Machinery Safety 101

In the first two posts in this series, we looked at Category B, the Basic cat­e­gory of sys­tem archi­tec­ture, and then moved on to look at Category 1. Category B under­pins Categories 2, 3 and 4. In this post we’ll look more deeply into Category 2.

Let’s start by look­ing at the def­i­n­i­tion for Category 2, taken from ISO 13849–1:2007. Remember that in these excerpts, SRP/​CS stands for Safety Related Parts of Control Systems.

Definition

6.2.5 Category 2

For cat­e­gory 2, the same require­ments as those accord­ing to 6.2.3 for cat­e­gory B shall apply. “Well–tried safety prin­ci­ples” accord­ing to 6.2.4 shall also be fol­lowed. In addi­tion, the fol­low­ing applies.

SRP/​CS of cat­e­gory 2 shall be designed so that their function(s) are checked at suit­able inter­vals by the machine con­trol sys­tem. The check of the safety function(s) shall be performed

• at the machine start-​​up, and
• prior to the ini­ti­a­tion of any haz­ardous sit­u­a­tion, e.g. start of a new cycle, start of other move­ments, and/​or
• peri­od­i­cally dur­ing oper­a­tion if the risk assess­ment and the kind of oper­a­tion shows that it is necessary.

The ini­ti­a­tion of this check may be auto­matic. Any check of the safety function(s) shall either

• allow oper­a­tion if no faults have been detected, or
• gen­er­ate an out­put which ini­ti­ates appro­pri­ate con­trol action, if a fault is detected.

Whenever pos­si­ble this out­put shall ini­ti­ate a safe state. This safe state shall be main­tained until the fault is cleared. When it is not pos­si­ble to ini­ti­ate a safe state (e.g. weld­ing of the con­tact in the final switch­ing device) the out­put shall pro­vide a warn­ing of the haz­ard.

For the des­ig­nated archi­tec­ture of cat­e­gory 2, as shown in Figure 10, the cal­cu­la­tion of MTTF_d and DC_avg should take into account only the blocks of the func­tional chan­nel (i.e. I, L and O in Figure 10) and not the blocks of the test­ing chan­nel (i.e. TE and OTE in Figure 10).

The diag­nos­tic cov­er­age (DC_avg) of the total SRP/​CS includ­ing fault-​​detection shall be low. The MTTF_d of each chan­nel shall be low-​​to-​​high, depend­ing on the required per­for­mance level (PL_r). Measures against CCF shall be applied (see Annex F).

The check itself shall not lead to a haz­ardous sit­u­a­tion (e.g. due to an increase in response time). The check­ing equip­ment may be inte­gral with, or sep­a­rate from, the safety-​​related part(s) pro­vid­ing the safety function.

The max­i­mum PL achiev­able with cat­e­gory 2 is PL = d.

NOTE 1 In some cases cat­e­gory 2 is not applic­a­ble because the check­ing of the safety func­tion can­not be applied to all components.

NOTE 2 Category 2 sys­tem behav­iour allows that

• the occur­rence of a fault can lead to the loss of the safety func­tion between checks,
• the loss of safety func­tion is detected by the check.

NOTE 3 The prin­ci­ple that sup­ports the valid­ity of a cat­e­gory 2 func­tion is that the adopted tech­ni­cal pro­vi­sions, and, for exam­ple, the choice of check­ing fre­quency can decrease the prob­a­bil­ity of occur­rence of a dan­ger­ous situation.

ISO 13849–1 Figure 10 — Category 2 Block diagram

Breaking it down

Let start by tak­ing apart the def­i­n­i­tion a piece at a time and look­ing at what each part means. I’ll also show a sim­ple cir­cuit that can meet the requirements.

Category B & Well-​​tried Components

The first para­graph speaks to the build­ing block approach taken in the standard:

For cat­e­gory 2, the same require­ments as those accord­ing to 6.2.3 for cat­e­gory B shall apply. “Well–tried safety prin­ci­ples” accord­ing to 6.2.4 shall also be fol­lowed. In addi­tion, the fol­low­ing applies.

Systems meet­ing Category 2 are required to meet all of the same require­ments as Category B, as far as the com­po­nents are con­cerned. Other require­ments for the cir­cuits are dif­fer­ent, and we will look at those in a bit.

