SAFETYRELATEDCONTROLSYSTEMS

Inapreviousarticlewediscussedtheissuesrelatingtomachinesafetysystemsfocusingmainly
onthePUWERregulationsandriskassessments.Inthisissuewilltakethissubjectastepfurther
andexplainsomeofthecontrolsystemprinciplesthatcanbeappliedtoequipmentoftenfoundin
todaysmillingenvironment.
MilloperatorsshouldbewellawareoftheimportanceofcomplyingwithBritishandInternational
safetystandardsinordertoensurecontinuedfunctionalityofequipmentandsafetyforusers.This
meansthatduringtheoperationofmachineryusersmustbefullyprotectedfromaccesstothe
movingpartsandwithinmodernautomaticproductionfacilitiesthisprotectionisbuiltintothe
controlsystem.

SafetyPrinciples
ChoiceofProtectiveMeasures
Whentheriskassessmentshowsthatamachineorprocesscarriesariskofinjurythehazard
mustbeeliminatedorcontained.Themannerinwhichthisisachievedwilldependonthenature
ofthemachineandthehazard.Inbasictermsthismeanspreventinganyaccesstotherelevant
partswhiletheyareinadangerouscondition.
Thebestchoiceofprotectivemeasureisadeviceorsystemthatprovidesthemaximum
protectionwiththeminimumhindrancetonormalmachineoperation.Itisimportantthatall
aspectsofmachineuseareconsidered,asexperienceshowsthatasystem,whichisdifficultto
use,ismoreliabletoberemovedorbypassed.
Toachievethisthereisachoiceofeither:
1.Preventingaccessduringdangerousmotionor
2.Preventingdangerousmotionduringaccess.
Thefollowinggivesabriefoverviewofthecharacteristicsofthemostcommonlyuseddevices.
FixedEnclosingGuards
Ifthehazardisonapartofthemachinery,whichdoesnotrequireaccess,itshouldbe
permanentlyguardedwithfixedenclosingguards.
MovableGuardswithInterlockingSwitches
Ifaccessisrequiredtheremustbeamovableguard,whichisinterlockedwiththepowersource
ofthehazardinamanner,whichensuresthatwhenevertheguarddoorisnotclosedthehazard
powerwillbeswitchedoff.Thisapproachinvolvestheuseofaninterlockingswitchfittedtothe
guarddoor.Thecontrolofthepowersourceofthehazardisroutedthroughtheswitchsectionof
theunit.Thepowersourceisusuallyelectricalbutitcouldalsobepneumaticorhydraulic.When
guarddoormovement(opening)isdetectedtheinterlockingswitchwillisolatethehazardpower
supplyeitherdirectlyorviaapowercontactor(orvalve).
Someinterlockingswitchesalsoincorporatealockingdevicethatlockstheguarddoorclosed
andwillnotreleaseituntilthemachineisinasafecondition.Forthemajorityofapplicationsthe
combinationofamovableguardandaninterlockswitchwithorwithoutguardlockingisthemost
reliableandcosteffectivesolution.
TwoHandControls
Theuseoftwohandcontrolsisacommonmethodofpreventingaccesswhileamachineisina
dangerouscondition.Twostartbuttonsmustbeoperatedatthesametimetorunthemachine.

Thisensuresthatbothhandsoftheoperatorareoccupiedinasafepositionandthereforecannot
beinthehazardarea.

