Source: https://machinerysafety101.com/tag/control-reliability/page/6/
Timestamp: 2018-06-20 07:34:25
Document Index: 754907827

Matched Legal Cases: ['art 1', 'art 1', 'art 1', 'art 2', 'art 1', 'art 2', 'art 1', 'art 2', 'art 1', 'art 1', 'art 1', 'art 1', 'art 2', 'art 100', 'art 1']

Control Reliability Archives | Page 6 of 7 | Machinery Safety 101
This arti­cle expands on the first in the series “Inter­lock Archi­tec­tures – Pt. 1: What do those cat­e­gories real­ly mean?”. Learn about the basic cir­cuit archi­tec­tures that under­lie all safe­ty inter­lock sys­tems under ISO 13849–1, and CSA Z432 and ANSI RIA R15.06.
In Part 1 of this series we explored Cat­e­go­ry B, the Basic Cat­e­go­ry that under­pins all the oth­er Cat­e­gories. This post builds on Part 1 by tak­ing a look at Cat­e­go­ry 1. Let’s start by explor­ing the dif­fer­ence as defined in ISO 13849–1. When you are read­ing, remem­ber that “SRP/CS” stands for “Safe­ty Relat­ed Parts of Con­trol Sys­tems”.
SRP/CS of Cat­e­go­ry 1 shall be designed and con­struct­ed using well-tried com­po­nents and well-tried safe­ty prin­ci­ples (see ISO 13849–2).
So what, exact­ly, is a “Well-Tried Com­po­nent”?? Let’s go back to the stan­dard for that:
A “well-tried com­po­nent” for a safe­ty-relat­ed appli­ca­tion is a com­po­nent which has been either
a) wide­ly used in the past with suc­cess­ful results in sim­i­lar appli­ca­tions, or
b) made and ver­i­fied using prin­ci­ples which demon­strate its suit­abil­i­ty and reli­a­bil­i­ty for safe­ty-relat­ed appli­ca­tions.
New­ly devel­oped com­po­nents and safe­ty prin­ci­ples may be con­sid­ered as equiv­a­lent to “well-tried” if they ful­fil the con­di­tions of b).
The deci­sion to accept a par­tic­u­lar com­po­nent as being “well-tried” depends on the appli­ca­tion.
NOTE 1 Com­plex elec­tron­ic com­po­nents (e.g. PLC, micro­proces­sor, appli­ca­tion-spe­cif­ic inte­grat­ed cir­cuit) can­not be con­sid­ered as equiv­a­lent to “well tried”.
Lets look at what this all means by refer­ring to ISO 13849–2:
Table 1 — Well-Tried Com­po­nents [2]
Well-Tried Com­po­nents
Con­di­tions for “well–tried”
Stan­dard or spec­i­fi­ca­tion
Screw All fac­tors influ­enc­ing the screw con­nec­tion and the appli­ca­tion are to be con­sid­ered. See Table A.2 “List of well–tried safe­ty prin­ci­ples”. Mechan­i­cal joint­ing such as screws, nuts, wash­ers, riv­ets, pins, bolts etc. are stan­dard­ised.
Spring See Table A.2 “Use of a well–tried spring”. Tech­ni­cal spec­i­fi­ca­tions for spring steels and oth­er spe­cial appli­ca­tions are giv­en in ISO 4960.
Cam All fac­tors influ­enc­ing the cam arrange­ment (e. g. part of an inter­lock­ing device) are to be con­sid­ered. See Table A.2 “List of well–tried safe­ty prin­ci­ples”. See EN 1088 (ISO 14119) (Inter­lock­ing devices).
Break–pin All fac­tors influ­enc­ing the appli­ca­tion are to be con­sid­ered. See Table A.2 “List of well-tried safe­ty prin­ci­ples”. —
Now we have a few ideas about what might con­sti­tute a ‘well-tried com­po­nent’. Unfor­tu­nate­ly, you will notice that ‘con­tac­tor’ or ‘relay’ or ‘lim­it switch’ appear nowhere on the list. This is a chal­lenge, but one that can be over­come. The key to deal­ing with this is to look at how the com­po­nents that you are choos­ing to use are con­struct­ed. If they use these com­po­nents and tech­niques, you are on your way to con­sid­er­ing them to be well-tried.
Anoth­er approach is to let the com­po­nent man­u­fac­tur­er wor­ry about the details of the con­struc­tion of the device, and sim­ply ensure that com­po­nents select­ed for use in the SRP/CS are ‘safe­ty rat­ed’ by the man­u­fac­tur­er. This can work in 80–90% of cas­es, with a small per­cent­age of com­po­nents, such as large motor starters, some ser­vo and step­per dri­ves and oth­er sim­i­lar com­po­nents unavail­able with a safe­ty rat­ing. It’s worth not­ing that many dri­ve man­u­fac­tur­ers are start­ing to pro­duce dri­ves with built-in safe­ty com­po­nents that are intend­ed to be inte­grat­ed into your SRP/CS.
