Safety Related Control Systems - Automation.com

34 shows a system which fulfills the requirements of category 3. An SR06AM safety monitoring relay unit is used to monitor a two channel control circuit. CookieConsent Thissiteusescookiestostoreinformationonyourcomputer.Withoutconsentcertainenhancedfeatureswillnotbeavailableandfuturevisitsmayrequirerepeatedconsent,soitisrecommendedtoaccepttheuseofcookies.VisittheAutomation.comPrivacyPolicyformoreinformation. SafetyRelatedControlSystems Facebook LinkedIn Twitter ByScientificTechnologies September16,2011 ScientificTechnologies,Inc. News Summary Inordertoprovidethesafetyfunctionthesystemmustcontinuetooperatecorrectlyunderallforeseeableconditions.Sohowdowedesignasystemtoachievethis,andwhenwehavedonethat,howdoweshowit? Firstofall,whatisasafetyrelatedcontrolsystem(oftenabbreviatedtoSRCS)? Itisthatpartofthecontrolsystemofamachinewhichpreventsahazardousconditionfromoccurring.Itcanbeaseparatededicatedsystemoritmaybeintegratedwiththenormalmachinecontrolsystem.   Itscomplexitywillvaryfromatypicalsimplesystem,suchasaguarddoorinterlockswitchandemergencystopswitchconnectedinseriestothecontrolcoilofpowercontactor,toacompoundsystemcomprisingbothsimpleandcomplexdevicescommunicatingthroughsoftwareandhardware.   Inordertoprovidethesafetyfunctionthesystemmustcontinuetooperatecorrectlyunderallforeseeableconditions.   Sohowdowedesignasystemtoachievethis,andwhenwehavedonethat,howdoweshowit?   TheEuropeanStandardprEN954-1"Safetyrelatedpartsofcontrolsystems"dealswiththeseaspects.   Itlaysdowna"language"offivecategoriesforbenchmarkinganddescribingtheperformanceofSRCSs.   Table32isasummaryofthecategories. SUMMARYOFREQUIREMENTS SYSTEMBAHAVIOR PRINCIPLE CATEGORYB (Seenote1) -Safetyrelatedpartsofamachinecontrolsystemsand/ortheirprotectiveequipment,aswellastheircomponents,shallbedesigned,constructed,selected,assembledandcombinedinaccordancewithrelevantstandardssothattheycanwithstandtheexpectedinfluence. Whenafaultoccursitcanleadtoalossofthesafetyfunction. Byselectionofcomponents (TowardsPREVENTIONoffaults) CATEGORY1 -TherequirementsofcategoryBapplytogetherwiththeuseofwelltriedsafetycomponentsandsafetyprinciples. AsdescribedforcategoryBbutwithhighersafetyrelatedreliabilityofthesafetyrelatedfunction.  (Thehigherthereliability,thelessthelikelyhoodofafault.) Byselectionofcomponents (TowardsPREVENTIONoffaults) CATEGORY2 -TherequirementsofcategoryBandtheuseofwelltriedsafetyprinciplesapply. -Thesafetyfunction(s)shallbecheckedatmachinestart-upandperiodicallybythemachinecontrolsystem.  Ifafaultisdetectedasafestateshallbeinitiatedorifthisisnotpossibleawarningshallbegiven. Thelossofasafetyfunctionisdetectedbythecheck.   Theoccurrenceofafaultcanleadtothelossofsafetyfunctionbetweenthecheckingintervals. Bystructure (TowardsDETECTIONoffaults) CATEGORY3 (seenotes2&3) -TherequirementsofcategoryBandtheuseofwelltriedsafetyprinciplesapply. -thesystemshallbedesignedsothatasinglefaultinanyofitspartsdoesnotleadtothelossofasafetyfunction. Whenthesinglefaultoccursthesafetyfunctionisalwaysperformed   Somebutnotallfaultswillbedetected   Anaccumulationofundetectedfaultscanleadtothelossofsafetyfunction Bystructure (TowardsDETECTIONoffaults) CATEGORY4 (seenotes2&3) -TherequirementsofcategoryBandtheuseofwelltriedsafetyprinciplesapply. -Thesystemshallbedesignedsothatasinglefaultinanyofitspartsdoesnotleadtothelossofsafetyfunction. -Thesinglefaultisdetectedatorbeforethenextdemandonthesafetyfunction.  