Tag Archives: CSA Z432

The Third Level of the Hierarchy: Information for Use

Posted by on January 16, 2012 Comments Off
This entry is part 3 of 3 in the series Hierarchy of Controls

I’ve writ­ten about the Hierarchy of Controls in past posts, but I’ve focused on the ‘engi­neer­ing’ side of the con­trol equa­tion: Physical changes to machine design to elim­i­nate haz­ards, and mechan­i­cal or elec­tri­cal con­trol sys­tems that can reduce risk.

The first two lev­els of the Hierarchy, Elimination/​Substitution and Engineering Controls, are typ­i­cally more chal­leng­ing to apply in most people’s minds, because expert knowl­edge is required. These lev­els are also more effec­tive in con­trol­ling risk than the sub­se­quent levels.

The Third Level

iStock_000009386795Small - Photo of Instruction manualThe third level of the Hierarchy is ‘Information for Use’, some­times abbre­vi­ated as ‘IFU.’ This level is decep­tively sim­ple, and is fre­quently the level peo­ple want to jump to when the other con­trols seem too dif­fi­cult to imple­ment. Done well, infor­ma­tion for use can make a sig­nif­i­cant con­tri­bu­tion to risk con­trol. Unfortunately, it’s done poorly or not at all more often than it’s done well.

Information for use includes:

  • Instructions and Manuals;
  • Operator Device tags and Legend Plates;
  • HMI screens;
  • Hazard Warning signs and labels;
  • Training Materials (text, video, audio) and Training (face-​​to-​​face, webi­nars, self-​​directed);
  • Sales and mar­ket­ing materials.

Information for use is needed in all the stages of the prod­uct life cycle: Transportation, Installation, Commissioning, Use, Maintenance, Service, Decommissioning and Disposal [1]. At each stage in the life cycle, the con­tent of the infor­ma­tion and the pre­sen­ta­tion may be dif­fer­ent. In every stage it can make a sig­nif­i­cant con­tri­bu­tion to risk reduc­tion by com­mu­ni­cat­ing the safe approach to the tasks in that stage, and the risks related to those tasks. The infor­ma­tion should include the intended use and the fore­see­able mis­uses of the prod­uct. This is a legal require­ment in the EU [2], and is a best-​​practice in North America.

In this arti­cle I’m going to focus on instruc­tion man­u­als. If you’re inter­ested in Hazard Warnings, includ­ing signs, labels, and inte­gra­tion into man­u­als and instruc­tions, watch for a future post on this topic.

Legal require­ments and standards

In the European Union, the legal oblig­a­tion to pro­vide infor­ma­tion with a prod­uct is enshrined in law [2].
No North American juris­dic­tions make an explicit require­ment for instruc­tions or infor­ma­tion for use in law, but many prod­uct spe­cific stan­dards include require­ments for the con­tent of manuals.

CSA Z432 [3] out­lines require­ments for con­tent in Clause 17, and in EN 60204–1 [7]. IEC 62079 [4], pro­vides guid­ance on the design and pre­sen­ta­tion of instruc­tions. ANSI Z535.6 [5], pro­vides spe­cific instruc­tions on inclu­sion of haz­ard warn­ings in man­u­als and instructions.

Training require­ments are also dis­cussed in CSA Z432 [3], Clause 18.

5% Discount on ISO and IEC Standards with code: CC2011

In the USA, pro­vid­ing infor­ma­tion for use with a prod­uct is con­sid­ered to be sound ‘due dili­gence’, how­ever, pro­vid­ing infor­ma­tion on resid­ual risk is often seen by lia­bil­ity lawyers as dan­ger­ous, since man­u­fac­tur­ers are pro­vid­ing infor­ma­tion, in writ­ing, that their prod­uct is not ‘per­fectly safe.’ If you’ve read any­thing I’ve writ­ten on risk assess­ment, you’ll know that there is no such state as ‘per­fectly safe.’ If a haz­ard exists, a poten­tial for harm exists, a prob­a­bil­ity can be assessed and thus risk exists, how­ever remote that risk may be. I think that this argu­ment by some lia­bil­ity lawyers is fatu­ous at best.

Kenneth Ross, one of the lead­ing prod­uct lia­bil­ity lawyers in the USA, dis­cusses the require­ments for warn­ings and instruc­tions in an arti­cle pub­lished in 2007 [6]. In the arti­cle, he explains the US requirements:

“Product sell­ers must pro­vide “rea­son­able warn­ings and instruc­tions” about their prod­ucts’ risks. The law dif­fer­en­ti­ates warn­ings and instruc­tions as follows:

“Warnings alert users and con­sumers to the exis­tence and nature of prod­uct risks so that they can pre­vent harm either by appro­pri­ate con­duct dur­ing use or con­sump­tion or by choos­ing not to use or consume.”

Instructions “inform per­sons how to use and con­sume prod­ucts safely.”

A court has held that warn­ings, stand­ing alone, may have no prac­ti­cal rel­e­vance with­out instruc­tions and that instruc­tions with­out warn­ings may not be adequate.

Therefore, when the law talks about the “duty to warn,” it includes warn­ings on prod­ucts in the form of warn­ing labels; safety infor­ma­tion in instruc­tions; instruc­tions that affir­ma­tively describe how to use a prod­uct safely; and safety infor­ma­tion in other means of com­mu­ni­ca­tion such as videos, adver­tis­ing, cat­a­logs and websites.

The law says that a man­u­fac­turer has a duty to warn where: (1) the prod­uct is dan­ger­ous; (2) the dan­ger is or should be known by the man­u­fac­turer; (3) the dan­ger is present when the prod­uct is used in the usual and expected man­ner; and (4) the dan­ger is not obvi­ous or well known to the user.”

Read Mr. Ross’ lat­est arti­cle on warnings.

This prac­ti­cal and sen­si­ble approach is very sim­i­lar to that in the EU. Note the require­ment that “instruc­tions that affir­ma­tively describe how to use a prod­uct safely.” The  old list of “don’ts” doesn’t cut it — you must tell your user how to use the prod­uct in an affir­ma­tive way.

