Safe Drive Control including Safe Torque Off (STO)

This entry is part 12 of 13 in the series Emergency Stop

Ed. Note: This art­icle was revised 25-​Jul-​17 to include inform­a­tion on safe standstill.

Safe Drive Control

Variable Frequency Drive for conveyor speed control
Variable Frequency Drive for con­vey­or speed con­trol [1]
Motor drives are every­where. From DC vari­able speed drives and index­ing drives, through AC Variable Frequency drives, servo drives and step­per motor drives, the cap­ab­il­it­ies and the flex­ib­il­ity of these elec­tron­ic sys­tems has giv­en machine design­ers unpre­ced­en­ted cap­ab­il­it­ies when com­pared to basic relay or contactor-​based motor starters. We now have the cap­ab­il­ity to con­trol mech­an­isms using motors in ways that would have been hard to ima­gine at the begin­ning of the indus­tri­al revolution.

Since we are con­trolling machinery, safety is always a con­cern. In the 1990’s when I star­ted design­ing machinery with motor drives, deal­ing with safety con­cerns usu­ally meant adding a suit­ably rated con­tact­or upstream of the drive so that you could inter­rupt power to the drive in case some­thing went wrong. With early servo drives, inter­rupt­ing the sup­ply power often meant los­ing pos­i­tion data or worse, so con­tact­ors were placed between the drive and the motor. This occa­sion­ally caused the drive stage of the servo con­trol­ler to blow up if the switch-​off happened with the motor run­ning and under high load. Motor drive man­u­fac­tur­ers respon­ded by provid­ing con­tact­ors and oth­er com­pon­ents built into their drives, cre­at­ing a fea­ture called Safe Torque Off (STO).

STO describes a state where “The drive is reli­ably torque-​free” [2]. The func­tions dis­cussed in this art­icle are described in detail in IEC 61800 – 5-​2 [3]. The func­tions are also lis­ted in [10, Table 5.2]. Note that only Safe Torque Off and Safe Stop 1 can be used for emer­gency stop func­tions. Safe Torque Off, Safe Stop 1 and Safe Stop 2 can be used for safety-​related stop func­tions ini­ti­ated by a safe­guard­ing device.

If you have been a read­er of this blog for a while, you may recall that I have dis­cussed stop cat­egor­ies before. This art­icle expands on those con­cepts in rela­tion to motor drives and their stop­ping func­tions spe­cific­ally. I’ve also talked about Emergency Stop extens­ively. You might be inter­ested in read­ing more about the e-​stop func­tion in the post “Emergency Stop – What’s so con­fus­ing about that?”

Safe Torque Off (STO)

According to Siemens, “The STO func­tion is the most com­mon and basic drive-​integrated safety func­tion. It ensures that no torque-​generating energy can con­tin­ue to act upon a motor and pre­vents unin­ten­tion­al start­ing.” Risk assess­ment of the machinery can identi­fy the need for an STO func­tion. The devices used for this applic­a­tion are described in IEC 60204 – 1 in clause 5.4 [4]. The design fea­tures for pre­ven­tion of unex­pec­ted start­ing are covered in more detail in EN 1037 [5] or ISO 14118 [6]. If you are inter­ested in these stand­ards, ISO 14118 is in the pro­cess of being revised. A new ver­sion should be avail­able with­in 12 – 18 months.

The STO func­tion oper­ates as shown in Fig.1. The blue line rep­res­ents the drive speed/​velocity, V, on the y-​axis, with time, t, on the x-axis.

Graph showing motor drive output over time when the STO function is activated.
Figure 1 – Safe Torque Off func­tion [1]
At the begin­ning of the stop­ping pro­cess (orange arrow and dot­ted line), the drive gate pulses are imme­di­ately shut off, remov­ing torque from the motor (i.e., zero torque). The speed of the driv­en equip­ment will drop at a rate determ­ined by the sys­tem fric­tion and iner­tia until stand­still is achieved. The zero torque con­di­tion is then main­tained until the safety func­tion per­mits restart­ing (area out­lined with yellow/​black zebra stripe). Note that drive stand­still may occur if the fric­tion and iner­tia of the sys­tem per­mit, but it is pos­sible that the driv­en equip­ment may coast for some time. You may be able to move the driv­en equip­ment by hand or grav­ity with drive in STO.STO is an uncon­trolled stop [4, 3.56]:

STO is an uncon­trolled stop [4, 3.56]:

uncon­trolled stop
stop­ping of machine motion by remov­ing elec­tric­al power to the machine actuators
NOTE This defin­i­tion does not imply any oth­er state of oth­er (for example, non-​electrical) stop­ping devices, for example, mech­an­ic­al or hydraul­ic brakes that are out­side the scope of this standard.

The defin­i­tion above is import­ant. Uncontrolled stops are the most com­mon form of stop­ping used in machines of all types and is required as a basic func­tion for all machines. It can be achieved in a num­ber of ways, includ­ing the use of a dis­con­nect­ing device, emer­gency stop sys­tems, and gate inter­lock­ing sys­tems that remove power from machine actuators.

The concept of an uncon­trolled stop is embod­ied in stop cat­egory 0 [4, 9.2.2]:

stop cat­egory 0 — stop­ping by imme­di­ate remov­al of power to the machine actu­at­ors (i.e., and uncon­trolled stop, see 3.56)

Stop cat­egory 0 is only appro­pri­ate where the machinery has little iner­tia, or where mech­an­ic­al fric­tion is high enough that the stop­ping time is short. It may also be used in cases where the machinery has very high iner­tia, but only for nor­mal stop­ping when coast­ing time is not a factor, not for safety stop­ping func­tions where the time to a no-​motion state is critical.

There are a few oth­er stop­ping modes that are often con­fused with STO:

  • Safe Stop 1
  • Safe Stop 2
  • Safe Operating Stop
  • Safe Standstill

Let’s explore the differences.

Safe Stop 1 (SS1)

If a defined stop­ping time is needed, a con­trolled stop­ping func­tion will be required fol­lowed by entry into STO. This stop­ping func­tion is called “Safe Stop 1” (SS1).