Note 1 from the first part of the def­i­n­i­tion is very impor­tant. So impor­tant that I’m going to repeat it here:
I added the bold text to empha­size the impor­tance of this state­ment. While this is includ­ed in a Note and is there­fore con­sid­ered to be explana­to­ry text and not part of the nor­ma­tive body of the stan­dard, it illu­mi­nates a key con­cept. This lit­tle note is what pre­vents a stan­dard PLC from being used in Cat­e­go­ry 1 sys­tems. It’s also impor­tant to real­ize that this def­i­n­i­tion is only con­sid­er­ing the hard­ware — no men­tion of soft­ware is made here, and soft­ware is not dealt with until lat­er in the stan­dard.
Let’s have a look at what ‘Well-Tried Safe­ty Prin­ci­ples’ might be.
Table 2 — Well-Tried Safe­ty Prin­ci­ples [2, A.2]
Well-tried Safe­ty Prin­ci­ples
Use of care­ful­ly select­ed mate­ri­als and man­u­fac­tur­ing Selec­tion of suit­able mate­r­i­al, ade­quate man­u­fac­tur­ing meth­ods and treat­ments relat­ed to the appli­ca­tion.
Use of com­po­nents with ori­ent­ed fail­ure mode The pre­dom­i­nant fail­ure mode of a com­po­nent is known in advance and always the same, see EN 292–2:1991, (ISO/TR 12100–2:1992), 3.7.4.
Over–dimensioning/safety fac­tor The safe­ty fac­tors are giv­en in stan­dards or by good expe­ri­ence in safe­ty-relat­ed appli­ca­tions.
Safe posi­tion The mov­ing part of the com­po­nent is held in one of the pos­si­ble posi­tions by mechan­i­cal means (fric­tion only is not enough). Force is need­ed for chang­ing the posi­tion.
Care­ful selec­tion, com­bi­na­tion, arrange­ment, assem­bly and instal­la­tion of components/system relat­ed to the appli­ca­tion —
Care­ful selec­tion of fas­ten­ing relat­ed to the appli­ca­tion Avoid rely­ing only on fric­tion.
Pos­i­tive mechan­i­cal action Depen­dent oper­a­tion (e. g. par­al­lel oper­a­tion) between parts is obtained by pos­i­tive mechan­i­cal link(s). Springs and sim­i­lar “flex­i­ble” ele­ments should not be part of the link(s) [see EN 292–2:1991 (ISO/TR 12100–2:1992), 3.5].
Mul­ti­ple parts Reduc­ing the effect of faults by mul­ti­ply­ing parts, e. g. where a fault of one spring (of many springs) does not lead to a dan­ger­ous con­di­tion.
Use of well–tried spring (see also Table A.3) A well–tried spring requires:
use of care­ful­ly select­ed mate­ri­als, man­u­fac­tur­ing meth­ods (e. g. pre­set­ting and cycling before use) and treat­ments (e. g. rolling and shot–peening),
suf­fi­cient safe­ty fac­tor for fatigue stress (i. e. with high prob­a­bil­i­ty a frac­ture will not occur).
Well–tried pres­sure coil springs may also be designed by:
use of care­ful­ly select­ed mate­ri­als, man­u­fac­tur­ing meth­ods (e. g. pre­set­ting and cycling before use) and treat­ments (e. g. rolling and shot-peen­ing),
clear­ance between the turns less than the wire diam­e­ter when unloaded, and
Lim­it­ed range of force and sim­i­lar para­me­ters Decide the nec­es­sary lim­i­ta­tion in rela­tion to the expe­ri­ence and appli­ca­tion. Exam­ples for lim­i­ta­tions are break pin, break plate, torque lim­it­ing clutch.
Lim­it­ed range of speed and sim­i­lar para­me­ters Decide the nec­es­sary lim­i­ta­tion in rela­tion to the expe­ri­ence and appli­ca­tion. Exam­ples for lim­i­ta­tions are cen­trifu­gal gov­er­nor; safe mon­i­tor­ing of speed or lim­it­ed dis­place­ment.
Lim­it­ed range of envi­ron­men­tal para­me­ters Decide the nec­es­sary lim­i­ta­tions. Exam­ples on para­me­ters are tem­per­a­ture, humid­i­ty, pol­lu­tion at the instal­la­tion. See clause 8 and con­sid­er manufacturer’s appli­ca­tion notes.
Lim­it­ed range of reac­tion time, lim­it­ed hys­tere­sis Decide the nec­es­sary lim­i­ta­tions.
Con­sid­er e. g. spring tired­ness, fric­tion, lubri­ca­tion, tem­per­a­ture, iner­tia dur­ing accel­er­a­tion and decel­er­a­tion,
com­bi­na­tion of tol­er­ances.