Second Best

So why is it that so many man­u­fac­tur­ers set­tle for man­u­als that are barely ‘sec­ond best’? In many com­pa­nies, the doc­u­men­ta­tion func­tion is:

  • Not seen to add value to the product;
  • not under­stood to have legal import in lim­it­ing prod­uct liability;
  • given lit­tle effort.

The per­cep­tion seems to be that man­u­als are pro­duced pri­mar­ily to fill fil­ing cab­i­nets and that cus­tomers don’t use the infor­ma­tion pro­vided. This leads to man­u­als that are writ­ten after-​​the-​​fact by engi­neers, or worse, the role of ‘tech­ni­cal writer’ is seen to be an entry level posi­tion often filled by interns or co-​​op students.

End-​​user train­ing is fre­quently given even less thought than the man­u­als. When designed together, the man­ual will sup­port the train­ing pro­gram, and the train­ers can use the man­ual as one of the pri­mary train­ing tools. This pro­vides con­ti­nu­ity, and ensures that the train­ing process is prop­erly documented.

iStock_000012657812Small - Techncial ManualMy expe­ri­ence is that few engi­neers are excel­lent writ­ers. There are some, no doubt. Writing man­u­als takes a sound under­stand­ing of edu­ca­tional the­ory, includ­ing an under­stand­ing of the audi­ence to whom the mate­r­ial is directed. The level of tech­ni­cal sophis­ti­ca­tion required for a sim­ple house­hold prod­uct is com­pletely dif­fer­ent from that required for the tech­ni­cal sup­port man­ual for an indus­trial weld­ing laser.
The engi­neers design­ing and inte­grat­ing an indus­trial sys­tem are often too close to the design of the prod­uct to be able to write effec­tively to the tar­get audi­ence. Assumptions about the level of edu­ca­tion that the user will have are often incor­rect, and key steps may be skipped because they are assumed to be ‘com­mon knowledge.’

Quality doc­u­men­ta­tion is also a cus­tomer ser­vice issue. Products that are well doc­u­mented require less cus­tomer ser­vice sup­port, and when cus­tomers do need sup­port, they are gen­er­ally more sat­is­fied with the result.

New Delivery Methods

The deliv­ery meth­ods for tech­ni­cal doc­u­ments have changed con­sid­er­ably in recent years. Large, ring-​​bound paper man­u­als are being dis­placed by on-​​line, inter­ac­tive doc­u­men­ta­tion that can be accessed at the user inter­face. The use of PDF-​​format man­u­als has jumped, and this brings in the abil­ity to link error mes­sages gen­er­ated by the con­trol sys­tem to the sec­tions of the man­ual that related to that aspect of the sys­tem. Video and ani­ma­tions can be added that pro­vide at-​​a-​​glance under­stand­ing of the oper­a­tion of the machin­ery. WiFi net­works in indus­trial facil­i­ties, along with the accep­tance of mobile pad-​​computing devices like the Apple iPad, mean users can have the instruc­tions where they need them, and tech­ni­cians and ser­vice per­son­nel can take the man­ual with them to the area where a prob­lem exists, and can use the doc­u­ments even in very low-​​light conditions.

Finding tech­ni­cal writ­ing resources can be a chal­lenge, par­tic­u­larly if you are look­ing to move away from paper to elec­tronic doc­u­men­ta­tion. The stan­dards men­tioned in this arti­cle are a good place to start.
Documentation can range from writ­ing through tech­ni­cal illus­tra­tions, ani­ma­tion and video pro­duc­tion. Finding indi­vid­u­als who can pro­vide you with pro­fes­sional ser­vices in these areas in a timely way and at a rea­son­able price is not an easy task. If you need assis­tance rang­ing from a few ques­tions that need answers to hir­ing a tech­ni­cal writer, Compliance InSight Consulting can help. Contact me for more information!

Are your prod­uct man­u­als as good as they could be? What kinds of chal­lenges have you had with get­ting them writ­ten, or used? Add your com­ments below!

References

5% Discount on ISO and IEC Standards with code: CC2011

[1]    “Safety of machin­ery — General prin­ci­ples for design — Risk assess­ment and risk reduc­tion”, ISO Standard 12100, 2010

[2]    “DIRECTIVE 2006/​42/​EC OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 17 May 2006 on machin­ery, and amend­ing Directive 95/​16/​EC”, Annex 1, Clause 1.7, European Commission, 2006.

[3]    “Safeguarding of Machinery”, CSA Standard Z432, Canadian Standards Association, 2004.

[4]    “Preparation of instruc­tions – Structuring, con­tent and pre­sen­ta­tion”, IEC Standard 62079, International Electrotechnical Commission, 2001.

[5]    “American National Standard For Product Safety Information in Product Manuals, Instructions, and Other Collateral Materials”, ANSI Standard Z535.6, American National Standards Institute, 2006.

[6]    “Danger! The Legal Duty to Warn and Instruct”, Kenneth Ross, Risk Management Magazine, 2007, http://​www​.rmmag​.com/​M​G​T​e​m​p​l​a​t​e​.​c​f​m​?​S​e​c​t​i​o​n​=​R​M​M​a​g​a​z​i​n​e​&​a​m​p​;​N​a​v​M​e​n​u​I​D​=​1​2​8​&​a​m​p​;​t​e​m​p​l​a​t​e​=​/​M​a​g​a​z​i​n​e​/​D​i​s​p​l​a​y​M​a​g​a​z​i​n​e​s​.​c​f​m​&​a​m​p​;​I​s​s​u​e​I​D​=​2​9​0​&​a​m​p​;​A​I​D​=​3​2​9​0​&​a​m​p​;​V​o​l​u​m​e​=​5​4​&​a​m​p​;​S​h​o​w​A​r​t​i​c​l​e=1, accessed 16-​​Jan-​​2012.

[7]      “Safety of machin­ery — Electrical equip­ment of machines — Part 1: General require­ments”, CENELEC Standard EN 60204–1, CENELEC, 2009.

