Monthly Archives: September 2010

Emergency Stop Categories

Posted by on September 27, 2010 4 comments
Emergency Stop on machine console
This entry is part 5 of 9 in the series Emergency Stop

I’ve noticed a lot of peo­ple look­ing for infor­ma­tion on Emergency Stop cat­e­gories recently, so this post is aimed at those read­ers who want to under­stand this topic in more depth.

Categories

The first point to make is that these cat­e­gories are not exclu­sive to emer­gency stop func­tions. They are STOP func­tions, and may be used for nor­mal stop­ping as well as e-​​stop.

Stop cat­e­gories and con­trol reli­a­bil­ity cat­e­gories are not the same, and there are sig­nif­i­cant dif­fer­ences that need to be under­stood by con­trol sys­tem design­ers. I’m going to sling a num­ber of stan­dards at you in this post, and I will pro­vide ref­er­ences at the end if you want to dig deeper.

Control reli­a­bil­ity cat­e­gories are defined and described in ISO 13849–1, and I’ve writ­ten quite a bit on these in the past. If you want to know more about Categories B, 1–4, check out this series of posts on ISO 13849–1 Categories.

Originating Standards

OK, so let’s talk about stop func­tion cat­e­gories. There are two stan­dards that define these cat­e­gories, and thank­fully they are har­mo­nized, mean­ing that the def­i­n­i­tions for the cat­e­gories are essen­tially the same in each doc­u­ment. They are:

  • IEC 60204–1, Safety of machin­ery — Electrical equip­ment of machines — Part 1: General require­ments (aka EN 60204–1)
  • NFPA 79, Electrical Standard for Industrial Machinery

Note that Canada does not have a stan­dard at the moment that specif­i­cally describes these same cat­e­gories, how­ever CSA Z432 does make ref­er­ence to NFPA 79, bring­ing the cat­e­gories in that way, albeit indirectly.

Download ANSI standards

Download IEC standards

Category Definitions

Emergency Stop ButtonThe cat­e­gories are bro­ken down into three gen­eral groups:

  • Category 0 — Equivalent to pulling the plug;
  • Category 1 — Bring things to a grace­ful stop, then pull the plug; and
  • Category 2 — Bring things to a stop and hold them there under power.

Let’s look at the def­i­n­i­tions in more detail. For com­par­i­son, I’m going to show the def­i­n­i­tions from the two stan­dards side-​​by-​​side.

Table 1
Comparison of Stop Function Categories
CategoryIEC 60204–1NFPA 79
0stop­ping by imme­di­ate removal of power to the machine actu­a­tors (i.e. an uncon­trolled stop – see 3.56);

is an uncon­trolled stop by imme­di­ately remov­ing power to the machine actuators.

1a con­trolled stop (see 3.11) with power avail­able to the machine actu­a­tors to achieve the stop and then removal of power when the stop is achieved;is a con­trolled stop with power to the machine actu­a­tors avail­able to achieve the stop then remove power when the stop is achieved.
2a con­trolled stop with power left avail­able to the machine actuators.is a con­trolled stop with power left avail­able to the machine actuators.

Definitions from IEC 60204–1:

3.11 con­trolled stop

stop­ping of machine motion with elec­tri­cal power to the machine actu­a­tors main­tained dur­ing the stop­ping process

3.56 uncon­trolled stop

stop­ping of machine motion by remov­ing elec­tri­cal power to the machine actuators

NOTE This def­i­n­i­tion does not imply any par­tic­u­lar state of other stop­ping devices, for exam­ple mechan­i­cal or hydraulic brakes.

As you can see, the two sets of Category descrip­tions are vir­tu­ally iden­ti­cal, with the pri­mary dif­fer­ence being the use of the def­i­n­i­tions in the IEC stan­dard instead of includ­ing that infor­ma­tion in the descrip­tion as in the NFPA standard.

Download ANSI standards

Download IEC standards

Minimum Requirements

Both stan­dards require that all machines have at least a Category 0 stop. This could be achieved by switch­ing off (by using the dis­con­nect­ing means for exam­ple), by phys­i­cally “pulling the plug” from the power sup­ply socket on the wall, through a ‘master-​​control relay’ cir­cuit, or through an emer­gency stop cir­cuit. Note that this does not require that all machines have an e-​​stop!!

To learn more about how to deter­mine the need for emer­gency stop, see my ear­lier post Emergency Stop – What’s so con­fus­ing about that?

Selecting a Stop Function

How do you decide on what cat­e­gory to use? First, a risk assess­ment is required. Second, a start/​stop analy­sis should be con­ducted. This is quite sim­ple, being a straight­for­ward analy­sis of the start­ing and stop­ping con­di­tions for the machin­ery. Next, ask these questions:

1) Will the machin­ery stop safely under an uncon­trolled stop?

If the machin­ery does not have a sig­nif­i­cant amount of iner­tia, mean­ing it won’t coast more than a very short time, then a Category 0 stop may be all that is required.

2) If the machin­ery coasts, or if the machin­ery can be stopped more quickly under con­trol than when power is sim­ply removed, then a Category 1 stop is likely the best choice.

