Category Archives: North American Robotics

Interlock Architectures Pt. 6 — Comparing North American and International Systems

Posted by on October 3, 2011 Comments Off
industrial Control Console
This entry is part 6 of 8 in the series Circuit Architectures Explored

I’ve now writ­ten six posts, includ­ing this one, on the topic of cir­cuit archi­tec­tures for the safety–related parts of con­trol sys­tems. In this post, we’ll com­pare the International and North American sys­tems. This com­par­i­son is not intended to draw con­clu­sions about which is “bet­ter”, but rather to com­pare and con­trast the two sys­tems so that design­ers can clearly see where the over­laps and the gaps in the sys­tems exist.

Since we’ve spent a lot of time talk­ing about ISO 13849–1 [1] in the pre­vi­ous five posts in this series, I think we should begin there by look­ing at Table 10 from the standard.

Table 10 — Summary of require­ments for cat­e­gories
Category Summary of requirements System behaviour Principle used
to achieve
safety		 MTTFd
of each
chan­nel		 DCavg CCF
B
(see
6.2.3)		SRP/​CS and/​or their pro­tec­tive equip­ment, as well as their com­po­nents, shall be designed, con­structed, selected, assem­bled and com­bined in accor­dance with rel­e­vant stan­dards so that they can with­stand the expected influence.

Basic safety prin­ci­ples shall be used.

The occur­rence of a fault can lead to the loss of the safety function.Mainly char­ac­ter­ized by selec­tion of componentsLow to mediumNoneNot rel­e­vant
1
(see
6.2.4)		Requirements of B shall apply. Well-​​tried com­po­nents and well-​​tried safety prin­ci­ples shall be used.The occur­rence of a fault can lead to the loss of the safety func­tion but the prob­a­bil­ity of occur­rence is lower than for cat­e­gory B.Mainly char­ac­ter­ized by selec­tion of componentsHighNoneNot rel­e­vant
2
(see
6.2.5)		Requirements of B and the use of well-​​tried safety prin­ci­ples shall apply. Safety func­tion shall be checked at suit­able inter­vals by the machine con­trol system.The occur­rence of a fault can lead to the loss of the safety func­tion between the checks. The loss of safety func­tion is detected by the check.Mainly char­ac­ter­ized by structureLow to highLow to mediumSee Annex F
3
(see
6.2.6)		Requirements of B and the use of well-​​tried safety prin­ci­ples shall apply.

Safety-​​related parts shall be designed, so that

—a sin­gle fault in any of these parts does not lead to the loss of the safety func­tion, and

—when­ever rea­son­ably prac­ti­ca­ble, the sin­gle fault is detected.

When a sin­gle fault occurs, the safety func­tion is always performed.

Some, but not all, faults will be detected.

Accumulation of unde­tected faults can lead to the loss of the safety function.

 Mainly
char­ac­ter­ized
by struc­ture		Low to
high		Low to
medium		 See
Annex F
 4
(see
6.2.7)

Requirements of B and the use of well-​​tried safety prin­ci­ples shall apply. Safety-​​related parts shall be designed, so that
—a sin­gle fault in any of these parts does not lead to a loss of the safety func­tion, and

—the sin­gle fault is detected at or before the next demand upon the safety func­tion, but that if this detec­tion is not pos­si­ble, an accu­mu­la­tion of unde­tected faults shall not lead to the loss of the safety function.

 

When a sin­gle fault occurs the safety func­tion is always per­formed. Detection of accu­mu­lated faults reduces the prob­a­bil­ity of the loss of the safety func­tion (high DC). The faults will be detected in time to pre­vent the loss of the safety function. Mainly char­ac­ter­ized by structure High High includ­ing accu­mu­la­tion of faults See Annex F
NOTE For full require­ments, see Clause 6.

Table 10 sum­ma­rizes all the key require­ments for the five cat­e­gories of archi­tec­ture, giv­ing the fun­da­men­tal mech­a­nism for achiev­ing safety, the required MTTFd, DC and CCF. Note that fault exclu­sion can be used in Categories 3 and 4. There is no sim­i­lar table avail­able for CSA Z432 [2] or RIA R 15.06 [3], so I have con­structed one fol­low­ing a sim­i­lar for­mat to Table 10.

