Machinery Safety 101

Understanding Safety Functions: the start/restart function

After the safety-related stop­ping and the reset func­tions, the start/restart func­tion is the next most com­mon. Without a start/restart func­tion, there is no way to make the machine do what it’s sup­posed to do. If you’re design­ing a machine con­trol sys­tem, you need to under­stand this function.

Start­ing the machine ini­tially is a manu­al func­tion. Whatever pre-start­ing checks need to be made, and when all is ready, press­ing the start but­ton ini­ti­ates the machine’s func­tion. The doc­u­ment­a­tion for the machine should include pre-start­ing check­lists and instruc­tions to help ensure that all the safety-related pre-start­ing con­di­tions are met before the START but­ton is pressed.

RE-start­ing the machine is anoth­er thing alto­geth­er. Restarts can be manu­al or auto­mat­ic, depend­ing on the type of machine, and the con­di­tions of its use. Machines that are designed to be used unat­ten­ded, like pumps, for example, may need to be able to restart auto­mat­ic­ally after a power loss or oth­er con­di­tion that forces a stop.

Risk Assessment considerations

As with any con­trol func­tion, determ­in­ing wheth­er it’s a safety func­tion or just a con­trol func­tion is the first step. When you are work­ing on the risk assess­ment for the machine, do a start-stop ana­lys­is to bet­ter under­stand what is going on when you are stop­ping and start­ing the machine. You need to ana­lyze what is going on at the moment that the start func­tion is activ­ated, includ­ing what move­ments will begin, the sequence (if any) that must occur for safe start­ing, and what haz­ards are present dur­ing start­ing. Think about the fail­ure modes that could occur, i.e., the start­ing sequence is broken for some reas­on, caus­ing out-of-sequence start­ing. What happens?

Once you have the start­ing pro­cess ana­lyzed, you can decide if there are any haz­ards cre­ated by the start­ing of the machine, and there­fore if it’s a safety func­tion. If haz­ards are present, or if a fail­ure mode in the start­ing pro­cess can cre­ate a haz­ard, it’s a safety func­tion. If no haz­ards are present, and none can be cre­ated, it’s a con­trol function.

Risk considerations for automatic restart

Go through the same pro­cess for restart­ing. If haz­ards are present, or if a fail­ure mode in the restart­ing pro­cess can cre­ate a haz­ard, it’s a safety func­tion. If no haz­ards are present, and none can be cre­ated, it’s a con­trol function.

Let’s get back to the require­ments in ISO 13849. When a decision is taken to use auto­mat­ic restart­ing, the next con­sid­er­a­tions must include any haz­ards that could be cre­ated by the auto­mat­ic restart­ing of the machine or the pos­sib­il­ity that work­ers could be exposed to machine haz­ards unex­pec­tedly if the machine were to attempt to restart auto­mat­ic­ally. Any haz­ards that are found must have appro­pri­ate mit­ig­a­tion meas­ures applied, includ­ing reject­ing the use of auto­mat­ic restarting.

Interlock bypass or defeat

Where auto­mat­ic restart­ing is used, the pos­sib­il­ity of defeat­ing or bypassing the inter­lock­ing device must be care­fully con­sidered. ISO 14119 [3] has a good tool in the Annexes that can help determ­ine how likely it may be for a work­er to attempt to bypass the interlocks.

If the design includes the pro­vi­sion of a guard muting/bypass mode, the design should include fea­tures that will inter­rupt the con­trol guard or PSDI modes, and lock them out until the oper­a­tion of the guard­ing is restored. 

Once you have decided that the start/restart func­tion is a safety func­tion, then the require­ments in ISO 13849 – 1 [1] apply.

Requirements

Here are the require­ments from ISO 13849 – 1:


5.2.3 Start/restart func­tion
The fol­low­ing applies in addi­tion to the require­ments of Table 8.

A restart shall take place auto­mat­ic­ally only if a haz­ard­ous situ­ation can­not exist. In par­tic­u­lar, for inter­lock­ing guards with a start func­tion, ISO 12100:2010, 6.3.3.2.5, applies.

These require­ments for start and restart shall also apply to machines which can be con­trolled remotely.

NOTE A sensor feed­back sig­nal to the con­trol sys­tem can ini­ti­ate an auto­mat­ic restart.

EXAMPLE In auto­mat­ic machine oper­a­tions, sensor feed­back sig­nals to the con­trol sys­tem are often used to con­trol the pro­cess flow. If a work piece has come out of pos­i­tion, the pro­cess flow is stopped. If the mon­it­or­ing of the inter­locked safe­guard is not super­i­or to the auto­mat­ic pro­cess con­trol, there could be a danger of restart­ing the machine while the oper­at­or read­justs the work piece. There­fore the remotely con­trolled restart ought not to be allowed until the safe­guard is closed again and the main­tain­er has left the haz­ard­ous area. The con­tri­bu­tion of pre­ven­tion of unex­pec­ted start-up provided by the con­trol sys­tem is depend­ent on the res­ult of the risk assessment.