SS1 is dir­ectly related to Stop Category 1 [4, 9.2.2]. As described in [4], Stop Category 1 func­tions as follows:

stop cat­egory 1 — a con­trolled stop (see 3.11) with power avail­able to the machine actu­at­ors to achieve the stop and then remov­al of power when the stop is achieved;

A “con­trolled stop” is defined in [4, 3.11]:

con­trolled stop
stop­ping of machine motion with elec­tric­al power to the machine actu­at­or main­tained dur­ing the stop­ping process

Once the con­trolled stop is com­pleted, i.e., machine motion has stopped, the drive may then be placed into STO (or cat­egory 0 stop). The stop­ping pro­cess is shown in Fig. 2 [7].

Graph showing the reduction of drive speed over time following the beginning of a controlled stopping process.
Figure 2 – Safe Stop 1

The stop­ping pro­cess starts where the orange arrow and dot­ted line are shown. As com­pared to Fig. 1 where the decel­er­a­tion curve is gentle and expo­nen­tial, the act­ive stop­ping peri­od in Fig. 2 is a lin­ear curve from oper­at­ing speed to zero speed. At the blue dot­ted line, the drive enters and stays in STO. The yellow/​black zebra striped area of the curve out­lines the com­plete stop­ping func­tion. This stop­ping meth­od is typ­ic­al of many types of machinery, par­tic­u­larly those with servo driv­en mechanisms.

Safe Stop 2 (SS2)

In some cases, the risk assess­ment may show that remov­ing power com­pletely from a mech­an­ism will increase the risk. An example might be a ver­tic­al axis where the motor drive is used to main­tain the pos­i­tion of the tool­ing. Removing power from the drive with the tool raised would res­ult in the tool­ing crash­ing to the bot­tom of the axis in an uncon­trolled way. Definitely NOT the desired way to achieve any kind of stop!

There are a num­ber of ways to pre­vent this kind of occur­rence, but I’m going to lim­it the dis­cus­sion here to the Safe Stop 2 function.

Let’s start with the defin­i­tion [4, 3.11]:

con­trolled stop
stop­ping of machine motion with elec­tric­al power to the machine actu­at­or main­tained dur­ing the stop­ping process

Wait! This is exactly the same as a stop cat­egory 1, so what is the dif­fer­ence? For that we need to look to [4, 9.2.2]:

stop cat­egory 2 — a con­trolled stop with power left avail­able to the machine actuators.

The first thing to know about stop cat­egory 2 is that this cat­egory can­not be used for emer­gency stop [4, 9.2.5.4.2]. If you have tool­ing where stop cat­egory 2 is the most appro­pri­ate stop under nor­mal con­di­tions, you will have to add an anoth­er means to pre­vent the axis from fall­ing dur­ing the emer­gency stop. This could be a spring-​set brake that is held released by the emer­gency stop sys­tem and is applied when the e-​stop sys­tem removes power from the tool­ing. There are many ways to achieve auto­mat­ic load-​holding besides brakes, but remem­ber, whatever you choose it must be effect­ive in power loss conditions.

As shown in Fig. 3, the oper­a­tion of Safe Stop 2 dif­fers from Safe Stop 1 in that, instead of enter­ing into STO when motion stops, the sys­tem enters Safe Operating Stop (SOS) [8], not STO. SOS is a stop cat­egory 2 func­tion. Full torque remains avail­able from the motor to hold the tool­ing in pos­i­tion. Safe stand­still is mon­itored by the drive or oth­er means.

Graph showing speed reduction to zero, followed by entry into stop category 2.
Figure 3 — Safe Stop 2

Depending on the ISO 13849 – 1 PLr, or the IEC 62061 SILr needed for the applic­a­tion, the drive may not have high enough reli­ab­il­ity on its own. In this case, a second chan­nel may be required to ensure that safe stand­still mon­it­or­ing is adequately reli­able. This can be achieved by adding anoth­er means of stand­still detec­tion, like a second encoder, or a stand­still mon­it­or­ing device. An example cir­cuit dia­gram show­ing this type of mon­it­or­ing can be found in Fig. 4 [10, Fig. 8.37], show­ing a safety PLC and drive used to provide an “inch­ing” or “jog” function.

Circuit diagram for a safe inching mode using a motor drive. Taken from Fig 8.37 in BGIA Report 2/2008e
Figure 4 — Safely lim­ited speed for inch­ing mode – PLd, Cat. 3 [10]
In Fig. 4, the encoders are labelled G1 and G2. Both encoders are con­nec­ted to the safety PLC to provide two-​channel feed­back required for Category 3 archi­tec­ture. G1 is also con­nec­ted to the motor drive for pos­i­tion and velo­city feed­back as needed for the applic­a­tion. Note that this par­tic­u­lar drive also has a con­tact­or upstream, Q1, to provide one chan­nel of the two required for Category 3. The second chan­nel would be provided by the pulse block­ing input on the drive. For more on how this cir­cuit func­tions and how the func­tion­al safety ana­lys­is is com­pleted, see [10].

Safe Operating Stop (SOS)

During a safe oper­at­ing stop (SOS), the motor is brought to a spe­cif­ic pos­i­tion and held there by the drive. Full torque is avail­able to keep the tool­ing in pos­i­tion. The stop is mon­itored safely by the drive. The func­tion is shown in Figure 4 [9].

A graph showing a drive maintaining position following a stop
Figure 5 — Safe Operating Stop

In Fig. 5, the y-​axis, s, rep­res­ents the pos­i­tion of the tool­ing, NOT the velo­city, while the x-​axis rep­res­ents time, t. The start of the pos­i­tion hold­ing func­tion is shown by the orange arrow and dashed line. The peri­od fol­low­ing the green dashed line is the SOS period.

SOS can­not be used for the emer­gency stop func­tion. Under cer­tain con­di­tions it may be used when guard inter­locks are opened, i.e., the guard door on a CNC lathe is opened so that the oper­at­or can place a new workpiece.

There a quite a few addi­tion­al “safe” drive func­tions. For more on these func­tions and how to imple­ment them, see [2] and applic­a­tion data from your favour­ite drive man­u­fac­turer. Reference is also provided in [9, Table 5.2].

Safe Standstill

Safe stand­still is a con­di­tion where motion has stopped and is being mon­itored by a safety-​rated device whose out­put sig­nals are used to con­trol the release of guard lock­ing devices. Safe stand­still is not the same as zero-​speed because zero-​speed can be achieved without the use of safety rated con­trol com­pon­ents and design, while safe stand­still requires both suit­able com­pon­ents and design.