PreventingDangerousMotion
Whenfrequentaccessisrequiredphysicalguardingatthehazardissometimestoorestrictivefor
partloadingoradjustment.Inthissituationadeviceisrequiredtopreventdangerousmotion
whileallowingunrestrictedaccessbysensingthepresenceoftheoperatorandisolatingthe
powersource.
PhotoelectricLightCurtains
Thesedevicesemitacurtainofharmlessinfraredlightbeamsinfrontofthehazardarea.When
anyofthebeamsareblockedbyintrusiontowardsthehazardareathelightcurtaincontrolcircuit
switchesoffthehazardpowersource.Lightcurtainsareextremelyversatileandcanguardareas
manymeterswide.Throughtheuseofmirrorsthelightbeamscanbedivertedaroundcornersto
encloseamachine.Theyareavailablewithdifferentlightbeamspacingsmakingthemsuitable
forapplicationsrangingfromperimeterguardingforindustrialrobotstopointofaccessguarding
onpressesandshears.
PressureSensitiveSafetyMats
Thesedevicesareusedtoprovideguardingofafloorareaaroundamachine.Amatrixof
interconnectedmatsislaidaroundthehazardareaandanypressure(e.g.,anoperators
footstep)willcausethematcontrollerunittoswitchoffpowertothehazard.
PressureSensitiveEdges
Thesedevicesareflexibleedgingstripsthatcanbemountedtotheedgeofamovingpart,such
asamachinetableorpowereddoor,thatposesariskofacrushingorshearing.Ifthemoving
partstrikestheoperator(orviceversa),theflexiblesensitiveedgeisdepressedandwillswitchoff
thehazardpowersource.Sensitiveedgescanalsobeusedtoguardmachinerywherethereisa
riskofoperatorentanglement.Ifanoperatorbecomescaughtinthemachine,contactwiththe
sensitiveedgewillshutdownmachinepower.Lightcurtains,floormatsandsensitiveedgescan
allbeclassifiedastripdevices.Theydonotactuallyrestrictaccessbutonlysenseit.Theyrely
entirelyontheirabilitytobothsenseandswitchfortheprovisionofsafety:itisimportantthattheir
controlcircuitincorporatesselfmonitoringandfailsafemeasures.Ingeneraltheyareonly
suitableonmachinery,whichstopsreasonablyquicklyafterswitchingoffthepowersource.
EmergencyStopDevices
Whereverthereisadangerofanoperatorgettingintotroubleonamachinetheremustbea
facilityforfastaccesstoanemergencystopdevice.Theestopdevicemustbecontinuously
operableandreadilyavailable.Eachoperatorpanelmustcontainatleastoneestopdevice.
Additionalestopdevicesmaybeusedatotherlocationsasneeded.EStopdevicescomein
variousforms.Pushbuttonswitchesandcablepullswitchesareexamplesofthemorepopular
typedevices.Whentheestopdeviceisactuated,itmustlatchinanditmustnotbepossibleto
generatethestopcommandwithoutlatchingin.Theresettingoftheemergencystopdevicemust
notcauseahazardoussituation.Aseparateanddeliberateactionmustbeusedtorestartthe
machine.

SafetyRelatedControlSystems
Asafetyrelatedcontrolsystemisthepartofamachinethatpreventshazardousconditionfrom
occurring.Itcanbeaseparatededicatedsystemorintegratedwiththenormalmachinecontrol
system.

Sohowdowedesignasystemtoachievethis,thestandardISO138491Safetyrelatedpartsof
controlsystemsdealswiththeseaspects.Itexplainsthecriteriaforfivecategoriesfor
benchmarkinganddescribingtheperformanceofthecontrolsystem.Category1isaimedatthe
preventionoffaultsCategories2,3and4requirethatiffaultscannotbepreventedtheymustbe
detected.Thecategoriescanbesummarizedasfollows,
CategoryB
Initselfhasnospecialmeasuresforsafetybutitformsthebaseforothercategories.Safety
relatedpartsofmachinecontrolsystemand/ortheirprotectiveequipment,aswellastheir
components,shallbedesigned,constructed,selected,assembledandcombinedinaccordance
withrelevantstandardssothattheycanwithstandtheexpectedinfluence.Whenafaultoccursit
canleadtoalossofthesafetyfunction.

