Interlock Architectures Pt. 6 — Comparing North American and International Systems

Posted by on October 3, 2011 Comments Off
industrial Control Console
This entry is part 6 of 8 in the series Circuit Architectures Explored

I’ve now writ­ten six posts, includ­ing this one, on the topic of cir­cuit archi­tec­tures for the safety–related parts of con­trol sys­tems. In this post, we’ll com­pare the International and North American sys­tems. This com­par­i­son is not intended to draw con­clu­sions about which is “bet­ter”, but rather to com­pare and con­trast the two sys­tems so that design­ers can clearly see where the over­laps and the gaps in the sys­tems exist.

Since we’ve spent a lot of time talk­ing about ISO 13849–1 [1] in the pre­vi­ous five posts in this series, I think we should begin there by look­ing at Table 10 from the standard.

Table 10 — Summary of require­ments for cat­e­gories
Category Summary of requirements System behaviour Principle used
to achieve
safety		 MTTFd
of each
chan­nel		 DCavg CCF
B
(see
6.2.3)		SRP/​CS and/​or their pro­tec­tive equip­ment, as well as their com­po­nents, shall be designed, con­structed, selected, assem­bled and com­bined in accor­dance with rel­e­vant stan­dards so that they can with­stand the expected influence.

Basic safety prin­ci­ples shall be used.

The occur­rence of a fault can lead to the loss of the safety function.Mainly char­ac­ter­ized by selec­tion of componentsLow to mediumNoneNot rel­e­vant
1
(see
6.2.4)		Requirements of B shall apply. Well-​​tried com­po­nents and well-​​tried safety prin­ci­ples shall be used.The occur­rence of a fault can lead to the loss of the safety func­tion but the prob­a­bil­ity of occur­rence is lower than for cat­e­gory B.Mainly char­ac­ter­ized by selec­tion of componentsHighNoneNot rel­e­vant
2
(see
6.2.5)		Requirements of B and the use of well-​​tried safety prin­ci­ples shall apply. Safety func­tion shall be checked at suit­able inter­vals by the machine con­trol system.The occur­rence of a fault can lead to the loss of the safety func­tion between the checks. The loss of safety func­tion is detected by the check.Mainly char­ac­ter­ized by structureLow to highLow to mediumSee Annex F
3
(see
6.2.6)		Requirements of B and the use of well-​​tried safety prin­ci­ples shall apply.

Safety-​​related parts shall be designed, so that

—a sin­gle fault in any of these parts does not lead to the loss of the safety func­tion, and

—when­ever rea­son­ably prac­ti­ca­ble, the sin­gle fault is detected.

When a sin­gle fault occurs, the safety func­tion is always performed.

Some, but not all, faults will be detected.

Accumulation of unde­tected faults can lead to the loss of the safety function.

 Mainly
char­ac­ter­ized
by struc­ture		Low to
high		Low to
medium		 See
Annex F
 4
(see
6.2.7)

Requirements of B and the use of well-​​tried safety prin­ci­ples shall apply. Safety-​​related parts shall be designed, so that
—a sin­gle fault in any of these parts does not lead to a loss of the safety func­tion, and

—the sin­gle fault is detected at or before the next demand upon the safety func­tion, but that if this detec­tion is not pos­si­ble, an accu­mu­la­tion of unde­tected faults shall not lead to the loss of the safety function.

 

When a sin­gle fault occurs the safety func­tion is always per­formed. Detection of accu­mu­lated faults reduces the prob­a­bil­ity of the loss of the safety func­tion (high DC). The faults will be detected in time to pre­vent the loss of the safety function. Mainly char­ac­ter­ized by structure High High includ­ing accu­mu­la­tion of faults See Annex F
NOTE For full require­ments, see Clause 6.

Table 10 sum­ma­rizes all the key require­ments for the five cat­e­gories of archi­tec­ture, giv­ing the fun­da­men­tal mech­a­nism for achiev­ing safety, the required MTTFd, DC and CCF. Note that fault exclu­sion can be used in Categories 3 and 4. There is no sim­i­lar table avail­able for CSA Z432 [2] or RIA R 15.06 [3], so I have con­structed one fol­low­ing a sim­i­lar for­mat to Table 10.

Summary of require­ments for CSA Z432 /​ Z434 and RIA R15.06
 CSA Z432-​​04 /​ Z434-​​03RIA R15.06 1999
Category Summary of requirements System behav­iour Principle used
to achieve
safety		Summary of requirements
AllSafety con­trol sys­tems (elec­tric, hydraulic, pneu­matic) shall meet one of the per­for­mance cri­te­ria listed in Clauses 4.5.2 to 4.5.5.

Safety cir­cuits (elec­tric, hydraulic, pneu­matic) shall meet one of the per­for­mance cri­te­ria listed in 4.5.1 through 4.5.4.2

2 These per­for­mance cri­te­ria are not to be con­fused with the European cat­e­gories B to 3 as described in ISO/​IEC DIS 13849–1, Safety of machin­ery – Safety-​​related parts of con­trol sys­tems – Part 1: General prin­ci­ples for design (in cor­re­la­tion with EN 954–1.) They are dif­fer­ent. The com­mit­tee believes that the cri­te­ria in 4.5.1–4.5.4 exceed the cri­te­ria of B — 3 respec­tively, and fur­ther believe the reverse is not true.

