Safe Drive Control including Safe Torque Off (STO)

Ed. Note: This arti­cle was revised 25-Jul-17 to include infor­ma­tion on safe stand­still.

Safe Drive Control including STO

Variable Frequency Drive for conveyor speed control
Vari­able Fre­quen­cy Dri­ve for con­vey­or speed con­trol [1]
Motor dri­ves are every­where. From DC vari­able speed dri­ves and index­ing dri­ves, through AC Vari­able Fre­quen­cy dri­ves, ser­vo dri­ves and step­per motor dri­ves, the capa­bil­i­ties and the flex­i­bil­i­ty of these elec­tron­ic sys­tems has giv­en machine design­ers unprece­dent­ed capa­bil­i­ties when com­pared to basic relay or con­tac­tor-based motor starters. We now have the capa­bil­i­ty to con­trol mech­a­nisms using motors in ways that would have been hard to imag­ine at the begin­ning of the indus­tri­al rev­o­lu­tion. Along with these con­trol capa­bil­i­ties come safe­ty-relat­ed func­tions like Safe Torque Off (STO).

Since we are con­trol­ling machin­ery, safe­ty is always a con­cern. In the 1990’s when I start­ed design­ing machin­ery with motor dri­ves, deal­ing with safe­ty con­cerns usu­al­ly meant adding a suit­ably rat­ed con­tac­tor upstream of the dri­ve so that you could inter­rupt pow­er to the dri­ve in case some­thing went wrong. With ear­ly ser­vo dri­ves, inter­rupt­ing the sup­ply pow­er often meant los­ing posi­tion data or worse. Plac­ing con­tac­tors between the dri­ve and the motor solved this prob­lem, but inter­rupt­ing the sup­ply pow­er would some­times cause the dri­ve stage of the ser­vo con­troller to blow up if the switch-off hap­pened with the motor run­ning and under high load. Motor dri­ve man­u­fac­tur­ers respond­ed by pro­vid­ing con­tac­tors and oth­er com­po­nents built into their dri­ves, cre­at­ing a fea­ture called Safe Torque Off (STO).

STO describes a state where “The dri­ve is reli­ably torque-free” [2]. The func­tions dis­cussed in this arti­cle are described in detail in IEC 61800–5-2 [3]. The func­tions are also list­ed in [10, Table 5.2]. Note that only Safe Torque Off and Safe Stop 1 can be used for emer­gency stop func­tions. Safe Torque Off, Safe Stop 1 and Safe Stop 2 can be used for safe­ty-relat­ed stop func­tions ini­ti­at­ed by a safe­guard­ing device. This dis­tinc­tion, between emer­gency stop func­tions and safe­guard­ing func­tions, is an impor­tant one.

If you have been a read­er of this blog for a while, you may recall that I have dis­cussed stop cat­e­gories before. This arti­cle expands on those con­cepts with the focus on motor dri­ves and their stop­ping func­tions specif­i­cal­ly. I’ve also talked about Emer­gency Stop exten­sive­ly. You might be inter­est­ed in read­ing more about the e-stop func­tion, start­ing with the post “Emer­gency Stop – What’s so con­fus­ing about that?”

Safe Torque Off (STO)

Accord­ing to Siemens, “The STO func­tion is the most com­mon and basic dri­ve-inte­grat­ed safe­ty func­tion. It ensures that no torque-gen­er­at­ing ener­gy can con­tin­ue to act upon a motor and pre­vents unin­ten­tion­al start­ing.” Risk assess­ment of the machin­ery can iden­ti­fy the need for an STO func­tion. The devices used for this appli­ca­tion are described in IEC 60204–1 in clause 5.4 [4]. The design fea­tures for pre­ven­tion of unex­pect­ed start­ing are cov­ered in more detail in EN 1037 [5] or ISO 14118 [6]. If you are inter­est­ed in these stan­dards, ISO 14118 is in the process of being revised. A new ver­sion should be avail­able with­in 12–18 months.

The STO func­tion oper­ates as shown in Fig.1. The blue line rep­re­sents the dri­ve speed/velocity, V, on the y-axis, with time, t, on the x-axis. The orange arrow and the dot­ted line show the ini­ti­a­tion of the stop­ping func­tion.

Graph showing motor drive output over time when the STO function is activated.
Fig­ure 1 — Safe Torque Off func­tion [1]
At the begin­ning of the stop­ping process (orange arrow and dot­ted line), the dri­ve gate puls­es are imme­di­ate­ly shut off, remov­ing torque from the motor (i.e., zero torque). The speed of the dri­ven equip­ment will drop at a rate deter­mined by the sys­tem fric­tion and iner­tia until stand­still is achieved. The zero torque con­di­tion is main­tained until the safe­ty func­tion per­mits restart­ing (area out­lined with yellow/black zebra stripe). Note that dri­ve stand­still may occur if the fric­tion and iner­tia of the sys­tem per­mit, but it is pos­si­ble that the dri­ven equip­ment may coast for some time. You may be able to move the dri­ven equip­ment by hand or grav­i­ty with the dri­ve in the STO mode.

STO is an uncon­trolled stop­ping mode [4, 3.56]:

uncon­trolled stop
stop­ping of machine motion by remov­ing elec­tri­cal pow­er to the machine actu­a­tors
NOTE This def­i­n­i­tion does not imply any oth­er state of oth­er (for exam­ple, non-elec­tri­cal) stop­ping devices, for exam­ple, mechan­i­cal or hydraulic brakes that are out­side the scope of this stan­dard.

