ISO 13849–1, Chapter 7 [1, 7] discusses the need for fault consideration and fault exclusion. Fault consideration is the process of examining the components and sub-systems used in the safety-related part of the control system (SRP/CS) and making a list of all the faults that could occur in each one. This a definitely non-trivial exercise!
Thinking back to some of the earlier articles in this series where I mentioned the different types of faults, you may recall that there are detectable and undetectable faults, and there are safe and dangerous faults, leading us to four kinds of fault:
Safe undetectable faults
Dangerous undetectable faults
Safe detectable faults
Dangerous detectable faults
For systems where no diagnostics are used, Category B and 1, faults need to be eliminated using inherently safe design techniques. Care needs to be taken when classifying components as “well-tried” versus using a fault exclusion, as components that might normally be considered “well-tried” might not meet those requirements in every application. [2, Annex A], Validation tools for mechanical systems, discusses the concepts of “Basic Safety Principles”, “Well-Tried Safety Principles”, and “Well-tried components”. [2, Annex A] also provides examples of faults and relevant fault exclusion criteria. There are similar Annexes that cover pneumatic systems [2, Annex B], hydraulic systems [2, Annex C], and electrical systems [2, Annex D].
For systems where diagnostics are part of the design, i.e., Category 2, 3, and 4, the fault lists are used to evaluate the diagnostic coverage (DC) of the test systems. Depending on the architecture, certain levels of DC are required to meet the relevant PL, see [1, Fig. 5]. The fault lists are starting point for the determination of DC, and are an input into the hardware and software designs. All of the dangerous detectable faults must be covered by the diagnostics, and the DC must be high enough to meet the PLr for the safety function.
The fault lists and fault exclusions are used in the Validation portion of this process as well. At the start of the Validation process flowchart [2, Fig. 1], you can see how the fault lists and the criteria used for fault exclusion are used as inputs to the validation plan.
Start of ISO 13849–2 Fig. 1
Faults that can be excluded do not need to validated, saving time and effort during the system verification and validation (V & V). How is this done?
Fault Consideration
The first step is to develop a list of potential faults that could occur, based on the components and subsystems included in SRP/CS. ISO 13849–2 [2] includes lists of typical faults for various technologies. For example, [2, Table A.4] is the fault list for mechanical components.
As you can see, there are many different types of faults that need to be considered. Keep in mind that I did not give you all of the different fault lists — this post would be a mile long if I did that! The point is that you need to develop a fault list for your system, and then consider the impact of each fault on the operation of the system. If you have components or subsystems that are not listed in the tables, then you need to develop your own fault lists for those items. Failure Modes and Effects Analysis (FMEA) is usually the best approach for developing fault lists for these components [23], [24].
When considering the faults to be included in the list there are a few things that should be considered [1, 7.2]:
if after the first fault occurs other faults develop due to the first fault, then you can group those faults together as a single fault
two or more single faults with a common cause can be considered as a single fault
multiple faults with different causes but occurring simultaneously is considered improbable and does not need to be considered
Examples
#1 — Voltage Regulator
A voltage regulator fails in a system power supply so that the 24 Vdc output rises to an unregulated 36 Vdc (the internal power supply bus voltage), and after some time has passed, two sensors fail. All three failures can be grouped and considered as a single fault because they originate in a single failure in the voltage regulator.
#2 — Lightning Strike
If a lightning strike occurs on the power line and the resulting surge voltage on the 400 V mains causes an interposing contactor and the motor drive it controls to fail to danger, then these failures may be grouped and considered as one. Again, a single event causes all of the subsequent failures.
#3 — Pneumatic System Lubrication
3a — A pneumatic lubricator runs out of lubricant and is not refilled, depriving downstream pneumatic components of lubrication.
3b — The spool on the system dump valve sticks open because it is not cycled often enough.
Neither of these failures has the same cause, so there is no need to consider them as occurring simultaneously because the probability of both happening concurrently is extremely small. One caution: These two faults MAY have a common cause — poor maintenance. If this is true and you decide to consider them to be two faults with a common cause, they could then be grouped as a single fault.