Figure1
Category1
CategoryBandCategory1areappliedtogetherwiththeuseofwelltriedsafetycomponentsand
safetyprinciples. Thiscombinationhasahighersafetyrelatedreliabilityandlesslikelihoodofa
fault.
Figure1showsasimplesafetyrelatedcontrolcircuit.Theinterlockdevicehaspositivemode
operationandsatisfiestherequirementsofcategory1.Thecontactoriscorrectlyselectedforits
dutyandisdesignedandmanufacturedtospecificstandards.Thepartofthesystemmostprone
toafaultistheconnectingwiring.Inordertoovercomethis,thewiringshouldbeinstalledin
accordancewiththerelevantclausesofIEC602041.Itshouldberoutedandprotectedina
mannerthatpreventsanyforeseeableshortcircuitsorgroundfaults.Thissystemwillsatisfythe
requirementsofcategory1.

Figure2
Category2
CategoryBandCategory2areappliedtogetherwiththeuseofwelltriedsafetyprinciples.This
combinationleadstosafetyfunction(s)checkatmachinestartupandperiodicallybythemachine
controlsystem.Ifafaultisdetectedasafestateshallbeinitiatedorifthisisnotpossiblea
warningshallbegiven.Anylossofsafetyfunctionisdetectedbythecheckbuttheoccurrenceof
afaultbetweenthecheckingintervalscouldleadtothelossofsafetyfunction.
Figure2showsasystem,whichsatisfiestherequirementsofcategory2andthereforemust
undergoatestofthesafetyfunctionbeforethemachinecanbestarted.Itmustalsobetested
periodically.AtinitialpoweruptheSafetyrelaywillnotallowswitchingofpowertothecontactor
untiltheguardisopenedandclosed.Thisinitiatesacheckforanysinglefaultsinthecircuitfrom
theswitchtotheSafetyrelay.Onlywhenthischeckissuccessfulwillthecontactorbeenergized.
Ateverysubsequentguardoperationthecircuitwillbesimilarlychecked.

Figure3
Category3
CategoryBandCategory3areappliedtogetherwiththeuseofwelltriedsafetyprinciples.The
systemisdesignedsothatasinglefaultinanyofitspartsdoesnotleadtolossofsafetyfunction.
Whenthesinglefaultoccursthesafetyfunctionisalwaysperformed.Somebutnotallfaultswill
bedetected.Anaccumulationofundetectedfaultscanleadtothelossofsafetyfunction.
Figure3showsasystemthatsatisfiestherequirementsofcategory3andisoftensuitablefor
applicationswithhigherriskestimations.Itisadualchannelsystemthatisfullymonitored,
includingthetwocontactors.Onopeningandclosingtheguard,anysingledangerousfaultwill
causethesafetyrelaytolockoffpowertothecontactorsuntilthefaultiscorrectedandtheSafety
relayisreset.
Category4
CategoryBandCategory4areappliedtogetherwiththeuseofwelltriedsafetyprinciples.The
systemshallbedesignedsothatasinglefaultinanyofitspartsdoesnotleadtolossofsafety
function.Thesinglefaultisdetectedatorbeforethenextdemandonthesafetyfunction.Ifthis
detectionisnotpossiblethenanaccumulationoffaultsshallnotleadtoalossofsafetyfunction.
Whenthefaultsoccurthesafetyfunctionisalwaysperformed.Thefaultswillbedetectedintime
topreventthelossofsafetyfunctions.
Category4requiresthatthesafetysystemfunctionisstillprovidedevenwithanaccumulationof
undetectedfaults.Themostpracticablewayofachievingthisistoemploycontinuousorhigh
frequencymonitoringtechniques.Thisisnotfeasiblewithmostmechanicalorelectromechanical
components(e.g.,mechanicalswitches,relays,contactors)suchasthoseusedininterlocking

andemergencystopsystems.Thesetechniquesareviable(andoftenused)tomonitorsolidstate
electroniccomponentsbecauseahighfrequencychangeofstateispossibleanddoesnot
substantiallydegradethelifeofthecomponent.Thereforethecategory4approachisoftenfound
inselfcontainedsubsystemssuchaslightcurtains.