (e.g. PL, AgPL, ASIL, etc.).

3.1.1

Machine Performance Level required

MPL_r

discrete level required as determined by processes in this document

3.1.2

Machine Performance Level achieved

MPL_a

discrete level achieved by the safety control systems (3.3.1) hardware, architecture and software

Note 1 to entry: Process for determination of MPLa will be covered in ISO 19014-2 and ISO 19014-4, under development.

3.2

functional safety

part of the overall safety relating to the equipment under control and its control system that depends on the correct functioning of the safety control system (SCS) (3.3.1) and other risk reduction measures

[SOURCE:IEC 61508‑4:2010, 3.1.12, modified]

3.3

machine control system

MCS

system which responds to input signals from parts of machine elements, operators (3.4.1) , external control equipment or any combination of these and generates output signals causing the machine to behave in the intended manner

[SOURCE:ISO 13849‑1:2015, 3.1.32]

3.3.1

safety control system

SCS

sub-system or system used by a MCS (3.3) to achieve functional safety (3.2) by affecting machine behaviour or mitigating a hazard

Note 1 to entry: A system which can fail in a way that creates a hazard is considered a SCS.

Note 2 to entry: For example, SCS for propulsion may include throttle, gear shift, start/stop, etc.

3.3.2

safety-related part of the control system

SRP/CS

part of a SCS (3.3.1) that responds to safety-related input signals and generates safety-related output signals

Note 1 to entry: The combined safety-related parts of a control system start at the point where the safety-related input signals are initiated (including, for example, the actuating cam and the roller of the position switch) and end at the output of the power control elements (including, for example, the main contacts of a contactor).

Note 2 to entry: If monitoring systems are used for diagnostic coverage, they are also considered as SRP/CS.

Note 3 to entry: SRP/CS is a part or component within the specific MCS.

[SOURCE:ISO 13849‑1:2015, 3.1.1, modified - Note 3 to entry has been added.]

3.4

person group

groups of people analyzed in the MCSSA (3.14)

3.4.1

operator

person operating the EMM and aware of associated risks or hazards

3.4.2

co-worker

person working in the vicinity of a machine and aware of associated hazards

3.4.3

bystander

person including non-employee, child, or member of the public with little or no awareness of machine hazards and no training

3.4.4

maintainer

person whose function is to perform maintenance tasks on the machine

Note 1 to entry: A maintainer is trained and familiar with the machine.

3.5

controllability

ability to avoid harm to the person group (3.4) at risk through the timely reactions of the operator (3.4.1) , possibly with the support of alternative controls

3.6

exposure

percentage of time a person group (3.4) is exposed to the hazard

Note 1 to entry: The exposure is the product of the following dependent probabilities: application use case (3.11) , hazard time (3.12) , and person group exposure (3.15) .

3.7

severity

estimate of the extent of harm to one or more individuals that can occur in a potentially hazardous situation

[SOURCE:ISO 26262‑1:2011, 1.120]

3.8

operation indicator

means by which the state of the equipment or machinery is represented to an observer

[SOURCE:ISO 22555:2007, 3.2]

3.8.1

warning indicator

visual, sensory or audible indications where an action from the operator (3.4.1) or control system is required

3.8.2

immediate action warning indicator

warning indicator (3.8.1) requiring immediate action from the operator (3.4.1) to mitigate hazard or system failure

3.9

application

different industries where a machine is used in, that can have different hazardous situations from one another

Note 1 to entry: Applications can include general construction, road construction, waste management, quarrying, etc.

3.10

use case

intended use of a machine within an application (3.9)

Note 1 to entry: For example, a dozer can have dozing, ripping, travel and maintenance use cases within an application.

3.11

application use case

highest percentage of time a machine is anticipated to be used in a use case (3.10) within a given application (3.9) during the intended use of the life cycle of the machine

Note 1 to entry: Because the application use case represents the highest percentage of time, and not the average, a machine in the population spends in a use case, the sum of application use cases across an application can be greater than 100 %.

3.12

hazard time

percentage of time within the work cycle of the application use where it is reasonably foreseeable that a hazard may exist should the control system being assessed fail

Note 1 to entry: For example, a dozer pushing material off a high wall is only exposed to the hazard of going over the high wall for the time where the machine is traveling towards the high wall within the stopping distance of the machine.

3.13

hazard zone

any space within or around machinery in which a person can be exposed to a hazard from the SCS (3.3.1) under analysis

[SOURCE:ISO 12100:2010 3.11, modified - “from the SCS under analysis” has been added.]

3.14

machine control system safety analysis

MCSSA

risk assessment used to determine the MPL_r(3.1.1) for the SCS (3.3.1) on a machine as outlined in this document

3.15

person group exposure

highest percentage of hazard time (3.12) that someone from the person group (3.4) being assessed is present in the hazard zone (3.13)

Note 1 to entry: The analysis is a sum of all the persons exposed from the person group, not a single individual within that group i.e. not a single car driving by, but the flow of traffic.

3.16

failure type

description of the type of failure that can occur in a SCS (3.3.1)

Note 1 to entry: Failure types to consider include failure to apply, failure to release, uncommanded apply, uncommanded release, incorrect apply rate, incorrect release rate or incorrect direction, etc.

3.17

worst credible

estimation of severity (3.7) of the most severe harm that can realistically occur from a single hazardous event

Note 1 to entry: Worst credible is not always the worst conceivable or the most likely but it is based on consideration of incident history and potential outcome of a hazardous events.