The use of these prin­ci­ples in the com­po­nents, as well as in the over­all design of the safe­guards is impor­tant. In devel­op­ing a sys­tem that uses ‘pos­i­tive mode oper­a­tion’, the mechan­i­cal link­age that oper­ates the elec­tri­cal con­tacts or the flu­id-pow­er valve that con­trols the prime-mover(s) (i.e. motors, cylin­ders, etc.), must act to direct­ly dri­ve the con­trol ele­ment (con­tacts or valve spool) to the safe state. Springs can be used to return the sys­tem to the run state or dan­ger­ous state, since a fail­ure of the spring will result in the inter­lock device stay­ing in the safe state (fail-safe or fail-to-safe­ty).
CSA Z432 [3] pro­vides us with a nice dia­gram that illus­trates the idea of “pos­i­tive-action” or “pos­i­tive-mode” oper­a­tion:
Fig­ure 1 — Pos­i­tive Mode Oper­a­tion [3, B.10]
In Fig. 1, open­ing the guard door forces the roller to fol­low the cam attached to the door, dri­ving the switch con­tacts apart and open­ing the inter­lock. Even if the con­tacts were to weld, they would still be dri­ven apart since the mechan­i­cal advan­tage pro­vid­ed by the width of the door and the cam are more than enough to force the con­tacts apart.
Here’s an exam­ple of a ‘neg­a­tive mode’ oper­a­tion:
Fig­ure 2 — Neg­a­tive Mode oper­a­tion [3, B.11]
In Fig. 2, the inter­lock switch relies on a spring to enter the safe state when the door is opened. If the spring in the inter­lock device fails, the sys­tem fails-to-dan­ger. Also note that this design is very easy to defeat. A ‘zip-tie’ or some tape is all that would be required to keep the inter­lock in the ‘RUN’ con­di­tion.
You should have a bet­ter idea of what is meant when you read about pos­i­tive and neg­a­tive-modes of oper­a­tion now. We’ll talk about defeat resis­tance in anoth­er arti­cle.
Com­bin­ing what you’ve learned so far, you can see that cor­rect­ly spec­i­fied com­po­nents, com­bined with over-dimen­sion­ing and imple­men­ta­tion of design lim­its along with the use of well-tried safe­ty prin­ci­ples will go a long way to improv­ing the reli­a­bil­i­ty of the con­trol sys­tem. The next part of the def­i­n­i­tion of Cat­e­go­ry 1 speaks to some addi­tion­al require­ments:
The max­i­mum PL achiev­able with cat­e­go­ry 1 is PL = c.
NOTE 2 There is no diag­nos­tic cov­er­age (DCavg = none) with­in cat­e­go­ry 1 sys­tems. In such struc­tures (sin­gle-chan­nel sys­tems) the con­sid­er­a­tion of CCF is not rel­e­vant.
NOTE 3 When a fault occurs it can lead to the loss of the safe­ty func­tion. How­ev­er, the MTTFd of each chan­nel in cat­e­go­ry 1 is high­er than in cat­e­go­ry B. Con­se­quent­ly, the loss of the safe­ty func­tion is less like­ly.
We now know that the integri­ty of a Cat­e­go­ry 1 sys­tem is greater than a Cat­e­go­ry B sys­tem, since the chan­nel MTTFd of the sys­tem has gone from “Low-to-Medi­um” in sys­tems exhibit­ing PLa or PLb per­for­mance to “High” in sys­tems exhibit­ing PLb or PLc per­for­mance. [1, Table 5] shows this dif­fer­ence in terms of pre­dict­ed years to fail­ure. As you can see, MTTFd “High” results in a pre­dict­ed fail­ure rate between 30 and 100 years. This is a pret­ty good result for sim­ply improv­ing the com­po­nents used in the sys­tem!
The oth­er ben­e­fit is the increase in the over­all PL. Where Cat­e­go­ry B archi­tec­ture can pro­vide PLb per­for­mance at best, Cat­e­go­ry 1 takes this up a notch to PLc. To get a han­dle on what PLc means, let’s look at our sin­gle and three shift exam­ples again. If we take a Cana­di­an oper­a­tion with a sin­gle shift per day, and a 50 week work­ing year we get:
In this case, PLc is equiv­a­lent to one fail­ure in 533.3 years of oper­a­tion to 1600 years of oper­a­tion.
In this case, PLc is equiv­a­lent to one fail­ure in 177.8 years of oper­a­tion to 533.3 years of oper­a­tion.
When com­plet­ing the analy­sis of a sys­tem, [1] lim­its the sys­tem MTTFd to 100 years regard­less of what the indi­vid­ual chan­nel MTTFd may be. Where the actu­al MTTFd is impor­tant relates to the need to replace com­po­nents dur­ing the life­time of the prod­uct. If a com­po­nent or a sub-sys­tem has an MTTFd that is less than the mis­sion time of the sys­tem, then the com­po­nent or sub­sys­tem must be replaced by the time the prod­uct reach­es it’s MTTFd. 20 years is the default mis­sion time, but you can choose a short­er or longer time span if it makes sense.
