This post continues the discussion on safety-related parameters by expanding the discussion to the effects of fluctuations, loss and restoration of power sources. While this topic most commonly refers to the mains supply voltage, it can also describe these effects in internal control system power supplies, and pneumatic or hydraulic sources.

TL;DR

Control systems must be protected against mechanical, electrical or fluid fluctuations and power loss. Fluctuations and losses are well defined by IEC, IEEE and ISO standards. Careful design of electrical systems, including the use of UPSs for electrical control systems and the careful design of pneumatic supply systems, including the proper sizing of pneumatic accumulators for compressed air-powered logic, is essential. Safety functions should be designed to “lock out” in a safe state, requiring intentional actions by users to restart the machine safely.

Contents

Fluctuations, loss and restoration of power sources

To better understand this topic, we need to get a definition for the “fluctuations or loss and restoration” of a power source. ISO 13849-1 [1] gives us that definition in clause 5.2.8.

Definition:

5.2.8 Fluctuations, loss and restoration of power sources
The following applies in addition to the requirements of Table 9.
When fluctuations in energy levels outside the design operating range occur, including loss of energy supply, the SRP/CS shall continue to provide or initiate output signal(s) which will enable other parts of the machine system to maintain a safe state.

ISO 13849-1:2015

Let’s break out the key ideas in the definition. I’ve highlighted them for you below.

When fluctuations in energy levels outside the design operating range occur, including loss of energy supply, the SRP/CS shall continue to provide or initiate output signal(s) which will enable other parts of the machine system to maintain a safe state.

[1, 5.2.8]

Let’s take each of these ideas one at a time.

Design operating range

Every technical power system has a designed operating range. There are technical standards that give us standard ranges for these power sources, for example:

• IEC 60038, IEC Standard Voltages [2]
• ISO 2944, Fluid power systems and components — Nominal pressures [3]

These standards provide engineers with common standard values for design. This does not mean that you won’t find systems that operate outside these values, but this is less likely than it once was.

The nominal values will also have a tolerance associated with them. For example, IEC 60204-1 [4] includes these clauses:

4.3.2 AC supplies

4.3.3 DC supplies

From batteries:

From converting equipment:

As you can see in clauses 4.3.2 and 4.3.3, the nominal voltages are not specified, see IEC 60038 for that, but the voltage tolerance is given. This is design tolerance centred around the nominal voltage.

Defining electrical voltage fluctuations

As you can see in clauses 4.3.2 and 4.3.3 above, the voltage fluctuations and interruptions are specified clearly. In clause 4.3.3, the specifications are somewhat different from those for AC systems due to the different sources used for DC supply. Control system DC power supplies must meet this requirement if you design the machine to conform to IEC 60204-1. Other control system design standards, such as NFPA 79 and CSA C22.2 No. 301, may have somewhat different values due to the nature of the electrical systems in Canada and the USA. Use the specifications that are appropriate for the installation location.

Focusing on the [4, 4.3.2] AC specifications for voltage fluctuations will help to understand what this means for your designs.

The effects of undervoltages, overvoltages and other electromagnetic (EM) effects vary widely. Nevertheless, they must be considered in the design of control systems.

Undervoltage

Undervoltage conditions are also called “sags” and “dips.”

Undervoltage is classified as a Long-duration Voltage Variation phenomenon. Long-duration voltage variation is commonly defined as the root-mean-square (RMS) value deviation at power frequencies for longer than one (1) minute. It is important to note that one minute or more duration differentiates an undervoltage condition from short-duration voltage variations such as voltage sags [5].

Undervoltage is described by IEEE 1159 [6] as the decrease in the AC voltage (RMS), typically to 80% – 90% of nominal, at the power frequency, for a period greater than 1 minute.

Undervoltage occurs when the average voltage of a three-phase power system drops below the intended levels and is sometimes referred to as a “brownout.” IEEE [6] discourages using the term “brownout” to describe undervoltage phenomena because there is no formal definition for the term, and it is not as clear as the term undervoltage.