Summary of require­ments for CSA Z432 /​ Z434 and RIA R15.06
 CSA Z432-​​04 /​ Z434-​​03RIA R15.06 1999
Category Summary of requirements System behav­iour Principle used
to achieve
safety		Summary of requirements
AllSafety con­trol sys­tems (elec­tric, hydraulic, pneu­matic) shall meet one of the per­for­mance cri­te­ria listed in Clauses 4.5.2 to 4.5.5.

Safety cir­cuits (elec­tric, hydraulic, pneu­matic) shall meet one of the per­for­mance cri­te­ria listed in 4.5.1 through 4.5.4.2

2 These per­for­mance cri­te­ria are not to be con­fused with the European cat­e­gories B to 3 as described in ISO/​IEC DIS 13849–1, Safety of machin­ery – Safety-​​related parts of con­trol sys­tems – Part 1: General prin­ci­ples for design (in cor­re­la­tion with EN 954–1.) They are dif­fer­ent. The com­mit­tee believes that the cri­te­ria in 4.5.1–4.5.4 exceed the cri­te­ria of B — 3 respec­tively, and fur­ther believe the reverse is not true.

SIMPLESimple safety con­trol sys­temsshall be designed and con­structed using accepted sin­gle chan­nel circuitry.

Such sys­tems may be programmable.

Note: This type of sys­tem should be used for sig­nalling and annun­ci­a­tion pur­poses only.

The occur­rence of a fault can lead to the loss of the safety function. Mainly char­ac­ter­ized by com­po­nent selection.Simple safety cir­cuits shall be designed and con­structed using accepted sin­gle chan­nel
cir­cuitry, and may be programmable.
SINGLE
CHANNEL		Single chan­nel safety con­trol sys­tems shall

a) be hard­ware based or com­ply with Clause 6.5;

b) include com­po­nents that should be safety rated; and

c) be used in accor­dance with man­u­fac­tur­ers’ rec­om­men­da­tions and proven cir­cuit designs (e.g., a sin­gle chan­nel electro­mechan­i­cal pos­i­tive break device that sig­nals a stop in a de-​​energized state).

Note: In this type of sys­tem a sin­gle com­po­nent fail­ure can lead to the loss of the safety function.

The occur­rence of a fault can lead to the loss of the safety function. Mainly char­ac­ter­ized by com­po­nent selection.Single chan­nel safety cir­cuits shall be hard­ware based or com­ply with 6.4, include com­po­nents
which should be safety rated, be used in com­pli­ance with man­u­fac­tur­ers’ rec­om­men­da­tions
and proven cir­cuit designs (e.g. a sin­gle chan­nel electro-​​mechanical pos­i­tive break device which sig­nals a stop in a de-​​energized state.) 

SINGLE CHANNEL
WITH
MONITORING

Single chan­nel safety con­trol sys­tems with mon­i­tor­ing shall include the require­ments for sin­gle chan­nel,
be safety rated, and be checked (prefer­ably auto­mat­i­cally) at suit­able inter­vals in accor­dance with the following:

a) The check of the safety function(s) shall be performed

i) at machine start-​​up; and

ii) peri­od­i­cally dur­ing oper­a­tion (prefer­ably at each change in state).

b) The check shall either

i) allow oper­a­tion if no faults have been detected; or

ii) gen­er­ate a stop if a fault is detected. A warn­ing shall be pro­vided if a haz­ard remains after ces­sa­tion of motion.

c) The check itself shall not cause a haz­ardous sit­u­a­tion.

d) Following detec­tion of a fault, a safe state shall be main­tained until the fault is cleared.

Note: In this type of cir­cuit a sin­gle com­po­nent fail­ure can also lead to the loss of the safety function.

The occur­rence of a fault can lead to the loss of the safety function.Characterized by both com­po­nent selec­tion and structure.Single chan­nel with mon­i­tor­ing safety cir­cuits shall include the require­ments for sin­gle chan­nel,
shall be safety rated, and shall be checked (prefer­ably auto­mat­i­cally) at suit­able intervals.

a) The check of the safety function(s) shall be performed

1) at machine start-​​up, and

2) peri­od­i­cally dur­ing operation;

b) The check shall either:

1) allow oper­a­tion if no faults have been detected, or

2) gen­er­ate a stop sig­nal if a fault is detected.
A warn­ing shall be pro­vided if a haz­ard remains after ces­sa­tion of motion;

c) The check itself shall not cause a haz­ardous situation;

d) Following detec­tion of a fault, a safe state shall be main­tained until the fault is cleared.

