Category Archives: Interlocks

Interlock Architectures – Pt. 5: Category 4 — Control Reliable

Posted by on September 26, 2011 Comments Off
This entry is part 5 of 8 in the series Circuit Architectures Explored

The most reli­able of the five sys­tem archi­tec­tures, Category 4 is the only archi­tec­ture that uses multiple-​​fault tol­er­ant tech­niques to help ensure that com­po­nent fail­ures do not result in an unac­cept­able expo­sure to risk. This post will delve into the depths of this archi­tec­ture in this install­ment on sys­tem archi­tec­tures. The def­i­n­i­tions and require­ments dis­cussed in this arti­cle come from ISO 13849–1, Edition 2 (2006) and ISO 13849–2, Edition 1 (2003).

As with pre­ced­ing arti­cles in this series, I’ll be build­ing on con­cepts dis­cussed in those arti­cles. If you need more infor­ma­tion, you should have a look at the pre­vi­ous arti­cles to see if I’ve answered your ques­tions there.

The Definition

The Category 4 def­i­n­i­tion builds on both Category B and Category 3. As you read, recall that “SRP/​CS” stands for “Safety Related Parts of the Control System”. Here is the com­plete definition:

6.2.7 Category 4
For cat­e­gory 4, the same require­ments as those accord­ing to 6.2.3 for cat­e­gory B shall apply. “Well-​​tried safety prin­ci­ples” accord­ing to 6.2.4 shall also be fol­lowed. In addi­tion, the fol­low­ing applies.
SRP/​CS of cat­e­gory 4 shall be designed such that

  • a sin­gle fault in any of these safety-​​related parts does not lead to a loss of the safety func­tion, and
  • the sin­gle fault is detected at or before the next demand upon the safety func­tions, e.g. imme­di­ately, at switch on, or at end of a machine oper­at­ing cycle, but if this detec­tion is not pos­si­ble, then an accu­mu­la­tion of unde­tected faults shall not lead to the loss of the safety function.

The diag­nos­tic cov­er­age (DCavg) of the total SRP/​CS shall be high, includ­ing the accu­mu­la­tion of faults. The MTTFd of each of the redun­dant chan­nels shall be high. Measures against CCF shall be applied (see
Annex F).

NOTE 1 Category 4 sys­tem behav­iour allows that

  • when a sin­gle fault occurs the safety func­tion is always performed,
  • the faults will be detected in time to pre­vent the loss of the safety function,
  • accu­mu­la­tion of unde­tected faults is taken into account.

NOTE 2 The dif­fer­ence between cat­e­gory 3 and cat­e­gory 4 is a higher DCavg in cat­e­gory 4 and a required MTTFd of each chan­nel of “high” only.

In prac­tice, the con­sid­er­a­tion of a fault com­bi­na­tion of two faults may be sufficient.

5% Discount on ISO and IEC Standards with code: CC2011

Breaking it down

For cat­e­gory 4, the same require­ments as those accord­ing to 6.2.3 for cat­e­gory B shall apply. “Well-​​tried safety prin­ci­ples” accord­ing to 6.2.4 shall also be followed.

The first two sen­tences give the basic require­ment for all the cat­e­gories from 2 through 4. Sound com­po­nent selec­tion based on the appli­ca­tion require­ments for volt­age, cur­rent, switch­ing capa­bil­ity and life­time must be con­sid­ered. In addi­tion, using well tried safety prin­ci­ples, such as switch­ing the +V rail side of the coil cir­cuit for con­trol com­po­nents is required. If you aren’t sure about what con­sti­tutes a “well-​​tried safety prin­ci­ple”, see the arti­cle on Category 2 where this is dis­cussed. Don’t con­fuse “well-​​tried safety prin­ci­ples” with “well-​​tried com­po­nents”. There is no require­ment in Category 4 for the use of well-​​tried com­po­nents, although you can use them for addi­tional reli­a­bil­ity if the design require­ments warrant.

In addi­tion, the fol­low­ing applies.
SRP/​CS of cat­e­gory 4 shall be designed such that

  • a sin­gle fault in any of these safety-​​related parts does not lead to a loss of the safety func­tion, and
  • the sin­gle fault is detected at or before the next demand upon the safety func­tions, e.g. imme­di­ately, at switch on, or at end of a machine oper­at­ing cycle, but if this detec­tion is not pos­si­ble, then an accu­mu­la­tion of unde­tected faults shall not lead to the loss of the safety function.

This is the big one. This para­graph, and the two bul­lets that fol­low it, define the fun­da­men­tal per­for­mance require­ments for this cat­e­gory. No sin­gle fault can lead to the loss of the safety func­tion in Category 4, and test­ing is required that can detect fail­ures and pre­vent an accu­mu­la­tion of faults that could even­tu­ally lead to the loss of the safety func­tion. The sec­ond bul­let is the one that defines the multiple-​​fault-​​tolerance require­ment for this cat­e­gory. If you go back to the def­i­n­i­tion of Category 3, you will see that an accu­mu­la­tion of faults may lead to the loss of the safety func­tion in that Category. This is the key dif­fer­ence between the cat­e­gories in my opinion.

The diag­nos­tic cov­er­age (DCavg) of the total SRP/​CS shall be high, includ­ing the accu­mu­la­tion of faults. The MTTFd of each of the redun­dant chan­nels shall be high. Measures against CCF shall be applied (see
Annex F).

These three sen­tences give the designer the cri­te­ria for diag­nos­tic cov­er­age, chan­nel fail­ure rates and com­mon cause fail­ure pro­tec­tion. As you can see, the abil­ity to diag­nose fail­ures auto­mat­i­cally is a crit­i­cal part of the design, as is the use of highly reli­able com­po­nents, lead­ing to highly reli­able chan­nels. The strongest CCF pro­tec­tion you can include in the design is also needed, although the “pass­ing score” of 65 remains unchanged (see Annex F in ISO 13849–1 for more details on scor­ing your design).

NOTE 1 Category 4 sys­tem behav­iour allows that

  • when a sin­gle fault occurs the safety func­tion is always performed,
  • the faults will be detected in time to pre­vent the loss of the safety function,
  • accu­mu­la­tion of unde­tected faults is taken into account.

Note 2: …In prac­tice, the con­sid­er­a­tion of a fault com­bi­na­tion of two faults may be sufficient.

Note 1 expands on the first para­graph in the def­i­n­i­tion, fur­ther clar­i­fy­ing the per­for­mance require­ments by explicit state­ments. Notice that nowhere is there a require­ment that sin­gle faults or accu­mu­la­tion of sin­gle faults be pre­vented, only detected by the diag­nos­tic sys­tem. Prevention of sin­gle faults is nearly impos­si­ble, since com­po­nents do fail. It is impor­tant to first under­stand which com­po­nents are crit­i­cal to the safety func­tion, and sec­ond, what kinds of faults each com­po­nent is likely to have, is fun­da­men­tal to being able to design a diag­nos­tic sys­tem that can detect the faults.

The cat­e­gory relies on redun­dancy to ensure that the com­plete loss of one chan­nel will not cause the loss of the safety func­tion, but this is only use­ful if the com­mon cause fail­ures have been prop­erly dealt with. Otherwise, a sin­gle event could wipe out both chan­nels simul­ta­ne­ously, caus­ing the loss of the safety func­tion and pos­si­bly result in an injury or fatality.

Also notice that mul­ti­ple sin­gle faults are per­mit­ted, as long as the accu­mu­la­tion does not result in the loss of the safety func­tion. ISO 13849 allows for “fault exclu­sion”, a con­cept that is not used in the North American standards.