Effects of undervoltage on equipment

Electromechanical devices, including three-phase motors, operate at specific voltage levels. If these devices are allowed to operate at reduced voltage levels, they will draw higher currents, resulting in increased heat in the windings of the equipment and damaging the insulation.

Like electromechanical equipment, power converters draw more current at lower mains voltages, causing the rectifiers to run hotter than normal. Power conversion equipment, like servo- and variable-frequency drives or AC-to-DC power supplies, can be somewhat more forgiving of fluctuations in the AC mains supply; however, they have their limits.

In linear DC power supplies, the mains voltage is first transformed to a lower voltage and then rectified and regulated to supply the DC loads. Since the input to the regulators is proportional to the AC mains voltage, at some point, the input voltage to the regulators will not be high enough to keep the output voltage regulated, and the output voltages will fall below specification.

Protection against undervoltages

To protect motors and equipment against undervoltage, a three-phase monitor relay, also known as a phase failure relay, or for single-phase systems, an undervoltage relay, can be a cost-effective solution to prevent costly damage from undervoltage. A three-phase monitor relay with undervoltage protection will shut down equipment when undervoltage occurs, preventing damage. These relays indicate the fault present for rapid troubleshooting and reduced downtime.

Undervoltage problems may be alleviated by: 

1. Reducing the system impedance – increase the size of the transformer, reduce the line length, add series capacitors or increase the size of line conductors.
2. Improving the voltage profile – adjust transformers to the correct tap setting (for manual tap changers) or install voltage regulators or automatic on-load tap changers. Voltage regulators include mechanical tap changing voltage regulators, electronic tap switching voltage regulators and ferroresonant transformers.
3. Reducing the line current – reduce the load on the feeder or circuit by transferring some loads to other substations or load centers, add shunt capacitors or static VAR compensators or upgrade the line to the next voltage level.

The choice of the appropriate solution should be based on the effectiveness of the mitigating device considering its benefit-cost factor.

Overvoltage

Overvoltage is classified as a “Long-duration Voltage Variation” phenomenon. Long-duration voltage variation is commonly defined as the root-mean-square (RMS) value deviation at power frequencies for longer than one (1) minute [7]. Overvoltage is not the same as voltage surge, which will be discussed later.

The IEEE defines overvoltage as an increase in the AC voltage (RMS), typically to 110% – 120% of the nominal voltage at the power frequency for longer than 1 minute.

Effects of overvoltages

Electrical and electronic devices are designed to operate at a prescribed voltage range (rated voltage) to achieve specified efficiency, performance, reliability and safety levels. Subjecting electrical or electronic devices to overvoltage can lead to hardware overheating, malfunctioning, insulation failure, arcing, shut down and shorter operating life. This is particularly true for electronic devices (including appliances with sensitive electronics), which run hotter than normal and will fail prematurely. Also, overvoltage protection leads to equipment shutdown. Furthermore, a printed circuit board can be expected to have a shorter life when operated above its rated voltage for long periods.

Compared to electronic equipment, motors, transformers, and some power supplies may benefit from voltage levels slightly above the rated nominal voltage, as long that it is within the voltage limits for the equipment. This is because the increased voltage decreases current flow in the device, resulting in lower I²R losses in the copper windings. Thus, efficiency improves and the operating temperature decreases. The challenge becomes determining and maintaining a voltage level that maximizes efficiency for certain devices without adversely affecting the life or operation of other devices.

An overvoltage on an induction motor will cause an increase in the reactive component of the current, causing increased eddy current heating of the rotor core laminations and stress on the insulation.

Protection against overvoltages

Generally, overvoltages can be mitigated by:

1. Adjusting transformers to the correct tap setting (for manual tap changers) or installing voltage regulators or automatic on-load tap changers to improve the voltage profile. Voltage regulators include servo-mechanical tap switching voltage regulators, electronic tap switching voltage regulators and ferroresonant transformers.
2. Manually or automatically switching off excess capacitor banks during light load or off-peak hours.

The chosen solution should be evaluated based on its effectiveness, benefits, and costs.

Electrical power Loss

Defining electrical power loss

Power supply interruptions, which are a temporary loss of electrical power for not more than 3 ms at any random time in the supply cycle with more than 1 s between losses, can cause hazardous situations due to the effects on the control system. A typical supply interruption is shown in the figure below.