Remem­ber that these are prob­a­bil­i­ties, not guar­an­tees. A fail­ure could hap­pen in the first hour of oper­a­tion, the last hour of oper­a­tion or nev­er. These fig­ures sim­ply pro­vide a way for you as the design­er to gauge the rel­a­tive reli­a­bil­i­ty of the sys­tem.
The stan­dard goes on to out­line some key dis­tinc­tions between ‘well-tried com­po­nent’ and ‘fault exclu­sion’. We’ll talk more about fault exclu­sions lat­er in the series.
It is impor­tant that a clear dis­tinc­tion between “well-tried com­po­nent” and “fault exclu­sion” (see Clause 7) be made. The qual­i­fi­ca­tion of a com­po­nent as being well-tried depends on its appli­ca­tion. For exam­ple, a posi­tion switch with pos­i­tive open­ing con­tacts could be con­sid­ered as being well-tried for a machine tool, while at the same time as being inap­pro­pri­ate for appli­ca­tion in a food indus­try — in the milk indus­try, for instance, this switch would be destroyed by the milk acid after a few months. A fault exclu­sion can lead to a very high PL, but the appro­pri­ate mea­sures to allow this fault exclu­sion should be applied dur­ing the whole life­time of the device. In order to ensure this, addi­tion­al mea­sures out­side the con­trol sys­tem may be nec­es­sary. In the case of a posi­tion switch, some exam­ples of these kinds of mea­sures are
means to ensure the trans­verse sta­bil­i­ty of the cam,
means to avoid over trav­el of the posi­tion switch, e.g. ade­quate mount­ing strength of the shock absorber and any align­ment devices, and
Final­ly, let’s look at the block dia­gram for Cat­e­go­ry 1. You will notice that it looks the same as the Cat­e­go­ry B block dia­gram, since only the com­po­nents used in the sys­tem have changed, and not the archi­tec­ture.
Fig­ure 3 — Cat­e­go­ry 1 Block Dia­gram [1, Fig. 9]
[1] Safe­ty of machin­ery — Safe­ty-relat­ed parts of con­trol sys­tems — Part 1: Gen­er­al prin­ci­ples for design. ISO Stan­dard 13849–1, Ed. 2. 2006.
[2] Safe­ty of machin­ery — Safe­ty-relat­ed parts of con­trol sys­tems — Part 2: Val­i­da­tion. ISO Stan­dard 13849–2, Ed. 2. 2012.
[3] Safe­guard­ing of Machin­ery. CSA Stan­dard Z432. 2004.
If you are work­ing on imple­ment­ing these design stan­dards in your prod­ucts, you need to buy copies of the stan­dards for your library.
ISO 13849–1:2006 Safe­ty of machin­ery — Safe­ty-relat­ed parts of con­trol sys­tems — Part 1: Gen­er­al prin­ci­ples for design
ISO 13849–2:2003 Safe­ty of machin­ery — Safe­ty-relat­ed parts of con­trol sys­tems — Part 2: Val­i­da­tion
If you are work­ing in the EU, or are work­ing on CE Mark­ing your prod­uct, you should hold the har­mo­nized ver­sion of this stan­dard, avail­able through the CEN resellers:
EN ISO 13849–1:2008 Safe­ty of machin­ery — Safe­ty-relat­ed parts of con­trol sys­tems — Part 1: Gen­er­al prin­ci­ples for design
EN ISO 13849–2:2012 Safe­ty of machin­ery — Safe­ty-relat­ed parts of con­trol sys­tems — Part 2: Val­i­da­tion
Watch for the next part of this series, “Inter­lock Archi­tec­tures – Pt. 3: Cat­e­go­ry 2″ where we expand on the first two cat­e­gories by adding some diag­nos­tic cov­er­age to improve reli­a­bil­i­ty.
Copy­right secured by Digiprove © 2011–2014
Acknowl­edge­ments: ISO, CSA. See ref­er­ences.
In 1995 CEN pub­lished an impor­tant stan­dard for machine builders — EN 954–1, Safe­ty of Machin­ery — Safe­ty Relat­ed Parts of Con­trol Sys­tems — Part 1: Gen­er­al Prin­ci­ples for Design. This stan­dard set the stage for defin­ing con­trol reli­a­bil­i­ty in machin­ery safe­guard­ing sys­tems, intro­duc­ing the Reli­a­bil­i­ty cat­e­gories that have become ubiq­ui­tous. So what do these cat­e­gories mean, and how are they applied under the lat­est machin­ery stan­dard, ISO 13849–1?
The archi­tec­tures used as the basis of inter­lock design and analy­sis have a long his­to­ry. Two basic forms exist­ed in the ear­ly days: the ANSI cat­e­gories and the CSA vari­ant, and the CEN forms.