CONTROL RELIABLEControl reli­able safety con­trol sys­tems shall be dual chan­nel with mon­i­tor­ing and shall be designed,
con­structed, and applied such that any sin­gle com­po­nent fail­ure, includ­ing mon­i­tor­ing, shall not pre­vent
the stop­ping action of the robot.
These safety con­trol sys­tems shall be hard­ware based or in accor­dance with Clause 6.5. The sys­tems shall include auto­matic mon­i­tor­ing at the sys­tem level con­form­ing to the following:

a) The mon­i­tor­ing shall gen­er­ate a stop if a fault is detected. A warn­ing shall be pro­vided if a haz­ard remains after ces­sa­tion of motion.

b) Following detec­tion of a fault, a safe state shall be main­tained until the fault is cleared.

c) Common mode fail­ures shall be taken into account when the prob­a­bil­ity of such a fail­ure occur­ring is
sig­nif­i­cant.

d) The sin­gle fault should be detected at time of fail­ure. If not prac­ti­ca­ble, the fail­ure shall be detected
at the next demand upon the safety function.

e) These safety con­trol sys­tems shall be inde­pen­dent of the nor­mal pro­gram con­trol (func­tion) and shall be designed to be not eas­ily defeated or not eas­ily bypassed with­out detection.

When a sin­gle fault occurs, the safety func­tion is always performed.

Some, but not all, faults will be detected.

Accumulation of unde­tected faults can lead to the loss of the safety function.

Characterized pri­mar­ily by structure.Control reli­able safety cir­cuitry shall be designed, con­structed and applied such that any sin­gle com­po­nent fail­ure shall not pre­vent the stop­ping action of the robot.

These cir­cuits shall be hard­ware based or com­ply with 6.4, and include auto­matic mon­i­tor­ing at the sys­tem level.

a) The mon­i­tor­ing shall gen­er­ate a stop sig­nal if a fault is detected. A warn­ing shall be pro­vided if a haz­ard remains after ces­sa­tion of motion;

b) Following detec­tion of a fault, a safe state shall be main­tained until the fault is cleared.

c) Common mode fail­ures shall be taken into account when the prob­a­bil­ity of such a fail­ure occur­ring is significant.

d) The sin­gle fault should be detected at time of fail­ure. If not prac­ti­ca­ble, the fail­ure shall be detected at the next demand upon the safety function.

CSA Z434 vs. RIA R15.06

Before we dig into the com­par­i­son between North America and the International stan­dards, we need to look at the dif­fer­ences between CSA and ANSI/​RIA. There are some sub­tle dif­fer­ences here that can trip you up and cost sig­nif­i­cant money to cor­rect after the fact. The fol­low­ing state­ments are based on my per­sonal expe­ri­ence and on dis­cus­sions that I have had with peo­ple on both the CSA and RIA tech­ni­cal com­mit­tees tasked with writ­ing these stan­dards. One more note — ANSI RIA R15.06 has been revised and ALL OF SECTION 4 has been replaced with ANSI/​RIA/​ISO 10218–1 [7]. This is very sig­nif­i­cant, but we need to deal with this old dis­cus­sion first.

Systems vs. Circuits

The CSA stan­dard uses the term “con­trol system(s)” through­out the def­i­n­i­tions of the cat­e­gories, while the ANSI/​RIA stan­dard uses the term “circuit(s)”. This is really the crux of the dis­cus­sion between these two stan­dards. While the dif­fer­ence between the terms may seem insignif­i­cant at first, you need to under­stand the back­ground to get the difference.

The CSA term requires two sep­a­rate sens­ing devices on the gate or other guard, just as the Category 3 and 4 def­i­n­i­tions do, and for the same rea­son. The CSA com­mit­tee felt that it was impor­tant to be able to detect all sin­gle faults, includ­ing mechan­i­cal ones. Also, the use of two inter­lock­ing devices on the guard makes it more dif­fi­cult to bypass the interlock.

The RIA term requires redun­dant elec­tri­cal con­nec­tions to the inter­lock­ing device, but implic­itly allows for a sin­gle inter­lock­ing device because it only explic­itly refers to “circuits”.