Copyright secured by Digiprove © 2012
Acknowledgements: Kenneth Ross, +1 (952) 933‑1195, kenr more…
Some Rights Reserved

Interlock Architectures Pt. 6 — Comparing North American and International Systems

Posted by on October 3, 2011 Comments Off
industrial Control Console
This entry is part 6 of 8 in the series Circuit Architectures Explored

I’ve now writ­ten six posts, includ­ing this one, on the topic of cir­cuit archi­tec­tures for the safety–related parts of con­trol sys­tems. In this post, we’ll com­pare the International and North American sys­tems. This com­par­i­son is not intended to draw con­clu­sions about which is “bet­ter”, but rather to com­pare and con­trast the two sys­tems so that design­ers can clearly see where the over­laps and the gaps in the sys­tems exist.

Since we’ve spent a lot of time talk­ing about ISO 13849–1 [1] in the pre­vi­ous five posts in this series, I think we should begin there by look­ing at Table 10 from the standard.

Table 10 — Summary of require­ments for cat­e­gories
Category Summary of requirements System behaviour Principle used
to achieve
safety		 MTTFd
of each
chan­nel		 DCavg CCF
B
(see
6.2.3)		SRP/​CS and/​or their pro­tec­tive equip­ment, as well as their com­po­nents, shall be designed, con­structed, selected, assem­bled and com­bined in accor­dance with rel­e­vant stan­dards so that they can with­stand the expected influence.Basic safety prin­ci­ples shall be used.The occur­rence of a fault can lead to the loss of the safety function.Mainly char­ac­ter­ized by selec­tion of componentsLow to mediumNoneNot rel­e­vant
1
(see
6.2.4)		Requirements of B shall apply. Well-​​tried com­po­nents and well-​​tried safety prin­ci­ples shall be used.The occur­rence of a fault can lead to the loss of the safety func­tion but the prob­a­bil­ity of occur­rence is lower than for cat­e­gory B.Mainly char­ac­ter­ized by selec­tion of componentsHighNoneNot rel­e­vant
2
(see
6.2.5)		Requirements of B and the use of well-​​tried safety prin­ci­ples shall apply. Safety func­tion shall be checked at suit­able inter­vals by the machine con­trol system.The occur­rence of a fault can lead to the loss of the safety func­tion between the checks. The loss of safety func­tion is detected by the check.Mainly char­ac­ter­ized by structureLow to highLow to mediumSee Annex F
3
(see
6.2.6)		Requirements of B and the use of well-​​tried safety prin­ci­ples shall apply.Safety-related parts shall be designed, so that

—a sin­gle fault in any of these parts does not lead to the loss of the safety func­tion, and

—when­ever rea­son­ably prac­ti­ca­ble, the sin­gle fault is detected.

When a sin­gle fault occurs, the safety func­tion is always performed.Some, but not all, faults will be detected.

Accumulation of unde­tected faults can lead to the loss of the safety function.

 Mainly
char­ac­ter­ized
by structure		Low to
high		Low to
medium		 See
Annex F
 4
(see
6.2.7)		Requirements of B and the use of well-​​tried safety prin­ci­ples shall apply. Safety-​​related parts shall be designed, so that
—a sin­gle fault in any of these parts does not lead to a loss of the safety func­tion, and

—the sin­gle fault is detected at or before the next demand upon the safety func­tion, but that if this detec­tion is not pos­si­ble, an accu­mu­la­tion of unde­tected faults shall not lead to the loss of the safety function.

 

When a sin­gle fault occurs the safety func­tion is always per­formed. Detection of accu­mu­lated faults reduces the prob­a­bil­ity of the loss of the safety func­tion (high DC). The faults will be detected in time to pre­vent the loss of the safety function. Mainly char­ac­ter­ized by structure High High includ­ing accu­mu­la­tion of faults See Annex F
NOTE For full require­ments, see Clause 6.

Table 10 sum­ma­rizes all the key require­ments for the five cat­e­gories of archi­tec­ture, giv­ing the fun­da­men­tal mech­a­nism for achiev­ing safety, the required MTTFd, DC and CCF. Note that fault exclu­sion can be used in Categories 3 and 4. There is no sim­i­lar table avail­able for CSA Z432 [2] or RIA R 15.06 [3], so I have con­structed one fol­low­ing a sim­i­lar for­mat to Table 10.

Summary of require­ments for CSA Z432 /​ Z434 and RIA R15.06
CSA Z432-​​04 /​ Z434-​​03RIA R15.06 1999
Category Summary of requirements System behav­iour Principle used
to achieve
safety		Summary of requirements
AllSafety con­trol sys­tems (elec­tric, hydraulic, pneu­matic) shall meet one of the per­for­mance cri­te­ria listed in Clauses 4.5.2 to 4.5.5.Safety cir­cuits (elec­tric, hydraulic, pneu­matic) shall meet one of the per­for­mance cri­te­ria listed in 4.5.1 through 4.5.4.2

2 These per­for­mance cri­te­ria are not to be con­fused with the European cat­e­gories B to 3 as described in ISO/​IEC DIS 13849–1, Safety of machin­ery – Safety-​​related parts of con­trol sys­tems – Part 1: General prin­ci­ples for design (in cor­re­la­tion with EN 954–1.) They are dif­fer­ent. The com­mit­tee believes that the cri­te­ria in 4.5.1–4.5.4 exceed the cri­te­ria of B — 3 respec­tively, and fur­ther believe the reverse is not true.

SIMPLESimple safety con­trol sys­temsshall be designed and con­structed using accepted sin­gle chan­nel circuitry.Such sys­tems may be programmable.

Note: This type of sys­tem should be used for sig­nalling and annun­ci­a­tion pur­poses only.

The occur­rence of a fault can lead to the loss of the safety function.Mainly char­ac­ter­ized by com­po­nent selection.Simple safety cir­cuits shall be designed and con­structed using accepted sin­gle chan­nel
cir­cuitry, and may be programmable.
SINGLE
CHANNEL		Single chan­nel safety con­trol sys­tems shalla) be hard­ware based or com­ply with Clause 6.5;

b) include com­po­nents that should be safety rated; and

c) be used in accor­dance with man­u­fac­tur­ers’ rec­om­men­da­tions and proven cir­cuit designs (e.g., a sin­gle chan­nel electro­mechan­i­cal pos­i­tive break device that sig­nals a stop in a de-​​energized state).