There are a num­ber of ways to achieve safe stand­still. Here are three com­mon approaches [12]:

  1. Rotation sensors
    Sensors includ­ing prox­im­ity sensors, resolv­ers, and encoders can be used to mon­it­or the motion of the drive com­pon­ents. A safe stand­still mon­it­or­ing device is used to when stand­still has occurred.  When a machine has an unstable rest pos­i­tion, a prox­im­ity sensor should be used to ensure the machine is in a safe con­di­tion before the guard lock­ing devices are released.
  2. Back EMF monitoring
    Back elec­tro­mot­ive force or Back EMF is the voltage cre­ated in an elec­tric motor due to the rota­tion of the arma­ture in the mag­net­ic field in the motor. This voltage opposes the applied voltage and is approx­im­ately pro­por­tion­al to the rota­tion­al speed of the motor. Back EMF remains after the sup­ply voltage has been removed, allow­ing mon­it­or­ing devices to indir­ectly meas­ure motor speed and standstill.
  3. Failsafe timer
    Failsafe timers are time delay relays designed for use in safety func­tions. Failsafe timers can be used when the stop­ping per­form­ance of the machinery is con­sist­ent and known.
    Following remov­al of power from the drive motor, the time delay starts. At the end of the time delay, the relay releases the guard lock­ing devices.
    Regular time delay relays can­not be used for this pur­pose, only fail-​safe relays designed to be used in safety func­tions can be used, along with suit­able safety sys­tems design tech­niques like ISO 13849 or IEC 62061.

Conclusions

As you can see, there are sig­ni­fic­ant dif­fer­ences between STO, SS1, SS2, SOS and Safe Standstill. While these func­tions may be used togeth­er to achieve a par­tic­u­lar safety func­tion, some are func­tions of the imple­ment­a­tion of the motor drive, e.g., STO, a func­tion of the design of the motor drive itself, e.g., STO, SS1, SS2, and SOS, or the design of con­trols extern­al to the motor drive, e.g., safe stand­still. The sim­il­ar­it­ies between these vari­ous func­tions can make it easy to con­fuse them. Care needs to be taken to ensure that the cor­rect tech­nic­al approach is used when real­ising the safety func­tion required by the risk assessment.

References

[1]    “Variable Frequency Drives – Industrial Wiki – odesie by Tech Transfer”, Myodesie​.com, 2017. [Online]. Available: https://​www​.myo​desie​.com/​w​i​k​i​/​i​n​d​e​x​/​r​e​t​u​r​n​E​n​t​r​y​/​i​d​/​3​040. [Accessed: 19- Jun- 2017]. 

[2] “Safe Torque Off (STO) – Safety Integrated – Siemens”, Industry​.siemens​.com, 2017. [Online]. Available: http://​www​.industry​.siemens​.com/​t​o​p​i​c​s​/​g​l​o​b​a​l​/​e​n​/​s​a​f​e​t​y​-​i​n​t​e​g​r​a​t​e​d​/​m​a​c​h​i​n​e​-​s​a​f​e​t​y​/​p​r​o​d​u​c​t​-​p​o​r​t​f​o​l​i​o​/​d​r​i​v​e​-​t​e​c​h​n​o​l​o​g​y​/​s​a​f​e​t​y​-​f​u​n​c​t​i​o​n​s​/​p​a​g​e​s​/​s​a​f​e​-​t​o​r​q​u​e​-​o​f​f​.​a​spx. [Accessed: 19- Jun- 2017].

[3]      Adjustable speed elec­tric­al power drive sys­tems – Part 5 – 2: Safety require­ments – Functional. IEC Standard 61800 – 5-​2. 2nd Ed. 2016.

[4]     Safety of machinery — Electrical equip­ment of machines — Part 1: General require­ments. IEC Standard 60204 – 1. 2006.

[5]     Safety of machinery — Prevention of unex­pec­ted start-​up. EN Standard 1037+A1. 2008.

[6]     Safety of machinery — Prevention of unex­pec­ted start-​up. ISO Standard 14118. 2000.

[7]     “Safe Stop 1 (SS1) – Safety Integrated – Siemens”, Industry​.siemens​.com, 2017. [Online]. Available: http://​www​.industry​.siemens​.com/​t​o​p​i​c​s​/​g​l​o​b​a​l​/​e​n​/​s​a​f​e​t​y​-​i​n​t​e​g​r​a​t​e​d​/​m​a​c​h​i​n​e​-​s​a​f​e​t​y​/​p​r​o​d​u​c​t​-​p​o​r​t​f​o​l​i​o​/​d​r​i​v​e​-​t​e​c​h​n​o​l​o​g​y​/​s​a​f​e​t​y​-​f​u​n​c​t​i​o​n​s​/​P​a​g​e​s​/​s​a​f​e​-​s​t​o​p​1​.​a​spx. [Accessed: 19- Jun- 2017].

[8]     “Safe Stop 2 (SS2) – Safety Integrated – Siemens”, Industry​.siemens​.com, 2017. [Online]. Available: http://​www​.industry​.siemens​.com/​t​o​p​i​c​s​/​g​l​o​b​a​l​/​e​n​/​s​a​f​e​t​y​-​i​n​t​e​g​r​a​t​e​d​/​m​a​c​h​i​n​e​-​s​a​f​e​t​y​/​p​r​o​d​u​c​t​-​p​o​r​t​f​o​l​i​o​/​d​r​i​v​e​-​t​e​c​h​n​o​l​o​g​y​/​s​a​f​e​t​y​-​f​u​n​c​t​i​o​n​s​/​P​a​g​e​s​/​s​a​f​e​-​s​t​o​p​2​.​a​spx. [Accessed: 19- Jun- 2017].

[9]     “Safe Operating Stop (SOS) – Safety Integrated – Siemens”, Industry​.siemens​.com, 2017. [Online]. Available: http://​www​.industry​.siemens​.com/​t​o​p​i​c​s​/​g​l​o​b​a​l​/​e​n​/​s​a​f​e​t​y​-​i​n​t​e​g​r​a​t​e​d​/​m​a​c​h​i​n​e​-​s​a​f​e​t​y​/​p​r​o​d​u​c​t​-​p​o​r​t​f​o​l​i​o​/​d​r​i​v​e​-​t​e​c​h​n​o​l​o​g​y​/​s​a​f​e​t​y​-​f​u​n​c​t​i​o​n​s​/​P​a​g​e​s​/​s​a​f​e​-​o​p​e​r​a​t​i​n​g​-​s​t​o​p​.​a​spx. [Accessed: 19- Jun- 2017].