Fault Exclusion
Once you have your well-considered fault lists together, the next question is “Can any of the listed faults be excluded?” This is a tricky question! There are a few points to consider:
Does the system architecture allow for fault exclusion?
Is the fault technically improbable, even if it is possible?
Does experience show that the fault is unlikely to occur?*
Are there technical requirements related to the application and the hazard that might support fault exclusion?
* BECAREFUL with this one!
Whenever faults are excluded, a detailed justification for the exclusion needs to be included in the system design documentation. Simply deciding that the fault can be excluded is NOTENOUGH! Consider the risk a person will be exposed to in the event the fault occurs. If the severity is very high, i.e., severe permanent injury or death, you may not want to exclude the fault even if you think you could. Careful consideration of the resulting injury scenario is needed.
Basing a fault exclusion on personal experience is seldom considered adequate, which is why I added the asterisk (*) above. Look for good statistical data to support any decision to use a fault exclusion.
There is much more information available in IEC 61508–2 on the subject of fault exclusion, and there is good information in some of the books mentioned below [0.1], [0.2], and [0.3]. If you know of additional resources you would like to share, please post the information in the comments!
Definitions
3.1.3 fault
state of an item characterized by the inability to perform a required function, excluding the inability during preventive maintenance or other planned actions, or due to lack of external resources
Note 1 to entry: A fault is often the result of a failure of the item itself, but may exist without prior failure.
Note 2 to entry: In this part of ISO 13849, “fault” means random fault. [SOURCE: IEC 60050?191:1990, 05–01.]
Book List
Here are some books that I think you may find helpful on this journey:
[0.2] Electromagnetic Compatibility for Functional Safety, 1st ed. Stevenage, UK: The Institution of Engineering and Technology, 2008.
Note: This reference list starts in Part 1 of the series, so “missing” references may show in other parts of the series. Included in the last post of the series is the complete reference list.
[18] M. Gentile and A. E. Summers, “Common Cause Failure: How Do You Manage Them?,” Process Saf. Prog., vol. 25, no. 4, pp. 331–338, 2006.
[19] Out of Control—Why control systems go wrong and how to prevent failure, 2nd ed. Richmond, Surrey, UK: HSE Health and Safety Executive, 2003.
Original content here is published under these license terms:
X
License Type:
Non-commercial, Attribution, Share Alike
License Summary:
You may copy this content, create derivative work from it, and re-publish it for non-commercial purposes, provided you include an overt attribution to the author(s) and the re-publication must itself be under the terms of this license or similar.
When designing safeguarding systems for machines, one of the basic building blocks is the movable guard. Movable guards can be doors, panels, gates or other physical barriers that can be opened without using tools. Every one of these guards needs to be interlocked with the machine control system so that the hazards covered by the guards will be effectively controlled when the guard is opened.
There are a number of important aspects to the design of movable guards. This article will focus on the selection of interlocking devices that are used with movable guards.
The Hierarchy of Controls
Figure 1 — The Hierarchy of Controls
This article assumes that a risk assessment has been done as part of the design process. If you haven’t done a risk assessment first, start there, and then come back to this point in the process. You can find more information on risk assessment methods in this post from 31-Jan-11. ISO 12100 [1] can also be used for guidance in this area.
The hierarchy of controls describes levels of controls that a machine designer can use to control the assessed risks. The hierarchy is defined in [1]. Designers are required to apply every level of the hierarchy in order, starting at the top. Each level is applied until the available measures are exhausted, or cannot be applied without destroying the purpose of the machine, allowing the designer to move to the next lower level.
Engineering controls are subdivided into a number of different sub-groups. Only movable guards are required to have interlocks. There are a number of similar types of guards that can be mistaken for movable guards, so let’s take a minute to look at a few important definitions.
