Machinery Safety 101

In this excellent article from Rockwell Automation’s The Journal, Mike Miller and Wayne Solberg explain how EN ISO 13849-1 and EN IEC 62061 mesh for machine builders.

Well worth the read in my opinion!

The Journal: Safety is Good Business – Marshall & Solberg

In Part 1 of this series we explored Category B, the Basic Category that underpins all of the other Categories. This post builds on Part 1 by taking a look at Category 1. Let’s start by exploring the difference as defined in ISO 13849-1. Remember that “SRP/CS” stands for “Safety Related Parts of Control Systems”.

SRP/CS of category 1 shall be designed and constructed using well-tried components and well-tried safety principles (see ISO 13849-2).

Well-Tried Components

So what, exactly, is a “Well-Tried Component”?? Let’s go back to the standard for that:

A “well-tried component” for a safety-related application is a component which has been either

a) widely used in the past with successful results in similar applications, or
b) made and verified using principles which demonstrate its suitability and reliability for safety-related applications.

Newly developed components and safety principles may be considered as equivalent to “well-tried” if they fulfil the conditions of b).

The decision to accept a particular component as being “well-tried” depends on the application.

NOTE 1 Complex electronic components (e.g. PLC, microprocessor, application-specific integrated circuit) cannot be considered as equivalent to “well tried”.

Lets look at what this all means by referencing ISO 13849-2:

Table A.3 — Well-Tried Components

Well-Tried Components	Conditions for “well–tried”	Standard or specification
Screw	All factors influencing the screw connection and the application are to be considered. See Table A.2 “List of well–tried safety principles”.	Mechanical jointing such as screws, nuts, washers, rivets, pins, bolts etc. are standardised.
Spring	See Table A.2 “Use of a well–tried spring”.	Technical specifications for spring steels and other special applications are given in ISO 4960.
Cam	All factors influencing the cam arrangement (e. g. part of an interlocking device) are to be considered. See Table A.2 “List of well–tried safety principles”.	See EN 1088 (ISO 14119) (Interlocking devices).
Break–pin	All factors influencing the application are to be considered. See Table A.2 “List of well-tried safety principles”.	—

OK, so now we have a few ideas about what might constitute a ‘well-tried component’. Unfortunately, you will notice that ‘contactor’ or ‘relay’ or ‘limit switch’ appear nowhere on the list. This is a challenge, but one that can be overcome. The key to dealing with this is to look at how the components that you are choosing to use are constructed. If they use these components and techniques, you are on your way to considering them to be well-tried.

Another approach is to let the component manufacturer worry about the details of the construction of the device, and simply ensure that components selected for use in the SRP/CS are ‘safety rated’ by the manufacturer. This can work in 80-90% of cases, with a small percentage of components, such as large motor starters, some servo and stepper drives and other similar components unavailable with a safety rating. It’s worth noting that many drive manufacturers are starting to produce drives with built-in safety components that are intended to be integrated into your SRP/CS.

Exclusion of Complex Electronics

Note 1 from the first part of the definition is very important. So important that I’m going to repeat it here:

NOTE 1 Complex electronic components (e.g. PLC, microprocessor, application-specific integrated circuit) cannot be considered as equivalent to “well tried”.

This little note is what prevents any safety system that incorporates a standard PLC from being considered anything more than Category B, regardless of redundancy and component selections for all other components. Its also important to realize that this definition is only considering the hardware – no mention of software is made here, and software is not dealt with until later in the standard.

Well-Tried Safety Principles

Let’s have a look at what ‘Well-Tried Safety Principles’ might be.

Table A.2 — Well-Tried Safety Principles

Well-tried Safety Principles	Remarks
Use of carefully selected materials and manufacturing	Selection of suitable material, adequate manufacturing methods and treatments related to the application.
Use of components with oriented failure mode	The predominant failure mode of a component is known in advance and always the same, see EN 292-2:1991, (ISO/TR 12100-2:1992), 3.7.4.
Over–dimensioning/safety factor	The safety factors are given in standards or by good experience in safety-related applications.
Safe position	The moving part of the component is held in one of the possible positions by mechanical means (friction only is not enough). Force is needed for changing the position.
Increased OFF force	A safe position/state is obtained by an increased OFF force in relation to ON force.
Careful selection, combination, arrangement, assembly and installation of components/system related to the application	—
Careful selection of fastening related to the application	Avoid relying only on friction.
Positive mechanical action	Dependent operation (e. g. parallel operation) between parts is obtained by positive mechanical link(s). Springs and similar “flexible” elements should not be part of the link(s) [see EN 292-2:1991 (ISO/TR 12100-2:1992), 3.5].
Multiple parts	Reducing the effect of faults by multiplying parts, e. g. where a fault of one spring (of many springs) does not lead to a dangerous condition.
Use of well–tried spring (see also Table A.3)	A well–tried spring requires: use of carefully selected materials, manufacturing methods (e. g. presetting and cycling before use) and treatments (e. g. rolling and shot–peening), sufficient guidance of the spring, and sufficient safety factor for fatigue stress (i. e. with high probability a fracture will not occur). Well–tried pressure coil springs may also be designed by: use of carefully selected materials, manufacturing methods (e. g. presetting and cycling before use) and treatments (e. g. rolling and shot-peening), sufficient guidance of the spring, and clearance between the turns less than the wire diameter when unloaded, and sufficient force after a fracture(s) is maintained (i. e. a fracture(s) will not lead to a dangerous condition).
Limited range of force and similar parameters	Decide the necessary limitation in relation to the experience and application. Examples for limitations are break pin, break plate, torque limiting clutch.
Limited range of speed and similar parameters	Decide the necessary limitation in relation to the experience and application. Examples for limitations are centrifugal governor; safe monitoring of speed or limited displacement.
Limited range of environmental parameters	Decide the necessary limitations. Examples on parameters are temperature, humidity, pollution at the installation. See clause 8 and consider manufacturer’s application notes.
Limited range of reaction time, limited hysteresis	Decide the necessary limitations. Consider e. g. spring tiredness, friction, lubrication, temperature, inertia during acceleration and deceleration, combination of tolerances.