The def­i­n­i­tion above is impor­tant. Uncon­trolled stops are the most com­mon form of stop­ping used in machines of all types and is required as a basic func­tion for all machines. There are var­i­ous ways of achiev­ing STO, includ­ing the use of a dis­con­nect­ing device, emer­gency stop sys­tems, and gate inter­lock­ing sys­tems that remove pow­er from machine actu­a­tors.

The embod­i­ment of the uncon­trolled stop con­cept is Stop Cat­e­go­ry 0 [4, 9.2.2]:

stop cat­e­go­ry 0 — stop­ping by imme­di­ate removal of pow­er to the machine actu­a­tors (i.e., and uncon­trolled stop, see 3.56)

Stop cat­e­go­ry 0 is only appro­pri­ate where the machin­ery has lit­tle iner­tia, or where mechan­i­cal fric­tion is high enough that the stop­ping time is short. It may also be used in cas­es where the machin­ery has very high iner­tia, but only for nor­mal stop­ping when coast­ing time is not a fac­tor, not for safe­ty stop­ping func­tions where the time to a no-motion state is crit­i­cal.

There are a few oth­er stop­ping modes that are often con­fused with STO:

  • Safe Stop 1
  • Safe Stop 2
  • Safe Oper­at­ing Stop
  • Safe Stand­still

Let’s explore the dif­fer­ences.

Safe Stop 1 (SS1)

If a defined stop­ping time is need­ed, a con­trolled stop­ping func­tion will be required fol­lowed by entry into STO. This stop­ping func­tion is called “Safe Stop 1” (SS1).

SS1 is direct­ly relat­ed to Stop Cat­e­go­ry 1 [4, 9.2.2]. As described in [4], Stop Cat­e­go­ry 1 func­tions as fol­lows:

stop cat­e­go­ry 1 — a con­trolled stop (see 3.11) with pow­er avail­able to the machine actu­a­tors to achieve the stop and then removal of pow­er when the stop is achieved;

A “con­trolled stop” is defined in [4, 3.11]:

con­trolled stop
stop­ping of machine motion with elec­tri­cal pow­er to the machine actu­a­tor main­tained dur­ing the stop­ping process

Once the con­trolled stop is com­plet­ed, i.e., machine motion has stopped, the dri­ve may then be placed into STO (or cat­e­go­ry 0 stop). The stop­ping process is shown in Fig. 2 [7].

Graph showing the reduction of drive speed over time following the beginning of a controlled stopping process.
Fig­ure 2 — Safe Stop 1

The stop­ping process starts where the orange arrow and dot­ted line are shown. As com­pared to Fig. 1 where the decel­er­a­tion curve is gen­tle and expo­nen­tial, the active stop­ping peri­od in Fig. 2 is a lin­ear curve from oper­at­ing speed to zero speed. At the blue dot­ted line, the dri­ve enters and stays in STO. The yellow/black zebra striped area of the curve out­lines the com­plete stop­ping func­tion. This stop­ping method is typ­i­cal of many types of machin­ery, par­tic­u­lar­ly those with ser­vo-dri­ven mech­a­nisms.

Safe Stop 2 (SS2)

In some cas­es, the risk assess­ment may show that remov­ing pow­er com­plete­ly from a mech­a­nism will increase the risk. An exam­ple might be a ver­ti­cal axis where the motor dri­ve is used to main­tain the posi­tion of the tool­ing. Remov­ing pow­er from the dri­ve with the tool raised would result in the tool­ing crash­ing to the bot­tom of the axis in an uncon­trolled way. Not the desired way to achieve any type of stop!

There are var­i­ous to pre­vent this kind of occur­rence, but I’m going to lim­it the dis­cus­sion here to the Safe Stop 2 func­tion.

Let’s start with the def­i­n­i­tion [4, 3.11]:

con­trolled stop
stop­ping of machine motion with elec­tri­cal pow­er to the machine actu­a­tor main­tained dur­ing the stop­ping process

Wait! The def­i­n­i­tion of a con­trolled stop is exact­ly the same as a stop cat­e­go­ry 1, so what is the dif­fer­ence? For that we need to look to [4, 9.2.2]:

stop cat­e­go­ry 2 — a con­trolled stop with pow­er left avail­able to the machine actu­a­tors.

Emer­gency Stop func­tions can­not use Stop Cat­e­go­ry 2 [4, 9.2.5.4.2]. If you have tool­ing where Stop Cat­e­go­ry 2 is the most appro­pri­ate stop­ping func­tion under nor­mal con­di­tions, you will have to add an anoth­er means to pre­vent the axis from falling dur­ing the emer­gency stop. The addi­tion­al means could be a spring-set brake that is held released by the emer­gency stop sys­tem and is applied when the e-stop sys­tem removes pow­er from the tool­ing. There are many ways to achieve auto­mat­ic load-hold­ing besides brakes, but remem­ber, what­ev­er you choose it must be effec­tive in pow­er loss con­di­tions.

As shown in Fig. 3, the oper­a­tion of Safe Stop 2 dif­fers from Safe Stop 1 in that, instead of enter­ing into STO when motion stops, the sys­tem enters Safe Oper­at­ing Stop (SOS) [8], not STO. SOS is a Stop Cat­e­go­ry 2 func­tion. Full torque remains avail­able from the motor to hold the tool­ing in posi­tion. Safe stand­still is mon­i­tored by the dri­ve or oth­er means.