SIMPLESimple safety con­trol sys­temsshall be designed and con­structed using accepted sin­gle chan­nel circuitry.

Such sys­tems may be programmable.

Note: This type of sys­tem should be used for sig­nalling and annun­ci­a­tion pur­poses only.

The occur­rence of a fault can lead to the loss of the safety function. Mainly char­ac­ter­ized by com­po­nent selection.Simple safety cir­cuits shall be designed and con­structed using accepted sin­gle chan­nel
cir­cuitry, and may be programmable.
SINGLE
CHANNEL		Single chan­nel safety con­trol sys­tems shall

a) be hard­ware based or com­ply with Clause 6.5;

b) include com­po­nents that should be safety rated; and

c) be used in accor­dance with man­u­fac­tur­ers’ rec­om­men­da­tions and proven cir­cuit designs (e.g., a sin­gle chan­nel electro­mechan­i­cal pos­i­tive break device that sig­nals a stop in a de-​​energized state).

Note: In this type of sys­tem a sin­gle com­po­nent fail­ure can lead to the loss of the safety function.

The occur­rence of a fault can lead to the loss of the safety function. Mainly char­ac­ter­ized by com­po­nent selection.Single chan­nel safety cir­cuits shall be hard­ware based or com­ply with 6.4, include com­po­nents
which should be safety rated, be used in com­pli­ance with man­u­fac­tur­ers’ rec­om­men­da­tions
and proven cir­cuit designs (e.g. a sin­gle chan­nel electro-​​mechanical pos­i­tive break device which sig­nals a stop in a de-​​energized state.) 

SINGLE CHANNEL
WITH
MONITORING

Single chan­nel safety con­trol sys­tems with mon­i­tor­ing shall include the require­ments for sin­gle chan­nel,
be safety rated, and be checked (prefer­ably auto­mat­i­cally) at suit­able inter­vals in accor­dance with the following:

a) The check of the safety function(s) shall be performed

i) at machine start-​​up; and

ii) peri­od­i­cally dur­ing oper­a­tion (prefer­ably at each change in state).

b) The check shall either

i) allow oper­a­tion if no faults have been detected; or

ii) gen­er­ate a stop if a fault is detected. A warn­ing shall be pro­vided if a haz­ard remains after ces­sa­tion of motion.

c) The check itself shall not cause a haz­ardous sit­u­a­tion.

d) Following detec­tion of a fault, a safe state shall be main­tained until the fault is cleared.

Note: In this type of cir­cuit a sin­gle com­po­nent fail­ure can also lead to the loss of the safety function.

The occur­rence of a fault can lead to the loss of the safety function.Characterized by both com­po­nent selec­tion and structure.Single chan­nel with mon­i­tor­ing safety cir­cuits shall include the require­ments for sin­gle chan­nel,
shall be safety rated, and shall be checked (prefer­ably auto­mat­i­cally) at suit­able intervals.

a) The check of the safety function(s) shall be performed

1) at machine start-​​up, and

2) peri­od­i­cally dur­ing operation;

b) The check shall either:

1) allow oper­a­tion if no faults have been detected, or

2) gen­er­ate a stop sig­nal if a fault is detected.
A warn­ing shall be pro­vided if a haz­ard remains after ces­sa­tion of motion;

c) The check itself shall not cause a haz­ardous situation;

d) Following detec­tion of a fault, a safe state shall be main­tained until the fault is cleared.

CONTROL RELIABLEControl reli­able safety con­trol sys­tems shall be dual chan­nel with mon­i­tor­ing and shall be designed,
con­structed, and applied such that any sin­gle com­po­nent fail­ure, includ­ing mon­i­tor­ing, shall not pre­vent
the stop­ping action of the robot.
These safety con­trol sys­tems shall be hard­ware based or in accor­dance with Clause 6.5. The sys­tems shall include auto­matic mon­i­tor­ing at the sys­tem level con­form­ing to the following:

a) The mon­i­tor­ing shall gen­er­ate a stop if a fault is detected. A warn­ing shall be pro­vided if a haz­ard remains after ces­sa­tion of motion.

b) Following detec­tion of a fault, a safe state shall be main­tained until the fault is cleared.

c) Common mode fail­ures shall be taken into account when the prob­a­bil­ity of such a fail­ure occur­ring is
sig­nif­i­cant.

d) The sin­gle fault should be detected at time of fail­ure. If not prac­ti­ca­ble, the fail­ure shall be detected
at the next demand upon the safety function.

e) These safety con­trol sys­tems shall be inde­pen­dent of the nor­mal pro­gram con­trol (func­tion) and shall be designed to be not eas­ily defeated or not eas­ily bypassed with­out detection.

When a sin­gle fault occurs, the safety func­tion is always performed.

Some, but not all, faults will be detected.

Accumulation of unde­tected faults can lead to the loss of the safety function.

Characterized pri­mar­ily by structure.Control reli­able safety cir­cuitry shall be designed, con­structed and applied such that any sin­gle com­po­nent fail­ure shall not pre­vent the stop­ping action of the robot.