Ifthisdetectionisnotpossiblethenanaccumulationoffaultsshallnotleadtoalossofsafetyfunction. Whenthefaultsoccurthesafetyfunctionisalwaysperformed.   Thefaultswillbedetectedintimetopreventthelossofsafetyfunctions. Bystructure (TowardsDETECTIONoffaults)   Table32 Note1:CategoryBinitselfhasnospecialmeasuresforsafetybutitformsthebaseforothercategories. Note2:Multiplefaultscausedbyacommoncauseorasinevitableconsequencesofthefirstfaultshallbecountedasasinglefault. Note3:Thefaultreviewmaybelimitedtotwofaultsincombinationifitcanbejustifiedbutcomplexcircuits(e.g.microprocessorcircuits)mayrequiremorefaultsincombinationtobeconsidered. Sohowdoyoudecideonwhichcategoryyouneed? Inordertotranslatetheserequirementsintoasystemdesignspecificationtherehastobeaninterpretationofthebasicrequirements.   Firstofallletusdisposeofonepopularmisconception.Itisacommonlyheldbeliefthatcategory1givestheleastprotectionandcategory4givesthebest.  Thisisnotthereasoningbehindthecategories.Theyareintendedasreferencepointswhichdescribethefunctionalperformanceofdifferentmethodtypesofsafetyrelatedcontrolsystems(ortheirconstituentparts).   Category1isaimedatthePREVENTIONoffaults.Itisachievedbytheuseofsuitabledesignprinciples,componentsandmaterials.Simplicityofprincipleanddesigntogetherwiththeuseofmaterialswithstableandpredictablecharacteristicsarethekeystothiscategory.   Categories2,3and4requirethatiffaultscannotbepreventedtheymustbeDETECTED(andappropriateactiontaken). Monitoringandcheckingarethekeystothesecategories.Themostusual(butnottheonly)methodofmonitoringistoduplicatethesafetycriticalfunctions(i.e.redundancy)andcomparetheiroperation.   Perhapsthebestwaytomakefurtherprogressistouseexamples.   Theexampleinfig.33isasimplesystemcomprisingaguarddoorinterlockswitchconnectedinseriestothecontrolcoilofapowercontactor.   Fig.33   Ifweconsiderthattheaimistowardcompletereliabilitywithnopossibilityofafailuretoadangerouscondition,whichofthecategoriesismostappropriate?   Figure33alsoshowsthelocationandnatureofpotentialdangerousfaults.   Ifwerefertotable32whichtypeofcategoryisthemostappropriate?Thepreventionoffaultsorthedetectionoffaults?   Thefirststepistoseparatethesystemintoitsmajorcomponentsandconsidertheirmodesofpotentialfailure.   Inthisexamplethecomponentsare: • Interlockswitch • Contactor • Wiring   Theinterlockswitchisamechanicaldevice.Thetaskwhichitperformsisasimpleonei.e.openingthecontactswhenaguarddoorisopened.Itfulfillstherequirementsofcategory1 andbytheuseofcorrectdesignprinciplesandmaterialsitcanbeprovedthat,whenusedwithinitsstatedoperatingparameters,itwillhavenofailurestoadangerouscondition.Thisismadefeasiblebythefactthatthedeviceisrelativelysimpleandhaspredictableandprovablecharacteristics.   Thecontactorisaslightlymorecomplexdeviceandmayhavesometheoreticalpossibilitiesforfailure.Contactorsfromreputablemanufacturersareextremelyreliabledevices.  