Graph showing speed reduction to zero, followed by entry into stop category 2.
Fig­ure 3 — Safe Stop 2

Depend­ing on the ISO 13849–1 PLr, or the IEC 62061 SILr need­ed for the appli­ca­tion, the dri­ve may not have high enough reli­a­bil­i­ty on its own. In this case, a sec­ond chan­nel may be required to ensure that safe stand­still mon­i­tor­ing is ade­quate­ly reli­able. This can be achieved by adding anoth­er means of stand­still detec­tion, like a sec­ond encoder, or a stand­still mon­i­tor­ing device. An exam­ple cir­cuit dia­gram show­ing this type of mon­i­tor­ing can be found in Fig. 4 [10, Fig. 8.37], show­ing a safe­ty PLC and dri­ve used to pro­vide an “inch­ing” or “jog” func­tion.

Circuit diagram for a safe inching mode using a motor drive. Taken from Fig 8.37 in BGIA Report 2/2008e
Fig­ure 4 — Safe­ly lim­it­ed speed for inch­ing mode — PLd, Cat. 3 [10]
In Fig. 4, the encoders are labelled G1 and G2. Both encoders are con­nect­ed to the safe­ty PLC to pro­vide two-chan­nel feed­back required for Cat­e­go­ry 3 archi­tec­ture. G1 is also con­nect­ed to the motor dri­ve for posi­tion and veloc­i­ty feed­back as need­ed for the appli­ca­tion. Note that this par­tic­u­lar dri­ve also has a con­tac­tor upstream, Q1, to pro­vide one chan­nel of the two required for Cat­e­go­ry 3. The sec­ond chan­nel would be pro­vid­ed by the pulse block­ing input on the dri­ve. For more on how this cir­cuit func­tions and how the func­tion­al safe­ty analy­sis is com­plet­ed, see [10].

Safe Operating Stop (SOS)

Dur­ing a safe oper­at­ing stop (SOS), the motor is brought to a spe­cif­ic posi­tion and held there by the dri­ve. Full torque is avail­able to keep the tool­ing in posi­tion. The stop is mon­i­tored safe­ly by the dri­ve. The func­tion is shown in Fig­ure 4 [9].

A graph showing a drive maintaining position following a stop
Fig­ure 5 — Safe Oper­at­ing Stop

In Fig. 5, the y-axis, s, rep­re­sents the posi­tion of the tool­ing, NOT the veloc­i­ty, while the x-axis rep­re­sents time, t. The start of the posi­tion hold­ing func­tion is shown by the orange arrow and dashed line. The peri­od fol­low­ing the green dashed line is the SOS peri­od.

SOS can­not be used for the emer­gency stop func­tion. Under cer­tain con­di­tions it may be used when guard inter­locks are opened, i.e., the guard door on a CNC lathe is opened so that the oper­a­tor can place a new work­piece.

There a quite a few addi­tion­al “safe” dri­ve func­tions. For more on these func­tions and how to imple­ment them, see [2] and appli­ca­tion data from your favourite dri­ve man­u­fac­tur­er. Ref­er­ence is also pro­vid­ed in [9, Table 5.2].

Safe Standstill

Safe stand­still is a con­di­tion where motion has stopped and is being mon­i­tored by a safe­ty-rat­ed device whose out­put sig­nals are used to con­trol the release of guard lock­ing devices. Safe stand­still is not the same as zero-speed because zero-speed can be achieved with­out the use of safe­ty-rat­ed con­trol com­po­nents and design, while safe stand­still requires both suit­able com­po­nents and design.

There are var­i­ous ways to achieve safe stand­still. Here are three approach­es [12]:

  1. Rota­tion sen­sors
    Sen­sors includ­ing prox­im­i­ty sen­sors, resolvers, and encoders can be used to mon­i­tor the motion of the dri­ve com­po­nents. A safe stand­still mon­i­tor­ing device is used to when stand­still has occurred.  When a machine has an unsta­ble rest posi­tion, a prox­im­i­ty sen­sor should be used to ensure the machine is in a safe con­di­tion before the guard lock­ing devices are released.
  2. Back EMF mon­i­tor­ing
    Back elec­tro­mo­tive force or Back EMF is the volt­age cre­at­ed in an elec­tric motor due to the rota­tion of the arma­ture in the mag­net­ic field in the motor. This volt­age oppos­es the applied volt­age and is approx­i­mate­ly pro­por­tion­al to the rota­tion­al speed of the motor. Back EMF remains after the sup­ply volt­age has been removed, allow­ing mon­i­tor­ing devices to indi­rect­ly mea­sure motor speed and stand­still.
  3. Fail­safe timer
    Fail­safe timers are time delay relays designed for use in safe­ty func­tions. Fail­safe timers can be used when the stop­ping per­for­mance of the machin­ery is con­sis­tent and known.
    Fol­low­ing removal of pow­er from the dri­ve motor, the time delay starts. At the end of the time delay, the relay releas­es the guard lock­ing devices.
    Reg­u­lar time delay relays can­not be used for this pur­pose, only fail-safe relays designed to be used in safe­ty func­tions can be used, along with suit­able safe­ty sys­tems design tech­niques like ISO 13849 or IEC 62061.

Conclusions

As you can see, there are sig­nif­i­cant dif­fer­ences between STO, SS1, SS2, SOS and Safe Stand­still. While these func­tions may be used togeth­er to achieve a par­tic­u­lar safe­ty func­tion, some are func­tions of the imple­men­ta­tion of the motor dri­ve, e.g., STO. Some are a func­tion of the design of the motor dri­ve itself, e.g., STO, SS1, SS2, and SOS, or the design of con­trols exter­nal to the motor dri­ve, e.g., safe stand­still. The sim­i­lar­i­ties between these var­i­ous func­tions can make it easy to con­fuse them. Care needs to be tak­en to ensure that the cor­rect tech­ni­cal approach is used when real­is­ing the safe­ty func­tion required by the risk assess­ment.