These cir­cuits shall be hard­ware based or com­ply with 6.4, and include auto­matic mon­i­tor­ing at the sys­tem level.

a) The mon­i­tor­ing shall gen­er­ate a stop sig­nal if a fault is detected. A warn­ing shall be pro­vided if a haz­ard remains after ces­sa­tion of motion;

b) Following detec­tion of a fault, a safe state shall be main­tained until the fault is cleared.

c) Common mode fail­ures shall be taken into account when the prob­a­bil­ity of such a fail­ure occur­ring is significant.

d) The sin­gle fault should be detected at time of fail­ure. If not prac­ti­ca­ble, the fail­ure shall be detected at the next demand upon the safety function.

CSA Z434 vs. RIA R15.06

Before we dig into the com­par­i­son between North America and the International stan­dards, we need to look at the dif­fer­ences between CSA and ANSI/​RIA. There are some sub­tle dif­fer­ences here that can trip you up and cost sig­nif­i­cant money to cor­rect after the fact. The fol­low­ing state­ments are based on my per­sonal expe­ri­ence and on dis­cus­sions that I have had with peo­ple on both the CSA and RIA tech­ni­cal com­mit­tees tasked with writ­ing these stan­dards. One more note — ANSI RIA R15.06 has been revised and ALL OF SECTION 4 has been replaced with ANSI/​RIA/​ISO 10218–1 [7]. This is very sig­nif­i­cant, but we need to deal with this old dis­cus­sion first.

Systems vs. Circuits

The CSA stan­dard uses the term “con­trol system(s)” through­out the def­i­n­i­tions of the cat­e­gories, while the ANSI/​RIA stan­dard uses the term “circuit(s)”. This is really the crux of the dis­cus­sion between these two stan­dards. While the dif­fer­ence between the terms may seem insignif­i­cant at first, you need to under­stand the back­ground to get the difference.

The CSA term requires two sep­a­rate sens­ing devices on the gate or other guard, just as the Category 3 and 4 def­i­n­i­tions do, and for the same rea­son. The CSA com­mit­tee felt that it was impor­tant to be able to detect all sin­gle faults, includ­ing mechan­i­cal ones. Also, the use of two inter­lock­ing devices on the guard makes it more dif­fi­cult to bypass the interlock.

The RIA term requires redun­dant elec­tri­cal con­nec­tions to the inter­lock­ing device, but implic­itly allows for a sin­gle inter­lock­ing device because it only explic­itly refers to “circuits”.

The expla­na­tion I’ve been given for the dis­crep­ancy is rooted in the early days of indus­trial robot­ics. Many early robot cells had NO inter­locks on the guard­ing because the haz­ards related to the robot motion was not well under­stood. There were a num­ber of inci­dents result­ing in fatal­i­ties that drove robot users to begin to seek bet­ter ways to pro­tect work­ers. The RIA R15.06 com­mit­tee decided that inter­locks were needed, but there was a recog­ni­tion that many users would balk at installing expen­sive inter­lock devices, so they com­pro­mised and allowed that ANY kind of inter­lock­ing device was bet­ter than none. This was amended in the 1999 edi­tion to require that com­po­nents be “safety rated”, effec­tively elim­i­nat­ing the use of con­ven­tional prox­im­ity switches and non-​​safety-​​rated limit switches.

The recent revi­sion of ANSI/​RIA R15.06 to include ANSI/​ISO 10218–1 as a replace­ment for Section 4 is sig­nif­i­cant for a cou­ple of rea­sons: 1) It now means that the robot itself need only meet the ISO stan­dard; instead of the ISO and the RIA stan­dards; and 2) It brings in ISO 13849–1 def­i­n­i­tions of reli­a­bil­ity cat­e­gories. This means that the US has now offi­cially dropped the “SIMPLE, SINGLE-​​CHANNEL,” etc. def­i­n­i­tions and now uses “Category B, 1, etc.” However, they have only adopted the Edition 1 ver­sion of the stan­dard, so none of the PL, MTTFd, etc. cal­cu­la­tions have been adopted. This means that the RIA stan­dard is now har­mo­nized to the 1995 edi­tion of EN 954–1. These updates to the 2006 edi­tion may come in sub­se­quent edi­tions of R15.06.

CSA has cho­sen to reaf­firm the 2003 edi­tion of CSA Z434, so the Canadian National Standard con­tin­ues to refer to the old definitions.

North America vs International Standards

In the descrip­tion of single-​​channel sys­tems /​ cir­cuits under the North American stan­dards you will notice that par­tic­u­lar atten­tion is paid to includ­ing descrip­tions of the use of “proven designs” and “positive-​​break devices”. What the TC’s were refer­ring to are the same “well-​​tried safety prin­ci­ples” and “well-​​tried com­po­nents” as referred to in the International stan­dards, only with less descrip­tion of what those might be. The only major addi­tion to the def­i­n­i­tions is the rec­om­men­da­tion to use “safety-​​rated devices”, which is not included in the International stan­dard. (N.B. The use of the word “should” in the def­i­n­i­tions should be under­stood as a strong rec­om­men­da­tion, but not nec­es­sar­ily a manda­tory require­ment.) Under EN 954–1 [4] and EN 1088 [5] (in the ref­er­enced edi­tions, in any case) it was pos­si­ble to use stan­dard limit switches arranged in a redun­dant man­ner and acti­vated using com­bined pos­i­tive and non-​​positive-​​mode acti­va­tion. In later edi­tions this changed, and there is now a pref­er­ence for devices intended for use in safety applications.