Self-​​Testing required

Category 2 brings in the idea of diag­nos­tics. If cor­rectly spec­i­fied com­po­nents have been selected (Category B), and those com­po­nents can be con­sid­ered ‘well-​​tried’ and are applied fol­low­ing ‘well-​​tried safety prin­ci­ples’, then adding a diag­nos­tic com­po­nent to the sys­tem should allow the sys­tem to detect some faults and there­fore achieve a cer­tain degree of ‘fault-​​tolerance’ or the abil­ity to func­tion cor­rectly even when some aspect of the sys­tem has failed.

Let’s look at the text:

SRP/​CS of Category 2 shall be designed so that their function(s) are checked at suit­able inter­vals by the machine con­trol sys­tem. The check of the safety function(s) shall be performed

• at the machine start-​​up, and
• prior to the ini­ti­a­tion of any haz­ardous sit­u­a­tion, e.g. start of a new cycle, start of other move­ments, and/​or
• peri­od­i­cally dur­ing oper­a­tion if the risk assess­ment and the kind of oper­a­tion shows that it is necessary.

The ini­ti­a­tion of this check may be auto­matic. Any check of the safety function(s) shall either

• allow oper­a­tion if no faults have been detected, or
• gen­er­ate an out­put which ini­ti­ates appro­pri­ate con­trol action, if a fault is detected.

Whenever pos­si­ble this out­put shall ini­ti­ate a safe state. This safe state shall be main­tained until the fault is cleared. When it is not pos­si­ble to ini­ti­ate a safe state (e.g. weld­ing of the con­tact in the final switch­ing device) the out­put shall pro­vide a warn­ing of the hazard.

Periodic check­ing is required. The checks must hap­pen at least each time there is a demand placed on the sys­tem, i.e. a guard door is opened and closed, or an emer­gency stop but­ton is pressed and reset. In addi­tion the integrity of the SRP/​CS must be tested at the start of a cycle or haz­ardous period, and poten­tially peri­od­i­cally dur­ing oper­a­tion if the risk assess­ment indi­cates that this is necessary.

The test­ing does not have to be auto­matic, although in prac­tice it usu­ally is. As long as the sys­tem integrity is good, then the out­put is allowed to remain on, and the machin­ery or process can run.

Watch Out!

Notice that the words ‘when­ever pos­si­ble’ are used in the last para­graph in this part of the def­i­n­i­tion where the stan­dard speaks about ini­ti­a­tion of a safe state. This word­ing alludes to the fact that these sys­tems are still prone to faults that can lead to the loss of the safety func­tion, and so can­not be called truly ‘fault-​​tolerant’. Loss of the safety func­tion must be detected by the mon­i­tor­ing sys­tem and a safe state ini­ti­ated. This requires care­ful thought, since the safety sys­tem com­po­nents may have to inter­act with the process con­trol sys­tem to ini­ti­ate and main­tain the safe state in the event that the safety sys­tem itself has failed.

All of this leads to an inter­est­ing ques­tion: If the sys­tem is hard­wired through the oper­at­ing chan­nel, and all the com­po­nents used in that chan­nel meet Category B require­ments, can the diag­nos­tic com­po­nent be pro­vided by a mon­i­tor­ing the sys­tem with a stan­dard PLC?

Unfortunately, the answer to this is NO. This is true because ALL of the com­po­nents must meet the well-​​tried require­ment, and since pro­gram­ma­ble elec­tron­ics are specif­i­cally excluded from being con­sid­ered well-​​tried, this approach can­not be used. Some North American stan­dards are writ­ten so that this approach could be applied, but under the International and EU require­ments it is not acceptable.

Finally, for the faults that can be detected by the mon­i­tor­ing sys­tem, detec­tion of a fault must ini­ti­ate a safe state. This means that on the next demand on the sys­tem, i.e. the next time the guard is opened or the emer­gency stop is pressed, the machine must go into a safe con­di­tion. Generally, detec­tion of a fault should pre­vent the sub­se­quent reset of the sys­tem until the fault is cleared or repaired.