Ref­er­ences

[1]    “Vari­able Fre­quen­cy Dri­ves — Indus­tri­al Wiki — ode­sie by Tech Trans­fer”, Myodesie.com, 2017. [Online]. Avail­able: https://www.myodesie.com/wiki/index/returnEntry/id/3040. [Accessed: 19- Jun- 2017].

[2] “Safe Torque Off (STO) — Safe­ty Inte­grat­ed — Siemens”, Industry.siemens.com, 2017. [Online]. Avail­able: http://www.industry.siemens.com/topics/global/en/safety-integrated/machine-safety/product-portfolio/drive-technology/safety-functions/pages/safe-torque-off.aspx. [Accessed: 19- Jun- 2017].

[3]      Adjustable speed elec­tri­cal pow­er dri­ve sys­tems — Part 5–2: Safe­ty require­ments — Func­tion­al. IEC Stan­dard 61800–5-2. 2nd Ed. 2016.

[4]     Safe­ty of machin­ery — Elec­tri­cal equip­ment of machines — Part 1: Gen­er­al require­ments. IEC Stan­dard 60204–1. 2006.

[5]     Safe­ty of machin­ery — Pre­ven­tion of unex­pect­ed start-up. EN Stan­dard 1037+A1. 2008.

[6]     Safe­ty of machin­ery — Pre­ven­tion of unex­pect­ed start-up. ISO Stan­dard 14118. 2000.

[7]     “Safe Stop 1 (SS1) — Safe­ty Inte­grat­ed — Siemens”, Industry.siemens.com, 2017. [Online]. Avail­able: http://www.industry.siemens.com/topics/global/en/safety-integrated/machine-safety/product-portfolio/drive-technology/safety-functions/Pages/safe-stop1.aspx. [Accessed: 19- Jun- 2017].

[8]     “Safe Stop 2 (SS2) — Safe­ty Inte­grat­ed — Siemens”, Industry.siemens.com, 2017. [Online]. Avail­able: http://www.industry.siemens.com/topics/global/en/safety-integrated/machine-safety/product-portfolio/drive-technology/safety-functions/Pages/safe-stop2.aspx. [Accessed: 19- Jun- 2017].

[9]     “Safe Oper­at­ing Stop (SOS) — Safe­ty Inte­grat­ed — Siemens”, Industry.siemens.com, 2017. [Online]. Avail­able: http://www.industry.siemens.com/topics/global/en/safety-integrated/machine-safety/product-portfolio/drive-technology/safety-functions/Pages/safe-operating-stop.aspx. [Accessed: 19- Jun- 2017].

[10]     M. Hauke, M. Schae­fer, R. Apfeld, T. Boe­mer, M. Huelke, T. Borows­ki, K. Bülles­bach, M. Dor­ra, H. Foer­mer-Schae­fer, W. Grigule­witsch, K. Heimann, B. Köh­ler, M. Krauß, W. Küh­lem, O. Lohmaier, K. Mef­fert, J. Pil­ger, G. Reuß, U. Schus­ter, T. Seifen and H. Zil­li­gen, “Func­tion­al safe­ty of machine controls–Application of EN ISO 13849–Report 2/2008e”, BGIA – Insti­tute for Occu­pa­tion­al Safe­ty and Health of the Ger­man Social Acci­dent Insur­ance, Sankt Augustin, 2017.

[11]     “Glos­sary”, Schmersalusa.com, 2017. [Online]. Avail­able: http://www.schmersalusa.com/service/glossary/#c3616. [Accessed: 10- Jan-2018].

[12]     Schm­er­sal Tech Briefs: Safe Speed & Stand­still Mon­i­tor­ing. Schm­er­sal USA, 2017.

Acknowledgements

Spe­cial thanks go out to two of my reg­u­lar read­ers for sug­gest­ing this post: Matt Ernst and con­trols­girl, who com­ments fre­quent­ly. Thanks for the ideas and the ques­tions that sparked this post!

How to do a 13849–1 analysis: Complete Reference List

An old book lying open with round eyeglasses lying on top.As promised in pre­vi­ous posts, here is the com­plete ref­er­ence list for the series “How to do a 13849–1 analy­sis”! If you have any addi­tion­al resources you think read­ers would find help­ful, please add them in the com­ments.

Book List

Here are some books that I think you may find help­ful on this jour­ney:

[0]     B. Main, Risk Assess­ment: Basics and Bench­marks, 1st ed. Ann Arbor, MI USA: DSE, 2004.

[0.1]  D. Smith and K. Simp­son, Safe­ty crit­i­cal sys­tems hand­book. Ams­ter­dam: Else­vier/But­ter­worth-Heine­mann, 2011.

[0.2]  Elec­tro­mag­net­ic Com­pat­i­bil­i­ty for Func­tion­al Safe­ty, 1st ed. Steve­nage, UK: The Insti­tu­tion of Engi­neer­ing and Tech­nol­o­gy, 2008.

[0.3]  Overview of tech­niques and mea­sures relat­ed to EMC for Func­tion­al Safe­ty, 1st ed. Steve­nage, UK: Overview of tech­niques and mea­sures relat­ed to EMC for Func­tion­al Safe­ty, 2013.

References

Note: This ref­er­ence list starts in Part 1 of the series, so “miss­ing” ref­er­ences may show in oth­er parts of the series. Includ­ed in the last post of the series is the com­plete ref­er­ence list.