The final sen­tence from Note 2 sug­gests that con­sid­er­a­tion of two con­cur­rent faults may be enough, but be care­ful. You need to look closely at the fault lists to see if there are any groups of high prob­a­bil­ity faults that are likely to occur con­cur­rently. IF there are, you need to assess these com­bi­na­tions of faults, whether there are 5 or 50 to be evaluated.

Fault Exclusion

Fault exclu­sion involves assess­ing the types of faults that can occur in each com­po­nent in the crit­i­cal path of the sys­tem. The deci­sion to exclude cer­tain kinds of faults is always a tech­ni­cal com­pro­mise between the the­o­ret­i­cal improb­a­bil­ity of the fault, the exper­tise of the designer(s) and engi­neers involved and the spe­cific tech­ni­cal require­ments of the appli­ca­tion. Whenever the deci­sion is made to exclude a par­tic­u­lar type of fault, the deci­sion and the process used to make it must be doc­u­mented in the Reliability Report included in the design file. Section 7.3 of ISO 13849–1 pro­vides guid­ance on fault exclusion.

In the sec­tion dis­cussing Category 1, the stan­dard has this to say about fault exclu­sion, and the dif­fer­ence between “well-​​tried com­po­nents” and “fault exclusion”:

It is impor­tant that a clear dis­tinc­tion between “well-​​tried com­po­nent” and “fault exclu­sion” (see Clause 7) be made. The qual­i­fi­ca­tion of a com­po­nent as being well-​​tried depends on its appli­ca­tion. For exam­ple, a posi­tion switch with pos­i­tive open­ing con­tacts could be con­sid­ered as being well-​​tried for a machine tool, while at the same time as being inap­pro­pri­ate for appli­ca­tion in a food indus­try — in the milk indus­try, for instance, this switch would be destroyed by the milk acid after a few months. A fault exclu­sion can lead to a very high PL, but the appro­pri­ate mea­sures to allow this fault exclu­sion should be applied dur­ing the whole life­time of the device. In order to ensure this, addi­tional mea­sures out­side the con­trol sys­tem may be nec­es­sary. In the case of a posi­tion switch, some exam­ples of these kinds of mea­sures are

  • means to secure the fix­ing of the switch after its adjustment,
  • means to secure the fix­ing of the cam,
  • means to ensure the trans­verse sta­bil­ity of the cam,
  • means to avoid over-​​travel of the posi­tion switch, e.g. ade­quate mount­ing strength of the shock absorber and any align­ment devices, and
  • means to pro­tect it against dam­age from outside.

To assist the designer, ISO 13849–2 pro­vides lists of typ­i­cal faults and the allow­able exclu­sions in Annex D.5. As an exam­ple, let’s con­sider the typ­i­cal sit­u­a­tion where a robust guard inter­lock­ing device has been selected. The deci­sion has been made to use redun­dant elec­tri­cal cir­cuits to the switch­ing com­po­nents in the inter­lock, so elec­tri­cal faults can be detected. But what about mechan­i­cal fail­ures? A fault list is needed:

 Interlock Mechanical Fault List
#Fault DescriptionResultLikelihood
1Key breaks offControl sys­tem can­not deter­mine guard posi­tion. Complete fail­ure of sys­tem through a sin­gle fault.Unlikely
2Screws mount­ing key to guard failControl sys­tem can­not deter­mine guard posi­tion. Complete fail­ure of sys­tem through a sin­gle fault.Unlikely
3Screws mount­ing inter­lock device to guard failControl sys­tem can­not deter­mine guard posi­tion. Complete fail­ure of sys­tem through a sin­gle fault.Unlikely
4Key and inter­lock device misaligned.Guard can­not close, pre­vent­ing machine from operating.Very likely
5Key and inter­lock device misaligned.Key and /​ or inter­lock device dam­aged. Guard may not close, or the key may jam in the inter­lock device once closed. Machine is inop­er­a­ble if the inter­lock can­not be com­pleted, or the guard can­not be opened if the key jams in the device.Likely
6Screws mount­ing key to guard removed by user.Interlock can now be bypassed by fix­ing the key into the inter­lock­ing device. Control sys­tem can no longer sense the posi­tion of the guard.Likely
7Screws mount­ing inter­lock device to guard removed by userProbably com­bined with the pre­ced­ing con­di­tion. Control sys­tem can no longer sense the posi­tion of the guard.Unlikely, but could happen.

There may be more fail­ure modes, but for the pur­pose of this dis­cus­sion, lets limit them to this list.

Looking at Fault 1, there are a num­ber of things that could result in a bro­ken key. They include: mis­align­ment of the key and the inter­lock device, lack of main­te­nance on the guard and the inter­lock­ing hard­ware, or inten­tional dam­age by a user. Unless the hard­ware is excep­tion­ally robust, includ­ing the design of the guard and any align­ment fea­tures incor­po­rated in the guard­ing, devel­op­ing sound ratio­nale for exclud­ing this fault will be very difficult.

Fault 2 con­sid­ers mechan­i­cal fail­ure of the mount­ing screws for the inter­lock key. Screws are con­sid­ered to be well-​​tried com­po­nents (see Annex A.5), so you can con­sider them for fault exclu­sion. You can improve their reli­a­bil­ity by using thread lock­ing adhe­sives when installing the screws to pre­vent them from vibrat­ing loose, and “tamper-​​proof” style screw heads to deter unau­tho­rized removal. Inclusion of these meth­ods will sup­port any deci­sion to exclude these faults. This goes to address­ing faults 3, 6 and 7 as well.

Faults 4 & 5 occur fre­quently and are often caused by poor device selec­tion (i.e. an inter­lock device intended for straight-​​line sliding-​​gate appli­ca­tions is cho­sen for a hinged gate), or by poor guard design (i.e. the guard is poorly guided by the reten­tion mech­a­nism and can be closed in a mis­aligned con­di­tion). Rationale for pre­ven­tion of these faults will need to include dis­cus­sion of design fea­tures that will pre­vent these conditions.

Excluding any other kind of fault fol­lows the same process: Develop the fault list, assess each fault against the rel­e­vant Annex from ISO 13849–2, deter­mine if there are pre­ven­ta­tive mea­sures that can be designed into the prod­uct and whether these pro­vide suf­fi­cient risk reduc­tion to allow the exclu­sion of the fault from consideration.

DCavg and MTTFd requirements

NOTE 2 The dif­fer­ence between cat­e­gory 3 and cat­e­gory 4 is a higher DCavg in cat­e­gory 4 and a required MTTFd of each chan­nel of “high” only.

The first sen­tence in Note 2 clar­i­fies the two main dif­fer­ences from a design stand­point, aside from the addi­tional fault tol­er­ance require­ments: Better diag­nos­tics are required and much higher require­ments for indi­vid­ual com­po­nent, and there­fore chan­nel, MTTFd.

The Block Diagram

The block dia­gram for Category 4 is almost iden­ti­cal to Category 3, and was updated by Corrigendum 1 to the dia­gram shown below. The text from the cor­ri­gen­dum that accom­pa­nies the dia­gram has this to say about the change:

Replace the draw­ing show­ing the des­ig­nated archi­tec­ture for cat­e­gory 4 with the fol­low­ing draw­ing. This
cor­rects the arrowed lines labeled “m” between L1 and O1, and L2 and O2, by chang­ing them from dashed to solid lines, rep­re­sent­ing higher diag­nos­tic coverage.

I’ve high­lighted this area using red ovals on Figure 12 to make it eas­ier to see .

ISO 13849-1 Figure 12 - Category 4 Block Diagram

ISO 13849–1 Figure 12 — Category 4 Block Diagram

Here is Figure 11 for com­par­i­son. Notice that the “m” lines are solid in Figure 12 and dashed in Figure 11? Subtle, but sig­nif­i­cant! There are no other dif­fer­ences between the diagrams.