[10]     M. Hauke, M. Schaefer, R. Apfeld, T. Boemer, M. Huelke, T. Borowski, K. Büllesbach, M. Dorra, H. Foermer-​Schaefer, W. Grigulewitsch, K. Heimann, B. Köhler, M. Krauß, W. Kühlem, O. Lohmaier, K. Meffert, J. Pilger, G. Reuß, U. Schuster, T. Seifen and H. Zilligen, “Functional safety of machine con­trols – Application of EN ISO 13849 – Report 2/​2008e”, BGIA – Institute for Occupational Safety and Health of the German Social Accident Insurance, Sankt Augustin, 2017.

[11]     “Glossary”, Schmersalusa​.com, 2017. [Online]. Available: http://​www​.schmersa​lusa​.com/​c​m​s​1​7​/​o​p​e​n​c​m​s​/​h​t​m​l​/​e​n​/​s​e​r​v​i​c​e​/​g​l​o​s​s​a​r​y​.​h​t​m​l#S. [Accessed: 25- Jul- 2017].

[12]     Schmersal Tech Briefs: Safe Speed & Standstill Monitoring. Schmersal USA, 2014.

Acknowledgements

Special thanks go out to two of my reg­u­lar read­ers for sug­gest­ing this post: Matt Ernst and con­trols­girl, who com­ments fre­quently. Thanks for the ideas and the ques­tions that sparked this post!

Industrial Exception” Becomes Permanent in Ontario

The “Industrial Exception”

The “Industrial Exception” is a clause in the Ontario Professional Engineer’s Act that per­mits unli­censed people to do work nor­mally reserved for licenced engin­eers. Ontario is the only Canadian Province or Territory to have this kind of exception.

Ontario Fall Economic Outlook

The Ontario Government com­mit­ted to main­tain­ing the “indus­tri­al excep­tion” in the Professional Engineers Act in their Fall Economic Outlook and Fiscal Review (p.17), released on the 27th of November, 2015. This state­ment put an end, at least for the moment, to the dis­cus­sions that star­ted in September of 2010 when Professional Engineers Ontario (PEO) formed the “Repeal of Industrial Exception Task Force (RIETF)” and res­ul­ted in the announce­ment of the repeal in January of 2013. The trans­ition peri­od giv­en to busi­ness was 90 days, in which time busi­nesses were expec­ted to con­duct an intern­al audit and vol­un­tar­ily report any viol­a­tions to PEO. They would then be giv­en anoth­er 12 months to rec­ti­fy their situ­ation, after which time they would be sub­ject to pen­al­ties under the Professional Engineers Act.

Professional Engineers Ontario claimed to have involved more than 100 industry groups in the con­sulta­tion pro­cess pri­or to pro­pos­ing the repeal, and yet 25 groups, among them Canada’s largest indus­tri­al asso­ci­ation the Canadian Manufacturers & Exporters, seem­ingly had no know­ledge of the pro­pos­al until the repeal was quietly announced.

The back­lash from industry groups and indi­vidu­al busi­nesses res­ul­ted in the gov­ern­ment decid­ing to aban­don the repeal, which res­ul­ted in a press release from PEO express­ing their shock and indig­na­tion in June of 2013. Nothing more was pub­licly announced until November of 2015, a two-​year silence.

Engineers Canada Press Release

On the 30th of November 2015, Engineers Canada put out a press release regard­ing the “indus­tri­al excep­tion” [1], spin­ning this decision as one that will neg­at­ively influ­ence the safety of work­ers in Ontario, and some­how neg­at­ively impact licensed engin­eers in the Province. This is simply spin by Professional Engineers Ontario  and Engineers Canada. Both organ­iz­a­tions are com­pletely ignor­ing the huge poten­tial impact revok­ing the excep­tion could have on Ontario’s man­u­fac­tur­ing sec­tor while mak­ing over­blown claims about the poten­tial neg­at­ive effects of mak­ing the excep­tion per­man­ent. I want to explore this a bit in this art­icle, as it has a dir­ect bear­ing on machinery safety in the Province.

Professional Engineers

In the Province of Ontario, Canada, where I live and where my prac­tice is based, the engin­eer­ing pro­fes­sion is reg­u­lated by the “Professional Engineers Act” (PEA) [2]. This act aims to reg­u­late the pro­fes­sion and provides the author­ity needed for Professional Engineers Ontario to license prac­ti­tion­ers. Only licenced engin­eers are author­ized to prac­tice pro­fes­sion­al engin­eer­ing as defined in the PEA.

Certified Engineering Technologists and Technicians

If you are a tech­no­lo­gist or a tech­ni­cian, you may choose to cer­ti­fy through the Ontario Association of Certified Engineering Technicians and Technologists (OACETT), how­ever, this does not per­mit you to do any work defined as the “prac­tice of pro­fes­sion­al engin­eer­ing”. Certified Engineering Technologists and Technicians gain no leg­al bene­fit from cer­ti­fic­a­tion, bey­ond the use of titles pro­tec­ted under the OACETT Act, 1998 [3].

Who is an “engineer”?

The PEA defines the “prac­tice of pro­fes­sion­al engin­eer­ing” as follows:

prac­tice of pro­fes­sion­al engin­eer­ing” means any act of plan­ning, design­ing, com­pos­ing, eval­u­at­ing, advising, report­ing, dir­ect­ing or super­vising that requires the applic­a­tion of engin­eer­ing prin­ciples and con­cerns the safe­guard­ing of life, health, prop­erty, eco­nom­ic interests, the pub­lic wel­fare or the envir­on­ment, or the man­aging of any such act; (“exer­cice de la pro­fes­sion d’ingénieur”) [2]

This is a tre­mend­ously broad defin­i­tion, espe­cially in that it includes the man­age­ment of the prac­tice, as well as the oth­er activ­it­ies involved, and the safe­guard­ing of “eco­nom­ic interests”, health, prop­erty, the pub­lic wel­fare, and the envir­on­ment. It’s also worth­while not­ing that there is no defin­i­tion of “engin­eer­ing prin­ciples”, so the lynch­pin for the defin­i­tion is itself undefined. If strictly applied, this defin­i­tion would res­ult in vir­tu­ally every busi­ness in the province that designs or man­u­fac­tures a product being leg­ally required to employ a licensed pro­fes­sion­al engin­eer and hold a Certificate of Authorization!