Table 1 — Definitions
International [1]
Canadian [2]
USA [10]
3.27 guard physical barrier, designed as part of the machine to provide protection.NOTE 1 A guard may act either alone, in which case it is only effective when “closed” (for a movable guard) or “securely held in place” (for a fixed guard), or in conjunction with an interlocking device with or without guard locking, in which case protection is ensured whatever the position of the guard.NOTE 2Depending on its construction, a guard may be described as, for example, casing, shield, cover, screen, door, enclosing guard.NOTE 3 The terms for types of guards are defined in 3.27.1 to 3.27.6. See also 6.3.3.2 and ISO 14120 for types of guards and their requirements.
Guard — a part of machinery specifically used to provide protection by means of a physical barrier. Depending on its construction, a guard may be called a casing, screen, door, enclosing guard, etc.
3.22 guard: A barrier that prevents exposure to an identified hazard.E3.22 Sometimes referred to as “barrier guard.”
3.27.4 interlocking guard guard associated with an interlocking device so that, together with the control system of the machine, the following functions are performed:
the hazardous machine functions “covered” by the guard cannot operate until the guard is closed,
if the guard is opened while hazardous machine functions are operating, a stop command is given, and
when the guard is closed, the hazardous machine functions “covered” by the guard can operate (the closure of the guard does not by itself start the hazardous machine functions)
NOTEISO 14119 gives detailed provisions.
Interlocked barrier guard — a fixed or movable guard attached and interlocked in such a manner that the machine tool will not cycle or will not continue to cycle unless the guard itself or its hinged or movable section encloses the hazardous area.
3.32 interlocked barrier guard: A barrier, or section of a barrier, interfaced with the machine control system in such a manner as to prevent inadvertent access to the hazard.
3.27.2 movable guard
guard which can be opened without the use of tools
Movable guard — a guard generally connected by mechanical means (e.g., hinges or slides) to the machine frame or an adjacent fixed element and that can be opened without the use of tools. The opening and closing of this type of guard may be powered.
3.37 movable barrier device: A safeguarding device arranged to enclose the hazard area before machine motion can be initiated.E3.37 There are two types of movable barrier devices:
Type A, which encloses the hazard area during the complete machine cycle;
Type B, which encloses the hazard area during the hazardous portion of the machine cycle.
3.28.1 interlocking device (interlock)mechanical, electrical or other type of device, the purpose of which is to prevent the operation of hazardous machine functions under specified conditions (generally as long as a guard is not closed)
Interlocking device (interlock) — a mechanical, electrical, or other type of device, the purpose of which is to prevent the operation of machine elements under specified conditions (usually when the guard is not closed).
No definition
3.27.5 interlocking guard with guard locking guard associated with an interlocking device and a guard locking device so that, together with the control system of the machine, the following functions are performed:
the hazardous machine functions “covered” by the guard cannot operate until the guard is closed and locked,
the guard remains closed and locked until the risk due to the hazardous machine functions “covered” by the guard has disappeared, and
when the guard is closed and locked, the hazardous machine functions “covered” by the guard can operate (the closure and locking of the guard do not by themselves start the hazardous machine functions)
NOTEISO 14119 gives detailed provisions.
Guard locking device — a device that is designed to hold the guard closed and locked until the hazard has ceased.
No definition
As you can see from the definitions, movable guards can be opened without the use of tools, and are generally fixed to the machine along one edge. Movable guards are always associated with an interlocking device. Guard selection is covered very well in ISO 14120 [11]. This standard contains a flowchart that is invaluable for selecting the appropriate style of guard for a given application.
Though much emphasis is placed on the correct selection of these interlocking devices, they represent a very small portion of the hierarchy. It is their widespread use that makes them so important when it comes to safety system design.
Electrical vs. Mechanical Interlocks
Figure 2 — Mechanical Interlocking
Most modern machines use electrical interlocks because the machine is fitted with an electrical control system, but it is entirely possible to interlock the power to the prime movers using mechanical means. This doesn’t affect the portion of the hierarchy involved, but it may affect the control reliability analysis that you need to do.
Mechanical Interlocks
Figure 2, from ISO 14119 [7, Fig. H.1, H.2 ], shows one example of a mechanical interlock. In this case, when cam 2 is rotated into the position shown in a), the guard cannot be opened. Once the hazardous condition behind the guard is effectively controlled, cam 2 rotates to the position in b), and the guard can be opened.