Testing is not per­mit­ted to intro­duce any new haz­ards or to slow the sys­tem down. The tests must occur ‘on-​​the-​​fly’ and with­out intro­duc­ing any delay in the sys­tem com­pared to how it would have oper­ated with­out the test­ing incor­po­rated. Test equip­ment can be inte­grated into the safety sys­tem or be exter­nal to it.

One more ‘gotcha’

Note 1 in the def­i­n­i­tion high­lights a sig­nif­i­cant pit­fall for many design­ers: if all of the com­po­nents in the func­tional chan­nel of the sys­tem can­not be checked, you can­not claim con­for­mity to Category 2. A sys­tem that oth­er­wise would meet the archi­tec­tural require­ments for Category 2 must be down­graded to Category 1 in cases where all the com­po­nents in the func­tional chan­nel can­not be tested. This is a major point and one which many design­ers miss when devel­op­ing their systems.

Calculation of MTTF_d

The next para­graph deals with the cal­cu­la­tion of the fail­ure rate of the sys­tem, or MTTF_d.

For the des­ig­nated archi­tec­ture of cat­e­gory 2, as shown in Figure 10, the cal­cu­la­tion of MTTF_d and DC_avg should take into account only the blocks of the func­tional chan­nel (i.e. I, L and O in Figure 10) and not the blocks of the test­ing chan­nel (i.e. TE and OTE in Figure 10).

Calculation of the fail­ure rate focuses on the func­tional chan­nel, not on the mon­i­tor­ing sys­tem, mean­ing that the fail­ure rate of the mon­i­tor­ing sys­tem is ignored when ana­lyz­ing sys­tems using this archi­tec­ture. The MTTF_d of each com­po­nent in the func­tional chan­nel is cal­cu­lated and then the MTTF_d of the total chan­nel is calculated.

The Diagnostic Coverage (DC_avg) is also cal­cu­lated based exclu­sively on the com­po­nents in the func­tional chan­nel, so when deter­min­ing what per­cent­age of the faults can be detected by the mon­i­tor­ing equip­ment, only faults in the func­tional chan­nel are considered.

This high­lights the fact that a fail­ure of the mon­i­tor­ing sys­tem can­not be detected, so a sin­gle fail­ure in the mon­i­tor­ing sys­tem that results in the sys­tem fail­ing to detect a sub­se­quent nor­mally detectable fail­ure in the func­tional chan­nel will result in the loss of the safety function.

Summing Up

The next para­graph sums up the lim­its of this par­tic­u­lar architecture:

The diag­nos­tic cov­er­age (DC_avg) of the total SRP/​CS includ­ing fault-​​detection shall be low. The MTTF_d of each chan­nel shall be low-​​to-​​high, depend­ing on the required per­for­mance level (PL_r). Measures against CCF shall be applied (see Annex F).

The first sen­tence reflects back to the pre­vi­ous para­graph on diag­nos­tic cov­er­age, telling you, as the designer, that you can­not make a claim to any­thing more than LOW DC cov­er­age when using this architecture.

This raises an inter­est­ing ques­tion, since Figure 5 in the stan­dard shows columns for both DC_avg = LOW and DC_avg=MED. My best advice to you as a user of the stan­dard is to abide by the text, mean­ing that you can­not claim higher than LOW for DC_avg in this architecture.

Another prob­lem raised by this sen­tence is the inclu­sion of the phrase “the total SRP/​CS includ­ing fault-​​detection”, since the pre­vi­ous para­graph explic­itly tells you that the assess­ment of DC_avg ‘should’ only include the func­tional chan­nel, while this sen­tence appears to include it. In stan­dards writ­ing, sen­tences includ­ing the word ‘shall’ are clearly manda­tory, while those includ­ing the word ‘should’ indi­cate a con­di­tion which is advised but not required. Hopefully this con­fu­sion will be clar­i­fied in the next edi­tion of the standard.

Failure rates in the func­tional chan­nel can be any­where in the range from LOW to HIGH depend­ing on the com­po­nents selected and the way they are applied in the design. The require­ment will be dri­ven by the desired PL of the sys­tem, so a PL_d sys­tem will require HIGH MTTF_d com­po­nents in the func­tional chan­nel, while the same archi­tec­ture used for a PL_b sys­tem would require only LOW MTTF_d com­po­nents.
Finally, applic­a­ble mea­sures against Common Cause Failures (CCF) must be used. Some of the mea­sures given in Table F.1 in Annex F of the stan­dard can­not be applied, such as Channel Separation, since you can­not sep­a­rate a sin­gle chan­nel. Other CCF mea­sures can and must be applied, and so there­fore you must score at least the min­i­mum 65 on the CCF table in Annex F to claim com­pli­ance with Category 2 requirements.