ISO 13849-1 Start/restart function. Table 8 showing standards applicable to the defined safety functions.
[1, Table 8]
ISO 13849 – 1:2015

Control guards

ISO 13849 – 1 ref­er­ence the require­ments for inter­lock­ing guards with a start func­tion, also called a “con­trol guard”, in ISO 12100, clause 6.3.3.2.5 [2]. This type of guard is sim­il­ar in func­tion to the “pres­ence-sens­ing device ini­ti­ation (PSDI)” applic­a­tion that is some­times used with light cur­tains in short-cycle machines. In a PSDI applic­a­tion, each time the work­er breaks the light cur­tain field and then clears it the machine will start the next cycle. A con­trol guard is a phys­ic­al, mech­an­ic­al guard with an inter­lock­ing device. The guard must be opened to place parts or do some­thing else that the machine needs each cycle, and then closed again to start the machine cycle. Con­trol guards gen­er­ally can­’t sup­port the cycle rates that are achiev­able with a light cur­tain in PSDI mode, but it’s still faster, and often ergo­nom­ic­ally bet­ter, than requir­ing the oper­at­or to press a sep­ar­ate cycle start but­ton for each cycle. Con­trol guards aren’t used that often in my exper­i­ence. Let’s look at [2, 6.3.3.2.5] since these require­ments build on those from [1].


6.3.3.2.5 Require­ments for inter­lock­ing guards with a start func­tion (con­trol guards)

An inter­lock­ing guard with a start func­tion may only be used provided that

  1. all require­ments for inter­lock­ing guards are sat­is­fied (see ISO 14119),
  2. the cycle time of the machine is short,
  3. the max­im­um open­ing time of the guard is pre­set to a low value (for example, equal to the cycle time) and, when this time is exceeded, the haz­ard­ous function(s) can­not be ini­ti­ated by the clos­ing of the inter­lock­ing guard with a start func­tion and reset­ting is neces­sary before restart­ing the machine,
  4. the dimen­sions or shape of the machine do not allow a per­son, or part of a per­son, to stay in the haz­ard zone or between the haz­ard zone and the guard while the guard is closed (see ISO 14120),
  5. all oth­er guards, wheth­er fixed (remov­able type) or mov­able, are inter­lock­ing guards,
  6. the inter­lock­ing device asso­ci­ated with the inter­lock­ing guard with a start func­tion is designed such that for example, by duplic­a­tion of pos­i­tion detect­ors and use of auto­mat­ic mon­it­or­ing (see 6.2.11.6) – its fail­ure can­not lead to an unintended/unexpected start-up, and
  7. the guard is securely held open (for example, by a spring or coun­ter­weight) such that it can­not ini­ti­ate a start while fall­ing by its own weight.
ISO 12100:2010

It’s worth­while know­ing that there is no defin­i­tion for what a “short cycle time” is. That is entirely up to the engin­eer­ing exper­i­ence of the designer(s) work­ing on the pro­ject. There are also lim­it­a­tions based on the cycle time of the machine so that the guard must be closed with­in the nor­mal cycle time of the machine. This helps to pro­tect work­ers who get dis­trac­ted from the machine tend­ing activ­ity for any reason.

Remote start/restart

If the design of the machine includes the pos­sib­il­ity for remote restart­ing, for example, a sewage pump loc­ated in a remote pump­ing sta­tion, then the risk assess­ment must address the haz­ards that could be cre­ated by remote start­ing. Haz­ard­ous energy con­trol pro­ced­ures, includ­ing lock­out, are a start­ing point, but addi­tion­al meas­ures, e.g., CCTV, may be needed. Addi­tion­al admin­is­trat­ive con­trols, like per­mit-to-work pro­ced­ures, may also be needed.

Start controls on an HMI

Unlike the safety-related stop and reset func­tions, there are no pro­hib­i­tions in [1] that would pre­vent using an HMI screen graph­ic as a start con­trol. Depend­ing on the haz­ards involved in the oper­a­tions and the related risks, it may not be advis­able. The only way to answer this ques­tion is via a risk assess­ment.


References

[1] Safety of machinery — Safety-related parts of con­trol sys­tems — Part 1: Gen­er­al prin­ciples for design, ISO 13849 – 1. Inter­na­tion­al Organ­iz­a­tion for Stand­ard­iz­a­tion (ISO), Geneva. 2015.

[2] Safety of machinery — Gen­er­al prin­ciples for design — Risk assess­ment and risk reduc­tion, ISO 12100. Inter­na­tion­al Organ­iz­a­tion for Stand­ard­iz­a­tion (ISO), Geneva. 2010.

[3] Safety of machinery — Inter­lock­ing devices asso­ci­ated with guards — Prin­ciples for design and selec­tion, ISO 14119. Inter­na­tion­al Organ­iz­a­tion for Stand­ard­iz­a­tion (ISO), Geneva.

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.