ISO 13849-1 Figure 11I went look­ing for a cir­cuit dia­gram to sup­port the block dia­gram, but wasn’t able to find one from a com­mer­cial source that I could share with you. Considering that the pri­mary dif­fer­ences are in the reli­a­bil­ity of the com­po­nents cho­sen and in the way the test­ing is done, this isn’t too sur­pris­ing. The basic phys­i­cal con­struc­tion of the two cat­e­gories can be vir­tu­ally identical.

Applications

The fol­low­ing is not from the stan­dards — this is my per­sonal opin­ion, based on 15 years of practice.

In the past, many man­u­fac­tur­ers decided that they were going to apply Category 4 archi­tec­ture with­out really under­stand­ing the design impli­ca­tions, because they believed that it was “the best”. With the change in the har­mo­niza­tion of EN 954–1 and ISO 13849–1 under the EU machin­ery direc­tive that comes into force on 29-​​Dec-​​2011, and con­sid­er­ing the great dif­fi­culty that many man­u­fac­tur­ers had in prop­erly imple­ment­ing EN 954–1, I can eas­ily imag­ine man­u­fac­tur­ers who have taken the approach that they already have Category 4 SRP/​CS on their sys­tems and mak­ing the state­ment that they now have PLe SRP/​CS sys­tem per­for­mance. This is a bad deci­sion for a lot of reasons:

  1. ISO 13849–1 PLe, Category 4 sys­tems should be reserved for very dan­ger­ous machin­ery where the tech­ni­cal effort and expense involved is war­ranted by the risk assess­ment. Attempting to apply this level of design to machin­ery where a PLb per­for­mance level is more suit­able based on a risk assess­ment, is a waste of design time and effort and a need­less expense. The prod­uct fam­ily stan­dards for these types of machines, such as EN 201 for plas­tic injec­tion mould­ing machines, or EN 692 for Mechanical Power Presses or EN 693 for Hydraulic Power Presses will explic­itly spec­ify the PL level required for these machines.
  2. Manufacturers have fre­quently claimed EN 954–1 Category 4 per­for­mance based on the rat­ing of the safety relay alone, with­out under­stand­ing that the rest of the SRP/​CS must be con­sid­ered, and clearly this is wrong. The SRP/​CS must be eval­u­ated as a com­plete system.

This lack of under­stand­ing endan­gers the users, the main­te­nance per­son­nel, the own­ers and the man­u­fac­tur­ers. If they con­tinue this approach and an injury occurs, it is my opin­ion that the courts will have more than enough evi­dence in the defendant’s pub­lished doc­u­ments to cause some seri­ous legal grief.

As design­ers involved with the safety of our company’s prod­ucts or with our co-worker’s safety, I believe that we owe it to every­one who uses our prod­ucts to be edu­cated and to cor­rectly apply these con­cepts. The fact that you have read all of the posts lead­ing up to this one is evi­dence that you are work­ing on get­ting educated.

Always con­duct a risk assess­ment and use the out­come from that work to guide your selec­tion of safe­guard­ing mea­sures, com­ple­men­tary pro­tec­tive mea­sures and the per­for­mance of the SRP/​CS that ties those sys­tems together. Choose per­for­mance lev­els that make sense based on the required risk reduc­tion and ensure that the design cri­te­ria is met by val­i­dat­ing the sys­tem once built.

As always, I wel­come your com­ments and ques­tions! Please feel free to com­ment below. I will respond to all your comments.

Copyright secured by Digiprove © 2011
Acknowledgements: ISO for excerpts from ISO 13849–1 and more…
Some Rights Reserved

Interlock Architectures – Pt. 4: Category 3 — Control Reliable

Posted by on September 19, 2011 Comments Off
ISO 13849-1 Figure 11
This entry is part 4 of 8 in the series Circuit Architectures Explored

Category 3 sys­tem archi­tec­ture is the first cat­e­gory that could be con­sid­ered to have sim­i­lar­ity to “Control Reliable” cir­cuits or sys­tems as defined in the North American stan­dards. It is not the same as Control Reliable, but we’ll get to in a fol­low­ing post. If you haven’t read the first three posts in this series, you may want to go back and review them as the con­cepts in those arti­cles are the basis for the dis­cus­sion in this post.

So what is “Control Reliable” any­way? This term was coined by the ANSI RIA R15.06 tech­ni­cal com­mit­tee when they were devel­op­ing their def­i­n­i­tions for con­trol sys­tem reli­a­bil­ity, first pub­lished in the 1999 edi­tion of the stan­dard. No men­tion of the con­cept of con­trol reli­a­bil­ity appears in the 1994 edi­tion of CSA Z434 or the pre­ced­ing edi­tion of RIA R15.06.

Essentially, the term “Control Reliable” means that the con­trol sys­tem is designed with some degree of fault tol­er­ance. Depending on the def­i­n­i­tions that you read, this could be sin­gle– or multiple-​​fault-​​tolerance.

There are a num­ber of design tech­niques that can be used to increase the fault tol­er­ance of a con­trol sys­tem. The older approaches, such as those given in ANSI RIA R15.06–1999, CSA Z434-​​03 or EN 954–1:95, rely pri­mar­ily on the struc­ture or archi­tec­ture of the cir­cuit, and the char­ac­ter­is­tics of the com­po­nents selected for use. ISO 13849–1 uses the same basic archi­tec­tures defined by EN 954–1:95, and extends them to include diag­nos­tic cov­er­age, com­mon cause fail­ure resis­tance and an under­stand­ing of the fail­ure rate of the com­po­nents to deter­mine the degree of fault tol­er­ance and reli­a­bil­ity pro­vided by the design.

OK, enough back­ground for now! Let’s look at the def­i­n­i­tion for Category 3 sys­tems. Remember that “SRP/​CS” means “Safety Related Parts of the Control System”.

Definition

6.2.6 Category 3

For cat­e­gory 3, the same require­ments as those accord­ing to 6.2.3 for cat­e­gory B shall apply. “Well-​​tried safety prin­ci­ples” accord­ing to 6.2.4 shall also be fol­lowed. In addi­tion, the fol­low­ing applies. SRP/​CS of cat­e­gory 3 shall be designed so that a sin­gle fault in any of these parts does not lead to the loss of the safety func­tion. Whenever rea­son­ably prac­ti­ca­ble, the sin­gle fault shall be detected at or before the next demand upon the safety function.

The diag­nos­tic cov­er­age (DCavg) of the total SRP/​CS includ­ing fault-​​detection shall be low. The MTTFd of each of the redun­dant chan­nels shall be low-​​to-​​high, depend­ing on the PLr. Measures against CCF shall be applied (see Annex F).

NOTE 1 The require­ment of single-​​fault detec­tion does not mean that all faults will be detected. Consequently, the accu­mu­la­tion of unde­tected faults can lead to an unin­tended out­put and a haz­ardous sit­u­a­tion at the machine. Typical exam­ples of prac­ti­ca­ble mea­sures for fault detec­tion are use of the feed­back of mechan­i­cally guided relay con­tacts and mon­i­tor­ing of redun­dant elec­tri­cal outputs.

NOTE 2 If nec­es­sary because of tech­nol­ogy and appli­ca­tion, type-​​C stan­dard mak­ers need to give fur­ther details on the detec­tion of faults.

NOTE 3 Category 3 sys­tem behav­iour allows that

  • when the sin­gle fault occurs the safety func­tion is always performed,
  • some but not all faults will be detected,
  • accu­mu­la­tion of unde­tected faults can lead to the loss of the safety function.