Also worth not­ing is that there is NO allowance for fault exclu­sion under the CSA stan­dard or the 1999 edi­tion of the ANSI standard.

As far as the RIA committee’s asser­tion that their def­i­n­i­tions are not equiv­a­lent to the International stan­dard, and may be supe­rior, I think that there are too may miss­ing qual­i­ties in the ANSI stan­dard for that to stand. In any case, this is now moot, since ANSI has adopted EN ISO 13849–1:2006 as a ref­er­ence to EN ISO 10218–1 [6], replac­ing Section 4 of ANSI/​RIA R15.06–1999.

References

[1] “Safety of machin­ery — Safety-​​related parts of con­trol sys­tems — Part 1: General prin­ci­ples for design”, ISO 13849–1, Edition 2, International Organization for Standardization (ISO), Geneva, 2006.

[2] “Safeguarding of machin­ery”, CSA Z432, Canadian Standards Association (CSA), Toronto, 2004.

[3] “American National Standard for Industrial Robots and Robot Systems — Safety Requirements”, ANSI/​RIA R15.06, American National Standards Institute, Inc. (ANSI), Ann Arbor, 1999.

[4] “Safety of machin­ery — Safety related parts of con­trol sys­tems — Part 1. General prin­ci­ples for design”, EN 954–1, European Committee for Standardization (CEN), Geneva, 1996.

[5] “Safety of machin­ery — Interlocking devices asso­ci­ated with guards — Principles for design and selec­tion”, EN 1088, CEN, Geneva, 1995.

[6] “Robots and robotic devices — Safety require­ments for indus­trial robots — Part 1: Robots”, European Committee for Standardization (CEN), Geneva, 2011.

[7] “Robots for Industrial Environment — Safety Requirements — Part 1 — Robot”, ANSI/​RIA/​ISO 10218–1, American National Standards Institute, Inc. (ANSI), Ann Arbor, 2007.

Copyright secured by Digiprove © 2011
Acknowledgements: See ref­er­ences listed at end of article.
Some Rights Reserved

How Risk Assessment Fails—Again. This time at DuPont.

Posted by on September 27, 2011 Comments Off
Casualty Evacuated by EMS
This entry is part 7 of 7 in the series Risk Assessment

A recent report released by the US Chemical Safety Board (CSB) looks at a series of acci­dents that occurred over a 33-​​hour period on January 22 and 23, 2010 at the DuPont Corporation’s Belle, West Virginia, chem­i­cal man­u­fac­tur­ing plant.

A num­ber of sig­nif­i­cant fail­ures occurred, but I want to focus on one pas­sage from the press release that is telling, par­tic­u­larly con­sid­er­ing that DuPont is seen as a class leader when it comes to worker safety. I would encour­age you to read the entire release. You can also have a look at the inves­ti­ga­tion details on the CSB site. CSB also pro­duced a video dis­cussing the investigation.

From the press release:

“Internal DuPont doc­u­ments released with the CSB report indi­cate that in the 1980’s, com­pany offi­cials con­sid­ered increas­ing the safety of the area of the plant where phos­gene is han­dled by enclos­ing the area and vent­ing the enclo­sure through  a scrub­ber sys­tem to destroy any toxic phos­gene gas before it entered the atmos­phere. The analy­sis con­cluded that an enclo­sure was the safest option for both work­ers and the pub­lic.  However, the doc­u­ments indi­cate the com­pany was con­cerned with con­tain­ing costs and decided not to make the safety improve­ments. A DuPont employee  wrote in 1988,  “It may be that in the present cir­cum­stances the busi­ness can afford $2 mil­lion for an enclo­sure; how­ever, in the long run can we afford to take such action which has such a small impact on safety and yet sets a prece­dent for all highly toxic mate­r­ial activities.[sic]”

The need for an enclo­sure was reit­er­ated in a 2004 process haz­ard analy­sis con­ducted by DuPont, but four exten­sions were granted by DuPont man­age­ment between 2004 and 2009, and at the time of the January 2010 release, no safety enclo­sure or scrub­ber sys­tem had been con­structed. CSB inves­ti­ga­tors con­cluded that an enclo­sure, scrub­ber sys­tem, and rou­tine require­ment for pro­tec­tive breath­ing equip­ment before per­son­nel entered the enclo­sure would have pre­vented any per­son­nel expo­sures or injuries.”

The high­lighted pas­sage above shows one of the key fail­ure modes in risk assess­ment: fail­ure to act on the results. So what’s the point of con­duct­ing risk assess­ments if they are going to be ignored? In a pre­sen­ta­tion in 2010, a col­league of mine made this statement:

“The risk assess­ment process is intended to be used as a deci­sion mak­ing tool that will help to pro­tect work­ers.” — Tom Doyle, 2010

This is a fun­da­men­tal truth. The risk assess­ment paper­work can­not pro­tect a worker from a haz­ard, only action based on the report can do that.