Arrangements that use the open guard to physically block operation of the controls can also be used in this way. See Figure 3 [7, Fig. C.1, C.2].
Figure 3 — Mechanical Interlocking using machine control devices
Fluid Power Interlocks
Figure 4, from [7, Fig. K.2], shows an example of two fluid-power valves used in complementary mode on a single sliding gate.
Figure 4 — Example of a fluid power interlock
In this example, fluid can flow from the pressure supply (the circle with the dot in it at the bottom of the diagram) through the two valves to the prime-mover, which could be a cylinder, or a motor or some other device when the guard is closed (position ‘a’). There could be an additional control valve following the interlock that would provide the normal control mode for the device.
When the guard is opened (position ‘b’), the two valve spools shift to the second position, the lower valve blocks the pressure supply, and the upper valve vents the pressure in the circuit, helping to prevent unexpected motion from trapped energy.
If the spring in the upper valve fails, the lower spool will be driven by the gate into a position that will still block the pressure supply and vent the trapped energy in the circuit.
By far the majority of interlocks used on machinery are electrical. Electrical interlocks offer ease of installation, flexibility in selection of interlocking devices, and complexity from simple to extremely complex. The architectural categories cover any technology, whether it is mechanical, fluidic, or electrical, so let’s have a look at architectures first.
Architecture Categories
Figure 5 — Control Reliability Categories
In Canada, CSAZ432 [2] and CSAZ434 [3] provide four categories of control reliability: simple, single channel, single-channel monitored and control reliable. In the U.S., the categories are very similar, with some differences in the definition for control reliable (see RIAR15.06, 1999). In the EU, there are five levels of control reliability, defined as Performance Levels (PL) given in ISO 13849–1 [4]: PL a, b, c, d and e. Underpinning these levels are five architectural categories: B, 1, 2, 3 and 4. Figure 5 shows how these architectures line up.
To add to the confusion, IEC 62061 [5] is another international control reliability standard that could be used. This standard defines reliability in terms of Safety Integrity Levels (SILs). These SILs do not line up exactly with the PLs in [4], but they are similar. [5] is based on IEC 61508 [6], a well-respected control reliability standard used in the process industries. [5] is not well suited to applications involving hydraulic or pneumatic elements.
The orange arrow in Figure 5 highlights the fact that the definition in the CSA standards results in a more reliable system than the ANSI/RIA definition because the CSA definition requires TWO (2) separate physical switches on the guard to meet the requirement, while the ANSI/RIA definition only requires redundant circuits, but makes no requirement for redundant devices. Note that the arrow representing the ANSI/RIA Control reliability category falls below the ISO Category 3 arrow due to this same detail in the definition.
Note that Figure 5 does not address the question of PL’s or SIL’s and how they relate to each other. That is a topic for another article!
The North American architectures deal primarily with electrical or fluid-power controls, while the EU system can accommodate electrical, fluid-power and mechanical systems.
From the single-channel-monitored or Category 2 level up, the systems are required to have testing built-in, enabling the detection of failures in the system. The level of fault tolerance increases as the category increases.
Interlocking devices
Interlocking devices are the components that are used to create the interlock between the safeguarding device and the machine’s power and control systems. Interlocking systems can be purely mechanical, purely electrical or a combination of these.
Photo 1 — Roller Cam Switch
Most machinery has an electrical/electronic control system, and these systems are the most common way that machine hazards are controlled. Switches and sensors connected to these systems are the most common types of interlocking devices.
Interlocking devices can be something as simple as a micro-switch or a reed switch, or as complex as a non-contact sensor with an electromagnetic locking device.
Images of interlocking devices used in this article are representative of some of the types and manufacturers available, but should not be taken as an endorsement of any particular make or type of device. There are lots of manufacturers and unique models that can fit any given application, and most manufacturers have similar devices available.