Note: In this type of sys­tem a sin­gle com­po­nent fail­ure can lead to the loss of the safety function.

The occur­rence of a fault can lead to the loss of the safety function.Mainly char­ac­ter­ized by com­po­nent selection.Single chan­nel safety cir­cuits shall be hard­ware based or com­ply with 6.4, include com­po­nents
which should be safety rated, be used in com­pli­ance with man­u­fac­tur­ers’ rec­om­men­da­tions
and proven cir­cuit designs (e.g. a sin­gle chan­nel electro-​​mechanical pos­i­tive break device which sig­nals a stop in a de-​​energized state.)
SINGLE CHANNEL
WITH
MONITORING		Single chan­nel safety con­trol sys­tems with mon­i­tor­ing shall include the require­ments for sin­gle chan­nel,
be safety rated, and be checked (prefer­ably auto­mat­i­cally) at suit­able inter­vals in accor­dance with the following:a) The check of the safety function(s) shall be performed

i) at machine start-​​up; and

ii) peri­od­i­cally dur­ing oper­a­tion (prefer­ably at each change in state).

b) The check shall either

i) allow oper­a­tion if no faults have been detected; or

ii) gen­er­ate a stop if a fault is detected. A warn­ing shall be pro­vided if a haz­ard remains after ces­sa­tion of motion.

c) The check itself shall not cause a haz­ardous sit­u­a­tion.

d) Following detec­tion of a fault, a safe state shall be main­tained until the fault is cleared.

Note: In this type of cir­cuit a sin­gle com­po­nent fail­ure can also lead to the loss of the safety function.

The occur­rence of a fault can lead to the loss of the safety function.Characterized by both com­po­nent selec­tion and structure.Single chan­nel with mon­i­tor­ing safety cir­cuits shall include the require­ments for sin­gle chan­nel,
shall be safety rated, and shall be checked (prefer­ably auto­mat­i­cally) at suit­able intervals.a) The check of the safety function(s) shall be performed

1) at machine start-​​up, and

2) peri­od­i­cally dur­ing operation;

b) The check shall either:

1) allow oper­a­tion if no faults have been detected, or

2) gen­er­ate a stop sig­nal if a fault is detected.
A warn­ing shall be pro­vided if a haz­ard remains after ces­sa­tion of motion;

c) The check itself shall not cause a haz­ardous situation;

d) Following detec­tion of a fault, a safe state shall be main­tained until the fault is cleared.

CONTROL RELIABLEControl reli­able safety con­trol sys­tems shall be dual chan­nel with mon­i­tor­ing and shall be designed,
con­structed, and applied such that any sin­gle com­po­nent fail­ure, includ­ing mon­i­tor­ing, shall not pre­vent
the stop­ping action of the robot.
These safety con­trol sys­tems shall be hard­ware based or in accor­dance with Clause 6.5. The sys­tems shall include auto­matic mon­i­tor­ing at the sys­tem level con­form­ing to the following:a) The mon­i­tor­ing shall gen­er­ate a stop if a fault is detected. A warn­ing shall be pro­vided if a haz­ard remains after ces­sa­tion of motion.

b) Following detec­tion of a fault, a safe state shall be main­tained until the fault is cleared.

c) Common mode fail­ures shall be taken into account when the prob­a­bil­ity of such a fail­ure occur­ring is
significant.

d) The sin­gle fault should be detected at time of fail­ure. If not prac­ti­ca­ble, the fail­ure shall be detected
at the next demand upon the safety function.

e) These safety con­trol sys­tems shall be inde­pen­dent of the nor­mal pro­gram con­trol (func­tion) and shall be designed to be not eas­ily defeated or not eas­ily bypassed with­out detection.

When a sin­gle fault occurs, the safety func­tion is always performed.Some, but not all, faults will be detected.

Accumulation of unde­tected faults can lead to the loss of the safety function.

Characterized pri­mar­ily by structure.Control reli­able safety cir­cuitry shall be designed, con­structed and applied such that any sin­gle com­po­nent fail­ure shall not pre­vent the stop­ping action of the robot.These cir­cuits shall be hard­ware based or com­ply with 6.4, and include auto­matic mon­i­tor­ing at the sys­tem level.

a) The mon­i­tor­ing shall gen­er­ate a stop sig­nal if a fault is detected. A warn­ing shall be pro­vided if a haz­ard remains after ces­sa­tion of motion;

b) Following detec­tion of a fault, a safe state shall be main­tained until the fault is cleared.

c) Common mode fail­ures shall be taken into account when the prob­a­bil­ity of such a fail­ure occur­ring is significant.

d) The sin­gle fault should be detected at time of fail­ure. If not prac­ti­ca­ble, the fail­ure shall be detected at the next demand upon the safety function.

CSA Z434 vs. RIA R15.06

Before we dig into the com­par­i­son between North America and the International stan­dards, we need to look at the dif­fer­ences between CSA and ANSI/​RIA. There are some sub­tle dif­fer­ences here that can trip you up and cost sig­nif­i­cant money to cor­rect after the fact. The fol­low­ing state­ments are based on my per­sonal expe­ri­ence and on dis­cus­sions that I have had with peo­ple on both the CSA and RIA tech­ni­cal com­mit­tees tasked with writ­ing these stan­dards. One more note — ANSI RIA R15.06 has been revised and ALL OF SECTION 4 has been replaced with ANSI/​RIA/​ISO 10218–1 [7]. This is very sig­nif­i­cant, but we need to deal with this old dis­cus­sion first.

Systems vs. Circuits

The CSA stan­dard uses the term “con­trol system(s)” through­out the def­i­n­i­tions of the cat­e­gories, while the ANSI/​RIA stan­dard uses the term “circuit(s)”. This is really the crux of the dis­cus­sion between these two stan­dards. While the dif­fer­ence between the terms may seem insignif­i­cant at first, you need to under­stand the back­ground to get the difference.

The CSA term requires two sep­a­rate sens­ing devices on the gate or other guard, just as the Category 3 and 4 def­i­n­i­tions do, and for the same rea­son. The CSA com­mit­tee felt that it was impor­tant to be able to detect all sin­gle faults, includ­ing mechan­i­cal ones. Also, the use of two inter­lock­ing devices on the guard makes it more dif­fi­cult to bypass the interlock.