It’s also import­ant to know that the title “engin­eer” is pro­tec­ted in the Province [2]:

pro­fes­sion­al engin­eer” means a per­son who holds a licence or a tem­por­ary licence; (“ingénieur”)

12. (1) No per­son shall engage in the prac­tice of pro­fes­sion­al engin­eer­ing or hold him­self, her­self or itself out as enga­ging in the prac­tice of pro­fes­sion­al engin­eer­ing unless the per­son is the hold­er of a licence, a tem­por­ary licence, a pro­vi­sion­al licence or a lim­ited licence.  R.S.O. 1990, c. P.28, s. 12 (1); 2001, c. 9, Sched. B, s. 11 (16).

12. (2) No per­son shall offer to the pub­lic or engage in the busi­ness of provid­ing to the pub­lic ser­vices that are with­in the prac­tice of pro­fes­sion­al engin­eer­ing except under and in accord­ance with a cer­ti­fic­ate of author­iz­a­tion.  R.S.O. 1990, c. P.28, s. 12 (2).

12. (3) Subsections (1) and (2) do not apply to pre­vent a person,
(f) from using the title “engin­eer” or an abbre­vi­ation of that title in a man­ner that is author­ized or required by an Act or reg­u­la­tion.  R.S.O. 1990, c. P.28, s. 12 (3); 2001, c. 9, Sched. B, s. 11 (17); 2010, c. 16, Sched. 2, s. 5 (18).

Regardless of your qual­i­fic­a­tions or exper­i­ence, or your job respons­ib­il­it­ies, you can­not use the term “engin­eer” without risk­ing the wrath of PEO. PEO has sig­ni­fic­ant powers under the PEA, and can take you to court or impose oth­er pen­al­ties as described in the PEA.

I believe that a sig­ni­fic­ant part of the prob­lem with the PEA is the breadth of the defin­i­tion of pro­fes­sion­al engin­eer­ing, and the lack of clar­ity cre­ated by the undefined “applic­a­tion of engin­eer­ing prin­ciples”. We could debate the defin­i­tions for hours, but instead, I want to focus on the impact that engin­eer­ing has on manufacturing.

Industrial Exception

Ontario has an inter­est­ing excep­tion built into the Professional Engineers Act, unof­fi­cially called the “indus­tri­al excep­tion”. So, what is the “indus­tri­al excep­tion”? This excep­tion is laid out in clause 12.(3)(a) [2]:

(3) Subsections (1) and (2) do not apply to pre­vent a person,

(a) from doing an act that is with­in the prac­tice of pro­fes­sion­al engin­eer­ing in rela­tion to machinery or equip­ment, oth­er than equip­ment of a struc­tur­al nature, for use in the facil­it­ies of the person’s employ­er in the pro­duc­tion of products by the person’s employer;

The exemp­tion per­mits unli­censed per­sons to do work covered by the defin­i­tion of pro­fes­sion­al engin­eer­ing if they are doing it for their employ­er on equip­ment owned and used by their employ­er for the work that employ­er does.

This situ­ation allows employ­ers to save money on wages by allow­ing lower paid work­ers to do work nor­mally reserved for high­er paid licenced pro­fes­sion­als. The down­side to this for employ­ers is that you have no guar­an­tee that the per­son doing the work is adequately qual­i­fied, and if any­thing goes wrong, they will be unlikely to carry insur­ance that could reduce the impact of any loss created.

The Industrial Exception does not per­mit unli­censed per­sons to con­duct Pre-​Start Health and Safety Reviews.

Based on this, a per­son can under­take any act gov­erned by the PEA related to machinery or equip­ment, oth­er than struc­tur­al engin­eer­ing, on behalf of their employ­er, as long as the equip­ment is owned by their employ­er and will be used in pro­duc­tion by their employ­er. This opens up modi­fic­a­tions and design of machinery and equip­ment to unli­censed per­sons, as long as the machinery or equip­ment is inten­ded for pro­duc­tion use by their employ­er. It does not per­mit unli­censed per­sons to design machinery or equip­ment and then sell that equip­ment to oth­ers. It also does not per­mit unli­censed per­sons to con­duct Pre-​Start Health and Safety Reviews. The exist­ence of the indus­tri­al exemp­tion is, in part, respons­ible for the exist­ence of Ontario’s Pre-​Start Health and Safety Review [4, Section 7].

Is there a problem?

Consider that the exemp­tion has been part of the PEA since 1984. In that time, the work­place acci­dent rates in Ontario have declined. Sixteen years later, in 2000, the “Pre-​Start Health and Safety Review” was cre­ated, and a whole new line of busi­ness for engin­eers was cre­ated. Accident rates have con­tin­ued to decline at about the same rate as they did pri­or to 2000. There is little evid­ence to show that the indus­tri­al excep­tion had any sig­ni­fic­ant effect on work­place safety in the time since its inception.

The excep­tion cre­ates NO bar­ri­ers for licenced engineers.

The excep­tion cre­ates NO bar­ri­ers for licenced engin­eers. The claims that the con­tinu­ation of the excep­tion cre­ates a bar­ri­er to licenced engin­eers who want to move to Ontario and con­tin­ue their prac­tice is com­pletely unsup­por­ted. The kinds of work that licenced engin­eers do is com­pletely unaf­fected by the excep­tion. The claim that the excep­tion cre­ates bar­ri­ers for licenced engin­eers mov­ing from Ontario to oth­er Provinces and Territories is also unfoun­ded, since Canadian engin­eer­ing licences are trans­fer­able, and there may be MORE work in oth­er provinces because the work done in Ontario under the exemp­tion must be done by licenced engin­eers in oth­er Provinces or Territories.