Photo 1 shows a safety-rated, direct-drive roller cam switch used as half of a complementary switch arrangement on a gate interlock. The integrator failed to cover the switches to prevent intentional defeat in this application.
Photo 2 — Micro-Switch used for interlocking
Photo 2 shows a ‘microswitch’ used for interlocking a machine cover panel that is normally held in place with fasteners, and so is a ‘fixed guard’ as long as the fasteners require a tool to remove. Fixed guards do not require interlocks under most circumstances. Some product family standards do require interlocks on fixed guards due to the nature of the hazards involved.
Microswitches are not safety-rated and are not recommended for use in this application. They are easily defeated and tend to fail to danger in my experience.
Requirements for interlocking devices are published in a number of standards, but the key ones for industrial machinery are ISO 14119 [7], [2], and ANSIB11.0 [8]. These standards define the electrical and mechanical requirements, and in some cases the testing requirements, that devices intended for safety applications must meet before they can be classified as safety components. Download standards
These devices are also integral to the reliability of the control systems into which they are integrated. Interlock devices, on their own, cannot meet a reliability rating above ISO 13849–1 Category 1, or CSAZ432-04 Single Channel. To understand this, consider that the definitions for Category 2, 3 and 4 all require the ability for the system to monitor and detect failures, and in Categories 3 & 4, to prevent the loss of the safety function. Similar requirements exist in CSA and ANSI’s “single-channel-monitored,” and “control-reliable” categories. Unless the interlock device has a monitoring system integrated into the device, these categories cannot be achieved.
Guard Locking
Interlocking devices are often used in conjunction with guard locking. There are a few reasons why a designer might want to lock a guard closed, but the most common one is a lack of safety distance. In some cases the guard may be locked closed to protect the process rather than the operator, or for other reasons.
Photo 4 — Interlocking Device with Guard Locking
Safety distance is the distance between the opening covered by the movable guard and the hazard. The minimum distance is determined using the safety distance calculations given in [2] and ISO 13855 [9]. This calculation uses a ‘hand-speed constant’, called K, to represent the theoretical speed that the average person can achieve when extending their hand straight forward when standing in front of the opening. In North America, K is usually 63 inches/second, or 1600 mm/s. Internationally and in the EU, there are two speeds, 2000 mm/s, used for an approach perpendicular to the plane of the guard, or 1600 mm/second for approaches at 45 degrees or less [9]. 2000 mm/s is used with movable guards, and is approximately equivalent to 79 inches/second. Using the International approach, if the value of Ds is greater than 500 mm when calculated using K = 2 000, then [9] permits the calculation to be done using K = 1 600 instead.
Using the stopping time of the machinery and K, the minimum safety distance can be calculated.
Eq. 1 Ds = K x Ts
Using Equation 1 [2], assume you have a machine that takes 250 ms to stop when the interlock is opened. Inserting the values into the equation gives you a minimum safety distance of:
Example 1 Ds = 63 in/s x 0.250 s = 15.75 inches
Example 2 Ds = 2000 mm/s x 0.250 s = 500 mm
As you can see, the International value of K gives a more conservative value, since 500 mm is approximately 20 inches.
Note that I have not included the ‘Penetration Factor’, Dpf in this calculation. This factor is used with presence sensing safeguarding devices like light curtains, fences, mats, two-hand controls, etc. This factor is not applicable to movable, interlocked guards.
Also important to consider is the amount the guard can be opened before activating the interlock. This will depend on many factors, but for simplicity, consider a hinged gate on an access point. If the guard uses two hinge-pin style switches, you may be able to open the gate a few inches before the switches rotate enough to detect the opening of the guard. In order to determine the opening size, you would slowly open the gate just to the point where the interlock is tripped, and then measure the width of the opening. Using the tables found in [2], [3], [10], or ISO 13857 [12], you can then determine how far the guard must be from the hazards behind it. If that distance is greater than what is available, you could remove one hinge-pin switch, and replace it with another type mounted on the post opposite the hinges. This could be a keyed interlock like Photo 3, or a non-contact device like Photo 5. This would reduce the opening width at the point of detection, and thereby reduce the safety distance behind the guard. But what if that is still not good enough?