The expla­na­tion I’ve been given for the dis­crep­ancy is rooted in the early days of indus­trial robot­ics. Many early robot cells had NO inter­locks on the guard­ing because the haz­ards related to the robot motion was not well under­stood. There were a num­ber of inci­dents result­ing in fatal­i­ties that drove robot users to begin to seek bet­ter ways to pro­tect work­ers. The RIA R15.06 com­mit­tee decided that inter­locks were needed, but there was a recog­ni­tion that many users would balk at installing expen­sive inter­lock devices, so they com­pro­mised and allowed that ANY kind of inter­lock­ing device was bet­ter than none. This was amended in the 1999 edi­tion to require that com­po­nents be “safety rated”, effec­tively elim­i­nat­ing the use of con­ven­tional prox­im­ity switches and non-​​safety-​​rated limit switches.

The recent revi­sion of ANSI/​RIA R15.06 to include ANSI/​ISO 10218–1 as a replace­ment for Section 4 is sig­nif­i­cant for a cou­ple of rea­sons: 1) It now means that the robot itself need only meet the ISO stan­dard; instead of the ISO and the RIA stan­dards; and 2) It brings in ISO 13849–1 def­i­n­i­tions of reli­a­bil­ity cat­e­gories. This means that the US has now offi­cially dropped the “SIMPLE, SINGLE-​​CHANNEL,” etc. def­i­n­i­tions and now uses “Category B, 1, etc.” However, they have only adopted the Edition 1 ver­sion of the stan­dard, so none of the PL, MTTFd, etc. cal­cu­la­tions have been adopted. This means that the RIA stan­dard is now har­mo­nized to the 1995 edi­tion of EN 954–1. These updates to the 2006 edi­tion may come in sub­se­quent edi­tions of R15.06.

CSA has cho­sen to reaf­firm the 2003 edi­tion of CSA Z434, so the Canadian National Standard con­tin­ues to refer to the old definitions.

North America vs International Standards

In the descrip­tion of single-​​channel sys­tems /​ cir­cuits under the North American stan­dards you will notice that par­tic­u­lar atten­tion is paid to includ­ing descrip­tions of the use of “proven designs” and “positive-​​break devices”. What the TC’s were refer­ring to are the same “well-​​tried safety prin­ci­ples” and “well-​​tried com­po­nents” as referred to in the International stan­dards, only with less descrip­tion of what those might be. The only major addi­tion to the def­i­n­i­tions is the rec­om­men­da­tion to use “safety-​​rated devices”, which is not included in the International stan­dard. (N.B. The use of the word “should” in the def­i­n­i­tions should be under­stood as a strong rec­om­men­da­tion, but not nec­es­sar­ily a manda­tory require­ment.) Under EN 954–1 [4] and EN 1088 [5] (in the ref­er­enced edi­tions, in any case) it was pos­si­ble to use stan­dard limit switches arranged in a redun­dant man­ner and acti­vated using com­bined pos­i­tive and non-​​positive-​​mode acti­va­tion. In later edi­tions this changed, and there is now a pref­er­ence for devices intended for use in safety applications.

Also worth not­ing is that there is NO allowance for fault exclu­sion under the CSA stan­dard or the 1999 edi­tion of the ANSI standard.

As far as the RIA committee’s asser­tion that their def­i­n­i­tions are not equiv­a­lent to the International stan­dard, and may be supe­rior, I think that there are too may miss­ing qual­i­ties in the ANSI stan­dard for that to stand. In any case, this is now moot, since ANSI has adopted EN ISO 13849–1:2006 as a ref­er­ence to EN ISO 10218–1 [6], replac­ing Section 4 of ANSI/​RIA R15.06–1999.

References

[1] “Safety of machin­ery — Safety-​​related parts of con­trol sys­tems — Part 1: General prin­ci­ples for design”, ISO 13849–1, Edition 2, International Organization for Standardization (ISO), Geneva, 2006.

[2] “Safeguarding of machin­ery”, CSA Z432, Canadian Standards Association (CSA), Toronto, 2004.

[3] “American National Standard for Industrial Robots and Robot Systems — Safety Requirements”, ANSI/​RIA R15.06, American National Standards Institute, Inc. (ANSI), Ann Arbor, 1999.