When deci­sion mak­ers receive the results from a risk assess­ment process and choose to ignore it, or as the press release stated, “…exten­sions were granted by DuPont man­age­ment…”, man­age­ment is mak­ing a fun­da­men­tally flawed deci­sion. The risk assess­ment process inten­tion­ally exposes the haz­ards in the scope of the analy­sis, and explic­itly ana­lyzes the prob­a­ble sever­ity of injury and occur­rence. Once the analy­sis is com­plete, choos­ing to ignore the results, pre­sum­ing that there is no evi­dence that the results are incor­rect, amounts to neg­li­gence in my opinion.

Does this mean that we should not con­duct risk assess­ments? Absolutely not! In the Western world, we are oblig­ated to pro­tect the safety of work­ers, includ­ing our col­leagues and employ­ees, as well as any­one else that may inten­tion­ally or unin­ten­tion­ally be exposed to the haz­ards cre­ated by our activ­i­ties. We are morally and eth­i­cally, as well as legally, obligated.

Used cor­rectly, risk assess­ment in any of its many forms pro­vides a pow­er­ful tool to pro­tect peo­ple. Like any other pow­er­ful tool, it also takes sig­nif­i­cant courage and skill to use cor­rectly. Defaulting to the cost argu­ment alone, as it appears that DuPont did in this case, results in the type of fatal fail­ures seen in this tragic series of events.

Special thanks to my col­league Bryan Hayward, the Safety Engineering Network Group on LinkedIn, and SafTEng​.net.

What is your expe­ri­ence with imple­ment­ing risk assess­ment? Have you expe­ri­enced this kind of result in your work? Share your expe­ri­ences by com­ment­ing on this post!

Copyright secured by Digiprove © 2011
Acknowledgements: US Chemical Safety Board for excerpts more…
Some Rights Reserved

Interlock Architectures – Pt. 5: Category 4 — Control Reliable

Posted by on September 26, 2011 Comments Off
This entry is part 5 of 8 in the series Circuit Architectures Explored

The most reli­able of the five sys­tem archi­tec­tures, Category 4 is the only archi­tec­ture that uses multiple-​​fault tol­er­ant tech­niques to help ensure that com­po­nent fail­ures do not result in an unac­cept­able expo­sure to risk. This post will delve into the depths of this archi­tec­ture in this install­ment on sys­tem archi­tec­tures. The def­i­n­i­tions and require­ments dis­cussed in this arti­cle come from ISO 13849–1, Edition 2 (2006) and ISO 13849–2, Edition 1 (2003).

As with pre­ced­ing arti­cles in this series, I’ll be build­ing on con­cepts dis­cussed in those arti­cles. If you need more infor­ma­tion, you should have a look at the pre­vi­ous arti­cles to see if I’ve answered your ques­tions there.

The Definition

The Category 4 def­i­n­i­tion builds on both Category B and Category 3. As you read, recall that “SRP/​CS” stands for “Safety Related Parts of the Control System”. Here is the com­plete definition:

6.2.7 Category 4
For cat­e­gory 4, the same require­ments as those accord­ing to 6.2.3 for cat­e­gory B shall apply. “Well-​​tried safety prin­ci­ples” accord­ing to 6.2.4 shall also be fol­lowed. In addi­tion, the fol­low­ing applies.
SRP/​CS of cat­e­gory 4 shall be designed such that

  • a sin­gle fault in any of these safety-​​related parts does not lead to a loss of the safety func­tion, and
  • the sin­gle fault is detected at or before the next demand upon the safety func­tions, e.g. imme­di­ately, at switch on, or at end of a machine oper­at­ing cycle, but if this detec­tion is not pos­si­ble, then an accu­mu­la­tion of unde­tected faults shall not lead to the loss of the safety function.

The diag­nos­tic cov­er­age (DCavg) of the total SRP/​CS shall be high, includ­ing the accu­mu­la­tion of faults. The MTTFd of each of the redun­dant chan­nels shall be high. Measures against CCF shall be applied (see
Annex F).

NOTE 1 Category 4 sys­tem behav­iour allows that

  • when a sin­gle fault occurs the safety func­tion is always performed,
  • the faults will be detected in time to pre­vent the loss of the safety function,
  • accu­mu­la­tion of unde­tected faults is taken into account.

NOTE 2 The dif­fer­ence between cat­e­gory 3 and cat­e­gory 4 is a higher DCavg in cat­e­gory 4 and a required MTTFd of each chan­nel of “high” only.

In prac­tice, the con­sid­er­a­tion of a fault com­bi­na­tion of two faults may be sufficient.

5% Discount on ISO and IEC Standards with code: CC2011

Breaking it down

For cat­e­gory 4, the same require­ments as those accord­ing to 6.2.3 for cat­e­gory B shall apply. “Well-​​tried safety prin­ci­ples” accord­ing to 6.2.4 shall also be followed.

The first two sen­tences give the basic require­ment for all the cat­e­gories from 2 through 4. Sound com­po­nent selec­tion based on the appli­ca­tion require­ments for volt­age, cur­rent, switch­ing capa­bil­ity and life­time must be con­sid­ered. In addi­tion, using well tried safety prin­ci­ples, such as switch­ing the +V rail side of the coil cir­cuit for con­trol com­po­nents is required. If you aren’t sure about what con­sti­tutes a “well-​​tried safety prin­ci­ple”, see the arti­cle on Category 2 where this is dis­cussed. Don’t con­fuse “well-​​tried safety prin­ci­ples” with “well-​​tried com­po­nents”. There is no require­ment in Category 4 for the use of well-​​tried com­po­nents, although you can use them for addi­tional reli­a­bil­ity if the design require­ments warrant.