If you have to install the guard closer to the hazard than the minimum safety distance, locking the guard closed and monitoring the stand-still of the machine allows you to ignore the safety distance requirement because the guard cannot be opened until the machinery is at a standstill, or in a safe state.
Guard locking devices can be mechanical, electromagnetic, or any other type that prevents the guard from opening. The guard locking device is only released when the machine has been made safe.
There are many types of safety-rated stand-still monitoring devices available now, and many variable-frequency drives and servo drive systems are available with safety-rated stand-still monitoring.
Environment, failure modes and fault exclusion
Every device has failure modes. The correct selection of the device starts with understanding the physical environment to which the device will be exposed. This means understanding the temperature, humidity, dust/abrasives exposure, chemical exposures, and mechanical shock and vibration exposures in the application. Selecting a delicate reed switch for use in a high-vibration, high-shock environment is a recipe for failure, just as selecting a mechanical switch in a dusty, damp, corrosive environment will also lead to premature failure.
Photo 5 — JOKABEDEN Interlock System
Interlock device manufacturers have a variety of non-contact interlocking devices available today that use coded RF signals or RFID technologies to ensure that the interlock cannot be defeated by simple measures, like taping a magnet to a reed switch. The Jokab EDEN system is one example of a system like this that also exhibits IP65 level resistance to moisture and dust. Note that systems like this include a safety monitoring device and the system as a whole can meet Control Reliable or Category 3 / 4 architectural requirements when a simple interlock switch could not.
The device standards do provide some guidance in making these selections, but it’s pretty general.
Fault Exclusion
Fault exclusion is another key concept that needs to be understood. Fault exclusion holds that failure modes that have an exceedingly low probability of occurring during the lifetime of the product can be excluded from consideration. This can apply to electrical or mechanical failures. Here’s the catch: Fault exclusion is not permitted under any North American standards at the moment. Designs based on the North American control reliability standards cannot take advantage of fault exclusions. Designs based on the International and EU standards can use fault exclusion, but be aware that significant documentation supporting the exclusion of each fault is needed.
Defeat resistance
Figure 6 — Preventing Defeat
The North American standards require that the devices chosen for safety-related interlocks be defeat-resistant, meaning they cannot be easily fooled with a cable-tie, a scrap of metal or a piece of tape.
Figure 6 [7, Fig. 10] shows a key-operated switch, like the Schmersal AZ15, installed with a cover that is intended to further guard against defeat. The key, sometimes called a ‘tongue’, used with the switch prevents defeat using a flat piece of metal or a knife blade. The cover prevents direct access to the interlocking device itself. Use of tamper-resistant hardware will further reduce the likelihood that someone can remove the key and insert it into the switch, bypassing the guard.
The International and EU standards do not require the devices to be inherently defeat resistant, which means that you can use “safety-rated” limit switches with roller-cam actuators, for example. However, as a designer, you are required to consider all reasonably foreseeable failure modes, and that includes intentional defeat. If the interlocking devices are easily accessible, then you must select defeat-resistant devices and install them with tamper-resistant hardware to cover these failure modes.
Photo 6 shows one type of tamper resistant fasteners made by Inner-Tite [13]. Photo 7 shows fasteners with uniquely keyed key ways made by Bryce Fastener [14], and Photo 8 shows more traditional tamperproof fasteners from the Tamperproof Screw Company [15]. Using fasteners like these will result in the highest level of security in a threaded fastener. There are many different designs available from a wide variety of manufacturers.
Almost any interlocking device can be bypassed by a knowledgeable person using wire and the right tools. This type of defeat is not generally considered, as the degree of knowledge required is greater than that possessed by “normal” users.
How to select the right device
When selecting an interlocking device, start by looking at the environment in which the device will be located. Is it dry? Is it wet (i.e., with cutting fluid, oil, water, etc.)? Is it abrasive (dusty, sandy, chips, etc.)? Is it indoors or outdoors and subject to wide temperature variations?