The ANSI/CSA archi­tec­tures were called SIMPLE, SINGLE CHANNEL, SINGLE CHANNEL-MONITORED, and CONTROL RELIABLE. The basic sys­tem arose in the ANSI/RIA R15.06 1992 stan­dard and was used until 2014. The CSA vari­ant used the same names as the ANSI ver­sion but made a small dif­fer­en­ti­a­tion in the CONTROL RELIABLE cat­e­go­ry. This dif­fer­en­ti­a­tion was very sub­tle and was often com­plete­ly mis­un­der­stood by read­ers. This sys­tem was intro­duced in Cana­da in CSA Z434-1994 and was dis­con­tin­ued in 2016. This sys­tem of safe­ty-relat­ed con­trol sys­tem archi­tec­ture cat­e­gories is no longer used in any juris­dic­tion.
And then there was EN 954–1
In 1996 CEN pub­lished an impor­tant stan­dard for machine builders — EN 954–1, “Safe­ty of Machin­ery — Safe­ty Relat­ed Parts of Con­trol Sys­tems — Part 1: Gen­er­al Prin­ci­ples for Design” [1]. This stan­dard set the stage for defin­ing con­trol reli­a­bil­i­ty in machin­ery safe­guard­ing sys­tems, intro­duc­ing the Reli­a­bil­i­ty cat­e­gories that have become ubiq­ui­tous. So what do these cat­e­gories mean, and how are they applied under the lat­est machin­ery func­tion­al safe­ty stan­dard, ISO 13849–1 [2]?
The cat­e­gories are used to describe sys­tem archi­tec­tures for safe­ty-relat­ed con­trol sys­tems. Each archi­tec­ture car­ries with it a range of reli­able per­for­mance that can be relat­ed to the degree of risk reduc­tion you are expect­ing to achieve with the sys­tem. These archi­tec­tures can be applied equal­ly to elec­tri­cal, elec­tron­ic, pneu­mat­ic, hydraulic or mechan­i­cal con­trol sys­tems.
Ear­ly elec­tri­cal ‘mas­ter-con­trol-relay’ cir­cuits used a sim­ple archi­tec­ture with a sin­gle con­tac­tor, or some­times two, and a sin­gle chan­nel style of archi­tec­ture to main­tain the con­tac­tor coil cir­cuit once the START or POWER ON but­ton (PB2 in Fig. 1) had been pressed. Pow­er to the out­put ele­ments of the machine con­trols was sup­plied via con­tacts on the con­tac­tor, which is why it was called the Mas­ter Con­trol Relay or ‘MCR’. The POWER OFF but­ton (PB1 in Fig. 1) could be labeled that way, or you could make the same cir­cuit into an Emer­gency Stop by sim­ply replac­ing the oper­a­tor with a red mush­room-head push but­ton. These devices were usu­al­ly spring-return, so to restore pow­er, all that was need­ed was to push the POWER ON but­ton again (Fig.1).
Fig­ure 1 — Basic Stop/Start Cir­cuit
Allen-Bradley 700PK Heavy Duty Con­tac­tor
Typ­i­cal­ly, the com­po­nents used in these cir­cuits were spec­i­fied to meet the cir­cuit con­di­tions, but not more. Con­trols man­u­fac­tur­ers brought out over-dimen­sioned ver­sions, such as Allen-Bradley’s Bul­letin 700-PK con­tac­tor which had 20 A rat­ed con­tacts instead of the stan­dard Bul­letin 700’s 10 A con­tacts.
When inter­locked guards began to show up, they were inte­grat­ed into the orig­i­nal MCR cir­cuit by adding a basic con­trol relay (CR1 in Fig. 2) whose coil was con­trolled by the inter­lock switch(es) (LS1 in Fig. 2), and whose out­put con­tacts were in series with the coil cir­cuit of the MCR con­tac­tor. Open­ing the guard inter­lock would open the MCR coil cir­cuit and drop pow­er to the machine con­trols. Very sim­ple.
Fig­ure 2 — Old-School Start/Stop Cir­cuit with Guard Relay
Typ­i­cal ice-cube style relay
‘Ice-cube’ style plug-in relays were often cho­sen for CR1. These devices did not have ‘force-guid­ed’ con­tacts in them, so it was pos­si­ble to have one con­tact in the relay fail while the oth­er con­tin­ued to oper­ate prop­er­ly.
LS1 could be any kind of switch. Fre­quent­ly a ‘micro-switch’ style of lim­it switch was cho­sen. These snap-action switch­es could fail short­ed inter­nal­ly, or weld closed and the actu­a­tor would con­tin­ue to work nor­mal­ly even though the switch itself had failed. These switch­es are also ridicu­lous­ly easy to bypass. All that is required is a piece of tape or an elas­tic band and the switch is no longer doing its job.