In addi­tion, the fol­low­ing applies.
SRP/​CS of cat­e­gory 4 shall be designed such that

  • a sin­gle fault in any of these safety-​​related parts does not lead to a loss of the safety func­tion, and
  • the sin­gle fault is detected at or before the next demand upon the safety func­tions, e.g. imme­di­ately, at switch on, or at end of a machine oper­at­ing cycle, but if this detec­tion is not pos­si­ble, then an accu­mu­la­tion of unde­tected faults shall not lead to the loss of the safety function.

This is the big one. This para­graph, and the two bul­lets that fol­low it, define the fun­da­men­tal per­for­mance require­ments for this cat­e­gory. No sin­gle fault can lead to the loss of the safety func­tion in Category 4, and test­ing is required that can detect fail­ures and pre­vent an accu­mu­la­tion of faults that could even­tu­ally lead to the loss of the safety func­tion. The sec­ond bul­let is the one that defines the multiple-​​fault-​​tolerance require­ment for this cat­e­gory. If you go back to the def­i­n­i­tion of Category 3, you will see that an accu­mu­la­tion of faults may lead to the loss of the safety func­tion in that Category. This is the key dif­fer­ence between the cat­e­gories in my opinion.

The diag­nos­tic cov­er­age (DCavg) of the total SRP/​CS shall be high, includ­ing the accu­mu­la­tion of faults. The MTTFd of each of the redun­dant chan­nels shall be high. Measures against CCF shall be applied (see
Annex F).

These three sen­tences give the designer the cri­te­ria for diag­nos­tic cov­er­age, chan­nel fail­ure rates and com­mon cause fail­ure pro­tec­tion. As you can see, the abil­ity to diag­nose fail­ures auto­mat­i­cally is a crit­i­cal part of the design, as is the use of highly reli­able com­po­nents, lead­ing to highly reli­able chan­nels. The strongest CCF pro­tec­tion you can include in the design is also needed, although the “pass­ing score” of 65 remains unchanged (see Annex F in ISO 13849–1 for more details on scor­ing your design).

NOTE 1 Category 4 sys­tem behav­iour allows that

  • when a sin­gle fault occurs the safety func­tion is always performed,
  • the faults will be detected in time to pre­vent the loss of the safety function,
  • accu­mu­la­tion of unde­tected faults is taken into account.

Note 2: …In prac­tice, the con­sid­er­a­tion of a fault com­bi­na­tion of two faults may be sufficient.

Note 1 expands on the first para­graph in the def­i­n­i­tion, fur­ther clar­i­fy­ing the per­for­mance require­ments by explicit state­ments. Notice that nowhere is there a require­ment that sin­gle faults or accu­mu­la­tion of sin­gle faults be pre­vented, only detected by the diag­nos­tic sys­tem. Prevention of sin­gle faults is nearly impos­si­ble, since com­po­nents do fail. It is impor­tant to first under­stand which com­po­nents are crit­i­cal to the safety func­tion, and sec­ond, what kinds of faults each com­po­nent is likely to have, is fun­da­men­tal to being able to design a diag­nos­tic sys­tem that can detect the faults.

The cat­e­gory relies on redun­dancy to ensure that the com­plete loss of one chan­nel will not cause the loss of the safety func­tion, but this is only use­ful if the com­mon cause fail­ures have been prop­erly dealt with. Otherwise, a sin­gle event could wipe out both chan­nels simul­ta­ne­ously, caus­ing the loss of the safety func­tion and pos­si­bly result in an injury or fatality.

Also notice that mul­ti­ple sin­gle faults are per­mit­ted, as long as the accu­mu­la­tion does not result in the loss of the safety func­tion. ISO 13849 allows for “fault exclu­sion”, a con­cept that is not used in the North American standards.

The final sen­tence from Note 2 sug­gests that con­sid­er­a­tion of two con­cur­rent faults may be enough, but be care­ful. You need to look closely at the fault lists to see if there are any groups of high prob­a­bil­ity faults that are likely to occur con­cur­rently. IF there are, you need to assess these com­bi­na­tions of faults, whether there are 5 or 50 to be evaluated.

Fault Exclusion

Fault exclu­sion involves assess­ing the types of faults that can occur in each com­po­nent in the crit­i­cal path of the sys­tem. The deci­sion to exclude cer­tain kinds of faults is always a tech­ni­cal com­pro­mise between the the­o­ret­i­cal improb­a­bil­ity of the fault, the exper­tise of the designer(s) and engi­neers involved and the spe­cific tech­ni­cal require­ments of the appli­ca­tion. Whenever the deci­sion is made to exclude a par­tic­u­lar type of fault, the deci­sion and the process used to make it must be doc­u­mented in the Reliability Report included in the design file. Section 7.3 of ISO 13849–1 pro­vides guid­ance on fault exclusion.