Is there a product standard that defines the type of interlock you are designing? An example of this is the interlock types in ANSIB151.1 [4] for plastic injection moulding machines. There may be restrictions on the type of devices that are suitable based on the requirements in the standard.
Consider integration requirements with the controls. Is the interlock purely mechanical? Is it integrated with the electrical system? Do you require guard locking capability? Do you require defeat resistance? What about device monitoring or annunciation?
Once you can answer these questions, you will have narrowed down your selections considerably. The final question is: What brand is preferred? Go to your preferred supplier’s catalogues and make a selection that fits with the answers to the previous questions.
The next stage is to integrate the device(s) into the controls, using whichever control reliability standard you need to meet. That is the subject for a series of articles!
Original content here is published under these license terms:
X
License Type:
Non-commercial, Attribution, Share Alike
License Summary:
You may copy this content, create derivative work from it, and re-publish it for non-commercial purposes, provided you include an overt attribution to the author(s) and the re-publication must itself be under the terms of this license or similar.
Five things that most machine builders fail to do. With a Sixth Bonus failure!
The Top Five errors I see machine builders make on a depressingly regular basis:
1) Poor or Absent Risk Assessment
Risk assessments are fundamental to safe machine design and liability limitation, and are required by law in the EU. They are a included in all of the modern North American machinery safety standards as well.
Machine builders frequently have trouble with the risk assessment process, usually because they fail to understand the process or because they fail to devote enough resources to getting it done.
If risk assessment is built into your design process, it becomes the norm for how you do business. Time and resources will automatically be devoted to the process, and since it’s part of how you do things it will become relatively painless. Where people go wrong is in making it a ‘big deal’ one-time event. Also getting it done early in the design process and iterated as the design progresses means that you have time to react to the findings, and you can complete any necessary changes at more cost-effective points in the design and build process. The worst time to do risk assessment is at the point where the machine is on the shop floor ready to start production. Costs for modification are then exponentially higher than during design and construction.
Poorly done, risk assessments become a liability defense lawyer’s worst nightmare and a plaintiff’s lawyer’s dream. Shortchanging the risk assessment process ensures that you will lose, either now or later.
Fight this problem by:learning how to conduct a risk assessment, using quality risk assessment software tools, and building risk assessment into your standard design process/practice in your organization.
2) Failure to be Aware of Regulations & Use Design Standards
This one is a mystery to me.
Every market has product safety legislation, supported by regulations. Granted, the scope and quality of these regulations varies widely, but if you want to sell a product in a market, it doesn’t take a lot of effort to find out what regulations may apply.
Design standards have been in existence for a long time. Most purchase orders, at least for custom machinery, contain lists of standards that the equipment is required to meet at Factory Acceptance Testing (FAT).
Why machine builders fail to grasp that using these standards can actually give them a competitive edge, as well as helping them to meet regulatory requirements, I don’t know. If you do, please either comment on this story or send me an email. I’d love to hear your thoughts on this!
Fight this problem by: Doing some research. Understand the market environment in which you sell your products. If you aren’t sure how to do this, use a consultant to assist you. Buy the standards, especially if your client calls them out in their specifications. Read and apply them to your designs.
Fixed guarding design is driven by at least two factors, a) preventing people from accessing hazards, and b) allowing raw materials and products into and out of the machinery.
Designers frequently go wrong by selecting a fixed guard where a movable guard is necessary to permit frequent access (say more than once per shift). This is sometimes done in an effort to avoid having to add interlocks to the control systems. Frequently the guard will be removed and replaced a couple of times, and then the screws will be left off, and eventually the guard itself will be left off, leaving the user with an unguarded hazard.
The other common fault with fixed guards relates to the second factor I mentioned — getting raw materials and products in an out of the machine. There are limits on the size of openings that can be left in guards, dependent on the distance from the opening to the hazards behind the guard and the size of the opening itself. Often the only factor considered is the size of the item that needs to enter or exit the machinery.