Eliminating the exemp­tion would force hun­dreds of small and medium-​sized employ­ers to hire licenced pro­fes­sion­al engin­eers to con­duct work that they may have been doing suc­cess­fully for years. This would increase labour costs for these employ­ers, assum­ing that they could actu­ally find an engin­eer to hire. This would also dis­place all of the work­ers already doing the work. Employers might have to halt pro­jects part way com­pleted until they could hire a licenced pro­fes­sion­al engin­eer to over­see the com­ple­tion of the pro­ject. In a let­ter dated 22-​Feb-​2013, Ian Howcroft, Vice President of Canadian Manufacturers and Exporters Ontario, said “…busi­nesses that gen­er­ate $270 bil­lion in GDP and employ over 700,000 Ontarians, are writ­ing to request that the imple­ment­a­tion of the “Repeal of the Industrial Exception”, cur­rently sched­uled to be in force March 1st, 2013, be dis­con­tin­ued until a full reg­u­lat­ory impact ana­lys­is can be con­duc­ted.” This request was made because “…busi­nesses have iden­ti­fied a num­ber of issues that could have sig­ni­fic­ant cost implic­a­tions for busi­nesses and neg­at­ive con­sequences for the Ontario Economy.” This let­ter was under­signed by 24 oth­er trade and busi­ness asso­ci­ations. Clearly, elim­in­at­ing the “indus­tri­al excep­tion” could have sig­ni­fic­ant impacts on Ontario’s eco­nomy and workforce.

Unfortunately, both Engineers Canada and Professional Engineers Ontario are attempt­ing to use fear, uncer­tainty, and doubt to per­suade the gen­er­al pub­lic that an immin­ent risk to life and health is being cre­ated by this 32-​year-​old legis­la­tion. If it was going to hap­pen, the prob­lem would have shown itself years ago. Claiming any­thing else is rediculous.

References

[1]     Engineers Canada, “Engineers Canada con­cerned Ontario gov­ern­ment decision will neg­at­ively impact work­place health and safety”, (online). 2015. Available: https://​www​.engin​eer​scanada​.ca/​n​e​w​s​/​e​n​g​i​n​e​e​r​s​-​c​a​n​a​d​a​-​c​o​n​c​e​r​n​e​d​-​o​n​t​a​r​i​o​-​g​o​v​e​r​n​m​e​n​t​-​d​e​c​i​s​i​o​n​-​w​i​l​l​-​n​e​g​a​t​i​v​e​l​y​-​i​m​p​a​c​t​-​w​o​r​k​p​l​a​c​e​-​h​e​a​lth. Accessed: 25-Feb-16.

[2]     Ontario. Legislative Assembly of Ontario, Professional Engineers Act, (R.S.O. 1990, c. P.28). Toronto. 1990. Available: https://​www​.ontario​.ca/​l​a​w​s​/​s​t​a​t​u​t​e​/​9​0​p​2​8​.​A​c​c​e​s​sed: 25-Feb-16.

[3]     Ontario. Legislative Assembly of Ontario, An Act respect­ing the Ontario Association of Certified Engineering Technicians and Technologists, Mr. Baird. (36:2 Bill PR25) Toronto. 1998. Available: http://www.ontla.on.ca/web/bills/bills_detail.do?locale=en&BillID=1800&isCurrent=false&ParlSessionID=36%3A2. Accessed: 25-Feb-16.

[4]    Ontario. Legislative Assembly of Ontario, Industrial Establishments. Ontario Regulation 851. Toronto. 1990. Available: https://​www​.ontario​.ca/​l​a​w​s​/​r​e​g​u​l​a​t​i​o​n​/​9​0​0​851. Accessed: 8-Mar-16.

Presence Sensing Devices – Reaching over sensing fields

This entry is part 2 of 3 in the series Guards and Guarding

I recently heard about an applic­a­tion ques­tion related to a light cur­tain where a small gap exis­ted at the top of the sens­ing field, between the last beam in the field and the sur­round­ing struc­ture of the machine. There was some con­cern raised about the gap, and wheth­er or not addi­tion­al guard­ing might be needed to close the gap. To answer this ques­tion, we need to split it into a few smal­ler pieces that we can deal with using the tools in the standards.

The first piece to con­sider is the gap at the top of the sens­ing field. For this part of the ana­lys­is, I’m going to assume that the light cur­tain is a fixed bar­ri­er guard, and we’ll ana­lyse the gap based on that idea.

The second piece of the puzzle is the place­ment of the light cur­tain, and we’ll look at that sep­ar­ately. Once we under­stand the two pieces, we’ll put them togeth­er to see if there are any oth­er issues that may need to be addressed.

The Application

For the pur­pose of this art­icle, I’ve sketched up the fol­low­ing fig­ures to illus­trate the ideas in the art­icle. These draw­ings don’t rep­res­ent any actu­al robot cell or applic­a­tion. Note that the light cur­tain in the sketch is shown with zero safety dis­tance to the robot envel­ope. This is NEVER permitted.

Cell Elevation View
Figure 1 – Cell Elevation View show­ing Gap above Light Curtain

 

Cell Plan View
Figure 2 – Cell Plan View

Analyzing The Gap

Light cur­tains are treated the same way that mov­able guards are treated, so the answer to this ques­tion starts with determ­in­ing the size of the gap. I’m going to ref­er­ence two sets of stand­ards in answer­ing this ques­tion: CSA and ISO.

Safety Distances for fingers reaching through an opening
Figure 3 – Finger-​to-​Knuckle Reaching through a Regular Opening [1, C.4]
Z432 Reaching Through Regular Openings
Figure 4 – Arm-​up-​to-​Shoulder Reaching through Regular Opening [1, C.4]
Referenced Standards
CSA Z432 2004 [1] ISO 13857 2008 [2]
Table 3 – Minimum dis­tance from haz­ard as a func­tion of bar­ri­er open­ing size Table 4 – Reaching through Regular openings
Opening Size (e) Safety Distance (sr) Opening Size (e) Safety Distance (sr)

11.1– 16.0mm [0.376″ – 0.625″]

Slotted >= 89.0 mm [3.5″] Square >= 66 mm [2.6″] Slot
10 < e <=12 Square/​Round
10 < e <=12
>= 100 mm >= 80 mm
49.1 – 132.0 mm [1.876 – 5.000″] Slotted/​Square <= 915.0 mm [36.0″] Slot/​Square/​Round 40 < e <= 120 mm <= 850 mm

The first thing to notice is that CSA and ISO use slightly dif­fer­ent open­ing sizes (e) and safety dis­tances (sr). These dif­fer­ences have their ori­gin in slightly dif­fer­ent anthro­po­met­ric data used to devel­op the tables. In both cases, the max­im­um value for e defines the largest open­ing per­mit­ted without addi­tion­al guarding.

Let’s look at the applic­a­tion to see if the gap between the top-​most beam and the edge of the phys­ic­al guard falls into the bands defined for e.