The RIA term requires redun­dant elec­tri­cal con­nec­tions to the inter­lock­ing device, but implic­itly allows for a sin­gle inter­lock­ing device because it only explic­itly refers to “circuits”.

The expla­na­tion I’ve been given for the dis­crep­ancy is rooted in the early days of indus­trial robot­ics. Many early robot cells had NO inter­locks on the guard­ing because the haz­ards related to the robot motion was not well under­stood. There were a num­ber of inci­dents result­ing in fatal­i­ties that drove robot users to begin to seek bet­ter ways to pro­tect work­ers. The RIA R15.06 com­mit­tee decided that inter­locks were needed, but there was a recog­ni­tion that many users would balk at installing expen­sive inter­lock devices, so they com­pro­mised and allowed that ANY kind of inter­lock­ing device was bet­ter than none. This was amended in the 1999 edi­tion to require that com­po­nents be “safety rated”, effec­tively elim­i­nat­ing the use of con­ven­tional prox­im­ity switches and non-​​safety-​​rated limit switches.

The recent revi­sion of ANSI/​RIA R15.06 to include ANSI/​ISO 10218–1 as a replace­ment for Section 4 is sig­nif­i­cant for a cou­ple of rea­sons: 1) It now means that the robot itself need only meet the ISO stan­dard; instead of the ISO and the RIA stan­dards; and 2) It brings in ISO 13849–1 def­i­n­i­tions of reli­a­bil­ity cat­e­gories. This means that the US has now offi­cially dropped the “SIMPLE, SINGLE-​​CHANNEL,” etc. def­i­n­i­tions and now uses “Category B, 1, etc.” However, they have only adopted the Edition 1 ver­sion of the stan­dard, so none of the PL, MTTFd, etc. cal­cu­la­tions have been adopted. This means that the RIA stan­dard is now har­mo­nized to the 1995 edi­tion of EN 954–1. These updates to the 2006 edi­tion may come in sub­se­quent edi­tions of R15.06.

CSA has cho­sen to reaf­firm the 2003 edi­tion of CSA Z434, so the Canadian National Standard con­tin­ues to refer to the old definitions.

North America vs International Standards

In the descrip­tion of single-​​channel sys­tems /​ cir­cuits under the North American stan­dards you will notice that par­tic­u­lar atten­tion is paid to includ­ing descrip­tions of the use of “proven designs” and “positive-​​break devices”. What the TC’s were refer­ring to are the same “well-​​tried safety prin­ci­ples” and “well-​​tried com­po­nents” as referred to in the International stan­dards, only with less descrip­tion of what those might be. The only major addi­tion to the def­i­n­i­tions is the rec­om­men­da­tion to use “safety-​​rated devices”, which is not included in the International stan­dard. (N.B. The use of the word “should” in the def­i­n­i­tions should be under­stood as a strong rec­om­men­da­tion, but not nec­es­sar­ily a manda­tory require­ment.) Under EN 954–1 [4] and EN 1088 [5] (in the ref­er­enced edi­tions, in any case) it was pos­si­ble to use stan­dard limit switches arranged in a redun­dant man­ner and acti­vated using com­bined pos­i­tive and non-​​positive-​​mode acti­va­tion. In later edi­tions this changed, and there is now a pref­er­ence for devices intended for use in safety applications.

Also worth not­ing is that there is NO allowance for fault exclu­sion under the CSA stan­dard or the 1999 edi­tion of the ANSI standard.

As far as the RIA committee’s asser­tion that their def­i­n­i­tions are not equiv­a­lent to the International stan­dard, and may be supe­rior, I think that there are too may miss­ing qual­i­ties in the ANSI stan­dard for that to stand. In any case, this is now moot, since ANSI has adopted EN ISO 13849–1:2006 as a ref­er­ence to EN ISO 10218–1 [6], replac­ing Section 4 of ANSI/​RIA R15.06–1999.

References

[1] “Safety of machin­ery — Safety-​​related parts of con­trol sys­tems — Part 1: General prin­ci­ples for design”, ISO 13849–1, Edition 2, International Organization for Standardization (ISO), Geneva, 2006.

[2] “Safeguarding of machin­ery”, CSA Z432, Canadian Standards Association (CSA), Toronto, 2004.

[3] “American National Standard for Industrial Robots and Robot Systems — Safety Requirements”, ANSI/​RIA R15.06, American National Standards Institute, Inc. (ANSI), Ann Arbor, 1999.

[4] “Safety of machin­ery — Safety related parts of con­trol sys­tems — Part 1. General prin­ci­ples for design”, EN 954–1, European Committee for Standardization (CEN), Geneva, 1996.

[5] “Safety of machin­ery — Interlocking devices asso­ci­ated with guards — Principles for design and selec­tion”, EN 1088, CEN, Geneva, 1995.

[6] “Robots and robotic devices — Safety require­ments for indus­trial robots — Part 1: Robots”, European Committee for Standardization (CEN), Geneva, 2011.

[7] “Robots for Industrial Environment — Safety Requirements — Part 1 — Robot”, ANSI/​RIA/​ISO 10218–1, American National Standards Institute, Inc. (ANSI), Ann Arbor, 2007.

Copyright secured by Digiprove © 2011–2012
Acknowledgements: See ref­er­ences listed at end of article.
Some Rights Reserved

Interlock Architectures – Pt. 5: Category 4 — Control Reliable

Posted by on September 26, 2011 Comments Off
This entry is part 5 of 8 in the series Circuit Architectures Explored

The most reli­able of the five sys­tem archi­tec­tures, Category 4 is the only archi­tec­ture that uses multiple-​​fault tol­er­ant tech­niques to help ensure that com­po­nent fail­ures do not result in an unac­cept­able expo­sure to risk. This post will delve into the depths of this archi­tec­ture in this install­ment on sys­tem archi­tec­tures. The def­i­n­i­tions and require­ments dis­cussed in this arti­cle come from ISO 13849–1, Edition 2 (2006) and ISO 13849–2, Edition 1 (2003).