Statisticsshowthatfailuresarerareandcanusuallybeattributedtopoorinstallationormaintenance.   Contactorsshouldalwayshavetheirpowercontactsprotectedbyanovercurrentcut-outdevicetopreventwelding.   Contactorsshouldbesubjecttoaregularinspectionroutinetodetectexcessivecontactpittingorlooseconnectionswhichcanleadtooverheatinganddistortion.    Thecontactorshouldcomplywithrelevantstandardswhichcovertherequiredcharacteristicsandconditionsofuse.   Byattendingtothesefactorsitispossibletokeepthepossibilitiesoffailuretoaminimum.Butforsomesituationseventhisisunacceptableandinordertoincreasethelevelofsafetyprovisionweneedtouseduplicationandmonitoring.   Thewiringwhichconnectsthecomponentstogethermustalsobeconsidered.UndetectedshortcircuitandgroundfaultscouldleadtoadangerousconditionbutifitisproperlydesignedandinstalledusingstandardssuchasEN60204forguidancethenthechancesoffailurearegreatlyreduced.   Thissystemcanprovideasignificantlevelofsafetywhichmaybeadequateformanysituations.Youmayhavenoticedhoweverthatboththecontactorandthewiringarepronetounlikelythoughtheoreticallyforeseeablefaults.Insomecasesitmaybepossible,bytakingprecautions(e.g.withregardtocableprotectionandrouting)toeliminateallfaultpossibilities.Ifthisisnotfeasiblethentechniquesrelevanttocategories2,3&4suchasduplicationandmonitoringareusuallybothmorepracticalandcosteffective.   Fig.34showsasystemwhichfulfillstherequirementsofcategory3.AnSR06AMsafetymonitoringrelayunitisusedtomonitoratwochannelcontrolcircuit.Anysinglefaultonthewiringorcontactorswillbedetectedbythesafetymonitoringrelayatthenextdemandonthesafetyfunction.NOTE:Althoughtheinterlockswitchnowhasdoublepolecontactsitisstilladevicewhichfulfillstherequirementsofcategory1-formingpartofasystemwhichfulfillstherequirementsofcategory3.   Fig.34   Thisposestheinevitablequestionofwhen,andtowhatdegree,doweneedtotakesuchmeasures.   Thesimpleansweristosaythatitdependsontheresultsoftheriskassessment.Thisisthecorrectapproachbutwemustunderstandthatthisincludesallfactorsandnotjustthelevelofriskatthehazardpoint.Forexample,itmaybethoughtthatiftheriskestimationshowsahighlevelofrisk,theinterlockswitchshouldbedoubledupandmonitored.Butinmanycircumstancesthisdevice,duetoitsapplication,designandsimplicity,willnotfailtodangerandtherewillbenoundetectedfaultstomonitor.   Thereforethesituationisbecomingclear, thetypeofcategoryusedwilldependonboththeriskassessmentandthenatureandcomplexityofthedeviceorsystem.Itisalsoclearthatwhereatotalsystemmeetstherequirementsofcategory3forexampleitmayincludedevicestocategory1.   Iftherearefaultpossibilitiesthehigherthedegreeofrisk,obtainedattheriskestimation,thegreaterthejustificationformeasurestopreventordetectthemandthetypeofcategoryshouldbechosentogivethemostsuitableandefficientmethodofdoingthis.Remember,thelevelofriskestimateisonefactorbutthenatureoftheprotectivedeviceorsystemandthemachine'soperatingcharacteristicsmustalsobetakenintoaccount.   Fig.35showsthesamebasiccircuitbuttheinterlockswitchisreplacedbyasafetylightcurtain.  Thesafetylightcurtainisacomplexdevice.Eveninitssimplestformitwillhavearelativelylargenumberofelectroniccomponentsincludingintegratedcircuits.  