[1]     Safe­ty of machin­ery — Safe­ty-relat­ed parts of con­trol sys­tems — Part 1: Gen­er­al prin­ci­ples for design. 3rd Edi­tion. ISO Stan­dard 13849–1. 2015.

[2]     Safe­ty of machin­ery — Safe­ty-relat­ed parts of con­trol sys­tems — Part 2: Val­i­da­tion. 2nd Edi­tion. ISO Stan­dard 13849–2. 2012.

[3]      Safe­ty of machin­ery — Gen­er­al prin­ci­ples for design — Risk assess­ment and risk reduc­tion. ISO Stan­dard 12100. 2010.

[4]     Safe­guard­ing of Machin­ery. 2nd Edi­tion. CSA Stan­dard Z432. 2004.

[5]     Risk Assess­ment and Risk Reduc­tion- A Guide­line to Esti­mate, Eval­u­ate and Reduce Risks Asso­ci­at­ed with Machine Tools. ANSI Tech­ni­cal Report B11.TR3. 2000.

[6]    Safe­ty of machin­ery — Emer­gency stop func­tion — Prin­ci­ples for design. ISO Stan­dard 13850. 2015.

[7]     Func­tion­al safe­ty of electrical/electronic/programmable elec­tron­ic safe­ty-relat­ed sys­tems. 7 parts. IEC Stan­dard 61508. Edi­tion 2. 2010.

[8]     S. Joce­lyn, J. Bau­doin, Y. Chin­ni­ah, and P. Char­p­en­tier, “Fea­si­bil­i­ty study and uncer­tain­ties in the val­i­da­tion of an exist­ing safe­ty-relat­ed con­trol cir­cuit with the ISO 13849–1:2006 design stan­dard,” Reliab. Eng. Syst. Saf., vol. 121, pp. 104–112, Jan. 2014.

[9]    Guid­ance on the appli­ca­tion of ISO 13849–1 and IEC 62061 in the design of safe­ty-relat­ed con­trol sys­tems for machin­ery. IEC Tech­ni­cal Report TR 62061–1. 2010.

[10]     Safe­ty of machin­ery — Func­tion­al safe­ty of safe­ty-relat­ed elec­tri­cal, elec­tron­ic and pro­gram­ma­ble elec­tron­ic con­trol sys­tems. IEC Stan­dard 62061. 2005.

[11]    Guid­ance on the appli­ca­tion of ISO 13849–1 and IEC 62061 in the design of safe­ty-relat­ed con­trol sys­tems for machin­ery. IEC Tech­ni­cal Report 62061–1. 2010.

[12]    D. S. G. Nix, Y. Chin­ni­ah, F. Dosio, M. Fessler, F. Eng, and F. Schr­ev­er, “Link­ing Risk and Reliability—Mapping the out­put of risk assess­ment tools to func­tion­al safe­ty require­ments for safe­ty relat­ed con­trol sys­tems,” 2015.

[13]    Safe­ty of machin­ery. Safe­ty relat­ed parts of con­trol sys­tems. Gen­er­al prin­ci­ples for design. CEN Stan­dard EN 954–1. 1996.

[14]   Func­tion­al safe­ty of electrical/electronic/programmable elec­tron­ic safe­ty-relat­ed sys­tems — Part 2: Require­ments for electrical/electronic/programmable elec­tron­ic safe­ty-relat­ed sys­tems. IEC Stan­dard 61508–2. 2010.

[15]     Reli­a­bil­i­ty Pre­dic­tion of Elec­tron­ic Equip­ment. Mil­i­tary Hand­book MIL-HDBK-217F. 1991.

[16]     “IFA — Prac­ti­cal aids: Soft­ware-Assis­tent SISTEMA: Safe­ty Integri­ty — Soft­ware Tool for the Eval­u­a­tion of Machine Appli­ca­tions”, Dguv.de, 2017. [Online]. Avail­able: http://www.dguv.de/ifa/praxishilfen/practical-solutions-machine-safety/software-sistema/index.jsp. [Accessed: 30- Jan- 2017].

[17]      “fail­ure mode”, 192–03-17, Inter­na­tion­al Elec­trotech­ni­cal Vocab­u­lary. IEC Inter­na­tion­al Elec­trotech­ni­cal Com­mis­sion, Gene­va, 2015.

[18]      M. Gen­tile and A. E. Sum­mers, “Com­mon Cause Fail­ure: How Do You Man­age Them?,” Process Saf. Prog., vol. 25, no. 4, pp. 331–338, 2006.

[19]     Out of Control—Why con­trol sys­tems go wrong and how to pre­vent fail­ure, 2nd ed. Rich­mond, Sur­rey, UK: HSE Health and Safe­ty Exec­u­tive, 2003.

[20]     Safe­guard­ing of Machin­ery. 3rd Edi­tion. CSA Stan­dard Z432. 2016.

[21]     O. Reg. 851, INDUSTRIAL ESTABLISHMENTS. Ontario, Cana­da, 1990.

[22]     “Field-pro­gram­ma­ble gate array”, En.wikipedia.org, 2017. [Online]. Avail­able: https://en.wikipedia.org/wiki/Field-programmable_gate_array. [Accessed: 16-Jun-2017].

[23]     Analy­sis tech­niques for sys­tem reli­a­bil­i­ty – Pro­ce­dure for fail­ure mode and effects analy­sis (FMEA). 2nd Ed. IEC Stan­dard 60812. 2006.

[24]     “Fail­ure mode and effects analy­sis”, En.wikipedia.org, 2017. [Online]. Avail­able: https://en.wikipedia.org/wiki/Failure_mode_and_effects_analysis. [Accessed: 16-Jun-2017].