NOTE 4 The tech­nol­ogy used will influ­ence the pos­si­bil­i­ties for the imple­men­ta­tion of fault detection.

5% Discount on ISO and IEC Standards with code: CC2011

Breaking it down

Let’s take the def­i­n­i­tion apart and look at the com­po­nents that make it up.

For cat­e­gory 3, the same require­ments as those accord­ing to 6.2.3 for cat­e­gory B shall apply. “Well-​​tried safety prin­ci­ples” accord­ing to 6.2.4 shall also be followed.

The first cou­ple of lines remind the designer of two key points:

  • The com­po­nents selected must be suit­able for the appli­ca­tion, i.e. cor­rectly spec­i­fied for volt­age, cur­rent, envi­ron­men­tal con­di­tions, etc.; and
  • “well-​​tried safety prin­ci­ples” must be used in the design.

It’s impor­tant to note here that we are talk­ing about “well tried safety prin­ci­ples” and NOT “well-​​tried com­po­nents”. The require­ment to use com­po­nents designed for safety appli­ca­tions comes from other stan­dards, like EN 1088 and ISO 13850. The require­ments from these stan­dards, such as the use of “direct-​​drive” con­tacts improves the fault tol­er­ance of the com­po­nent, and so ben­e­fits the design in the end. These improve­ments are gen­er­ally reflected in the B10d or MTTFd of the com­po­nent, and are points that inspec­tors will com­monly look for, since they are easy to spot in the field, since “safety-​​rated com­po­nents” often use red or yel­low caps to iden­tify them clearly in the con­trol panel.

In addi­tion, the fol­low­ing applies. SRP/​CS of cat­e­gory 3 shall be designed so that a sin­gle fault in any of these parts does not lead to the loss of the safety function.

This sen­tence makes the require­ment for single-​​fault tol­er­ance. This means that the fail­ure of any sin­gle com­po­nent in the func­tional chan­nel can­not result in the loss of the safety func­tion. To meet this require­ment, redun­dancy is needed. With redun­dant sys­tems, one com­plete chan­nel can fail with­out los­ing the abil­ity to stop the machin­ery. It is pos­si­ble to lose the func­tion of the mon­i­tor­ing sys­tem from a sin­gle com­po­nent fail­ure, but as long as the sys­tem con­tin­ues to pro­vide the safety func­tion this may be accept­able. The sys­tem should not per­mit itself to be reset if the mon­i­tor­ing sys­tem is not working.

One more “gotcha” from this sen­tence: In order to meet the require­ment that any sin­gle com­po­nent fail­ure can be detected, the design will require two sep­a­rate sen­sors to detect the posi­tion of a gate, for exam­ple. This per­mits the sys­tem to detect a fail­ure in either sen­sor, includ­ing mechan­i­cal fail­ures like bro­ken keys or attempts to defeat the safety sys­tem. You can clearly see this in both the block dia­gram, which does not show any mon­i­tor­ing con­nec­tion to the input devices, and in the cir­cuit dia­gram. Both of these dia­grams are shown later in this post. The only way out of the require­ment to have redun­dant sen­sors is to select a gate switch that is robust enough that mechan­i­cal faults can rea­son­ably be excepted. I’ll get into fault excep­tions later in this article.

Whenever rea­son­ably prac­ti­ca­ble, the sin­gle fault shall be detected at or before the next demand upon the safety function.

This sen­tence can be a bit sticky. The phrase “Whenever rea­son­ably prac­ti­ca­ble” means that your design needs to be able to detect sin­gle faults unless it would be “unrea­son­able” to do so. What con­sti­tutes an unrea­son­able degree of effort? This is for you to decide. I will say that if there is a com­mon, off the shelf com­po­nent (COTS) avail­able that will do the job, and you choose not to use it, you will have a dif­fi­cult time con­vinc­ing a court that you took every rea­son­ably prac­ti­ca­ble means to detect the fault.

Following the comma, the rest of the sen­tence pro­vides the designer with the basic require­ment for the test sys­tem: it must be able to detect a sin­gle com­po­nent fail­ure at the moment of demand (this is usu­ally how it’s done, since this is typ­i­cally the sim­plest way) or before it occurs, which can hap­pen if your test equip­ment has a means to detect a change in some crit­i­cal char­ac­ter­is­tic of the mon­i­tored component(s).

 The diag­nos­tic cov­er­age (DCavg) of the total SRP/​CS includ­ing fault-​​detection shall be low.

This sen­tence tells you that your design must meet the require­ments for LOW Diagnostic Coverage. To get to LOW DCavg, we need to look first at Table 6:

ISO 13849–1:06 Table 6

Diagnostic Coverage (DC)

Denotation Range
 None DC < 60%
 Low 60% ? DC < 90%
 Medium 90% ? DC < 99%
 High 99% ? DC

NOTE 1 For SRP/​CS con­sist­ing of sev­eral parts an aver­age value DCavg for DC is used in Figure 5, Clause 6 and E.2. 

NOTE 2 The choice of the DC ranges is based on the key val­ues 60 %, 90 % and 99 % also estab­lished in other stan­dards (e.g. IEC 61508) deal­ing with diag­nos­tic cov­er­age of tests. Investigations show that (1 — DC) rather than DC itself is a char­ac­ter­is­tic mea­sure for the effec­tive­ness of the test. (1 — DC) for the key val­ues 60 %, 90 % and 99 % forms a kind of log­a­rith­mic scale fit­ting to the log­a­rith­mic PL-​​scale. A DC-​​value less than 60 % has only slight effect on the reli­a­bil­ity of the tested sys­tem and is there­fore called “none”. A DC-​​value greater than 99 % for com­plex sys­tems is very hard to achieve. To be prac­ti­ca­ble, the num­ber of ranges was restricted to four. The indi­cated bor­ders of this table are assumed within an accu­racy of 5 %.

Based on Table 6, the DCavg must be between 60% and 90%, all com­po­nents con­sid­ered. To score this, we must go to Annex E and look at Table E1. Using the fac­tors in Table E1, score the design. If you end up in the desired range between 60% and 90% DC cov­er­age, you can move on. If not, the design will require mod­i­fi­ca­tion to bring it into this range.

The MTTFd of each of the redun­dant chan­nels shall be low-​​to-​​high, depend­ing on the PLr. 

This sen­tence reminds you that your com­po­nent selec­tions mat­ter. Depending on the PLr you are try­ing to achieve, you will need to choose com­po­nents with suit­able MTTFd rat­ings. Remember that just because you are using a Category 3 archi­tec­ture, you have not auto­mat­i­cally achieved the high­est lev­els of reli­a­bil­ity. If you refer to Figure 5 in the stan­dard, you can see that a Category 3 archi­tec­ture can meet a range of PL’s, all the way from PLa through PLe!

ISO 13849-1 Figure 5

ISO 13849–1 Figure 5

 If you want, or need, to know the numeric bound­aries of each of the bands in the dia­gram above, look at Annex K of the stan­dard. The full numeric rep­re­sen­ta­tion of Figure 5 is pro­vided in that Annex.

Measures against CCF shall be applied (see Annex F).

In order for the archi­tec­ture of your design to meet Category 3 archi­tec­ture, CCF mea­sures are required. I’ve dis­cussed Common Cause Failures else­where on the blog, but as a reminder, a Common Cause Failure is one where a sin­gle event, like a light­ning strike on the power line, or a cable being cut, results in the fail­ure of the sys­tem. This is not the same as a Common Mode Failure, where sim­i­lar or dif­fer­ent com­po­nents fail in the same way. For instance, if both out­put con­tac­tors were to weld closed either simul­ta­ne­ously or at dif­fer­ent time due to over­load­ing because they were under­sized, this could be con­sid­ered to be a Common Mode Failure. If they both weld closed due to a light­ning strike, that is a Common Cause Failure.