Power supply interruptions can affect different subsystems, like Programmable Logic Controllers (PLC) and variable frequency motor drives, in different ways.

Effects on PLCs

The Programmable Logic Controller (PLC) is ubiquitous in industrial control and automation systems. PLC manufacturers design PLCs to be very rugged and robust to assure longevity, reliability and safety. Yet, like any other microprocessor electronics, their reliability depends on a reliable power source. The level of reliability required from a PLC depends on the level of reliability demanded by the specific process being monitored and controlled. Some processes may tolerate a complete loss of power to the PLC, only requiring the PLC to reboot when power returns. In other applications, the PLC must remain fully functional to allow the process to continue and terminate to a known state even after a complete loss of power. Standard PLCs are evaluated to a less stringent set of requirements than safety PLCs [9].

The PLC, like other kinds of microprocessor-based equipment, has an internal switch-mode power supply. The PLC is typically powered from a standard AC supply or, in some cases, from a 24 V DC supply. From these sources, the power supply creates tightly regulated DC voltages vital to the proper operation of the PLC’s internal CPU, volatile memory chips and all of the other internal PLC electronics. These DC output voltages will stay within regulation over a wide mains supply voltage range. However, the acceptable voltage range is not infinite. Once the input voltage is out of its normal operational range, the critical DC output voltages will go out of regulation, causing the PLC to malfunction. This typically occurs during mains supply undervoltage conditions or due to momentary or sustained mains supply interruptions [9].

Safety PLCs

Safety functions require the control systems to use safety-rated PLCs. Safety PLCs are designed to reduce the probability of failure to a very low level through redundancy and diversity in their hardware design. They are designed to fail in a predictable, safe way. The hardware is subjected to extensive environmental (heat, cold, humidity) and EMC testing. The internal software and overall operation of the safety PLC is evaluated and certified by an independent safety agency like Underwriters Laboratories (UL) to established international standards [9].

Effects on Switch Mode Power Supplies

In a switch-mode power supply, the AC power enters the power converter through an input filter stage which will block high-frequency EMI from being conducted back to the incoming AC source. The filtered AC power is then rectified to DC and heavily filtered with large electrolytic capacitors. These capacitors also provide a power storage reservoir, allowing the power converter to ride through short power interruptions. 

An acceptable output voltage level is maintained to power the remaining power supply electronics. The duration of this ride-through time is conditional, dependent on the incoming a.c. voltage level. The power converter’s electrolytic capacitors are fully charged when the power source operates at a nominal voltage. They will provide enough energy to maintain the power converter for the maximum ride-through time while maintaining essential regulated DC output voltages to the PLC’s electronics. The ride-through time is typically over 500 milliseconds. 

If the power converter has a rated input voltage range of 80 to 140 V AC, the ride-through time will decrease as the AC input voltage decreases from its nominal 120 V a.c. level. If the PLC is installed in a location experiencing sustained 85 V a.c. “low-line” conditions, the ride-through time may be reduced to almost zero. Should a large motor start-up or any other condition occur that causes the AC line voltage to drop below 80 V AC for even a few milliseconds, it can cause the power supply output to go out of regulation resulting in a PLC fault or malfunction [9].

The PLC is not unique in having an internal switch-mode power supply. Typically, every switch, router, computer, server and device used in automation systems incorporates the same type of internal power supply. This includes telemetry equipment supporting the reporting of remote pipeline remote sensors. All switch mode power supply designs are not equal, but every critical device in an automation system is susceptible to fault conditions due to reduced ride-through times. Further, even when the full nominal line voltage is available a power interruption exceeding the power converter’s full ride-through capability will result in the same types of PLC and equipment failures [9].

Protecting Control Systems Against Power Interruptions

The most common way to protect control systems from power interruptions is through the use of a device called an uninterruptible power supply (UPS). UPSs use a double-conversion technique; the AC mains supply voltage is converted to DC, then used to charge a battery bank. The DC voltage from the battery bank is then converted back to AC using an inverter for use by the connected equipment.  Only double-conversion industrial UPSs offer the level of power conditioning and battery backup protection that critical industrial applications require. Since industrial conditions are often harsher than those in offices and homes, standard off-the-shelf consumer and computer-grade UPSs are unsuitable for industrial control systems [9].