The prob­lem with these cir­cuits is that they can fail in a num­ber of ways that aren’t obvi­ous to the user, with the result being that the inter­lock might not work as expect­ed, or the Emer­gency Stop might fail just when you need it most.
These orig­i­nal cir­cuits are the basis for what became known as ‘Cat­e­go­ry B’ (‘B’ for ‘Basic’) cir­cuits. Here’s the def­i­n­i­tion from the stan­dard. Note that I am tak­ing this excerpt from ISO 13849–1: 2007 (Edi­tion 2). “SRP/CS” stands for “Safe­ty Relat­ed Parts of Con­trol Sys­tems”:
6.2.3 Cat­e­go­ry B
The SRP/CS shall, as a min­i­mum, be designed, con­struct­ed, select­ed, assem­bled and com­bined in accor­dance with the rel­e­vant stan­dards and using basic safe­ty prin­ci­ples for the spe­cif­ic appli­ca­tion to with­stand
the expect­ed oper­at­ing stress­es, e.g. the reli­a­bil­i­ty with respect to break­ing capac­i­ty and fre­quen­cy,
the influ­ence of the processed mate­r­i­al, e.g. deter­gents in a wash­ing machine, and
oth­er rel­e­vant exter­nal influ­ences, e.g. mechan­i­cal vibra­tion, elec­tro­mag­net­ic inter­fer­ence, pow­er sup­ply inter­rup­tions or dis­tur­bances.
There is no diag­nos­tic cov­er­age (DCavg = none) with­in cat­e­go­ry B sys­tems and the MTTFd of each chan­nel can be low to medi­um. In such struc­tures (nor­mal­ly sin­gle-chan­nel sys­tems), the con­sid­er­a­tion of CCF is not rel­e­vant.
The max­i­mum PL achiev­able with cat­e­go­ry B is PL = b.
NOTE When a fault occurs it can lead to the loss of the safe­ty func­tion.
Spe­cif­ic require­ments for elec­tro­mag­net­ic com­pat­i­bil­i­ty are found in the rel­e­vant prod­uct stan­dards, e.g. IEC 61800–3 for pow­er dri­ve sys­tems. For func­tion­al safe­ty of SRP/CS in par­tic­u­lar, the immu­ni­ty require­ments are rel­e­vant. If no prod­uct stan­dard exists, at least the immu­ni­ty require­ments of IEC 61000–6-2 should be fol­lowed.
The stan­dard also pro­vides us with a nice block dia­gram of what a sin­gle-chan­nel sys­tem might look like:
ISO 13849–1 Cat­e­go­ry B Des­ig­nat­ed Archi­tec­ture
If you look at this block dia­gram and the Start/Stop Cir­cuit with Guard Relay above, you can see how this basic cir­cuit trans­lates into a sin­gle chan­nel archi­tec­ture, since from the con­trol inputs to the con­trolled load you have a sin­gle chan­nel. Even the guard loop is a sin­gle chan­nel. A fail­ure in any com­po­nent in the chan­nel can result in loss of con­trol of the load.
Lets look at each part of this require­ment in more detail, since each of the sub­se­quent Cat­e­gories builds upon these BASIC require­ments.
The SRP/CS shall, as a min­i­mum, be designed, con­struct­ed, select­ed, assem­bled and com­bined in accor­dance with the rel­e­vant stan­dards and using basic safe­ty prin­ci­ples for the spe­cif­ic appli­ca­tion…
We have to go to ISO 13849–2 to get a def­i­n­i­tion of what Basic Safe­ty Prin­ci­ples might include. Look­ing at Annex A.2 of the stan­dard we find:
Table A.1 — Basic Safety Principles
Basic Safe­ty Prin­ci­ples
Use of suit­able mate­ri­als and ade­quate man­u­fac­tur­ing Selec­tion of mate­r­i­al, man­u­fac­tur­ing meth­ods and treat­ment in rela­tion to, e. g. stress, dura­bil­i­ty, elas­tic­i­ty, fric­tion, wear,
cor­ro­sion, tem­per­a­ture.
Cor­rect dimen­sion­ing and shap­ing Con­sid­er e. g. stress, strain, fatigue, sur­face rough­ness, tol­er­ances, stick­ing, man­u­fac­tur­ing.
Prop­er selec­tion, com­bi­na­tion, arrange­ments, assem­bly and instal­la­tion of components/systems. Apply manufacturer’s appli­ca­tion notes, e. g. cat­a­logue sheets, instal­la­tion instruc­tions, spec­i­fi­ca­tions, and use of good engi­neer­ing prac­tice in sim­i­lar components/systems.
Use of de–energisation prin­ci­ple The safe state is obtained by release of ener­gy. See pri­ma­ry action for stop­ping in EN 292–2:1991 (ISO/TR 12100–2:1992), 3.7.1. Ener­gy is sup­plied for start­ing the move­ment of a mech­a­nism. See pri­ma­ry action for start­ing in EN 292–2:1991 (ISO/TR 12100–2:1992), 3.7.1.Consider dif­fer­ent modes, e. g. oper­a­tion mode, main­te­nance mode.