Annex F pro­vides a check­list that is used to score the CCF of the design. The design must meet at least 65 points to be con­sid­ered to meet the min­i­mum level of CCF pro­tec­tion, and more is bet­ter of course! Score your design and see where you come out. Less than 65 and you need to do more. 65 or more and you are good to go.

The Notes

The notes given in the def­i­n­i­tion are also impor­tant. Note 1 reminds the designer that not all faults will be detected, and an accu­mu­la­tion of unde­tected faults can lead to the loss of the safety func­tion. Be aware that it is up to you as the designer to min­i­mize the kinds of fail­ures that can accu­mu­late undetected.

Note 2 speaks to the pos­si­bil­ity that a Type-​​C prod­uct stan­dard, like EN 201 for injec­tion mould­ing machines for exam­ple, may impose a min­i­mum PLr on the design. Make sure that you get a copy of any Type-​​C stan­dard that is rel­e­vant for your prod­uct and mar­ket. Note that the des­ig­na­tion “Type-​​C” comes from ISO. If you go look­ing for this ter­mi­nol­ogy in ANSI or CSA stan­dards, you won’t find it used because the con­cept doesn’t exist in the same way in these National standards.

Note 3 gives you the basic per­for­mance para­me­ters for the design. If your design can do these things, then you’re halfway there.

Finally, Note 4 is a reminder that dif­fer­ent kinds of tech­nol­ogy have greater or lesser capa­bil­ity to detect fail­ures. More sophis­ti­cated tech­nol­ogy may be required to achieve the PL level you need.

The Block Diagram

Let’s have a look at the func­tional block dia­gram for this Category.

ISO 13849-1 Figure 11By look­ing at the dia­gram you can see clearly the two inde­pen­dent chan­nels and the cross-​​monitoring con­nec­tion between the chan­nels. Input devices are not mon­i­tored, but out­put devices are mon­i­tored. This is another sig­nif­i­cant rea­son requir­ing the use of two phys­i­cally sep­a­rate input devices to sense the guard posi­tion or what­ever other safe­guard­ing device is inte­grated into the sys­tem. The only way that a fail­ure in the input devices can be detected is if one chan­nel changes state and one does not.

If you want to learn more about apply­ing the block dia­gram­ming method to you design, there is a good expla­na­tion of the method in the SISTEMA Cookbook 1, pub­lished by the IFA in Germany. You can down­load the English ver­sion from the link above, or get the doc­u­ment directly from the IFA web site.

Circuit Diagram

By now you prob­a­bly get the idea that there are as many ways to con­fig­ure a Category 3 cir­cuit as there are appli­ca­tions. Below is a typ­i­cal cir­cuit dia­gram bor­rowed from Rockwell Allen-​​Bradley, show­ing the appli­ca­tion of typ­i­cal safety relays in a com­plete sys­tem that includes the emer­gency stop sys­tem, a gate inter­lock and a safety mat. You can meet the require­ments for Category 3 archi­tec­ture in other ways, so don’t feel that you must use a COTS safety relay. It just may be the most straight­for­ward way in many cases.

This is not a plug for A-​​B prod­ucts. Neither Machinery Safety 101, nor I, have any rela­tion­ship with Rockwell Allen-​​Bradley.

From Rockwell Automation pub­li­ca­tion SAFETY-​​WD001A-​​EN-​​P – June 2011, p.6.

If you’re inter­ested in obtain­ing the source doc­u­ment con­tain­ing this dia­gram, you can down­load it directly from the Rockwell Automation web site.

Emergency Stop Subsystem

The emer­gency stop cir­cuit uses the 440R-​​512R2 relay on the left side of the dia­gram. This par­tic­u­lar sys­tem uses Category 3 archi­tec­ture in the e-​​stop sys­tem, which may be more than is required. A risk assess­ment and a start-​​stop analy­sis is required to deter­mine what per­for­mance level is needed for this sub­sys­tem. Get more infor­ma­tion on emer­gency stop.

 Gate Interlock Subsystem

The gate inter­lock cir­cuit is located in the cen­ter of the dia­gram, and uses the 440R-​​D22R2 relay. As you can see, there are two phys­i­cally sep­a­rate gate inter­lock switches. Only one con­tact from each switch is used, so one switch is con­nected to Channel 1, and the other to Channel 2. Notice that there is no other mon­i­tor­ing of these devices (i.e. no sec­ond con­nec­tion to either switch). The sec­ondary con­tacts on these switches could be con­nected to the PLC for annun­ci­a­tion pur­poses. This would allow the PLC to dis­play the open/​closed sta­tus of the gate on the machine HMI.

The out­put con­tac­tors, K3 and K4, are mon­i­tored by the reset loop con­nected to S34 and the +V rail.

One more inter­est­ing point — did you notice that there is a “zone e-​​stop” included in the gate inter­lock? If you look imme­di­ately below the cen­tral safety relay and a lit­tle to the left you will find an emer­gency stop device. This device is wired in series with the gate inter­lock, so acti­vat­ing it will drop out K3 and K4 but not dis­turb the oper­a­tion of the rest of the machine. The safety relay can’t dis­tin­guish between the e-​​stop but­ton and the gate inter­locks, so if annun­ci­a­tion is needed, you may want to use a third con­tact on the e-​​stop device to con­nect to a PLC input for this purpose.

Safety Mat Subsystem

The safety mat sub­sys­tem is located on the right side of the dia­gram and uses a sec­ond 440R-​​D22R2 relay. Safety mats can be either sin­gle or dual chan­nel in design. The mat show in this draw­ing is a dual-​​channel type. Stepping on the mat causes the con­duc­tive lay­ers in the mat to touch, short­ing Channel 1 to Channel 2. This cre­ates an input fault that will be detected by the 440R relay. The fault con­di­tion will cause the out­put of the relay to open, stop­ping the machine.

Safety mats can be dam­aged rea­son­ably eas­ily, and the cir­cuit design shown will detect shorts or opens within the mat and will pre­vent the haz­ardous motion from start­ing or continuing.

The out­put con­tac­tors, K5 and K6 are mon­i­tored by the relay reset loop con­nected to S34 and the +V rail.

This cir­cuit also includes a con­ven­tional start-​​stop cir­cuit that doesn’t rely on the safety relay.

One more thing — just like the gate inter­lock cir­cuit, this cir­cuit also includes a “zone e-​​stop”. Look below and to the left of the safety mat relay. As with the gate inter­lock, press­ing this but­ton will drop out K5 and K6, stop­ping the same motions pro­tected by the safety mat. Since the relay can’t tell the dif­fer­ence between the e-​​stop but­ton and the mat being acti­vated, you may want to use the same approach and add a third con­tact to the e-​​stop but­ton, con­nect­ing it to the PLC for annunciation.

Component Selection

The com­po­nents used in the cir­cuit are crit­i­cal to the final PL rat­ing of the design. The final PL of the design depends on the MTTFd of the com­po­nents used in each chan­nel. No knowl­edge of the inter­nal con­struc­tion of the safety relays is needed, because the relays come with a PL rat­ing from the man­u­fac­turer. They can be treated as a sub­sys­tem unto them­selves. The selec­tion of the input and out­put devices is then the sig­nif­i­cant fac­tor. Component data sheets can be down­loaded from the Rockwell site if you want to dig a bit deeper.

What did you think about this arti­cle? What ques­tions came to mind that weren’t answered for you? I look for­ward to hear­ing your thoughts and questions!

