New! - Norman Equipment Co.

28What are the defined levels of relative risk formachinery within which the safety systemshould be designed?The European harmonized standard, EN954-1 (Safety ofMachinery — Design of Safety Related ControlSystems), outlines five relative levels of risk associatedwith the operation/maintenance of machinery. Thegreater the possibility and/or severity of injury, thegreater the requirements are on the design and integrityof the machine safety systems.In general, these levels of risk are defined as follows:º SafetyCat.BGeneral SafetySystem RequirementsSafety system designed tomeet operational requirementsand withstand expected externalinfluences.(This category is usually satisfiedby selecting componentscompatible with the applicationconditions … e.g. temperature,voltage, load, etc.)1 Safety system must meet therequirements of Category B, butmust use “well-tried” safety principlesand components.“Well-tried” principles and componentsinclude those which:. avoid certain faults … e.g.short circuits.. reduce probability of faults… e.g. over-rating selected components,over-dimensioning forstructural integrity.. detect faults early … e.g.ground fault protection.. assure the mode of the fault… e.g. ensure an open circuitwhen it is vital that power beinterrupted should an unsafe conditionarise.. limit the consequences ofthe fault.2 Safety system must meet therequirements of Category B. Inaddition the machine shall beprevented from starting if a faultis detected upon application ofmachine power, or upon periodicchecking during operation.(This suggests the use of asafety relay module with redundancyand self-checking. Singlechanneloperation is permittedprovided that the input devices …such as machine guard interlocks,E-stop pushbuttons, et al… are tested for proper operationon a regular basis.)General SafetySystem BehaviorA single fault orfailure in the safetysystem canlead to the loss ofthe safety function.A single fault orfailure in the safetysystem canlead to the loss ofthe safety function.However, theuse of “well tried”safety principlesand safety componentsresults in ahigher level ofsafety system reliability.Here, too, a singlefault or failurein the safety systemcan lead tothe loss of thesafety functionbetween thechecking intervals.However, periodicchecking maydetect faults andpermit timelymaintenance ofthe safety system.SafetyCat.General SafetySystem Requirements3 Safety system must meet therequirements of Category B. Inaddition the safety control systemmust be designed such that asingle fault will not lead to theloss of the safety function. And,where practical, the single faultwill be detected.(This requires redundancy inthe safety circuit monitoring moduleand the use of dual-channelmonitoring of the input and outputdevices such as machineguard interlock switches, E-stoppushbuttons, safety relays, etc.)4* Safety system must meet therequirements of Category B. Inaddition the safety control systemmust be designed such that asingle fault will not lead to theloss of the safety function andwill be detected at or before thenext demand on the safety system.If this is not possible, thenthe accumulation of multiplefaults must not lead to the loss ofthe safety function.(This also requires redundancyin the safety circuit and the use ofdual-channel monitoring of theinput and output devices such asmachine guard interlock switches,E-stop pushbuttons, safety relays,etc. Here the number of allowablefaults will be determined by theapplication, technology used, andsystem structure.)General SafetySystem BehaviorHere a singlefault or failure inthe safety systemwill not lead to theloss of the safetyfunction and,where possible,will be detected.Here a singlefault or failure inthe safety systemwill not lead to theloss of the safetyfunction, and it willbe detected intime to prevent theloss of the safetyfunction.*Category 4 safety requirements are usually associatedwith extremely high-risk applications. Since general machinedesign practice respects classic safety hierarchy, in whichmost machine hazards are either:designed out,guarded against (if they cannot be designed out), and,. (as a last resort) warned against,Category 4 requirements may arise relatively infrequently.FIGURE 11377