Both of these faults often occur because the guarding is not designed, but is allowed to happen during machine build. The size and shape of the guards is then often driven by convenience in fabrication rather than by thoughtful design and application of the minimum code requirements.
Fight this problem by: Designing the guards on your product rather than allowing them to happen, based on the outcome of the risk assessment and the limits defined in the standards. Tables for guard openings and safety distances are available in North American, EU and International standards.
4) Movable Guard Interlocking
Movable guards themselves are usually reasonably well done. Note that I am not talking about self adjusting guards like those found on a table saw for instance. I am talking about guard doors, gates, and covers.
The problem usually comes with the design of the interlock that is required to go with the movable guard. The first part of the problem goes back to my #1 mistake: Risk Assessment. No risk assessment means that you cannot reasonably hope to get the reliability requirements right for the interlocking system. Next, there are small but significant differences in how the Canadian, US, EU and International standards handle control reliability, and the biggest differences occur in the higher reliability classifications.
In the USA, the standards speak of control reliable circuits (see ANSIRIAR15.06–1999, 4.5.5). This requirement is written in such a way that a single interlocking device, installed with dual channel electrical circuits and suitably selected components will meet the requirements. No single ELECTRICAL component failure will lead to the loss of the safety function, but a single mechanical fault could.
In Canada, the machinery and robotics standards speak of control reliable systems (see CSAZ432, 8.2.5), not circuits as in the US standards. This requirement is written in such a way that TWO electromechanical interlocking devices are required, one in each electrical channel of the interlocking system. This permits the system to detect mechanical failures such as broken or missing keys, and if different types of interlocking devices are chosen, may also permit detection of efforts to bypass the interlock. Most single mechanical faults and electrical faults will be detected.
In the EU and Internationally, control reliability is much more highly developed. Here, the application of ISO 13849, IEC 62061 or IEC 61508 have taken control reliability to higher levels than anything seen to date in North America. Under these standards, the required Performance Level (PLr) or Safety Integrity Level (SIL) must be known. This is based on the outcome of, you guessed it, the Risk Assessment. No risk assessment, or a poor risk assessment, dooms the designer to likely failure. Significant skill is required to handle the analysis and design of safety related parts of control systems under these standards.
Fight this problem by: Getting the training you need to properly apply these standards and then using them in your designs.
5) Safety Distances
Safety distances crop up anywhere you don’t have a physical barrier keeping the user away from the hazard. Whether its an opening in a fixed guard, a movable guard like a guard door or gate, or a presence-sensing safeguarding device like a light curtain, safety distances have to be considered in the machine design. The easier it is for the user to come in contact with the hazard, the more safety distance matters.
Stopping performance of the machinery must be tested to validate the safety distances used. Failure to get the safety distance right means that your guards will give your users a false sense of security, and will expose them to injury. This will also expose your company to significant liability when someone gets hurt, because they will. Its only a matter of time.
Fight this problem by: Testing safeguarding devices.
6) Validation
OK, so this list should really be SIX things. Just consider this to be a bonus for reading this far!
Designs, and particularly safety critical designs, must be tested. Let me say it again:
Safety Critical Designs MUST Be Tested.
Whatever theory you are working under, whether it’s North American, European, International or something else, you cannot afford missing the validation step. Without validation you have no evidence that your system worked at all, let alone if it worked correctly.
Fight this problem by:TESTINGYOURDESIGNS.
A wise man once said: “If you think safety is expensive, try having an accident.” The gentleman was involved in investigating the crash of a Sikorsky S-92 helicopter off the coast of Newfoundland. 17 people died as a result of the failure of two titanium studs that held an oil filter onto the main gearbox, and the fact that the helicopter failed the ‘1/2-hour gearbox run-dry test’ that is required for all new helicopter designs. This was a clear case of failure in the risk assessment process complicated by failure in the test process.
Original content here is published under these license terms:
X
License Type:
Non-commercial, Attribution, Share Alike
License Summary:
You may copy this content, create derivative work from it, and re-publish it for non-commercial purposes, provided you include an overt attribution to the author(s) and the re-publication must itself be under the terms of this license or similar.