In the sec­tion dis­cussing Category 1, the stan­dard has this to say about fault exclu­sion, and the dif­fer­ence between “well-​​tried com­po­nents” and “fault exclusion”:

It is impor­tant that a clear dis­tinc­tion between “well-​​tried com­po­nent” and “fault exclu­sion” (see Clause 7) be made. The qual­i­fi­ca­tion of a com­po­nent as being well-​​tried depends on its appli­ca­tion. For exam­ple, a posi­tion switch with pos­i­tive open­ing con­tacts could be con­sid­ered as being well-​​tried for a machine tool, while at the same time as being inap­pro­pri­ate for appli­ca­tion in a food indus­try — in the milk indus­try, for instance, this switch would be destroyed by the milk acid after a few months. A fault exclu­sion can lead to a very high PL, but the appro­pri­ate mea­sures to allow this fault exclu­sion should be applied dur­ing the whole life­time of the device. In order to ensure this, addi­tional mea­sures out­side the con­trol sys­tem may be nec­es­sary. In the case of a posi­tion switch, some exam­ples of these kinds of mea­sures are

  • means to secure the fix­ing of the switch after its adjustment,
  • means to secure the fix­ing of the cam,
  • means to ensure the trans­verse sta­bil­ity of the cam,
  • means to avoid over-​​travel of the posi­tion switch, e.g. ade­quate mount­ing strength of the shock absorber and any align­ment devices, and
  • means to pro­tect it against dam­age from outside.

To assist the designer, ISO 13849–2 pro­vides lists of typ­i­cal faults and the allow­able exclu­sions in Annex D.5. As an exam­ple, let’s con­sider the typ­i­cal sit­u­a­tion where a robust guard inter­lock­ing device has been selected. The deci­sion has been made to use redun­dant elec­tri­cal cir­cuits to the switch­ing com­po­nents in the inter­lock, so elec­tri­cal faults can be detected. But what about mechan­i­cal fail­ures? A fault list is needed:

 Interlock Mechanical Fault List
#Fault DescriptionResultLikelihood
1Key breaks offControl sys­tem can­not deter­mine guard posi­tion. Complete fail­ure of sys­tem through a sin­gle fault.Unlikely
2Screws mount­ing key to guard failControl sys­tem can­not deter­mine guard posi­tion. Complete fail­ure of sys­tem through a sin­gle fault.Unlikely
3Screws mount­ing inter­lock device to guard failControl sys­tem can­not deter­mine guard posi­tion. Complete fail­ure of sys­tem through a sin­gle fault.Unlikely
4Key and inter­lock device misaligned.Guard can­not close, pre­vent­ing machine from operating.Very likely
5Key and inter­lock device misaligned.Key and /​ or inter­lock device dam­aged. Guard may not close, or the key may jam in the inter­lock device once closed. Machine is inop­er­a­ble if the inter­lock can­not be com­pleted, or the guard can­not be opened if the key jams in the device.Likely
6Screws mount­ing key to guard removed by user.Interlock can now be bypassed by fix­ing the key into the inter­lock­ing device. Control sys­tem can no longer sense the posi­tion of the guard.Likely
7Screws mount­ing inter­lock device to guard removed by userProbably com­bined with the pre­ced­ing con­di­tion. Control sys­tem can no longer sense the posi­tion of the guard.Unlikely, but could happen.

There may be more fail­ure modes, but for the pur­pose of this dis­cus­sion, lets limit them to this list.

Looking at Fault 1, there are a num­ber of things that could result in a bro­ken key. They include: mis­align­ment of the key and the inter­lock device, lack of main­te­nance on the guard and the inter­lock­ing hard­ware, or inten­tional dam­age by a user. Unless the hard­ware is excep­tion­ally robust, includ­ing the design of the guard and any align­ment fea­tures incor­po­rated in the guard­ing, devel­op­ing sound ratio­nale for exclud­ing this fault will be very difficult.

Fault 2 con­sid­ers mechan­i­cal fail­ure of the mount­ing screws for the inter­lock key. Screws are con­sid­ered to be well-​​tried com­po­nents (see Annex A.5), so you can con­sider them for fault exclu­sion. You can improve their reli­a­bil­ity by using thread lock­ing adhe­sives when installing the screws to pre­vent them from vibrat­ing loose, and “tamper-​​proof” style screw heads to deter unau­tho­rized removal. Inclusion of these meth­ods will sup­port any deci­sion to exclude these faults. This goes to address­ing faults 3, 6 and 7 as well.

Faults 4 & 5 occur fre­quently and are often caused by poor device selec­tion (i.e. an inter­lock device intended for straight-​​line sliding-​​gate appli­ca­tions is cho­sen for a hinged gate), or by poor guard design (i.e. the guard is poorly guided by the reten­tion mech­a­nism and can be closed in a mis­aligned con­di­tion). Rationale for pre­ven­tion of these faults will need to include dis­cus­sion of design fea­tures that will pre­vent these conditions.

Excluding any other kind of fault fol­lows the same process: Develop the fault list, assess each fault against the rel­e­vant Annex from ISO 13849–2, deter­mine if there are pre­ven­ta­tive mea­sures that can be designed into the prod­uct and whether these pro­vide suf­fi­cient risk reduc­tion to allow the exclu­sion of the fault from consideration.