[4] “Safety of machin­ery — Safety related parts of con­trol sys­tems — Part 1. General prin­ci­ples for design”, EN 954–1, European Committee for Standardization (CEN), Geneva, 1996.

[5] “Safety of machin­ery — Interlocking devices asso­ci­ated with guards — Principles for design and selec­tion”, EN 1088, CEN, Geneva, 1995.

[6] “Robots and robotic devices — Safety require­ments for indus­trial robots — Part 1: Robots”, European Committee for Standardization (CEN), Geneva, 2011.

[7] “Robots for Industrial Environment — Safety Requirements — Part 1 — Robot”, ANSI/​RIA/​ISO 10218–1, American National Standards Institute, Inc. (ANSI), Ann Arbor, 2007.

Copyright secured by Digiprove © 2011
Acknowledgements: See ref­er­ences listed at end of article.
Some Rights Reserved

CSA Z1002 Risk Assessment Standard — 60 Day Public Review

Posted by on January 17, 2011 1 comment

60 Day Public Review Starts Today

CSA (the Canadian Standards Association) has been work­ing on a new risk assess­ment stan­dard called Z1002 — Occupational Health and Safety Hazard Identification and Elimination and Risk Assessment and Control, since the fall of 2007.

This risk assess­ment stan­dard is the first of its kind glob­ally and will place the CSA Z100x series of Occupational Health and Safety Management stan­dards at the fore­front glob­ally when it is pub­lished this year.

This stan­dard is des­tined to become a Canadian National Standard and will have influ­ence on all the stan­dards in the CSA Catalog that include risk assess­ment (CSA Z432, CSA Z434, CSA Z460, CSA Z462, etc.)

As of today, the stan­dard is avail­able for pub­lic review. This means that you can down­load a draft copy of the stan­dard for free and have a look at the con­tent of the doc­u­ment. It’s also hoped that you will pro­vide com­ments on the doc­u­ment that will go back to the tech­ni­cal com­mit­tee at the end of the Public Review phase on 17-​​Apr-​​11 17-​​Mar-​​11. Every com­ment will be reviewed by the Technical Committee. You have the chance to make change in the doc­u­ment before it is pub­lished later this year.

Public Review is only open for 60 days, so act quickly! On 17-​​Apr-​​11 17-​​Mar-​​11 review will close per­ma­nently for this edi­tion of the document!

Get The Draft

If you are inter­ested in review­ing and com­ment­ing on the draft, please visit:

https://​review​.csa​.ca/​o​p​r​/​o​p​r​_​l​i​s​t​.​asp

You can down­load the draft and you can link to the com­ments page for the doc­u­ment to pro­vide your thoughts on it.

More Information

Need more infor­ma­tion on this stan­dard? Please con­tact the CSA Project Manager:
Elizabeth Rankin  (eliz­a­bethdotrankinatcsadotca)  ,
ph: (416) 747‑2011

Five things most machine builders do incorrectly

Posted by on August 6, 2010 10 comments

The Top Five errors I see machine builders make on a depress­ingly reg­u­lar basis:

1) Poor or Absent Risk Assessment

Risk assess­ments are fun­da­men­tal to safe machine design and lia­bil­ity lim­i­ta­tion, and are required by law in the EU. They are a included in all of the mod­ern North American machin­ery safety stan­dards as well.

Machine builders fre­quently have trou­ble with the risk assess­ment process, usu­ally because they fail to under­stand the process or because they fail to devote enough resources to get­ting it done.

If risk assess­ment is built into your design process, it becomes the norm for how you do busi­ness. Time and resources will auto­mat­i­cally be devoted to the process, and since it’s part of how you do things it will become rel­a­tively pain­less. Where peo­ple go wrong is in mak­ing it a ‘big deal’ one-​​time event. Also get­ting it done early in the design process and iter­ated as the design pro­gresses means that you have time to react to the find­ings, and you can com­plete any nec­es­sary changes at more cost-​​effective points in the design and build process. The worst time to do risk assess­ment is at the point where the machine is on the shop floor ready to start pro­duc­tion. Costs for mod­i­fi­ca­tion are then expo­nen­tially higher than dur­ing design and construction.