Electrical design

Power system design is a discipline that takes more than a blog post, even a long one, to understand. However, there are some key points to take away:

• Power distribution systems experience under and over-voltage conditions. Depending on where the equipment is installed, these may be relatively rare or happen frequently.
• Power distribution systems experience interruptions with the frequency depending on where the equipment is installed and the reliability of the local power distribution grid.
• Protecting control systems from these fluctuations and losses is important to ensure the safe and reliable operation of the equipment.
• Safety functions should be designed with undervoltage lockout features so that low-line or complete power loss results in the machine assuming a safe state. Recovery of the supply voltage cannot cause the machine to restart automatically in most cases, so a manual recovery and re-starting procedure is needed. The only exception is high-reliability systems that are required to operate unattended for long periods.
• ISO 14118, Safety of machinery – Prevention of unexpected start-up [10], guides these aspects of machinery design.

Fluidic power sources

Pneumatic and hydraulic systems are usually powered by compressors or pumps that are in turn powered by electric motors. The effects of voltage variations on those motors can affect the fluid power systems they drive. However, in this section, I will discuss the effects of variations in the output of the compressor or pump on the driven system. In particular, the effects on purely fluid-powered control systems will be explored.

Pneumatic systems

Pneumatic systems are similar to DC electrical systems in that there is a defined operating pressure, called the nominal pressure, similar to the DC system voltage. The term ”nominal pressure” is defined in ISO 2944 [3], as shown below.

3.1
nominal pressure
pressure value assigned to a component, piping or a system for the purpose of convenient designation and indicating its belonging to a series

ISO 2944

Pneumatic power sources

Several types of compressors are commonly used in industry, with the reciprocating, positive-displacement compressor most common. These compressors have several variants, which I won’t go into here. If you are interested in learning more, I recommend Hydraulics and Pneumatics — A Technician’s and Engineer’s Guide [11].

Pressure pulsations

Reciprocating positive-displacement compressors produce a flow of compressed air with pulsating pressure. The frequency of the pulsations is determined by the number of high-pressure cylinders and the speed of the crankshaft.

This is similar to the pulsating DC voltage produced by a rectifier.

The rectifier is followed by some large filter capacitors that charge to the peak value of the pulsating DC. The capacitors discharge through the load between output pulses, ”smoothing” the pulses. The residual ”ripple voltage” is the remainder of the pulsations that are not fully reduced by the filter.

The pulsations produced by the compressor can set up a vibration in the attached piping if not damped correctly [12]. Non-resonant vibrations can cause long-term metal fatigue in the piping and supporting structures. Resonant vibrations can exacerbate these problems and cause significant noise in a plant by transferring those vibrations to the building structure and supporting structures [12].

Similar to the rectifier supplying a capacitor bank in a power supply, the compressor supplies an ”air receiver,” which is just a suitably sized tank, usually after flowing through a cooler and a dryer to reduce the temperature of the compressed air and remove the moisture from the atmosphere. The receiver volume is large enough to supply the typical load on the compressed air system without significantly reducing air pressure. A control system will regulate the receiver pressure by controlling the compressor [11].

Often, there are at least two separate air receivers in a compressed air system:

• PRIMARY receiver – located near the compressor, after the after-cooler but before filtration and drying equipment
• SECONDARY receivers – located close to points of larger intermittent air consumers

Each receiver will have a dedicated overpressure relief valve.

The large surface area of the primary receiver acts to cool the air. Consequently, any water not removed by the upstream cooler and separator will condense in the receiver and pool in the bottom, requiring a drain valve. Some receivers have a manual drain valve requiring periodic drainage as a maintenance task. This is typical for secondary receivers where the incoming air is already cool and relatively dry. The primary receiver in the schematic above will typically have automatic drainage.

Overpressure conditions

Like over-voltage conditions in electrical systems, over-pressure conditions can permanently damage or destroy pneumatic components and cause tubing, receivers and some components to rupture.