This prin­ci­ple shall not be used in spe­cial appli­ca­tions, e. g. to keep ener­gy for clamp­ing devices.
Prop­er fas­ten­ing For the appli­ca­tion of screw lock­ing con­sid­er manufacturer’s appli­ca­tion notes.Overloading can be avoid­ed by apply­ing ade­quate torque load­ing tech­nol­o­gy.
Lim­i­ta­tion of the gen­er­a­tion and/or trans­mis­sion of force and sim­i­lar para­me­ters Exam­ples are break pin, break plate, torque lim­it­ing clutch.
Lim­i­ta­tion of range of envi­ron­men­tal para­me­ters Exam­ples of para­me­ters are tem­per­a­ture, humid­i­ty, pol­lu­tion at the instal­la­tion place. See clause 8 and con­sid­er
manufacturer’s appli­ca­tion notes.
Lim­i­ta­tion of speed and sim­i­lar para­me­ters Con­sid­er e. g. the speed, accel­er­a­tion, decel­er­a­tion required by the appli­ca­tion
Prop­er reac­tion time Con­sid­er e. g. spring tired­ness, fric­tion, lubri­ca­tion, tem­per­a­ture, iner­tia dur­ing accel­er­a­tion and decel­er­a­tion,
Pro­tec­tion against unex­pect­ed start–up Con­sid­er unex­pect­ed start-up caused by stored ener­gy and after pow­er “sup­ply” restora­tion for dif­fer­ent modes as
oper­a­tion mode, main­te­nance mode etc.
Spe­cial equip­ment for release of stored ener­gy may be nec­es­sary.
Spe­cial appli­ca­tions, e. g. to keep ener­gy for clamp­ing devices or ensure a posi­tion, need to be con­sid­ered
sep­a­rate­ly.
Sim­pli­fi­ca­tion Reduce the num­ber of com­po­nents in the safe­ty-relat­ed sys­tem.
Sep­a­ra­tion Sep­a­ra­tion of safe­ty-relat­ed func­tions from oth­er func­tions.
Prop­er lubri­ca­tion —
Prop­er pre­ven­tion of the ingress of flu­ids and dust Con­sid­er IP rat­ing [see EN 60529 (IEC 60529)]
As you can see, the basic safe­ty prin­ci­ples are pret­ty basic — select com­po­nents appro­pri­ate­ly for the appli­ca­tion, con­sid­er the oper­at­ing con­di­tions for the com­po­nents, fol­low manufacturer’s data, and use de-ener­giza­tion to cre­ate the stop func­tion. That way, a loss of pow­er results in the sys­tem fail­ing into a safe state, as does an open relay coil or set of burnt con­tacts.
“…the expect­ed oper­at­ing stress­es, e.g. the reli­a­bil­i­ty with respect to break­ing capac­i­ty and fre­quen­cy,”
Spec­i­fy your com­po­nents cor­rect­ly with regard to volt­age, cur­rent, break­ing capac­i­ty, tem­per­a­ture, humid­i­ty, dust,…
“…oth­er rel­e­vant exter­nal influ­ences, e.g. mechan­i­cal vibra­tion, elec­tro­mag­net­ic inter­fer­ence, pow­er sup­ply inter­rup­tions or dis­tur­bances.”
“Spe­cif­ic require­ments for elec­tro­mag­net­ic com­pat­i­bil­i­ty are found in the rel­e­vant prod­uct stan­dards, e.g. IEC 61800–3 for pow­er dri­ve sys­tems. For func­tion­al safe­ty of SRP/CS in par­tic­u­lar, the immu­ni­ty require­ments are rel­e­vant. If no prod­uct stan­dard exists, at least the immu­ni­ty require­ments of IEC 61000–6-2 should be fol­lowed.”
Prob­a­bly the biggest ‘gotcha’ in this point is “elec­tro­mag­net­ic inter­fer­ence”. This is impor­tant enough that the stan­dard devotes a para­graph to it specif­i­cal­ly. I added the bold text to high­light the idea of ‘func­tion­al safe­ty’. You can find oth­er infor­ma­tion in oth­er posts on this blog on that top­ic. If your prod­uct is des­tined for the Euro­pean Union (EU), then you will almost cer­tain­ly be doing some EMC test­ing, unless your prod­uct is a ‘fixed instal­la­tion’. If it’s going to almost any oth­er mar­ket, you prob­a­bly are not under­tak­ing this test­ing. So how do you know if your design meets this cri­te­ria? Unless you test, you don’t. You can make some edu­cat­ed guess­es based on using sound engi­neer­ing prac­tices , but after that you can only hope.