ISO 13849–1 Analysis — Part 8: Fault Exclusion

Fault Consideration & Fault Exclusion

ISO 13849–1, Chap­ter 7 [1, 7] dis­cuss­es the need for fault con­sid­er­a­tion and fault exclu­sion. Fault con­sid­er­a­tion is the process of exam­in­ing the com­po­nents and sub-sys­tems used in the safe­ty-relat­ed part of the con­trol sys­tem (SRP/CS) and mak­ing a list of all the faults that could occur in each one. This a def­i­nite­ly non-triv­ial exer­cise!

Think­ing back to some of the ear­li­er arti­cles in this series where I men­tioned the dif­fer­ent types of faults, you may recall that there are detectable and unde­tectable faults, and there are safe and dan­ger­ous faults, lead­ing us to four kinds of fault:

  • Safe unde­tectable faults
  • Dan­ger­ous unde­tectable faults
  • Safe detectable faults
  • Dan­ger­ous detectable faults

For sys­tems where no diag­nos­tics are used, Cat­e­go­ry B and 1, faults need to be elim­i­nat­ed using inher­ent­ly safe design tech­niques. Care needs to be tak­en when clas­si­fy­ing com­po­nents as “well-tried” ver­sus using a fault exclu­sion, as com­po­nents that might nor­mal­ly be con­sid­ered “well-tried” might not meet those require­ments in every appli­ca­tion. [2, Annex A], Val­i­da­tion tools for mechan­i­cal sys­tems, dis­cuss­es the con­cepts of “Basic Safe­ty Prin­ci­ples”, “Well-Tried Safe­ty Prin­ci­ples”, and “Well-tried com­po­nents”.  [2, Annex A] also pro­vides exam­ples of faults and rel­e­vant fault exclu­sion cri­te­ria. There are sim­i­lar Annex­es that cov­er pneu­mat­ic sys­tems [2, Annex B], hydraulic sys­tems [2, Annex C], and elec­tri­cal sys­tems [2, Annex D].

For sys­tems where diag­nos­tics are part of the design, i.e., Cat­e­go­ry 2, 3, and 4, the fault lists are used to eval­u­ate the diag­nos­tic cov­er­age (DC) of the test sys­tems. Depend­ing on the archi­tec­ture, cer­tain lev­els of DC are required to meet the rel­e­vant PL, see [1, Fig. 5]. The fault lists are start­ing point for the deter­mi­na­tion of DC, and are an input into the hard­ware and soft­ware designs. All of the dan­ger­ous detectable faults must be cov­ered by the diag­nos­tics, and the DC must be high enough to meet the PLr for the safe­ty func­tion.

The fault lists and fault exclu­sions are used in the Val­i­da­tion por­tion of this process as well. At the start of the Val­i­da­tion process flow­chart [2, Fig. 1], you can see how the fault lists and the cri­te­ria used for fault exclu­sion are used as inputs to the val­i­da­tion plan.

The diagram shows the first few stages in the ISO 13849-2 Validation process. See ISO 13849-2, Figure 1.
Start of ISO 13849–2 Fig. 1

Faults that can be exclud­ed do not need to val­i­dat­ed, sav­ing time and effort dur­ing the sys­tem ver­i­fi­ca­tion and val­i­da­tion (V & V). How is this done?

Fault Consideration

The first step is to devel­op a list of poten­tial faults that could occur, based on the com­po­nents and sub­sys­tems includ­ed in SRP/CS. ISO 13849–2 [2] includes lists of typ­i­cal faults for var­i­ous tech­nolo­gies. For exam­ple, [2, Table A.4] is the fault list for mechan­i­cal com­po­nents.

Mechanical fault list from ISO 13849-2
Table A.4 — Faults and fault exclu­sions — Mechan­i­cal devices, com­po­nents and ele­ments
(e.g. cam, fol­low­er, chain, clutch, brake, shaft, screw, pin, guide, bear­ing)

[2] con­tains tables sim­i­lar to Table A.4 for:

  • Pres­sure-coil springs
  • Direc­tion­al con­trol valves
  • Stop (shut-off) valves/non-return (check) valves/quick-action vent­ing valves/shuttle valves, etc.
  • Flow valves
  • Pres­sure valves
  • Pipework
  • Hose assem­blies
  • Con­nec­tors
  • Pres­sure trans­mit­ters and pres­sure medi­um trans­duc­ers
  • Com­pressed air treat­ment — Fil­ters
  • Com­pressed-air treat­ment — Oil­ers
  • Com­pressed air treat­ment — Silencers
  • Accu­mu­la­tors and pres­sure ves­sels
  • Sen­sors
  • Flu­idic Infor­ma­tion pro­cess­ing — Log­i­cal ele­ments
  • etc.

As you can see, there are many dif­fer­ent types of faults that need to be con­sid­ered. Keep in mind that I did not give you all of the dif­fer­ent fault lists — this post would be a mile long if I did that! The point is that you need to devel­op a fault list for your sys­tem, and then con­sid­er the impact of each fault on the oper­a­tion of the sys­tem. If you have com­po­nents or sub­sys­tems that are not list­ed in the tables, then you need to devel­op your own fault lists for those items. Fail­ure Modes and Effects Analy­sis (FMEA) is usu­al­ly the best approach for devel­op­ing fault lists for these com­po­nents [23], [24].