Connected equipment is commonly designed to operate at 5.5-8.25 bar (80-120 psig), with some components like shop air nozzles requiring as little as 1.75 bar (25 psig.)

Generally, plant air distribution systems operate at 7-8.5 bar (100-125 psig). In some cases, the ”mains” pressure may be even higher. Most industrial pneumatics equipment is designed to operate safely at up to 9 bar (130 psig) but may be damaged at pressures exceeding that.

Consequently, ISO 4414 [13] requires overpressure relief valves to be installed at the service unit, with a relief pressure of not more than 110% of the machine’s lowest rated component(s). If the plant mains pressure cannot exceed 8.25 bar (120 psig), these valves are often omitted unless the connected equipment has an absolute maximum pressure lower than that.

Where internal system pressures are further reduced, components connected to the low-pressure portion of the system should be protected from over-pressure conditions that would exceed the Maximum Allowable Working Pressure (MAWP) of the component, following the same basic rule as the service unit overpressure device.

Effects of pressure variations

For power components, such as air cylinders and motors, reduction in air pressure translates into lower force at the cylinder rod or lower torque at the motor shaft. This is due to Pascal’s Law [8] relating pressure, force and area.

F=PA

As the pressure falls, so does the force available at the rod for a given cylinder diameter. This can lead to sluggish operation, incomplete strokes, and ”jittering” of the driven load.

For pneumatic control systems, pulsating air pressure can cause partial valve spool motion, sticking valves, and inconsistent operation. Reducing pulsations or variations in the compressed air supplied to the control system is very important.

Additionally, water in the compressed air system to the machine can cause a ”water lock” in tube bends. Permanent damage is possible. Rust and dirt carried from the distribution piping can jam valves. Lubrication is still necessary for some applications. Over-lubrication can bog down small spool valves, preventing them from shifting. If water and pneumatic oil mix, it can create a white slurry that can block small hoses and tubes and can require complete disassembly of the affected components to fix.

Design of pneumatic systems

Proper design of pneumatic systems is an engineering course on its own. However, there are a few key ideas that should be taken from this discussion:

• A sufficient primary receiver size will reduce the compressor pulsations, thereby preventing problems with supplied equipment.
• Compressed air must be filtered, cooled and dried in the supply system. Additional filtering and drying may be needed at the consumer service unit.
• ISO 8573-1, Compressed air — Part 1: Contaminants and purity classes provide a system for describing the quality of compressed air. The standard provides 10 Classes, [16], [17].
• Secondary receivers near or within air-consuming equipment may be necessary to ensure that any pneumatic safety functions have sufficient air supply to do their job when required.
• Pneumatic safety functions may require an under-pressure lockout circuit to ensure that the safety function(s) will assume a safe state when the supply pressure falls below a predetermined lower limit, preventing an unexpected equipment restart if the mains pressure recovers.

Safety function behaviour

As you can see, there are many ways that energy supply variations can negatively affect equipment operation. The effects on safety modules, safety PLCs and safety-related fluidic logic can be severe.

Safety functions are required to have predictable behaviour in the face of these system-wide fluctuations. They must fail into a safe state and ensure that the machinery cannot restart unexpectedly when the supply returns to normal. Off-the-shelf safety-rated components are designed to deal with these situations, with suitable internal monitoring and margins built in so that they will act predictably. However, if you are designing a bespoke safety system, you must design and test your prototype for all of the reasonably likely kinds of supply variations that will occur in the real world.

Courses

If you are unsure how to proceed with functional safety or ISO 13849, check out our FS101 course. This course will teach you how to proceed:

• with a review of machinery risk assessment
• developing the Safety Requirement Specifications
• analyzing your design
• developing the validation documentation, and
• developing the validation test procedure

This course is suitable for control systems designers and engineers. If you have a CMSE designation or equivalent, and you’re still not feeling confident about how to use ISO 13849, this course will work for you too. The course includes a review of machinery risk assessment according to ISO 12100. Our RA101 course will give you the needed expertise if you have never had risk assessment training.