Moresophisticatedtypes(andhencewithmorefeatures)mayalsodependonprogrammabledevicesandsoftware.   Fig.35   Toanticipateandeliminatealldangerousfaultsinanelectronicbutnon-programmabledevicewouldbeahugetaskandwithaprogrammabledeviceitwouldbevirtuallyimpossible.Thereforewemustacceptthatfaultswillbepossibleandthebestansweristodetectthemandensurethatthenecessaryprotectiveactionistaken(e.g.lockingouttoasafestate).Sowewouldneedadevicethatsatisfiestherequirementsofcategory2,3or4.Withasimplecircuitsuchasinfig.35thelightcurtainwillalsomonitorthewiringandcontactors.Asalllightcurtainsarerelativelycomplex,thechoiceofcategorieswillusuallydependsolelyontheresultsoftheriskassessment. Thisdoesnotprecludethefactthatitmaybepossibletoworktoadifferentcategoryifadeviceusesanunconventionalbutprovableapproach.  Wecanseefromthelasttwoexamplesthatthesamedegreeofprotectionisprovidedbytwotypesofsystemsusingdevicessatisfyingdifferentcategories.   Hopefullytheseexampleswillencourageapatternoflogictoenablethecorrectdecisiontobemade. FurtherConsiderationsandExamples Inthissectionweshallgiveexamplesofsafetyrelatedcontrolcircuitswithreferencetorecommendedpracticesandthesafetyrelatedcontrolsystemcategorieswhereappropriate. GeneralRequirements Thesystemmustbecapableofwithstandingallexpectedinfluences.  Thesewillincludetemperature,environment,powerloading,frequencyofuse,airborneinterference,vibrationetc.  ThestandardEN60204-1"Safetyofmachinery-Electricalequipmentofmachines–Specificationforgeneralrequirements"providesdetailedguidanceonsuchthingsaselectricshockprotection,wiringpractices,insulation,equipment,powersupplies,controlcircuitsandfunctions,etc.  Aknowledgeofthisstandardisessentialforthoseconcernedwiththedesignandmaintenanceofsafetyrelatedcontrolsystems. CircuitsandMonitoringSafetyRelayUnits Theexamplesgivenbelowarebasedontheuseofacontrolinterlockingswitchbutthesameprinciplecanbeappliedtootherswitchingdevicee.g.emergencystoportripdevices. Category1 Fig.36showsasimplesafetyrelatedcontrolcircuit.Theinterlockdevicehaspositivemodeoperationandsatisfiestherequirementsofcategory1.Thecontactoriscorrectlyselectedforitsdutyandisdesignedandmanufacturedtospecificstandards.Thepartofthesystemmostpronetoafaultistheconnectingwiring.InordertoovercomethisitshouldbeinstalledinaccordancewiththerelevantclausesofstandardEN60204.Itshouldberoutedandprotectedinamannerwhichpreventsanyforeseeableshortcircuitsorearthfaults.Thissystemwillsatisfytherequirementsofcategory1.   Fig.36 Category1 Fig.37showsaslightlymorecomplexcircuit.Inthiscasethereisarequirementfortheinterlockdevicetocontrolmorethanonecontactor,eachbeingonadifferentpowercircuit.Itscomponentpartsmustbegiventhesameconsiderations.   Fig.37   Withanon-safetyrelatedcircuitanordinaryrelaycouldbeusedto"split"thesignalbutwheresafetyisconcernedthiswoulddefinitelynotbeacceptableastheycan(andsometimesdo)stick.ThereforeamonitoringsafetyrelayunitsuchastheSR05Aisusedtoprovideanensuredswitchingaction.Thissystemwillsatisfytherequirementsofcategory1. Category2 Fig.38showsasystemwhichsatisfiestherequirementsofcategory2andthereforemustundergoatestofthesafetyfunctionbeforethemachinecanbestarted.Itmustalsobetestedperiodically.Atinitialpowerupthesafetymonitoringrelaywillnotallowswitchingofpowertothecontactoruntiltheguardisopenedandclosed.Thisinitiatesacheckforanysinglefaultsinthecircuitfromtheswitchtothesafetymonitoringrelay.Onlywhenthischeckissuccessfulwillthecontactorbeenergized.Ateverysubsequentguardoperationthecircuitwillbesimilarlychecked.   