Cell Elevation Close Up
Figure 5 – Cell Elevation Close-Up

Based on the sketches of the applic­a­tion, we have a prob­lem: The gap shown above the light cur­tain is right at the edge of the robot envel­ope, i.e., the danger zone. We are going to have to either, a) Move the fence back 915 mm to get the neces­sary safety dis­tance or, b) close the gap off com­pletely, either with hard guard­ing or by extend­ing the light cur­tain to close the gap.

Knowing the size of the gap, we can now decide if the gap should be reduced, or the light cur­tain moved or enlarged. Since light cur­tains run about $125/​linear inch, adding an addi­tion­al plate to reduce the size of the gap is likely the most cost effect­ive choice. We also need to know the dis­tance from the top-​most beam of the light cur­tain to the haz­ard behind the guard. If that dis­tance is less than 915/​850 mm, then we have anoth­er prob­lem, since the guard­ing is already too close to the hazard.

Analyzing the Light Curtain

The light cur­tain pos­i­tion­ing is driv­en by the stop­ping per­form­ance of the machine. Again, let’s ref­er­ence both CSA and ISO for the rel­ev­ant calculations.

Referenced Standards
CSA Z432 2004 ISO 13855 2005 [3]
5.1 Overall sys­tem stop­ping performance
The over­all sys­tem stop­ping per­form­ance com­prises at least two phases.Thetwophasesare linked by Equation (1):

T = t1 + t2                             (1)

where
T is the over­all sys­tem stop­ping performance;
t1 is the max­im­um time between the occur­rence of the actu­ation of the safe­guard and the out­put sig­nal achiev­ing the OFF-state;
t2 is the stop­ping time, which is the max­im­um time required to ter­min­ate the haz­ard­ous machine func­tion after the out­put sig­nal from the safe­guard achieves the OFF-​state. The response time of the con­trol sys­tem of the machine shall be included in t2.

t1 and t2 are influ­enced by vari­ous factors, e.g. tem­per­at­ure, switch­ing time of valves, age­ing of components.

t1 and t2 are func­tions of the safe­guard and the machine, respect­ively, and are determ­ined by design and eval­u­ated by meas­ure­ment. The eval­u­ation of these two val­ues shall include the uncer­tain­ties res­ult­ing from the meas­ure­ments, cal­cu­la­tions and/​or construction.

Clause 10.11 – Safeguarding device safety dis­tanceThecalculationforminimum safe dis­tance between a safe­guard­ing device and the danger zone of a machine shall be as follows:

S = [K (Ts + Tc + Tr + Tbm)] + Dpf

where
Ds = min­im­um safe dis­tance between the safe­guard­ing device and the hazard

K = speed con­stant: 1.6 m/​s (63 in/​s) min­im­um, based on the move­ment being the hand/​arm only and the body being stationary.
Note: A great­er value may be required in spe­cif­ic applic­a­tions and when body motion must also be considered.
Ts = worst stop­ping time of the machine/​equipment

Tc = worst stop­ping time of the con­trol system

Tr = response time of the safe­guard­ing device, includ­ing its interface
Note: Tr for inter­locked bar­ri­er may include a delay due to actu­ation. This delay may res­ult in Tr being a deduct (neg­at­ive value).

Note: Ts + Tc + Tr are usu­ally meas­ured by a stop-​time meas­ur­ing device if unknown.

Tbm = addi­tion­al stop­ping time allowed by the brake mon­it­or before it detects stop-​time deteri­or­a­tion bey­ond the end users’ pre­de­ter­mined lim­its. (For part revolu­tion presses only.)

Dpf = max­im­um travel towards the haz­ard with­in the presence-​sensing safe­guard­ing device’s (PSSD) field that may occur before a stop is signaled. Depth pen­et­ra­tion factors will change depend­ing on the type of device and applic­a­tion. See Figure 5 for spe­cif­ic val­ues. (If applic­able, based on the style of safety device.)

Clause 6.2.3 – Electro-​sensitive pro­tect­ive equip­ment employ­ing act­ive opto-​electronic pro­tect­ive devices with a sensor detec­tion cap­ab­il­ity of  < 40 mm  in diameter

6.2.3.1 Calculation

The min­im­um dis­tance, S, in mil­li­metres, from the detec­tion zone to the haz­ard zone shall not be less than that cal­cu­lated using Equation (2):

S = (K x T ) + C                             (2)

where

K = 2 000 mm/​s;

C = 8 (d – 14), but not less than 0;

d is the sensor detec­tion cap­ab­il­ity of the device, in mil­li­metres (mm).

[Author’s Note – T comes from 5.1, above]

Then

S = (2 000 x T ) + 8(d-14)               (3)

Equation (3) applies to all min­im­um dis­tances of S up to and includ­ing 500 mm. The min­im­um value of S shall be 100 mm.

Where the val­ues for S, cal­cu­lated using Equation (3), exceed 500 mm, Equation (4) can be used. In this case, the min­im­um value of S shall be 500 mm.

S = (K x T ) + C                          (2)

where

K = 1 600 mm/​s;

C = 8 (d - 14), but not less than 0;

d is the sensor detec­tion cap­ab­il­ity of the device, in mil­li­metres (mm).

Then

S = (1 600 x T ) + 8(d – 14)

ISO 13855 Fig. 3 a) Normal Approach
Figure 6 – ISO 13855 Fig. 3 a) Normal Approach

Key

1 haz­ard zone

2 detec­tion zone

3 fixed guard

S min­im­um distance

a Direction of approach

The two cal­cu­la­tion meth­ods shown above are essen­tially the same, with the primary dif­fer­ence being the value of K, the “hand-​speed con­stant”. ISO uses a high­er value of K for light cur­tain install­a­tions where the field is ver­tic­al or angled as low as 45º. If the cal­cu­lated value of S is >500 mm, then the value of K is reduced to 1600 mm/​s. Using the high­er value of K for a North American install­a­tion is not wrong, and will res­ult in a more con­ser­vat­ive install­a­tion res­ult. Use of 1 600 mm/​s for machines going into inter­na­tion­al mar­kets is wrong if S is <500 mm when cal­cu­lated using 2 000 mm/​s.