References

[1] Safety of machinery — Safety-related parts of control systems — Part 1: General principles for design, ISO 13849-1. International Organization for Standardization (ISO). 2015.

[2] IEC Standard Voltages, IEC 60038. International Electrotechnical Commission (IEC). 2009.

[3] Fluid power systems and components — Nominal pressures, ISO 2944. International Organization for Standardization (ISO). 2000.

[4] Safety of machinery – Electrical equipment of machines – Part 1: General requirements, IEC 60204-1. International Electrotechnical Commission (IEC). 2018.

[5]     “POWER QUALITY BASICS: UNDERVOLTAGE”, Powerqualityworld.com, 2011. [Online]. Available: http://www.powerqualityworld.com/2011/03/power-quality-basics-undervoltage.html. [Accessed: 23- Jun- 2020].

[6]    Recommended Practice For Monitoring Electric Power Quality, IEEE Standard 1159. Institute of Electrical and Electronics Engineers (IEEE). 1995.

[7]    “POWER QUALITY BASICS: OVERVOLTAGE”, Powerqualityworld.com, 2020. [Online]. Available: http://www.powerqualityworld.com/2011/03/power-quality-basics-overvoltage.html. [Accessed: 23- Jun- 2020].

[8] E. Csanyi, “Definitions of Abnormal Voltage Conditions”, EEP – Electrical Engineering Portal, 2020. [Online]. Available: https://electrical-engineering-portal.com/definitions-of-abnormal-voltage-conditions. [Accessed: 24- Jun- 2020].

[9]    “How Power Problems Affect PLC Reliability – Falcon Electric”, Falcon Electric, 2020. [Online]. Available: https://www.falconups.com/power-problems-affect-plc-reliability.htm. [Accessed: 24- Jun- 2020].

[10] Safety of machinery – Prevention of unexpected start-up, ISO 14118. International Organization for Standardization (ISO). 2017.

[11] Parr, A., Hydraulics and Pneumatics — A Technician’s and Engineer’s Guide, 3rd ed. Oxford: Butterworth-Heinemann. 2011.

[12] A. Almasi, “Pulsation of flow and pressure in piping of reciprocating pumps and compressors”, Piprocessinstrumentation.com, 2020. [Online]. Available: https://www.piprocessinstrumentation.com/pumps-motors-drives/article/21145391/pulsation-of-flow-and-pressure-in-piping-of-reciprocating-pumps-and-compressors. [Accessed: 19- Sep- 2022].

[13] S. Greenfield and L. de la Roche, Introduction to Vibration & Pulsation in Reciprocating Compressors. Calgary, AB: Beta Machinery Analysis Ltd.

[14] Pneumatic fluid power – General rules and safety requirements for systems and their components, ISO 4414. International Organization for Standardization (ISO). 2010.

[15] “Air receiver Tank Capacity Calculation – Easy Ways”, Air Compressor Parts & Kits, 2015. [Online]. Available: https://primeaircompressor.wordpress.com/2015/05/08/air-receiver-tank-capacity-calculation-easy-ways/. [Accessed: 19- Sep- 2022].

[16] “Field Air Compressors Water in your Compressed Air System”, Field Air Compressors, 2018. [Online]. Available: http://www.fieldaircompressors.co.za/2018/01/15/water-in-your-compressed-air-system/. [Accessed: 19- Sep- 2022].

[16] Compressed air — Part 1: Contaminants and purity classes, ISO 8573-1. International Organization for Standardization (ISO). 2010.

[17] “Compressed Air Quality and ISO 8573-1 Purity Classes”, Blog.exair.com, 2019. [Online]. Available: https://blog.exair.com/2019/10/16/compressed-air-quality-and-iso-8573-1-purity-classes/. [Accessed: 19- Sep- 2022].

© 2022, Compliance inSight Consulting Inc.
This work is licensed under a Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License.

Related posts:

Emergency Off (EMO) vs Emergency Stop Understanding safety functions: Pressure or temperature Understanding safety functions: Safe speed and safe standstill CE Marking Wire and Cable – Necessity or Luxury? ISO 13849-1 Analysis — Part 8: Fault Exclusion