Fig.38 Category3 Fig.39showsasystemwhichsatisfiestherequirementsofcategory3andisoftensuitableforapplicationswithhigherriskestimations.Itisadualchannelsystemwhichisfullymonitoredincludingthetwocontactors.Onopeningandclosingtheguard,anysingledangerousfaultwillcausethesafetymonitoringrelaytolockoffpowertothecontactorsuntilthefaultisrectifiedandthesafetymonitoringrelayisreset.   Fig.39 Category4 Category4requiresthatthesafetysystemfunctionisstillprovidedevenwithanaccumulationofundetectedfaults.Themostpracticablewayofachievingthisistoemploycontinuousorhighfrequencymonitoringtechniques.Thisisnotfeasiblewithmostmechanicalorelectromechanicalcomponents(e.g.mechanicalswitches,relays,contactors)suchasareusedininterlockingandemergencystopsystems.   Thesetechniquesareviable(andoftenused)tomonitorsolidstateelectroniccomponentsbecauseahighfrequencychangingofstateispossibleanddoesnotsubstantiallydegradethelifeofthecomponent.Thereforethecategory4approachisoftenfoundinselfcontained"sub-systems"suchaslightcurtains. P.E.S.(ProgrammableElectronicSystems) Inthesafetyrelatedcircuitsshownpreviously,theprotectivedeviceisdirectlyconnectedtothecontactor(s)usingonlywiringandsimpleorfullymonitoredelectromechanicaldevices.Thisisthenormallyrecommended"hardwired"method.Itssimplicitymeansthatitisreliableandrelativelyeasytomonitor.   Increasinglythenormaloperationalcontrolofmachineryisbeinghandledbyprogrammableequipment.Withtheadvancesintechnology,programmableandcomplexelectroniccontrolsystemscouldberegardedasthecentralnervoussystemofmanymachines.Whateverhappensinthecontrolsystemwillaffectthe machineactionandconverselywhateverhappenstothemachineactionwillaffectthecontrolsystem.Stoppingoneofthesemachinesbyanysourceotherthanitscontrolsystemmayresultinseveretoolandmachinedamageaswellasprogramlossordamage.Itisalsopossiblethat,uponrestarting,themachinemaybehaveinanunpredictablemannerdueto"scrambling"ofitscontrolcommandsequence.   Unfortunatelymostprogrammableelectronicsystemshavetoomanyfailuremodesduetotheircomplexitytoallowtheiruseastheonlywayofstoppingthemachineoncommandfromanguarddoorinterlockoremergencystopbutton.   InotherwordswecanstopitwithoutmachinedamageORstopitSAFELYBUTNOTBOTH.Sowhatdowedo?Threesolutionsaregivenbelow:   1-SafetyRelatedProgrammableSystems Intheoryitispossibletodesignaprogrammablesystemwhichhasasafetyintegritylevelhighenoughforsafetyrelateduse.Inpracticethiswouldnormallybeachievedbyusingspecialmeasuressuchasduplicationanddiversitywithcrossmonitoring.Insomesituationsthismaybepossiblebutitisimportanttorealizethatthesespecialmeasureswillneedtobeappliedtoallaspectsincludingthewritingofsoftware.   Thebasicquestionis,canyouprovethattherewillbeno(orsufficientlyfew)failures.Afullfailuremodeanalysisforevenrelativelysimpleprogrammableequipmentmay,atbest,beexcessivelytimeconsumingandexpensiveor,atworst,beimpossible.   