Let’s assume some val­ues so we can do a rep­res­ent­at­ive calculation:

Stopping Time of the sys­tem (T) = 265 ms [0.265 s]

Light cur­tain res­ol­u­tion (d) = 30 mm [1.2″]

Calculating Dpf

Dpf = 8 x (d – 14) = 8 x (30 – 14) = 128

Using K = 2 000 mm/​s

S = (2000 x 0.265) + 128 = 658 mm

Since applic­a­tions where S > 500 mm can be recal­cu­lated using K = 1600 mm/​s

S = (1 600 x 0.265) + 128 = 552 mm

So, from the above cal­cu­la­tion, we can see that the dis­tance from the plane of the light cur­tain to the edge of the robot envel­ope (i.e., the danger zone) must be at least 552 mm [21.75″]. That dis­tance is enough that some people might be able to stand between the light cur­tain field and the fix­ture in the cell, so we should prob­ably add a hori­zont­al light cur­tain to pro­tect against that pos­sib­il­ity. See Figure 7.

Figure 7 - Vertical Light Curtain with Horizontal segment
Figure 7 – Vertical Light Curtain with Horizontal seg­ment [1, Fig. B.15 (c)]
Another altern­at­ive to adding a hori­zont­al sec­tion is to slope the light cur­tain field, so that the plane of the light cur­tain is at 45 degrees above the hori­zont­al, with the highest beam as far away from the haz­ard as pos­sible. See Figure 8.

Figure 8 - Sloped light curtain installation [1, CSA Z432 Fig B.15 (c)]
Figure 8 – Sloped light cur­tain install­a­tion [1, CSA Z432 Fig B.15 (c)]
This type of install­a­tion avoids the need to replace the exist­ing light cur­tain, as long as the field depth is enough to meet the cal­cu­lated Ds.

The field could also be laid hori­zont­ally, with no ver­tic­al com­pon­ent. This will change the Dpf cal­cu­la­tion as high­lighted by the note in Figure 8. Dpf for a hori­zont­al field is cal­cu­lated using the fol­low­ing equation:

Dpf = 1 200 mm [48″]

there­fore

S = (1 600 x 0.265) + 1200 = 1 624 mm

Note also that there is a height restric­tion placed on hori­zont­al devices based on the object res­ol­u­tion as well, so the 0.3 m max­im­um height may not apply to an exclus­ively hori­zont­al applic­a­tion. Note that ISO 13855 allows H a max­im­um value of 1 000 mm, rather than cut­ting the value off at 990 mm as done in CSA Z432. Using either the 14 mm or the 30 mm res­ol­u­tion cur­tains yields a min­im­um height of 0 mm and a max­im­um of 990 mm (CSA) or 1 000 mm (ISO). Note that the 3rd Edition of CSA Z432 is likely to har­mon­ize these dis­tances with the ISO cal­cu­la­tions, elim­in­at­ing these differences.

Also, note that field heights where H > 300 mm may require addi­tion­al safe­guards in con­junc­tion with the Presence-​Sensing Safeguarding Device (PSSD) field.

Figure 8 - Calculating "H" [1, Fig. B.15 (g)]
Figure 8 – Calculating “H” [1, Fig. B.15 (g)]
Going back to our ori­gin­al ver­tic­al field install­a­tion, there is one more option that could be con­sidered: Reduce the object res­ol­u­tion of the light cur­tain. If we go down to the smal­lest object res­ol­u­tion typ­ic­ally avail­able, 14 mm, the cal­cu­la­tion looks like this:

Dpf = 8 x (14 – 14) = 0

S = (2 000 x 0.265) + 0 = 530 mm

Since S > 500,

S = (1 600 x 0.265) + 0 = 424 mm [16.7″]

While we have sub­stan­tially reduced the safety dis­tance, it looks like we will still need the hori­zont­al light cur­tain to ensure that no one can stand behind the cur­tain without being detected.

If the design of the machinery allows, it might be pos­sible to reduce the stop­ping time of the machine. If you can reduce the stop­ping time, you will be able to shorten the safety dis­tance required. Note that the safety dis­tance can nev­er go to zero, and can nev­er be less than that determ­ined by the object res­ol­u­tion applied to the reaching-​through tables. In this case, a 14 mm open­ing res­ults in an 89 mm [3.5″] min­im­um safety dis­tance (CSA). Since the stop­ping time of the machine can nev­er be zero, 89 mm works out to a stop­ping time of 44.5 ms using K=2 000 mm/​s, or 55.6 ms if K= 1 600 mm/​s. Very few machines can stop this quickly.

The cal­cu­lated safety dis­tance is about half of the safety dis­tance required for the gap, at 915 mm. Clearly, clos­ing the gap with the light cur­tain or hard guard­ing will be prefer­able to mov­ing the fence away from the danger zone by 915 mm.

Here’s one more fig­ure to help illus­trate these ideas.

Z432 Figure B.14 a
Figure 9 – CSA Z432 Figure B.15 a)

Figure 9 shows the dif­fer­ence between the reaching-​through or reaching-​over light cur­tain applic­a­tions. Notice that without a restrict­ing guard above the cur­tain as we have in our example, the Dpf value goes out to 1 200 mm [48″], rather than the 915 mm value used in our example.

The lower fig­ures show light fence applic­a­tions, where two or three beams are used, rather than a full cov­er­age light curtain.

Summary

Here are some of the more import­ant considerations:
1) Is the field of the light cur­tain placed cor­rectly, based on the stop­ping per­form­ance of the machine?
2) What is the object res­ol­u­tion of the sens­ing field? This dimen­sion may be used to assess the size of the “open­ings” in the field if this becomes relevant.
3) What is the height of the low­est and highest beams or the edges of the sens­ing field?
4) What are the dimen­sions of the gap above the field of the cur­tain, and the dis­tance from the open­ing to the closest hazard?

ed. note: This art­icle was reviewed and updated 28-Aug-17.

Acknowledgements

I’d like to acknow­ledge my col­league, Christian Bidner, who sug­ges­ted the idea for this art­icle based on a real-​world applic­a­tion he had seen. Christian works for OMRON/​STI in their Toronto office.

References

[1]     Safeguarding of Machinery. CSA Z432. Canadian Standards Association (CSA).  Toronto. 2004.

[2]     Safety of machinery – Safety dis­tances to pre­vent haz­ard zones being reached by upper and lower limbs. ISO 13857.International Organization for Standardization (ISO). Geneva. 2008.

[3]     Safety of machinery – Positioning of safe­guards with respect to the approach speeds of parts of the human body. ISO 13855. International Organization for Standardization (ISO). Geneva. 2010.

Digiprove sealCopyright secured by Digiprove © 2015 – 2017
Acknowledgements: Figures from CSA Z432, Calculations f more…
Some Rights Reserved