“…There is no diag­nos­tic cov­er­age (DCavg = none) with­in cat­e­go­ry B sys­tems…”
Cat­e­go­ry B sys­tems are fun­da­men­tal­ly sin­gle-chan­nel. A sin­gle fault in the sys­tem will lead to the loss of the safe­ty func­tion. This sen­tence refers to the con­cept of “diag­nos­tic cov­er­age” that was intro­duced in ISO 13849–1:2007, but what this means in prac­tice is that there is no mon­i­tor­ing or feed­back from any crit­i­cal ele­ments. Remem­ber our basic MCR cir­cuit? If the MCR con­tac­tor weld­ed closed, the only diag­nos­tic was the fail­ure of the machine to stop when the emer­gency stop but­ton was pressed.
This part of the state­ment is refer­ring to anoth­er new con­cept from ISO 13849–1:2007, “MTTFd”. Stand­ing for “Mean Time to Fail­ure Dan­ger­ous”, this con­cept looks at the expect­ed fail­ure rates of the com­po­nent in hours. Cal­cu­lat­ing MTTFd is a sig­nif­i­cant part of imple­ment­ing the new stan­dard. From the per­spec­tive of under­stand­ing Cat­e­go­ry B, what this means is that you do not need to use high-reli­a­bil­i­ty com­po­nents in these sys­tems.
“In such struc­tures (nor­mal­ly sin­gle-chan­nel sys­tems), the con­sid­er­a­tion of CCF is not rel­e­vant.”
CCF is anoth­er new con­cept from ISO 13849–1:2007, and stands for “Com­mon Cause Fail­ure”. I’m not going to get into this in any detail here, but suf­fice to say that design tech­niques, as well as chan­nel sep­a­ra­tion (impos­si­ble in a sin­gle chan­nel archi­tec­ture) and oth­er tech­niques are used to reduce the like­li­hood of CCF in high­er reli­a­bil­i­ty sys­tems.
“The max­i­mum PL achiev­able with cat­e­go­ry B is PL = b.”
PL stands for “Per­for­mance Lev­el”, divid­ed into five degrees from ‘a’ to ‘e’. PLa is equal to an aver­age prob­a­bil­i­ty of dan­ger­ous fail­ure per hour of >= 10-5 to < 10-4 fail­ures per hour. PLb is equal to >= 3 × 10-6 to < 10-5 fail­ures per hour or once in 10,000 to 100,000 hours, to once in 3,000,000 hours of oper­a­tion. This sounds like a lot, but when deal­ing with prob­a­bil­i­ties, these num­bers are actu­al­ly pret­ty low.
If you con­sid­er an oper­a­tion run­ning a sin­gle shift in Cana­da where the nor­mal work­ing year is 50 weeks and the nor­mal work­day is 7.5 hours, a work­ing year is
If we go to an oper­a­tion run­ning three shifts in Cana­da, a work­ing year is:
Now you should be start­ing to get an idea about where this is going. It’s impor­tant to remem­ber that prob­a­bil­i­ties are just that — the fail­ure could hap­pen in the first hour of oper­a­tion or at any time after that, or nev­er. These fig­ures give you some way to gauge the rel­a­tive reli­a­bil­i­ty of the design, and ARE NOT any sort of guar­an­tee.
Watch for the next post in this series where I will look at Cat­e­go­ry 1 require­ments!
[1] Safe­ty of Machin­ery — Safe­ty Relat­ed Parts of Con­trol Sys­tems — Part 1: Gen­er­al Prin­ci­ples for Design. CEN Stan­dard EN 954–1. 1996.
[2] Safe­ty of machin­ery — Safe­ty-relat­ed parts of con­trol sys­tems — Part 1: Gen­er­al prin­ci­ples for design. ISO Stan­dard 13849–1. 2006.
[3] Safe­ty of machin­ery — Safe­ty-relat­ed parts of con­trol sys­tems — Part 2: Val­i­da­tion, ISO Stan­dard 13849–2. 2003.
[4] Safe­ty of machin­ery — Safe­ty-relat­ed parts of con­trol sys­tems — Part 100: Guide­lines for the use and appli­ca­tion of ISO 13849–1. ISO Tech­ni­cal Report TR 100. 2000.
[5] Safe­ty of machin­ery — Safe­ty-relat­ed parts of con­trol sys­tems — Part 1: Gen­er­al prin­ci­ples for design. CEN Stan­dard EN ISO 13849–1. 2008.
Acknowl­edge­ments: As cit­ed-IDEC, Allen Bradley
Author Doug NixPosted on 2010-07-21 2017-12-26 Categories Control Functions, Control Reliability, Functional Safety, Guards and GuardingTags Control Reliability, controls reliability 13849 machinery interlock, Emergency Stop, EN 954-1, EN ISO 13849-1, ISO 13849-17 Comments on Interlock Architectures — Pt. 1: What do those categories really mean?
756,512 hits