Copyright secured by Digiprove © 2011
Acknowledgements: ISO for excerpts from ISO 13849–1 and more…
Some Rights Reserved

Understanding the Hierarchy of Controls

Posted by on February 28, 2011 4 comments
Effectiveness of the Hierarchy of Controls
This entry is part 2 of 3 in the series Hierarchy of Controls

Risk assess­ment is the first step in reduc­ing the risk that your cus­tomers and users are exposed to when they use your prod­ucts. The sec­ond step is Risk Reduction, some­times called Risk Control or Risk Mitigation. This arti­cle looks at the ways that risk can be con­trolled using the Hierarchy of Controls. Figure 2 from ISO 12100–1 (shown below) illus­trates this point.

The sys­tem is called a hier­ar­chy because you must apply each level in the order that they fall in the list. In terms of effec­tive­ness at reduc­ing risk, the first level in the hier­ar­chy, elim­i­na­tion, is the most effec­tive, down to the last, PPE*, which has the least effectiveness.

It’s impor­tant to under­stand that ques­tions must be asked after each step in the hier­ar­chy is imple­mented, and that is “Is the risk reduced as much as pos­si­ble? Is the resid­ual risk a) in com­pli­ance with legal require­ments, and b) accept­able to the user or worker?”. When you can answer ‘YES’ to all of these ques­tions, the last step is to ensure that you have warned the user of the resid­ual risks, have iden­ti­fied the required train­ing needed and finally have made rec­om­men­da­tions for any needed PPE.

*PPE — Personal Protective Equipment. e.g. Protective eye wear, safety boots, bump caps, hard hats, cloth­ing, gloves, res­pi­ra­tors, etc. CSA Z1002 includes ‘…any­thing designed to be worn, held, or car­ried by an indi­vid­ual for pro­tec­tion against one or more haz­ards.’  in this definition.

Risk Reduction from the Designer's Viewpoint

ISO 12100:2010 — Figure 2

 

Introducing the Hierarchy of Controls

The Hierarchy of Controls was devel­oped in a num­ber of dif­fer­ent stan­dards over the last 20 years or so. The idea was to pro­vide a com­mon struc­ture that would pro­vide guid­ance to design­ers when con­trol­ling risk.

Typically, the first three lev­els of the hier­ar­chy may be con­sid­ered to be ‘engi­neer­ing con­trols’ because they are part of the design process for a prod­uct. This does not mean that they must be done by engineers!

We’ll look at each level in the hier­ar­chy in detail. First, let’s take a look at what is included in the Hierarchy.

The Hierarchy of Controls includes:

1)    Hazard Elimination or Substitution (Design)
2)    Engineering Controls (see [1, 2, 8, 9, 10, and 11])

a)    Barriers

b)    Guards (Fixed, Movable w/​interlocks)

c)    Safeguarding Devices

d)    Complementary Protective Measures

3)    Information for Use (see [1, 2, 4, 7, 8, 12, and 13])

a)    Hazard Warnings

b)    Manuals

c)    HMI* & Awareness Devices (lights, horns)

4)    Administrative Controls (see [1, 2, 4, 5, 7, and 8])

a)    Training

b)    SOP’s,

c)    Hazardous Energy Control Procedures (see [5, 14])

d)    Authorization

5)    Personal Protective Equipment

a)    Specification

b)    Fitting

c)    Training in use

d)    Maintenance

*HMI — Human-​​Machine Interface. Also called the ‘con­sole’ or ‘oper­a­tor sta­tion’. The loca­tion on the machine where the oper­a­tor con­trols are located. Often includes a pro­gram­ma­ble screen or oper­a­tor dis­play, but can be a sim­ple array of but­tons, switches and indi­ca­tor lights.

The man­u­fac­turer, devel­oper or inte­gra­tor of the sys­tem should pro­vide the first three lev­els of the hier­ar­chy. Where they have not been pro­vided, the work­place or user should pro­vide them.

The last two lev­els must be pro­vided by the work­place or user.

Effectiveness

Each layer in the hier­ar­chy has a level of effec­tive­ness that is related to the fail­ure modes asso­ci­ated with the con­trol mea­sures and the rel­a­tive effec­tive­ness in reduc­ing risk in that layer. As you go down the hier­ar­chy, the reli­a­bil­ity and effec­tive­ness decrease as shown below.

Effectiveness of the Hierarchy of ControlsThere is no way to mea­sure or specif­i­cally quan­tify the reli­a­bil­ity or effec­tive­ness of each layer of the hier­ar­chy — that must wait until you make some selec­tions from each level, and even then it can be very hard to do. The impor­tant thing to under­stand is that Elimination is more effec­tive than Guarding (engi­neer­ing con­trols), which is more effec­tive than Awareness Means, etc.

1. Hazard Elimination or Substitution

Hazard Elimination

Hazard elim­i­na­tion is the most effec­tive means of reduc­ing risk from a par­tic­u­lar haz­ard, for the sim­ple rea­son that once the haz­ard has been elim­i­nated there is no remain­ing risk. Remember that risk is a func­tion of sever­ity and prob­a­bil­ity. Since both sever­ity and prob­a­bil­ity are affected by the exis­tence of the haz­ard, elim­i­nat­ing the haz­ard reduces the risk from that par­tic­u­lar haz­ard to zero. Some prac­ti­tion­ers con­sider this to mean the elim­i­na­tion is 100% effec­tive, how­ever it’s my opin­ion that this is not the case because even elim­i­na­tion has fail­ure modes that can re-​​introduce the hazard.

Failure Modes:

Hazard elim­i­na­tion can fail if the haz­ard is rein­tro­duced into the design. With machin­ery this isn’t that likely to occur, but in processes, ser­vices and work­places it can occur.

Substitution

Substitution requires the designer to sub­sti­tute a less haz­ardous mate­r­ial or process for the orig­i­nal mate­r­ial or process. For exam­ple, beryl­lium is a highly toxic metal that is used in some high tech appli­ca­tions. Inhalation or skin con­tact with beryl­lium dust can do seri­ous harm to a per­son very quickly, caus­ing acute beryl­lium dis­ease. Long term expo­sure can cause chronic beryl­lium dis­ease. Substituting a less toxic mate­r­ial with sim­i­lar prop­er­ties in place of the beryl­lium in the process  could reduce or elim­i­nate the pos­si­bil­ity of beryl­lium dis­ease, depend­ing on the exact con­tent of the sub­sti­tute mate­r­ial. If the sub­sti­tute mate­r­ial includes any amount of beryl­lium, then the risk is only reduced. If it con­tains no beryl­lium, the risk is elim­i­nated. Note that the risk can also be reduced by ensur­ing that the beryl­lium dust is not cre­ated by the process, since beryl­lium is not toxic unless ingested.

Alternatively, using processes to han­dle the beryl­lium with­out cre­at­ing dust or par­ti­cles could reduce the expo­sure to the mate­r­ial in forms that are likely to cause beryl­lium dis­ease. An exam­ple of this could be sub­sti­tu­tion of water-​​jet cut­ting instead of mechan­i­cal saw­ing of the material.

Failure Modes:

Reintroduction of the sub­sti­tuted mate­r­ial into a process is the pri­mary fail­ure mode, how­ever there may be oth­ers that are spe­cific to the haz­ard and the cir­cum­stances. In the above exam­ple, pre– and post-​​cutting han­dling of the mate­r­ial could still cre­ate dust or small par­ti­cles, result­ing in expo­sure to beryl­lium. A sub­sti­tuted mate­r­ial might intro­duce other, new haz­ards, or might cre­ate fail­ure modes in the final prod­uct that would result in risks to the end user. Careful con­sid­er­a­tion is required!