ThestandardIEC1508dealswiththissubjectingreatdetail.Anyoneconcernedwithsafetyrelatedprogrammablesystemsisadvisedtostudyit.   Thedevelopmentcostsofthesesystemsarejustifiableinapplicationswheretheyhavesignificantadvantagesornoothermethodwillwork.   2-MonitoringUnitwithTimeDelayedOverrideCommand (seeFig.40) Thissystemhasthehighintegritylevelofhardwiringandalsoallowsacorrectlysequencedshut-downwhichprotectsthemachineandprogram.   Fig.40   TheSR10MDprimaryoutputsareconnectedtoinputsattheprogrammabledevice(e.g.PLC)andthedelayedoutputsareconnectedtothecontactor.Whentheguardinterlockswitchisactuated,theprimaryoutputsonthesafetymonitoringrelayswitchimmediately.Thissignalstheprogrammablesystemtocarryoutacorrectlysequencedstop.Aftersufficienttimehaselapsedtoallowthisprocessthedelayedoutputonthesafetymonitoringrelayswitchesandisolatesthemaincontactor.   Thisrangeofsafetymonitoringrelayscanbeusedwithvariousprotectivedevicesandisavail-ablewithotherconfigurationsandswitchingarrangementstosuittherequirementsofparticularsystems.   Note:Anycalculationstodeterminetheoverallstoppingtimemusttakeaccountofthesafetymonitoringrelayoutputdelayperiod.ThisisparticularlyimportantwhenusingthisfactortodeterminethepositioningofdevicesinaccordancewithstandardprEN999.   3-ProgrammableSystemControlledGuardLockingDevices (seeFig.41) Thissystemagainprovidesthehighintegritylevelofhardwiringcombinedwiththeabilitytogiveacorrectlysequencedshutdownbutitisonlyapplicablewherethehazardisprotectedbyaguard.   Fig.41   InordertoallowopeningoftheguarddoortheTL8018solenoidmustreceiveareleasesignalfromthePLC.Thissignalwillonlybegivenafterastopcommandsequencehasbeencompleted.Thisensuresthereisnotooldamageorprogramloss.WhenthesolenoidisenergizedthedoorcanbeopenedwhichcausesthecontrolcircuitcontactsontheTL8018toisolatethemachinecontactor.   Toovercomemachinerun-downorspuriousreleasesignals,itmaybenecessarytouseanSTISMT01timeddelayunitorSMD02stoppedmotiondetectorinconjunctionwiththePLC.(EithertheTL8018orTL8012switchescanbeusedinthisapplication.) OtherConsiderations   MachineRestart-Manual/AutoResetandControlGuards If(forexample)aninterlockedguardisopenedonanoperatingmachine,thesafetyinterlockswitchwillstopthatmachine.Inmostcircumstancesitisimperativethatthemachinedoesnotrestartimmediatelywhentheguardisclosed.ThemostcommonwayofachievingthisistorelyonalatchingcontactorstartarrangementasshowninFig.42(aninterlockedguarddoorisusedasanexampleherebuttherequirementsapplytoother protectiondevicesandemergencystopsystems).   Fig.42   Pressingandreleasingthestartbuttonmomentarilyenergizesthecontactorcontrolcoilwhichclosesthepowercontacts.Aslongaspowerisflowingthroughthepowercontactsthecontrolcoiliskeptenergized(electricallylatched)viathecontactor'sauxiliarycontactswhicharemechanicallylinkedtothepowercontacts.Anyinterruptiontothemainpowerorcontrolsupplyresultsinthede-energizingofthecoilandopeningofthemainpowerandauxiliarycontacts.Theguardinterlockiswiredintothecontactorcontrolcircuit.Thismeansthatrestartcanonlybeachievedbyclosingtheguardandthenswitching"ON"atthenormalstartbuttonwhichresetsthecontactorandstartsthemachine.   