Use of Positive-Mode Operation

The use of these principles in the components, as well as in the overall design of the safeguards is important. In developing a system that uses ‘positive mode operation’, the mechanical linkage that operates the electrical contacts or the fluid-power valve that controls the prime-mover(s) (i.e. motors, cylinders, etc.), must act to directly drive the control element (contacts or valve spool) to the safe state. Springs can be used to return the system to the run state or dangerous state, since a failure of the spring will result in the interlock device staying in the safe state (fail-safe or fail-to-safety).

CSA Z432 provides us with a nice diagram that illustrates the idea of “positive-action” or “positive-mode” operation:

In Figure B.10, opening the guard door forces the roller to follow the cam attached to the door, driving the switch contacts apart and opening the interlock. Even if the contacts were to weld, they would still be driven apart since the mechanical advantage provided by the width of the door and the cam are more than enough to force the contacts apart.

Here’s an example of a ‘negative mode’ operation:

In Figure B.11, the interlock switch relies on a spring to enter the safe state when the door is opened. If the spring in the interlock device fails, the system fails-to-danger. Also note that this design is very easy to defeat. A ‘zip-tie’ or some tape is all that would be required to keep the interlock in the ‘RUN’ condition.

You should have a better idea of what is meant when you read about positive and negative-modes of operation now. We’ll talk about defeat resistance in another article.

Reliability

Combining what you’ve learned so far, you can see that correctly specified components, combined with over-dimensioning and implementation of design limits along with the use of well-tried safety principles will go a long way to improving the reliability of the control system. The next part of the definition of Category 1 speaks to some additional requirements:

The MTTF_d of each channel shall be high.

The maximum PL achievable with category 1 is PL = c.

NOTE 2 There is no diagnostic coverage (DC_avg = none) within category 1 systems. In such structures (single-channel systems) the consideration of CCF is not relevant.

NOTE 3 When a fault occurs it can lead to the loss of the safety function. However, the MTTF_d of each channel in category 1 is higher than in category B. Consequently, the loss of the safety function is less likely.

We now know that the control reliability is better with a Category 1 system than with a B, since the MTTF_d of the system has gone from a maximum of ‘b’ to ‘c’. PL_c is equivalent to >= 10^-6 to < 3 x 10^-6 failures per hour. Pretty good for simply improving the components used in the system!

To get a handle on what PLc means, let’s look at our single and three shift examples again. If we take a Canadian operation with a single shift per day, and a 50 week working year we get:

7.5 h/shift x 5 d/w x 50 w/a = 1875 h/a

In this case, PL_c is equivalent to one failure in 533.3 years of operation to 1600 years of operation.

Looking at three shifts per day in the same operation gives us:

7.5 h/shift x 3 shifts/d x 5 d/w x 50 w/a = 5625 h/a

In this case, PL_c is equivalent to one failure in 177.8 years of operation to 533.3 years of operation.

Remember that these are probabilities, not guarantees. A failure could happen in the first hour of operation, the last hour of operation or never. These figures simply provide a way for you as the designer to gauge the relative reliability of the system.

Well-Tried Components versus Fault Exclusions

The standard goes on to outline some key distinctions between ‘well-tried component’ and ‘fault exclusion’. We’ll talk more about fault exclusions later in the series.

It is important that a clear distinction between “well-tried component” and “fault exclusion” (see Clause 7) be
made. The qualification of a component as being well-tried depends on its application. For example, a position
switch with positive opening contacts could be considered as being well-tried for a machine tool, while at the
same time as being inappropriate for application in a food industry — in the milk industry, for instance, this
switch would be destroyed by the milk acid after a few months. A fault exclusion can lead to a very high PL,
but the appropriate measures to allow this fault exclusion should be applied during the whole lifetime of the
device. In order to ensure this, additional measures outside the control system may be necessary. In the case
of a position switch, some examples of these kinds of measures are

• means to secure the fixing of the switch after its adjustment,
• means to secure the fixing of the cam,
• means to ensure the transverse stability of the cam,
• means to avoid over travel of the position switch, e.g. adequate mounting strength of the shock absorber
  and any alignment devices, and
• means to protect it against damage from outside.

System Block Diagram

Finally, Here is the block diagram for Category 1, which looks the same as that for Category B, since only the components used in the system have changed, and not the architecture.

ISO 13849-1 Figure 9 - Category 1 Block Diagram

Add to your Library

If you are working on implementing these design standards in your products, you need to buy copies of the standards for your library.

• ISO 13849-1:2006 Safety of machinery — Safety-related parts of control systems — Part 1: General principles for design
• ISO 13849-2:2003 Safety of machinery — Safety-related parts of control systems — Part 2: Validation
• ISO TR 13849-100:2000 Safety of machinery — Safety-related parts of control systems — Part 100: Guidelines for the use and application of ISO 13849-1

Download IEC standards, International Electrotechnical Commission standards.

If you are working in the EU, or are working on CE Marking your product, you should hold the harmonized version of this standard, available through the CEN resellers:

EN ISO 13849-1:2008 Safety of machinery — Safety-related parts of control systems — Part 1: General principles for design

Next Installment

Watch for the next part of this series, “Interlock Architectures – Pt. 3: Category 2″ where we expand on the first two categories by adding some diagnostic coverage to improve reliability.

Have questions? Email me!