As with pre­ced­ing arti­cles in this series, I’ll be build­ing on con­cepts dis­cussed in those arti­cles. If you need more infor­ma­tion, you should have a look at the pre­vi­ous arti­cles to see if I’ve answered your ques­tions there.

The Definition

The Category 4 def­i­n­i­tion builds on both Category B and Category 3. As you read, recall that “SRP/​CS” stands for “Safety Related Parts of the Control System”. Here is the com­plete definition:

6.2.7 Category 4
For cat­e­gory 4, the same require­ments as those accord­ing to 6.2.3 for cat­e­gory B shall apply. “Well-​​tried safety prin­ci­ples” accord­ing to 6.2.4 shall also be fol­lowed. In addi­tion, the fol­low­ing applies.
SRP/​CS of cat­e­gory 4 shall be designed such that

  • a sin­gle fault in any of these safety-​​related parts does not lead to a loss of the safety func­tion, and
  • the sin­gle fault is detected at or before the next demand upon the safety func­tions, e.g. imme­di­ately, at switch on, or at end of a machine oper­at­ing cycle, but if this detec­tion is not pos­si­ble, then an accu­mu­la­tion of unde­tected faults shall not lead to the loss of the safety function.

The diag­nos­tic cov­er­age (DCavg) of the total SRP/​CS shall be high, includ­ing the accu­mu­la­tion of faults. The MTTFd of each of the redun­dant chan­nels shall be high. Measures against CCF shall be applied (see
Annex F).

NOTE 1 Category 4 sys­tem behav­iour allows that

  • when a sin­gle fault occurs the safety func­tion is always performed,
  • the faults will be detected in time to pre­vent the loss of the safety function,
  • accu­mu­la­tion of unde­tected faults is taken into account.

NOTE 2 The dif­fer­ence between cat­e­gory 3 and cat­e­gory 4 is a higher DCavg in cat­e­gory 4 and a required MTTFd of each chan­nel of “high” only.

In prac­tice, the con­sid­er­a­tion of a fault com­bi­na­tion of two faults may be sufficient.

5% Discount on ISO and IEC Standards with code: CC2011

Breaking it down

For cat­e­gory 4, the same require­ments as those accord­ing to 6.2.3 for cat­e­gory B shall apply. “Well-​​tried safety prin­ci­ples” accord­ing to 6.2.4 shall also be followed.

The first two sen­tences give the basic require­ment for all the cat­e­gories from 2 through 4. Sound com­po­nent selec­tion based on the appli­ca­tion require­ments for volt­age, cur­rent, switch­ing capa­bil­ity and life­time must be con­sid­ered. In addi­tion, using well tried safety prin­ci­ples, such as switch­ing the +V rail side of the coil cir­cuit for con­trol com­po­nents is required. If you aren’t sure about what con­sti­tutes a “well-​​tried safety prin­ci­ple”, see the arti­cle on Category 2 where this is dis­cussed. Don’t con­fuse “well-​​tried safety prin­ci­ples” with “well-​​tried com­po­nents”. There is no require­ment in Category 4 for the use of well-​​tried com­po­nents, although you can use them for addi­tional reli­a­bil­ity if the design require­ments warrant.

In addi­tion, the fol­low­ing applies.
SRP/​CS of cat­e­gory 4 shall be designed such that

  • a sin­gle fault in any of these safety-​​related parts does not lead to a loss of the safety func­tion, and
  • the sin­gle fault is detected at or before the next demand upon the safety func­tions, e.g. imme­di­ately, at switch on, or at end of a machine oper­at­ing cycle, but if this detec­tion is not pos­si­ble, then an accu­mu­la­tion of unde­tected faults shall not lead to the loss of the safety function.

This is the big one. This para­graph, and the two bul­lets that fol­low it, define the fun­da­men­tal per­for­mance require­ments for this cat­e­gory. No sin­gle fault can lead to the loss of the safety func­tion in Category 4, and test­ing is required that can detect fail­ures and pre­vent an accu­mu­la­tion of faults that could even­tu­ally lead to the loss of the safety func­tion. The sec­ond bul­let is the one that defines the multiple-​​fault-​​tolerance require­ment for this cat­e­gory. If you go back to the def­i­n­i­tion of Category 3, you will see that an accu­mu­la­tion of faults may lead to the loss of the safety func­tion in that Category. This is the key dif­fer­ence between the cat­e­gories in my opinion.

The diag­nos­tic cov­er­age (DCavg) of the total SRP/​CS shall be high, includ­ing the accu­mu­la­tion of faults. The MTTFd of each of the redun­dant chan­nels shall be high. Measures against CCF shall be applied (see
Annex F).

These three sen­tences give the designer the cri­te­ria for diag­nos­tic cov­er­age, chan­nel fail­ure rates and com­mon cause fail­ure pro­tec­tion. As you can see, the abil­ity to diag­nose fail­ures auto­mat­i­cally is a crit­i­cal part of the design, as is the use of highly reli­able com­po­nents, lead­ing to highly reli­able chan­nels. The strongest CCF pro­tec­tion you can include in the design is also needed, although the “pass­ing score” of 65 remains unchanged (see Annex F in ISO 13849–1 for more details on scor­ing your design).

NOTE 1 Category 4 sys­tem behav­iour allows that

  • when a sin­gle fault occurs the safety func­tion is always performed,
  • the faults will be detected in time to pre­vent the loss of the safety function,
  • accu­mu­la­tion of unde­tected faults is taken into account.

Note 2: …In prac­tice, the con­sid­er­a­tion of a fault com­bi­na­tion of two faults may be sufficient.

Note 1 expands on the first para­graph in the def­i­n­i­tion, fur­ther clar­i­fy­ing the per­for­mance require­ments by explicit state­ments. Notice that nowhere is there a require­ment that sin­gle faults or accu­mu­la­tion of sin­gle faults be pre­vented, only detected by the diag­nos­tic sys­tem. Prevention of sin­gle faults is nearly impos­si­ble, since com­po­nents do fail. It is impor­tant to first under­stand which com­po­nents are crit­i­cal to the safety func­tion, and sec­ond, what kinds of faults each com­po­nent is likely to have, is fun­da­men­tal to being able to design a diag­nos­tic sys­tem that can detect the faults.