3) If the machin­ery includes devices that require power to keep them in a safe state, then a Category 2 stop is likely the best choice.

If you choose to use a Category 2 stop, be aware that leav­ing power on the machin­ery leaves the user open to haz­ards related to hav­ing power on the machin­ery. Careful risk assess­ment is required in these cases especially.

Risk Assessment and Stop/​Start Analysis

Risk assess­ment is crit­i­cal to the spec­i­fi­ca­tion of all safety–related func­tions. While emer­gency stop is not a safe­guard, it is con­sid­ered to be a ‘com­ple­men­tary pro­tec­tive mea­sure’. Understanding the haz­ards that need to be con­trolled and the degree of risk related to the haz­ards is basic design infor­ma­tion that will pro­vide spe­cific direc­tion on the stop cat­e­gory required and the degree of con­trol reli­a­bil­ity nec­es­sary to pro­vide the expected risk reduction.

Stop/​Start Analysis is quite sim­ple. It amounts to con­sid­er­ing all of the intended stop/​start con­di­tions for the machin­ery, and then includ­ing con­di­tions that may result from rea­son­ably fore­see­able fail­ure modes of the machin­ery and fore­see­able mis­uses of the machin­ery. Create a table with three columns as a start­ing point, sim­i­lar to Table 2.

Table 2
Example Start/​Stop Analysis

DescriptionStart ConditionStop Condition
Lubricant PumpLubricant Pump Start Button PressedLubricant Pump Stop Button Pressed
  Low Lubricant Level in reservoir
  High pres­sure drop across lubri­cant filter
Main Spindle MotorStart enabled and Start Button PressedLow Lubricant Pressure
  Stop but­ton pressed
Feed Advance motorFeed Advance but­ton pressedFeed Stop but­ton pressed
  Feed end of travel limit reached
Emergency Stop All motions stop, lubri­cant pump remains running

The above table is sim­ply an exam­ple of what a start/​stop analy­sis can look like. You can have as much detail as you like.

Control Reliability Requirements

Both ISO 13849–1 and IEC 62061 base the ini­tial require­ments for reli­a­bil­ity on the out­come of the risk assess­ment (PLr or SILr). If the stop­ping con­di­tion is part of nor­mal oper­a­tion, then sim­ple cir­cuit require­ments (i.e. PLa, Category 1) are all that may be required. If the stop­ping con­di­tion is intended to be an Emergency Stop, then addi­tional analy­sis is needed to deter­mine exactly what may be required.

More Information

How have you typ­i­cally imple­mented your stops and emer­gency stop systems?

Have you ever used the START/​STOP analy­sis method?

I care about what you think as a reader, so please leave me com­ments and ques­tions! If you would pre­fer to dis­cuss your ques­tion pri­vately,  con­tact me directly.

Referenced Standards

5% Discount on All Standards with code: CC2011

American National Standards Institute (ANSI)

ANSI/​NFPA 79, 2007 — Electrical Standard for Industrial Machinery

Download stan­dards from ANSI

Canadian Standards Association (CSA)

CSA Z432, 2004 — Safeguarding of Machinery
CSA Store

International Electrotechnical Commission (IEC)

IEC 60204–1, 2009 — Electrical Equipment of Industrial Machines

Download IEC standards

International Standardization Organization (ISO)

ISO 13849–1, 2006 — Safety of Machinery — Safety Related Parts of Control Systems — Part 1: General Principles for Design

ISO 13849–2, 2006 — Safety of Machinery — Safety Related Parts of Control Systems — Part 2: Validation

Download ISO Standards

5% Discount on All Standards with code: CC2011

Manufacturing Automation Roundtable

Posted by on September 21, 2010 Comments Off

I had the great plea­sure today of par­tic­i­pat­ing in a round table dis­cus­sion that was held by Manufacturing Automation mag­a­zine at their head­quar­ters in Aurora, Ontario.

Around the table were: Elizabeth Rankin — CSA, Wayne De L’Orme — Ontario Ministry of Labour, Dave Lawson — Advanced Motion & Controls, Jeff Mathyssen — Electro-​​Mag, Rick Sauer — Festo, Dan Fournier — Omron and Lisa Bolton — Sherrard Kuzz LLP.

The depth and breadth of the exper­tise was refresh­ing, and the dis­cus­sion that ranged from stan­dards and har­mo­niza­tion to the prac­tice of safety, work­place OHS  and edu­ca­tion of engi­neers and users was stimulating.

CLB Media is plan­ning to have a video of the dis­cus­sions avail­able on their web site, as well as an arti­cle in the mag­a­zine and on the web site.

For more infor­ma­tion, con­tact Mary Del Ciancio at CLB Media.

Watch for the arti­cle in Manufacturing Automation in their Nov/​Dec issue!

Missing MTTFd data

Posted by on September 13, 2010 Comments Off

What the heck is MTTFd???