Poorly done, risk assess­ments become a lia­bil­ity defense lawyer’s worst night­mare and a plaintiff’s lawyer’s dream. Shortchanging the risk assess­ment process ensures that you will lose, either now or later.

Fight this prob­lem by: learn­ing how to con­duct a risk assess­ment, using qual­ity risk assess­ment soft­ware tools, and build­ing risk assess­ment into your stan­dard design process/​practice in your organization.

2) Failure to be Aware of Regulations & Use Design Standards

This one is a mys­tery to me.

Every mar­ket has prod­uct safety leg­is­la­tion, sup­ported by reg­u­la­tions. Granted, the scope and qual­ity of these reg­u­la­tions varies widely, but if you want to sell a prod­uct in a mar­ket, it doesn’t take a lot of effort to find out what reg­u­la­tions may apply.

Design stan­dards have been in exis­tence for a long time. Most pur­chase orders, at least for cus­tom machin­ery, con­tain lists of stan­dards that the equip­ment is required to meet at Factory Acceptance Testing (FAT).

Why machine builders fail to grasp that using these stan­dards can actu­ally give them a com­pet­i­tive edge, as well as help­ing them to meet reg­u­la­tory require­ments, I don’t know. If you do, please either com­ment on this story or send me an email  (dnixatcom­pli­an­cein­sightdotca)  . I’d love to hear your thoughts on this!

Fight this prob­lem by: Doing some research. Understand the mar­ket envi­ron­ment in which you sell your prod­ucts. If you aren’t sure how to do this, use a con­sul­tant to assist you. Buy the stan­dards, espe­cially if your client calls them out in their spec­i­fi­ca­tions. Read and apply them to your designs.

One great resource for infor­ma­tion on reg­u­la­tory envi­ron­ments and stan­dards appli­ca­tions is the IEEE Product Safety Engineering Society and the EMC-​​PSTC Listserv that they maintain.

3) Fixed Guard Design

Fixed guard­ing design is dri­ven by at least two fac­tors, a) pre­vent­ing peo­ple from access­ing haz­ards, and b) allow­ing raw mate­ri­als and prod­ucts into and out of the machinery.

Designers fre­quently go wrong by select­ing a fixed guard where a mov­able guard is nec­es­sary to per­mit fre­quent access (say more than once per shift). This is some­times done in an effort to avoid hav­ing to add inter­locks to the con­trol sys­tems. Frequently the guard will be removed and replaced a cou­ple of times, and then the screws will be left off, and even­tu­ally the guard itself will be left off, leav­ing the user with an unguarded haz­ard.

The other com­mon fault with fixed guards relates to the sec­ond fac­tor I men­tioned — get­ting raw mate­ri­als and prod­ucts in an out of the machine. There are lim­its on the size of open­ings that can be left in guards, depen­dent on the dis­tance from the open­ing to the haz­ards behind the guard and the size of the open­ing itself. Often the only fac­tor con­sid­ered is the size of the item that needs to enter or exit the machinery.

Both of these faults often occur because the guard­ing is not designed, but is allowed to hap­pen dur­ing machine build. The size and shape of the guards is then often dri­ven by con­ve­nience in fab­ri­ca­tion rather than by thought­ful design and appli­ca­tion of the min­i­mum code requirements.

Fight this prob­lem by: Designing the guards on your prod­uct rather than allow­ing them to hap­pen, based on the out­come of the risk assess­ment and the lim­its defined in the stan­dards. Tables for guard open­ings and safety dis­tances are avail­able in North American, EU and International standards.

4) Movable Guard Interlocking

Movable guards them­selves are usu­ally rea­son­ably well done. Note that I am not talk­ing about self adjust­ing guards like those found on a table saw for instance. I am talk­ing about guard doors, gates, and covers.

The prob­lem usu­ally comes with the design of the inter­lock that is required to go with the mov­able guard. The first part of the prob­lem goes back to my #1 mis­take: Risk Assessment. No risk assess­ment means that you can­not rea­son­ably hope to get the reli­a­bil­ity require­ments right for the inter­lock­ing sys­tem. Next, there are small but sig­nif­i­cant dif­fer­ences in how the Canadian, US, EU and International stan­dards han­dle con­trol reli­a­bil­ity, and the biggest dif­fer­ences occur in the higher reli­a­bil­ity classifications.