If nei­ther elim­i­na­tion or sub­sti­tu­tion is pos­si­ble, we move to the next level in the hierarchy.

2. Engineering Controls

Engineering con­trols typ­i­cally include var­i­ous types of mechan­i­cal guards [16, 17, & 18], inter­lock­ing sys­tems [9, 10, 11, & 15], and safe­guard­ing devices like light cur­tains or fences, area scan­ners, safety mats and two-​​hand con­trols [19]. These sys­tems are proac­tive in nature, act­ing auto­mat­i­cally to pre­vent access to a haz­ard and there­fore pre­vent­ing injury. These sys­tems are designed to act before a per­son can reach the dan­ger zone and be exposed to the hazard.

Control reli­a­bil­ity

Barrier guards and fixed guards are not eval­u­ated for reli­a­bil­ity because they do not rely on a con­trol sys­tem for their effec­tive­ness. As long as they are placed cor­rectly in the first place, and are oth­er­wise prop­erly designed to con­tain the haz­ards they are pro­tect­ing, then noth­ing more is required. On the other hand, safe­guard­ing devices, like inter­locked guards, light fences, light cur­tains, area scan­ners, safety mats, two-​​hand con­trols and safety edges, all rely on a con­trol sys­tem for their effec­tive­ness. Correct appli­ca­tion of these devices requires cor­rect place­ment based on the stop­ping per­for­mance of the haz­ard and cor­rect inte­gra­tion of the safety device into the safety related parts of the con­trol sys­tem [19]. The degree of reli­a­bil­ity is based on the amount of risk reduc­tion that is being required of the safe­guard­ing device and the degree of risk present in the unguarded state [9, 10].

There are many detailed tech­ni­cal require­ments for engi­neer­ing con­trols that I can’t get into in this arti­cle, but you can learn more by check­ing out the ref­er­ences at the end of this arti­cle and other arti­cles on this blog.

Failure Modes

Failure modes for engi­neer­ing con­trols are as many and as var­ied as the devices used and the meth­ods of inte­gra­tion cho­sen. This dis­cus­sion will have to wait for another article!

Awareness Devices

Of spe­cial note are ‘aware­ness devices’. This group includes warn­ing lights, horns, buzzers, bells, etc. These devices have some aspects that are sim­i­lar to engi­neer­ing con­trols, in that they are usu­ally part of the machine con­trol sys­tem, but they are also some­times classed as ‘infor­ma­tion for use’, par­tic­u­larly when you con­sider indi­ca­tor or warn­ing lights and HMI screens. In addi­tion to these ‘active’ types of devices, aware­ness devices may also include lines painted or taped on the floor or on the edge of a step or ele­va­tion change, warn­ing chains, sig­nage, etc. Signage may also be included in the class of ‘infor­ma­tion for use’, along with HMI screens.

Failure Modes

Failure modes for Awareness Devices include:

  • Ignoring the warn­ings (Complacency or Failure to com­pre­hend the mean­ing of the warning);
  • Failure to main­tain the device (warn­ing lights burned out or removed);
  • Defeat of the device (silenc­ing an audi­ble warn­ing device);
  • Inappropriate selec­tion of the device (invis­i­ble or inaudi­ble in the pre­dom­i­nat­ing conditions).

Complementary Protective Measures

Complementary Protective mea­sures are a class of con­trols that are sep­a­rate from the var­i­ous types of safe­guard­ing because they gen­er­ally can­not pre­vent injury, but may reduce the sever­ity of injury or the prob­a­bil­ity of the injury occur­ring. Complementary pro­tec­tive mea­sures are reac­tive in nature, mean­ing that they are not auto­matic. They must be man­u­ally acti­vated by a user before any­thing will occur, e.g. press­ing an emer­gency stop but­ton. They can only com­ple­ment the pro­tec­tion pro­vided by the auto­matic systems.

A good exam­ple of this is the Emergency Stop sys­tem that is designed into many machines. On its own, the emer­gency stop sys­tem will do noth­ing to pre­vent an injury. The sys­tem must be acti­vated man­u­ally by press­ing a but­ton or pulling a cable. This relies on some­one detect­ing a prob­lem and real­iz­ing that the machine needs to be stopped to avoid or reduce the sever­ity of an injury that is about to occur or is occur­ring. Emergency stop can only ever be a back-​​up mea­sure to the auto­matic inter­locks and safe­guard­ing devices used on the machine. In many cases, the next step in emer­gency response after press­ing the emer­gency stop is to call 911.

Failure Modes:

The fail­ure modes for these kinds of con­trols are too numer­ous to list here, how­ever they range from sim­ple fail­ure to replace a fixed guard or bar­rier fence, to fail­ure of elec­tri­cal, pneu­matic or hydraulic con­trols. These fail­ure modes are enough of a con­cern that a new field of safety engi­neer­ing called ‘Functional Safety Engineering’ has grown up around the need to be able to ana­lyze the prob­a­bil­ity of fail­ure of these sys­tems and to use addi­tional design ele­ments to reduce the prob­a­bil­ity of fail­ure to a level we can tol­er­ate. For more on this, see [9, 10, 11].

Once you have exhausted all the pos­si­bil­i­ties in Engineering Controls, you can move to the next level down in the hierarchy.

3. Information for Use

This is a very broad topic, includ­ing man­u­als, instruc­tion sheets, infor­ma­tion labels on the prod­uct, haz­ard warn­ing signs and labels, HMI screens, indi­ca­tor and warn­ing lights, train­ing mate­ri­als, video, pho­tographs, draw­ings, bills of mate­ri­als, etc. There are some excel­lent stan­dards now avail­able that can guide you in devel­op­ing these mate­ri­als [1, 12 and 13].

Failure Modes:

The major fail­ure modes in this level include:

  • Poorly writ­ten or incom­plete materials;
  • Provision of the mate­ri­als in a lan­guage that is not under­stood by the user;
  • Failure by the user to read and under­stand the materials;
  • Inability to access the mate­ri­als when needed;
  • Etcetera.

When all pos­si­bil­i­ties for inform­ing the user have been cov­ered, you can move to the next level down in the hier­ar­chy. Note that this is the usual sep­a­ra­tion point between the man­u­fac­turer and the user of a prod­uct. This is nicely illus­trated in Fig 2 from ISO 12100 above. It is impor­tant to under­stand at this point that the resid­ual risk posed by the prod­uct to the user may not yet be tol­er­a­ble. The user is respon­si­ble for imple­ment­ing the next two lev­els in the hier­ar­chy in most cases. The man­u­fac­turer can make rec­om­men­da­tions that the user may want to fol­low, but typ­i­cally that is the extent of influ­ence that the man­u­fac­turer will have on the user.

4. Administrative Controls

This level in the hier­ar­chy includes:

  • Training;
  • Standard Operating Procedures (SOP’s);
  • Safe work­ing pro­ce­dures e.g. Hazardous Energy Control, Lockout, Tagout (where per­mit­ted by law), etc.;
  • Authorization; and
  • Supervision.