The cat­e­gory relies on redun­dancy to ensure that the com­plete loss of one chan­nel will not cause the loss of the safety func­tion, but this is only use­ful if the com­mon cause fail­ures have been prop­erly dealt with. Otherwise, a sin­gle event could wipe out both chan­nels simul­ta­ne­ously, caus­ing the loss of the safety func­tion and pos­si­bly result in an injury or fatality.

Also notice that mul­ti­ple sin­gle faults are per­mit­ted, as long as the accu­mu­la­tion does not result in the loss of the safety func­tion. ISO 13849 allows for “fault exclu­sion”, a con­cept that is not used in the North American standards.

The final sen­tence from Note 2 sug­gests that con­sid­er­a­tion of two con­cur­rent faults may be enough, but be care­ful. You need to look closely at the fault lists to see if there are any groups of high prob­a­bil­ity faults that are likely to occur con­cur­rently. IF there are, you need to assess these com­bi­na­tions of faults, whether there are 5 or 50 to be evaluated.

Fault Exclusion

Fault exclu­sion involves assess­ing the types of faults that can occur in each com­po­nent in the crit­i­cal path of the sys­tem. The deci­sion to exclude cer­tain kinds of faults is always a tech­ni­cal com­pro­mise between the the­o­ret­i­cal improb­a­bil­ity of the fault, the exper­tise of the designer(s) and engi­neers involved and the spe­cific tech­ni­cal require­ments of the appli­ca­tion. Whenever the deci­sion is made to exclude a par­tic­u­lar type of fault, the deci­sion and the process used to make it must be doc­u­mented in the Reliability Report included in the design file. Section 7.3 of ISO 13849–1 pro­vides guid­ance on fault exclusion.

In the sec­tion dis­cussing Category 1, the stan­dard has this to say about fault exclu­sion, and the dif­fer­ence between “well-​​tried com­po­nents” and “fault exclusion”:

It is impor­tant that a clear dis­tinc­tion between “well-​​tried com­po­nent” and “fault exclu­sion” (see Clause 7) be made. The qual­i­fi­ca­tion of a com­po­nent as being well-​​tried depends on its appli­ca­tion. For exam­ple, a posi­tion switch with pos­i­tive open­ing con­tacts could be con­sid­ered as being well-​​tried for a machine tool, while at the same time as being inap­pro­pri­ate for appli­ca­tion in a food indus­try — in the milk indus­try, for instance, this switch would be destroyed by the milk acid after a few months. A fault exclu­sion can lead to a very high PL, but the appro­pri­ate mea­sures to allow this fault exclu­sion should be applied dur­ing the whole life­time of the device. In order to ensure this, addi­tional mea­sures out­side the con­trol sys­tem may be nec­es­sary. In the case of a posi­tion switch, some exam­ples of these kinds of mea­sures are

  • means to secure the fix­ing of the switch after its adjustment,
  • means to secure the fix­ing of the cam,
  • means to ensure the trans­verse sta­bil­ity of the cam,
  • means to avoid over-​​travel of the posi­tion switch, e.g. ade­quate mount­ing strength of the shock absorber and any align­ment devices, and
  • means to pro­tect it against dam­age from outside.

To assist the designer, ISO 13849–2 pro­vides lists of typ­i­cal faults and the allow­able exclu­sions in Annex D.5. As an exam­ple, let’s con­sider the typ­i­cal sit­u­a­tion where a robust guard inter­lock­ing device has been selected. The deci­sion has been made to use redun­dant elec­tri­cal cir­cuits to the switch­ing com­po­nents in the inter­lock, so elec­tri­cal faults can be detected. But what about mechan­i­cal fail­ures? A fault list is needed:

 Interlock Mechanical Fault List
#Fault DescriptionResultLikelihood
1Key breaks offControl sys­tem can­not deter­mine guard posi­tion. Complete fail­ure of sys­tem through a sin­gle fault.Unlikely
2Screws mount­ing key to guard failControl sys­tem can­not deter­mine guard posi­tion. Complete fail­ure of sys­tem through a sin­gle fault.Unlikely
3Screws mount­ing inter­lock device to guard failControl sys­tem can­not deter­mine guard posi­tion. Complete fail­ure of sys­tem through a sin­gle fault.Unlikely
4Key and inter­lock device misaligned.Guard can­not close, pre­vent­ing machine from operating.Very likely
5Key and inter­lock device misaligned.Key and /​ or inter­lock device dam­aged. Guard may not close, or the key may jam in the inter­lock device once closed. Machine is inop­er­a­ble if the inter­lock can­not be com­pleted, or the guard can­not be opened if the key jams in the device.Likely
6Screws mount­ing key to guard removed by user.Interlock can now be bypassed by fix­ing the key into the inter­lock­ing device. Control sys­tem can no longer sense the posi­tion of the guard.Likely
7Screws mount­ing inter­lock device to guard removed by userProbably com­bined with the pre­ced­ing con­di­tion. Control sys­tem can no longer sense the posi­tion of the guard.Unlikely, but could happen.

There may be more fail­ure modes, but for the pur­pose of this dis­cus­sion, lets limit them to this list.

Looking at Fault 1, there are a num­ber of things that could result in a bro­ken key. They include: mis­align­ment of the key and the inter­lock device, lack of main­te­nance on the guard and the inter­lock­ing hard­ware, or inten­tional dam­age by a user. Unless the hard­ware is excep­tion­ally robust, includ­ing the design of the guard and any align­ment fea­tures incor­po­rated in the guard­ing, devel­op­ing sound ratio­nale for exclud­ing this fault will be very difficult.

Fault 2 con­sid­ers mechan­i­cal fail­ure of the mount­ing screws for the inter­lock key. Screws are con­sid­ered to be well-​​tried com­po­nents (see Annex A.5), so you can con­sider them for fault exclu­sion. You can improve their reli­a­bil­ity by using thread lock­ing adhe­sives when installing the screws to pre­vent them from vibrat­ing loose, and “tamper-​​proof” style screw heads to deter unau­tho­rized removal. Inclusion of these meth­ods will sup­port any deci­sion to exclude these faults. This goes to address­ing faults 3, 6 and 7 as well.