TherequirementfornormalinterlockingsituationsismadeclearinEN292part13.22.4   Whentheguardisclosed,thehazardousmachinefunctionscoveredbytheguardcanoperate,buttheclosureoftheguarddoesnotbyitselfinitiatetheiroperation.   Manymachinesalreadyhaveeithersingleordoublecontactorswhichoperateasdescribedabove(orhaveasystemwhichachievesthesameresult).Whenfittinganinterlocktoexistingmachineryitisnecessarytodeterminewhetherthepowercontrolarrangementmeetsthisrequirementandtakeadditionalmeasuresifnecessary. Auto/ManualReset Onsometypesofprotectivedevices,afteractuationofthesafetyfunction,theoutputwillremainoffuntilthedevicehasbeenreset.Somedevicesareavailableineithermanualresetorauto-resetversions.   Amanualresetdependsonamanualswitchingactionafterthede-actuationofthedeviceand mayalsotriggerasystemintegritycheckbeforethesafetysystemisresettorenderthemachinecapableofbeingstarted.Itwillrequiretheoperationofabuttonorkeyoperatedswitchwhichmaybefittedeitheronthedevice,thecontrolunitorataremotelocation.Whereveritis,itshouldprovideagoodviewofthehazardsothattheoperatorcancheckthattheareaisclearbeforeoperation.   InFig.43,aftertheguardhasbeenopenedandclosedagainthesafetymonitoringrelaywillnotallowthemachinetoberestarteduntiltheresetbuttonhasbeenpressedandreleased.WhenthisisdonethesafetymonitoringrelaychecksthatbothcontactorsareOFFandthatbothinterlockcircuits(andthereforetheguard)areclosed.Ifthesechecksaresuccessfulthemachinecanthenberestartedfromthenormalcontrols.   Fig.43   An auto-resetdevice doesnotrequireamanualswitchingactionbutafterde-actuationitwillalwaysconductasystemintegritycheckbeforeresettingthesystem.  Anauto-resetsystemshouldnotbeconfusedwithadevicewithoutresetfacilities.Inthelatterthesafetysystemwillbeenabledimmediatelyafterde-actuationbuttherewillbenosystemintegritycheck.   ControlGuards A controlguard stopsamachinewhentheguard isopenedanddirectlystartsitagainwhentheguardisclosed.   Theuseofcontrolguardsisonlyallowedundercertainstringentconditionsbecauseanyunexpectedstart-uporfailuretostopwouldbeextremelydangerous.  Theinterlockingsystemmusthavethehighestpossiblereliability(itisoftenadvisabletouseguardlocking).   TheuseofcontrolguardscanONLYbeconsideredonmachinerywherethereisNOPOSSIBILITYofanoperatororpartofhisbodystayinginorreachingintothedangerzonewhiletheguardisclosed.   Thecontrolguardmustbetheonlyaccesstothehazardarea.   DefinitionofControlReliability ControlreliabilityisdefinedbyANSIstandardB11.19-1990,5.5as"…thedevice,systemorinterfaceshallbedesigned,constructedandinstalledsuchthatasinglecomponentfailurewithinthedevice,interfaceorsystemshallnotpreventnormalstoppingactionfromtakingplacebutshallpreventasuccessivemachinecycle…"  ThisdefinitionisacceptedforuseintheUnitedStatesandwhilethereisnotanexactcorrelationbetweenANSIstandardsandEuropeanstandards,theANSIdefinitionabovecorrespondsmostdirectlywithCategory3.   ThisarticleisprovidedbyScientificTechnologies,Inc.(STI).STIhasgrowntobealeadingsupplierofmachinesafeguardingproductsintheUnitedStatesandisrecognizedthroughouttheworldforitssuperiorproductsandservices.    ClickHereforMoreInformation Didyouenjoythisgreatarticle? Checkoutourfreee-newsletterstoreadmoregreatarticles.. Subscribe