Training is the method used to get the infor­ma­tion pro­vided by the man­u­fac­turer to the worker or end user. This can be pro­vided by the man­u­fac­turer, by a third party, or self-​​taught by the user or worker.
SOP’s can include any kind of pro­ce­dure insti­tuted by the work­place to reduce risk. For exam­ple, requir­ing work­ers who drive vehi­cles to do a walk-​​around inspec­tion of the vehi­cle before use, and log­ging of any prob­lems found dur­ing the inspec­tion is an exam­ple of an SOP to reduce risk while dri­ving.
Safe work­ing pro­ce­dures can be strongly influ­enced by the man­u­fac­turer through the infor­ma­tion for use pro­vided. Maintenance pro­ce­dures for haz­ardous tasks pro­vided in the main­te­nance man­ual are an exam­ple of this.
Authorization is the pro­ce­dure that an employer uses to autho­rize a worker to carry out a par­tic­u­lar task. For exam­ple, an employer might put a pol­icy in place that only per­mits licensed elec­tri­cians to access elec­tri­cal enclo­sures and carry out work with the enclo­sure live. The employer might require that work­ers who may need to use lad­ders in their work take a lad­der safety and a fall pro­tec­tion train­ing course. Once the pre­req­ui­sites for autho­riza­tion are com­pleted, the worker is ‘autho­rized’ by the employer to carry out the task.
Supervision is one of the most crit­i­cal of the Administrative Controls. Sound super­vi­sion can make all of the above work. Failure to prop­erly super­vise work can cause all of these mea­sures to fail.

Failure Modes

Administrative con­trols have many fail­ure modes. Here are some of the most common:

  • Failure to train;
  • Failure to inform work­ers regard­ing the haz­ards present and the related risks;
  • Failure to cre­ate and imple­ment SOP’s;
  • Failure to pro­vide and main­tain spe­cial equip­ment needed to imple­ment SOP’s;
  • No for­mal means of autho­riza­tion — i.e. How do you KNOW that Joe has his lift truck license?;
  • Failure to super­vise adequately.

I’m sure you can think of MANY other ways that Administrative Controls can go wrong!

5. Personal Protective Equipment (PPE)

PPE includes every­thing from safety glasses, to hard­hats and bump caps, to fire-​​retardant cloth­ing, hear­ing defend­ers, and work boots. Some stan­dards even include warn­ing devices that are worn by the user, such as gas detec­tors and person-​​down detec­tors, in this group.
PPE is prob­a­bly the sin­gle most over-​​used and least under­stood risk con­trol mea­sure. It falls at the bot­tom of the hier­ar­chy for a num­ber of reasons:

  1. It is a mea­sure of last resort;
  2. It per­mits the haz­ard to come as close to the per­son as their clothing;
  3. It is often incor­rectly specified;
  4. It is often poorly fitted;
  5. It is often poorly main­tained; and
  6. It is often improp­erly used.

The prob­lems with PPE are hard to deal with. You can­not glue or screw a set of safety glasses to a person’s face, so ensur­ing the the pro­tec­tive equip­ment is used is a big prob­lem that goes back to supervision.

Many small and medium sized enter­prises do not have the exper­tise in the orga­ni­za­tion to prop­erly spec­ify, fit and main­tain the equipment.

User com­fort is extremely impor­tant. Uncomfortable equip­ment won’t be used for long.

Finally, by the time that prop­erly spec­i­fied, fit­ted and used equip­ment can do it’s job, the haz­ard is as close to the per­son as it can get. The prob­a­bil­ity of fail­ure at this point is very high, which is what makes PPE a mea­sure of last resort, com­ple­men­tary to the more effec­tive mea­sures that can be pro­vided in the first three lev­els of the hierarchy.

If work­ers are not prop­erly trained and ade­quately informed about the haz­ards they face and the rea­sons behind the use of PPE, they are deprived of the oppor­tu­nity to make safe choices, even if that choice is to refuse the work.

Failure Modes

Failure modes for PPE include:

  • Incorrect spec­i­fi­ca­tion (not suit­able for the hazard);
  • Incorrect fit (allows haz­ard to bypass PPE);
  • Poor main­te­nance (pre­vents or restricts vision or move­ment, increas­ing the risk; causes PPE fail­ure under stress or allows haz­ard to bypass PPE);
  • Incorrect usage (fail­ure to train and inform users, incor­rect selec­tion or spec­i­fi­ca­tion of PPE).

Time to Apply the Hierarchy

So now you know some­thing about the ‘hier­ar­chy of con­trols’. Each layer has its own intri­ca­cies and nuances that can only be learned by train­ing and expe­ri­ence. With a doc­u­mented risk assess­ment in hand, you can begin to apply the hier­ar­chy to con­trol the risks. Don’t for­get to iter­ate the assess­ment post-​​control to doc­u­ment the degree of risk reduc­tion achieved. You may cre­ate new haz­ards when con­trol mea­sures are applied, and you may need to add addi­tional con­trol mea­sures to achieve effec­tive risk reduction.

The doc­u­ments ref­er­enced below should give you a good start in under­stand­ing some of these challenges.

References

5% Discount on All Standards with code: CC2011

[1]             Safety of machin­ery – Basic con­cepts, gen­eral prin­ci­ples for design – Part 1: Basic ter­mi­nol­ogy and method­ol­ogy, ISO Standard 12100–1, 2003.
[2]            Safety of machin­ery – Basic con­cepts, gen­eral prin­ci­ples for design – Basic ter­mi­nol­ogy and method­ol­ogy, Part 2: Technical prin­ci­ples, ISO Standard 12100–2, 2003.
[3]            Safety of Machinery – Risk Assessment – Part 1: Principles, ISO Standard 14121–1, 2007.
[4]            Safety of machin­ery — Prevention of unex­pected start-​​up, ISO 14118, 2000
[5]            Control of haz­ardous energy – Lockout and other meth­ods, CSA Z460, 2005
[6]            Fluid power sys­tems and com­po­nents – Graphic sym­bols and cir­cuit dia­grams – Part 1: Graphic sym­bols for con­ven­tional use and data-​​processing appli­ca­tions, ISO Standard 1219–1, 2006
[7]            Pneumatic fluid power — General rules and safety require­ments for sys­tems and their com­po­nents, ISO Standard 4414, 1998
[8]            American National Standard for Industrial Robots and Robot Systems — Safety Requirements, ANSI/​RIA R15.06, 1999.
[9]            Safety of machin­ery — Safety-​​related parts of con­trol sys­tems — Part 1: General prin­ci­ples for design, ISO Standard 13849–1, 2006
[10]          Safety of machin­ery – Functional safety of safety-​​related elec­tri­cal, elec­tronic and pro­gram­ma­ble elec­tronic con­trol sys­tems, IEC Standard 62061, 2005
[11]           Functional safety of electrical/​electronic/​programmable elec­tronic safety-​​related sys­tems, IEC Standard 61508-​​X, seven parts.
[12]          Preparation of Instructions — Structuring, Content and Presentation, IEC Standard 62079, 2001
[13]          American National Standard For Product Safety Information in Product Manuals, Instructions, and Other Collateral Materials, ANSI Standard Z535.6, 2010.
[14]          Control of Hazardous Energy Lockout/​Tagout and Alternative Methods, ANSI Standard Z244.1, 2003.
[15]          Safety of Machinery — Interlocking devices asso­ci­ated with guards — prin­ci­ples for design and selec­tion, EN 1088+A1:2008.
[16]          Safety of Machinery — Guards — General require­ments for the design and con­struc­tion of fixed and mov­able guards, EN 953+A1:2009.
[17]          Safety of machin­ery — Guards — General require­ments for the design and con­struc­tion of fixed and mov­able guards, ISO 14120.
[18]         Safety of machin­ery — Safety dis­tances to pre­vent haz­ard zones being reached by upper and lower limbs, ISO 13857:2008.
[19]         Safety of machin­ery — Positioning of safe­guards with respect to the approach speeds of parts of the human body, ISO 13855:2010.

5% Discount on All Standards with code: CC2011

All original content on these pages is fingerprinted and certified by Digiprove
Performance Optimization WordPress Plugins by W3 EDGE