Faults 4 & 5 occur fre­quently and are often caused by poor device selec­tion (i.e. an inter­lock device intended for straight-​​line sliding-​​gate appli­ca­tions is cho­sen for a hinged gate), or by poor guard design (i.e. the guard is poorly guided by the reten­tion mech­a­nism and can be closed in a mis­aligned con­di­tion). Rationale for pre­ven­tion of these faults will need to include dis­cus­sion of design fea­tures that will pre­vent these conditions.

Excluding any other kind of fault fol­lows the same process: Develop the fault list, assess each fault against the rel­e­vant Annex from ISO 13849–2, deter­mine if there are pre­ven­ta­tive mea­sures that can be designed into the prod­uct and whether these pro­vide suf­fi­cient risk reduc­tion to allow the exclu­sion of the fault from consideration.

DCavg and MTTFd requirements

NOTE 2 The dif­fer­ence between cat­e­gory 3 and cat­e­gory 4 is a higher DCavg in cat­e­gory 4 and a required MTTFd of each chan­nel of “high” only.

The first sen­tence in Note 2 clar­i­fies the two main dif­fer­ences from a design stand­point, aside from the addi­tional fault tol­er­ance require­ments: Better diag­nos­tics are required and much higher require­ments for indi­vid­ual com­po­nent, and there­fore chan­nel, MTTFd.

The Block Diagram

The block dia­gram for Category 4 is almost iden­ti­cal to Category 3, and was updated by Corrigendum 1 to the dia­gram shown below. The text from the cor­ri­gen­dum that accom­pa­nies the dia­gram has this to say about the change:

Replace the draw­ing show­ing the des­ig­nated archi­tec­ture for cat­e­gory 4 with the fol­low­ing draw­ing. This
cor­rects the arrowed lines labeled “m” between L1 and O1, and L2 and O2, by chang­ing them from dashed to solid lines, rep­re­sent­ing higher diag­nos­tic coverage.

I’ve high­lighted this area using red ovals on Figure 12 to make it eas­ier to see .

ISO 13849-1 Figure 12 - Category 4 Block Diagram

ISO 13849–1 Figure 12 — Category 4 Block Diagram

Here is Figure 11 for com­par­i­son. Notice that the “m” lines are solid in Figure 12 and dashed in Figure 11? Subtle, but sig­nif­i­cant! There are no other dif­fer­ences between the diagrams.

ISO 13849-1 Figure 11I went look­ing for a cir­cuit dia­gram to sup­port the block dia­gram, but wasn’t able to find one from a com­mer­cial source that I could share with you. Considering that the pri­mary dif­fer­ences are in the reli­a­bil­ity of the com­po­nents cho­sen and in the way the test­ing is done, this isn’t too sur­pris­ing. The basic phys­i­cal con­struc­tion of the two cat­e­gories can be vir­tu­ally identical.

Applications

The fol­low­ing is not from the stan­dards — this is my per­sonal opin­ion, based on 15 years of practice.

In the past, many man­u­fac­tur­ers decided that they were going to apply Category 4 archi­tec­ture with­out really under­stand­ing the design impli­ca­tions, because they believed that it was “the best”. With the change in the har­mo­niza­tion of EN 954–1 and ISO 13849–1 under the EU machin­ery direc­tive that comes into force on 29-​​Dec-​​2011, and con­sid­er­ing the great dif­fi­culty that many man­u­fac­tur­ers had in prop­erly imple­ment­ing EN 954–1, I can eas­ily imag­ine man­u­fac­tur­ers who have taken the approach that they already have Category 4 SRP/​CS on their sys­tems and mak­ing the state­ment that they now have PLe SRP/​CS sys­tem per­for­mance. This is a bad deci­sion for a lot of reasons:

  1. ISO 13849–1 PLe, Category 4 sys­tems should be reserved for very dan­ger­ous machin­ery where the tech­ni­cal effort and expense involved is war­ranted by the risk assess­ment. Attempting to apply this level of design to machin­ery where a PLb per­for­mance level is more suit­able based on a risk assess­ment, is a waste of design time and effort and a need­less expense. The prod­uct fam­ily stan­dards for these types of machines, such as EN 201 for plas­tic injec­tion mould­ing machines, or EN 692 for Mechanical Power Presses or EN 693 for Hydraulic Power Presses will explic­itly spec­ify the PL level required for these machines.
  2. Manufacturers have fre­quently claimed EN 954–1 Category 4 per­for­mance based on the rat­ing of the safety relay alone, with­out under­stand­ing that the rest of the SRP/​CS must be con­sid­ered, and clearly this is wrong. The SRP/​CS must be eval­u­ated as a com­plete system.

This lack of under­stand­ing endan­gers the users, the main­te­nance per­son­nel, the own­ers and the man­u­fac­tur­ers. If they con­tinue this approach and an injury occurs, it is my opin­ion that the courts will have more than enough evi­dence in the defendant’s pub­lished doc­u­ments to cause some seri­ous legal grief.

As design­ers involved with the safety of our company’s prod­ucts or with our co-worker’s safety, I believe that we owe it to every­one who uses our prod­ucts to be edu­cated and to cor­rectly apply these con­cepts. The fact that you have read all of the posts lead­ing up to this one is evi­dence that you are work­ing on get­ting educated.

Always con­duct a risk assess­ment and use the out­come from that work to guide your selec­tion of safe­guard­ing mea­sures, com­ple­men­tary pro­tec­tive mea­sures and the per­for­mance of the SRP/​CS that ties those sys­tems together. Choose per­for­mance lev­els that make sense based on the required risk reduc­tion and ensure that the design cri­te­ria is met by val­i­dat­ing the sys­tem once built.

As always, I wel­come your com­ments and ques­tions! Please feel free to com­ment below. I will respond to all your comments.

Copyright secured by Digiprove © 2011–2012
Acknowledgements: ISO for excerpts from ISO 13849–1 and more…
Some Rights Reserved

All original content on these pages is fingerprinted and certified by Digiprove
Performance Optimization WordPress Plugins by W3 EDGE