When con­sid­er­ing the faults to be includ­ed in the list there are a few things that should be con­sid­ered [1, 7.2]:

  • if after the first fault occurs oth­er faults devel­op due to the first fault, then you can group those faults togeth­er as a sin­gle fault
  • two or more sin­gle faults with a com­mon cause can be con­sid­ered as a sin­gle fault
  • mul­ti­ple faults with dif­fer­ent caus­es but occur­ring simul­ta­ne­ous­ly is con­sid­ered improb­a­ble and does not need to be con­sid­ered

Examples

#1 — Voltage Regulator

A volt­age reg­u­la­tor fails in a sys­tem pow­er sup­ply so that the 24 Vdc out­put ris­es to an unreg­u­lat­ed 36 Vdc (the inter­nal pow­er sup­ply bus volt­age), and after some time has passed, two sen­sors fail. All three fail­ures can be grouped and con­sid­ered as a sin­gle fault because they orig­i­nate in a sin­gle fail­ure in the volt­age reg­u­la­tor.

#2 — Lightning Strike

If a light­ning strike occurs on the pow­er line and the result­ing surge volt­age on the 400 V mains caus­es an inter­pos­ing con­tac­tor and the motor dri­ve it con­trols to fail to dan­ger, then these fail­ures may be grouped and con­sid­ered as one. Again, a sin­gle event caus­es all of the sub­se­quent fail­ures.

#3 — Pneumatic System Lubrication

3a — A pneu­mat­ic lubri­ca­tor runs out of lubri­cant and is not refilled, depriv­ing down­stream pneu­mat­ic com­po­nents of lubri­ca­tion.

3b — The spool on the sys­tem dump valve sticks open because it is not cycled often enough.

Nei­ther of these fail­ures has the same cause, so there is no need to con­sid­er them as occur­ring simul­ta­ne­ous­ly because the prob­a­bil­i­ty of both hap­pen­ing con­cur­rent­ly is extreme­ly small. One cau­tion: These two faults MAY have a com­mon cause — poor main­te­nance. If this is true and you decide to con­sid­er them to be two faults with a com­mon cause, they could then be grouped as a sin­gle fault.

Fault Exclusion

Once you have your well-con­sid­ered fault lists togeth­er, the next ques­tion is “Can any of the list­ed faults be exclud­ed?” This is a tricky ques­tion! There are a few points to con­sid­er:

  • Does the sys­tem archi­tec­ture allow for fault exclu­sion?
  • Is the fault tech­ni­cal­ly improb­a­ble, even if it is pos­si­ble?
  • Does expe­ri­ence show that the fault is unlike­ly to occur?*
  • Are there tech­ni­cal require­ments relat­ed to the appli­ca­tion and the haz­ard that might sup­port fault exclu­sion?

BE CAREFUL with this one!

When­ev­er faults are exclud­ed, a detailed jus­ti­fi­ca­tion for the exclu­sion needs to be includ­ed in the sys­tem design doc­u­men­ta­tion. Sim­ply decid­ing that the fault can be exclud­ed is NOT ENOUGH! Con­sid­er the risk a per­son will be exposed to in the event the fault occurs. If the sever­i­ty is very high, i.e., severe per­ma­nent injury or death, you may not want to exclude the fault even if you think you could. Care­ful con­sid­er­a­tion of the result­ing injury sce­nario is need­ed.

Bas­ing a fault exclu­sion on per­son­al expe­ri­ence is sel­dom con­sid­ered ade­quate, which is why I added the aster­isk (*) above. Look for good sta­tis­ti­cal data to sup­port any deci­sion to use a fault exclu­sion.

There is much more infor­ma­tion avail­able in IEC 61508–2 on the sub­ject of fault exclu­sion, and there is good infor­ma­tion in some of the books men­tioned below [0.1], [0.2], and [0.3]. If you know of addi­tion­al resources you would like to share, please post the infor­ma­tion in the com­ments!

Definitions

3.1.3 fault
state of an item char­ac­ter­ized by the inabil­i­ty to per­form a required func­tion, exclud­ing the inabil­i­ty dur­ing pre­ven­tive main­te­nance or oth­er planned actions, or due to lack of exter­nal resources
Note 1 to entry: A fault is often the result of a fail­ure of the item itself, but may exist with­out pri­or fail­ure.
Note 2 to entry: In this part of ISO 13849, “fault” means ran­dom fault. [SOURCE: IEC 60050?191:1990, 05–01.]

Book List

Here are some books that I think you may find help­ful on this jour­ney:

[0]     B. Main, Risk Assess­ment: Basics and Bench­marks, 1st ed. Ann Arbor, MI USA: DSE, 2004.

[0.1]  D. Smith and K. Simp­son, Safe­ty crit­i­cal sys­tems hand­book. Ams­ter­dam: Else­vier/But­ter­worth-Heine­mann, 2011.

[0.2]  Elec­tro­mag­net­ic Com­pat­i­bil­i­ty for Func­tion­al Safe­ty, 1st ed. Steve­nage, UK: The Insti­tu­tion of Engi­neer­ing and Tech­nol­o­gy, 2008.

[0.3]  Overview of tech­niques and mea­sures relat­ed to EMC for Func­tion­al Safe­ty, 1st ed. Steve­nage, UK: Overview of tech­niques and mea­sures relat­ed to EMC for Func­tion­al Safe­ty, 2013.

References

Note: This ref­er­ence list starts in Part 1 of the series, so “miss­ing” ref­er­ences may show in oth­er parts of the series. Includ­ed in the last post of the series is the com­plete ref­er­ence list.