DCavg and MTTFd requirements

NOTE 2 The dif­fer­ence between cat­e­gory 3 and cat­e­gory 4 is a higher DCavg in cat­e­gory 4 and a required MTTFd of each chan­nel of “high” only.

The first sen­tence in Note 2 clar­i­fies the two main dif­fer­ences from a design stand­point, aside from the addi­tional fault tol­er­ance require­ments: Better diag­nos­tics are required and much higher require­ments for indi­vid­ual com­po­nent, and there­fore chan­nel, MTTFd.

The Block Diagram

The block dia­gram for Category 4 is almost iden­ti­cal to Category 3, and was updated by Corrigendum 1 to the dia­gram shown below. The text from the cor­ri­gen­dum that accom­pa­nies the dia­gram has this to say about the change:

Replace the draw­ing show­ing the des­ig­nated archi­tec­ture for cat­e­gory 4 with the fol­low­ing draw­ing. This
cor­rects the arrowed lines labeled “m” between L1 and O1, and L2 and O2, by chang­ing them from dashed to solid lines, rep­re­sent­ing higher diag­nos­tic coverage.

I’ve high­lighted this area using red ovals on Figure 12 to make it eas­ier to see .

ISO 13849-1 Figure 12 - Category 4 Block Diagram

ISO 13849–1 Figure 12 — Category 4 Block Diagram

Here is Figure 11 for com­par­i­son. Notice that the “m” lines are solid in Figure 12 and dashed in Figure 11? Subtle, but sig­nif­i­cant! There are no other dif­fer­ences between the diagrams.

ISO 13849-1 Figure 11I went look­ing for a cir­cuit dia­gram to sup­port the block dia­gram, but wasn’t able to find one from a com­mer­cial source that I could share with you. Considering that the pri­mary dif­fer­ences are in the reli­a­bil­ity of the com­po­nents cho­sen and in the way the test­ing is done, this isn’t too sur­pris­ing. The basic phys­i­cal con­struc­tion of the two cat­e­gories can be vir­tu­ally identical.

Applications

The fol­low­ing is not from the stan­dards — this is my per­sonal opin­ion, based on 15 years of practice.

In the past, many man­u­fac­tur­ers decided that they were going to apply Category 4 archi­tec­ture with­out really under­stand­ing the design impli­ca­tions, because they believed that it was “the best”. With the change in the har­mo­niza­tion of EN 954–1 and ISO 13849–1 under the EU machin­ery direc­tive that comes into force on 29-​​Dec-​​2011, and con­sid­er­ing the great dif­fi­culty that many man­u­fac­tur­ers had in prop­erly imple­ment­ing EN 954–1, I can eas­ily imag­ine man­u­fac­tur­ers who have taken the approach that they already have Category 4 SRP/​CS on their sys­tems and mak­ing the state­ment that they now have PLe SRP/​CS sys­tem per­for­mance. This is a bad deci­sion for a lot of reasons:

  1. ISO 13849–1 PLe, Category 4 sys­tems should be reserved for very dan­ger­ous machin­ery where the tech­ni­cal effort and expense involved is war­ranted by the risk assess­ment. Attempting to apply this level of design to machin­ery where a PLb per­for­mance level is more suit­able based on a risk assess­ment, is a waste of design time and effort and a need­less expense. The prod­uct fam­ily stan­dards for these types of machines, such as EN 201 for plas­tic injec­tion mould­ing machines, or EN 692 for Mechanical Power Presses or EN 693 for Hydraulic Power Presses will explic­itly spec­ify the PL level required for these machines.
  2. Manufacturers have fre­quently claimed EN 954–1 Category 4 per­for­mance based on the rat­ing of the safety relay alone, with­out under­stand­ing that the rest of the SRP/​CS must be con­sid­ered, and clearly this is wrong. The SRP/​CS must be eval­u­ated as a com­plete system.

This lack of under­stand­ing endan­gers the users, the main­te­nance per­son­nel, the own­ers and the man­u­fac­tur­ers. If they con­tinue this approach and an injury occurs, it is my opin­ion that the courts will have more than enough evi­dence in the defendant’s pub­lished doc­u­ments to cause some seri­ous legal grief.

As design­ers involved with the safety of our company’s prod­ucts or with our co-worker’s safety, I believe that we owe it to every­one who uses our prod­ucts to be edu­cated and to cor­rectly apply these con­cepts. The fact that you have read all of the posts lead­ing up to this one is evi­dence that you are work­ing on get­ting educated.

Always con­duct a risk assess­ment and use the out­come from that work to guide your selec­tion of safe­guard­ing mea­sures, com­ple­men­tary pro­tec­tive mea­sures and the per­for­mance of the SRP/​CS that ties those sys­tems together. Choose per­for­mance lev­els that make sense based on the required risk reduc­tion and ensure that the design cri­te­ria is met by val­i­dat­ing the sys­tem once built.

As always, I wel­come your com­ments and ques­tions! Please feel free to com­ment below. I will respond to all your comments.

Copyright secured by Digiprove © 2011
Acknowledgements: ISO for excerpts from ISO 13849–1 and more…
Some Rights Reserved
All original content on these pages is fingerprinted and certified by Digiprove
Performance Optimization WordPress Plugins by W3 EDGE