When you first start to work through ISO 13849–1, the first thing that will smack you in the head is the plethora of new acronyms. The first one you’ll run into is ‘PL’, of course, since the entire pur­pose of the stan­dard is to aid the designer in deter­min­ing the reli­a­bil­ity Performance Level of the con­trol sys­tem. Shortly after that you’ll find your­self face to face with MTTFd.

MTTFd, or the Mean Time To Failure (dan­ger­ous), is the name given to the expected fail­ure rate per year for a com­po­nent used in a sys­tem that is being ana­lyzed. This rate dif­fers from the straight fail­ure rate for the com­po­nent because it’s lim­ited to the fail­ures that result in a dan­ger­ous fail­ure mode, or that may lead to a haz­ard.

So how do you get this data?

Obtaining MTTFd data for a com­po­nent should be easy for a designer. Component man­u­fac­tur­ers who mar­ket com­po­nents intended for safety appli­ca­tions should pro­vide this data in the com­po­nent spec­i­fi­ca­tions, but there are thou­sands, per­haps mil­lions, of dif­fer­ent com­po­nents being mar­keted today for use in safety sys­tems. Most of the major man­u­fac­tur­ers are already pro­vid­ing this fig­ure, or a fig­ure that can be used to derive MTTFd, B10d, but for many com­po­nents, this data is sim­ply not available.

Here are some ran­domly cho­sen exam­ples of manufacturer’s spec­i­fi­ca­tion sheets that give this data:

Allen-​​Bradley Trojan™ T15 Interlock Switch

Pilz PNOZ X2 (pdf data sheet)

Telemecanique XPS MP Safety Controller (pdf data sheet)

B10d is the num­ber of cycles until 10% of the com­po­nents being tested fail in a dan­ger­ous way. Using fail­ure rate data from the component’s data sheet, it is pos­si­ble to esti­mate B10d from either B10 or T (the appli­ca­tion depen­dent life­time of the com­po­nent). Check out Annex C of the stan­dard if you want to see how this can be done.

But what do you do if the man­u­fac­turer of your favourite con­tac­tor doesn’t pro­vide ANY fail­ure data? Some major man­u­fac­tur­ers still don’t pro­vide any fail­ure rate data at all, some pro­vide expected life­times under spe­cific oper­a­tion con­di­tions. Some pro­vide only EN 954–1:95 data. In the last case, I think this is one of the rea­sons for the EC Machinery Working Group’s deci­sion late last year to extend the tran­si­tion period to ISO 13849–1:07. Need to know more about that decision?

Now what?

Unless you work for a large orga­ni­za­tion, insti­tut­ing a life test­ing pro­gram is not likely to be an option, since you either need a pro­tracted period of time with a few com­po­nents in test, or thou­sands of sam­ples for a short time.

The stan­dard pro­vides the option to use 10 years as a default where no other data is avail­able. 10 years sounds like a long time at first blush, par­tic­u­larly if the planned life­time of the sys­tem involved is 20 years. Typical MTTFd val­ues for high-​​reliability com­po­nents are in the hun­dreds of years, so by com­par­i­son, 10 years is almost noth­ing. Tables are also pro­vided for some kinds of com­po­nents, but the tables are nec­es­sar­ily lim­ited in size, so not every com­po­nent will be listed.

Your only option is to use the data in the stan­dard, or pick up some of the other pub­li­ca­tions that include com­po­nent fail­ure data, like MIL-​​HDBK-​​217F, IEC/​TR 62380 (based on UTE 80810 & RDF 2000), NPRD 95 or IEC 61709 (based on Siemens SN 29500 doc­u­ments). Some of these doc­u­ments may be dif­fi­cult or impos­si­ble to obtain.

The result of this lack of objec­tive data from the com­po­nent man­u­fac­tur­ers is:

  • Conservative results based on the min­i­mum default MTTFd;
  • Potential over-​​design of safety related controls;
  • Increased man­u­fac­tur­ing costs for machine builders;

The rea­sons for this sit­u­a­tion vary by man­u­fac­turer, but ulti­mately it comes down to the cost of life test­ing com­po­nents mul­ti­plied by num­ber of com­po­nents built by each man­u­fac­turer. Typical life tests require load sim­u­la­tors and switch­ing for thou­sands of com­po­nents, as well as data log­ging to trap fail­ures and record rel­e­vant data. In the case of fluid power com­po­nents (pneu­mat­ics and hydraulics), this becomes increas­ingly com­plex. For many com­po­nent man­u­fac­tur­ers, the cost of the life test­ing is pro­hib­i­tive, even though this data is badly needed by their users.

Will we see an improve­ment in the future? The largest con­trols com­po­nent man­u­fac­tur­ers are very likely to pro­vide this data as they have it avail­able, mean­ing as they com­plete test­ing. New designs are much more likely to come with this data ini­tially, while it may be a long time before some of the old stan­dard com­po­nents get time in the life test cell. Until then, lots of com­po­nents will be assigned ’10 years’.

A big thank you to Wouter Leusden for the idea for this post!

Have a thought to share on this topic? Correct an error in the arti­cle? Sound off? Leave a comment!

All original content on these pages is fingerprinted and certified by Digiprove
Performance Optimization WordPress Plugins by W3 EDGE