Example Circuit

Here’s an exam­ple of what a sim­ple Category 2 cir­cuit con­structed from dis­crete com­po­nents might look like. Note that PB1 and PB2 could just as eas­ily be inter­lock switches on guard doors as push but­tons on a con­trol panel. For the sake of sim­plic­ity, I did not illus­trate surge sup­pres­sion on the relays, but you should include MOV’s or RC sup­pres­sors across all relay coils. All relays are con­sid­ered to be con­structed with  ‘force-​​guided’ designs and meet the require­ments for well-​​tried components.

Example Example Category 2 cir­cuit from dis­crete components

Here is how the cir­cuit works:

1. The machine is stopped with power off. CR1, CR2, and M are off. CR3 is off until the reset but­ton is pressed, since the NC mon­i­tor­ing con­tacts on CR1, CR2 and M are all closed, but the NO reset push but­ton con­tact is open.
2. The reset push but­ton, PB3,  is pressed. If both CR1, CR2 and M are off, their nor­mally closed con­tacts will be closed, so press­ing PB3 will result in CR3 turn­ing on.
3. CR3 closes its con­tacts, ener­giz­ing CR1 and CR2 which seal their con­tact cir­cuits in and de-​​energize CR3. The time delays inher­ent in relays per­mit this to work.
4. With CR1 and CR2 closed and CR3 held off because its coil cir­cuit opened when CR1 and CR2 turned on, M ener­gizes and motion can start.

In this cir­cuit the mon­i­tor­ing func­tion is pro­vided by CR3. If any of CR1, CR2 or M were to weld closed, CR3 could not ener­gize, and so a sin­gle fault is detected and the machine is pre­vented from re-​​starting. If the machine is stopped by press­ing either PB1 or PB2, the machine will stop since CR1 and CR2 are redun­dant. If CR3 fails, then the M rung is all held open because CR3 has not de-​​energized, pre­vent­ing the machine from start­ing with a failed mon­i­tor­ing sys­tem. If CR1 or CR2 fail with an open coil, then M can­not ener­gize because of the redun­dant con­tacts on the M rung.

This cir­cuit can­not detect a fail­ure in PB1, PB2, or PB3. Testing is con­ducted each time the cir­cuit is reset.

If M is a motor starter rather than the motor itself, it will need to be dupli­cated for redun­dancy and a mon­i­tor­ing con­tact added to the CR3 rung unless a rea­son­able case for fault exclu­sion can be made.

In cal­cu­lat­ing MTTF_d, PB1, PB2, CR1, CR2, CR3 and M must be included. CR3 is included because it has a func­tional con­tact in the M rung and is there­fore part of the func­tional chan­nel of the cir­cuit as well as being part of the OT and OTE channels.

Download IEC stan­dards, International Electrotechnical Commission stan­dards.
Download ISO Standards

Watch for the next install­ment in this series where we’ll explore Category 3, the first of the ‘fault tol­er­ant’ architectures!

+DougNix is Managing Director and Principal Consultant at Compliance InSight Consulting, Inc. (http://​www​.com​pli​an​cein​sight​.ca) in Kitchener, Ontario, and is Lead Author and Managing Editor of the Machinery Safety 101 blog.

Doug’s work includes teach­ing machin­ery risk assess­ment tech­niques pri­vately and through Conestoga College Institute of Technology and Advanced Learning in Kitchener, Ontario, as well as pro­vid­ing tech­ni­cal ser­vices and train­ing pro­grams to clients related to risk assess­ment, indus­trial machin­ery safety, safety-​​related con­trol sys­tem inte­gra­tion and reli­a­bil­ity, laser safety and reg­u­la­tory conformity.

Connect me on Facebook | Twitter | Google + | LinkedIn | Website

Copyright secured by Digiprove © 2011–2012Some Rights Reserved