In the USA, the stan­dards speak of con­trol reli­able cir­cuits (see ANSI RIA R15.06–1999, 4.5.5). This require­ment is writ­ten in such a way that a sin­gle inter­lock­ing device, installed with dual chan­nel elec­tri­cal cir­cuits and suit­ably selected com­po­nents will meet the require­ments. No sin­gle ELECTRICAL com­po­nent fail­ure will lead to the loss of the safety func­tion, but a sin­gle mechan­i­cal fault could.

In Canada, the machin­ery and robot­ics stan­dards speak of con­trol reli­able sys­tems (see CSA Z432, 8.2.5), not cir­cuits as in the US stan­dards. This require­ment is writ­ten in such a way that TWO electro­mechan­i­cal inter­lock­ing devices are required, one in each elec­tri­cal chan­nel of the inter­lock­ing sys­tem. This per­mits the sys­tem to detect mechan­i­cal fail­ures such as bro­ken or miss­ing keys, and if dif­fer­ent types of inter­lock­ing devices are cho­sen, may also per­mit detec­tion of efforts to bypass the inter­lock. Most sin­gle mechan­i­cal faults and elec­tri­cal faults will be detected.

In the EU and Internationally, con­trol reli­a­bil­ity is much more highly devel­oped. Here, the appli­ca­tion of ISO 13849, IEC 62061 or IEC 61508 have taken con­trol reli­a­bil­ity to higher lev­els than any­thing seen to date in North America. Under these stan­dards, the required Performance Level (PLr) or Safety Integrity Level (SIL) must be known. This is based on the out­come of, you guessed it, the Risk Assessment. No risk assess­ment, or a poor risk assess­ment, dooms the designer to likely fail­ure. Significant skill is required to han­dle the analy­sis and design of safety related parts of con­trol sys­tems under these standards.

Fight this prob­lem by: Getting the train­ing you need to prop­erly apply these stan­dards and then using them in your designs.

5) Safety Distances

Safety dis­tances crop up any­where you don’t have a phys­i­cal bar­rier keep­ing the user away from the haz­ard. Whether its an open­ing in a fixed guard, a mov­able guard like a guard door or gate, or a presence-​​sensing safe­guard­ing device like a light cur­tain, safety dis­tances have to be con­sid­ered in the machine design. The eas­ier it is for the user to come in con­tact with the haz­ard, the more safety dis­tance matters.

Stopping per­for­mance of the machin­ery must be tested to val­i­date the safety dis­tances used. Failure to get the safety dis­tance right means that your guards will give your users a false sense of secu­rity, and will expose them to injury. This will also expose your com­pany to sig­nif­i­cant lia­bil­ity when some­one gets hurt, because they will. Its only a mat­ter of time.

Fight this prob­lem by: Testing safe­guard­ing devices.

6) Validation

OK, so this list should really be SIX things. Just con­sider this to be a bonus for read­ing this far!

Designs, and par­tic­u­larly safety crit­i­cal designs, must be tested. Let me say it again:

Safety Critical Designs MUST Be Tested.

Whatever the­ory you are work­ing under, whether it’s North American, European, International or some­thing else, you can­not afford miss­ing the val­i­da­tion step. Without val­i­da­tion you have no evi­dence that your sys­tem worked at all, let alone if it worked correctly.

Fight this prob­lem by: TESTING YOUR DESIGNS.

A wise man once said: “If you think safety is expen­sive, try hav­ing an acci­dent.” The gen­tle­man was involved in inves­ti­gat­ing the crash of a Sikorsky S-​​92 heli­copter off the coast of Newfoundland. 17 peo­ple died as a result of the fail­ure of two tita­nium studs that held an oil fil­ter onto the main gear­box, and the fact that the heli­copter failed the ‘1/​2-​​hour gear­box run-​​dry test’ that is required for all new heli­copter designs. This was a clear case of fail­ure in the risk assess­ment process com­pli­cated by fail­ure in the test process.

Watch the CBC doc­u­men­tary “Cougar 491″. This is def­i­nitely worth the time. If you are located out­side Canada, you will have a prob­lem with this link. Unfortunately, CBC does not stream it’s video out­side Canada. Sorry.

All original content on these pages is fingerprinted and certified by Digiprove
Performance Optimization WordPress Plugins by W3 EDGE