[1]     Safe­ty of machin­ery — Safe­ty-relat­ed parts of con­trol sys­tems — Part 1: Gen­er­al prin­ci­ples for design. 3rd Edi­tion. ISO Stan­dard 13849–1. 2015.

[2]     Safe­ty of machin­ery — Safe­ty-relat­ed parts of con­trol sys­tems — Part 2: Val­i­da­tion. 2nd Edi­tion. ISO Stan­dard 13849–2. 2012.

[3]      Safe­ty of machin­ery — Gen­er­al prin­ci­ples for design — Risk assess­ment and risk reduc­tion. ISO Stan­dard 12100. 2010.

[4]     Safe­guard­ing of Machin­ery. 2nd Edi­tion. CSA Stan­dard Z432. 2004.

[5]     Risk Assess­ment and Risk Reduc­tion- A Guide­line to Esti­mate, Eval­u­ate and Reduce Risks Asso­ci­at­ed with Machine Tools. ANSI Tech­ni­cal Report B11.TR3. 2000.

[6]    Safe­ty of machin­ery — Emer­gency stop func­tion — Prin­ci­ples for design. ISO Stan­dard 13850. 2015.

[7]     Func­tion­al safe­ty of electrical/electronic/programmable elec­tron­ic safe­ty-relat­ed sys­tems. 7 parts. IEC Stan­dard 61508. Edi­tion 2. 2010.

[8]     S. Joce­lyn, J. Bau­doin, Y. Chin­ni­ah, and P. Char­p­en­tier, “Fea­si­bil­i­ty study and uncer­tain­ties in the val­i­da­tion of an exist­ing safe­ty-relat­ed con­trol cir­cuit with the ISO 13849–1:2006 design stan­dard,” Reliab. Eng. Syst. Saf., vol. 121, pp. 104–112, Jan. 2014.

[9]    Guid­ance on the appli­ca­tion of ISO 13849–1 and IEC 62061 in the design of safe­ty-relat­ed con­trol sys­tems for machin­ery. IEC Tech­ni­cal Report TR 62061–1. 2010.

[10]     Safe­ty of machin­ery — Func­tion­al safe­ty of safe­ty-relat­ed elec­tri­cal, elec­tron­ic and pro­gram­ma­ble elec­tron­ic con­trol sys­tems. IEC Stan­dard 62061. 2005.

[11]    Guid­ance on the appli­ca­tion of ISO 13849–1 and IEC 62061 in the design of safe­ty-relat­ed con­trol sys­tems for machin­ery. IEC Tech­ni­cal Report 62061–1. 2010.

[12]    D. S. G. Nix, Y. Chin­ni­ah, F. Dosio, M. Fessler, F. Eng, and F. Schr­ev­er, “Link­ing Risk and Reliability—Mapping the out­put of risk assess­ment tools to func­tion­al safe­ty require­ments for safe­ty relat­ed con­trol sys­tems,” 2015.

[13]    Safe­ty of machin­ery. Safe­ty relat­ed parts of con­trol sys­tems. Gen­er­al prin­ci­ples for design. CEN Stan­dard EN 954–1. 1996.

[14]   Func­tion­al safe­ty of electrical/electronic/programmable elec­tron­ic safe­ty-relat­ed sys­tems — Part 2: Require­ments for electrical/electronic/programmable elec­tron­ic safe­ty-relat­ed sys­tems. IEC Stan­dard 61508–2. 2010.

[15]     Reli­a­bil­i­ty Pre­dic­tion of Elec­tron­ic Equip­ment. Mil­i­tary Hand­book MIL-HDBK-217F. 1991.

[16]     “IFA — Prac­ti­cal aids: Soft­ware-Assis­tent SISTEMA: Safe­ty Integri­ty — Soft­ware Tool for the Eval­u­a­tion of Machine Appli­ca­tions”, Dguv.de, 2017. [Online]. Avail­able: http://www.dguv.de/ifa/praxishilfen/practical-solutions-machine-safety/software-sistema/index.jsp. [Accessed: 30- Jan- 2017].

[17]      “fail­ure mode”, 192–03-17, Inter­na­tion­al Elec­trotech­ni­cal Vocab­u­lary. IEC Inter­na­tion­al Elec­trotech­ni­cal Com­mis­sion, Gene­va, 2015.

[18]      M. Gen­tile and A. E. Sum­mers, “Com­mon Cause Fail­ure: How Do You Man­age Them?,” Process Saf. Prog., vol. 25, no. 4, pp. 331–338, 2006.

[19]     Out of Control—Why con­trol sys­tems go wrong and how to pre­vent fail­ure, 2nd ed. Rich­mond, Sur­rey, UK: HSE Health and Safe­ty Exec­u­tive, 2003.

[20]     Safe­guard­ing of Machin­ery. 3rd Edi­tion. CSA Stan­dard Z432. 2016.

[21]     O. Reg. 851, INDUSTRIAL ESTABLISHMENTS. Ontario, Cana­da, 1990.

[22]     “Field-pro­gram­ma­ble gate array”, En.wikipedia.org, 2017. [Online]. Avail­able: https://en.wikipedia.org/wiki/Field-programmable_gate_array. [Accessed: 16-Jun-2017].

[23]     Analy­sis tech­niques for sys­tem reli­a­bil­i­ty – Pro­ce­dure for fail­ure mode and effects analy­sis (FMEA). 2nd Ed. IEC Stan­dard 60812. 2006.

[24]     “Fail­ure mode and effects analy­sis”, En.wikipedia.org, 2017. [Online]. Avail­able: https://en.wikipedia.org/wiki/Failure_mode_and_effects_analysis. [Accessed: 16-Jun-2017].