Principles, Standards and Implementation

Catalogs > Safety Products Catalog > Principles, Standards and Implementation > Protective Measures and Complementary Equipment

Protective Measures and Complementary Equipment

Safety Switches

When access to the machine is infrequent, movable (operable) guards are preferred. The guard is interlocked with the power source of the hazard in a manner which ensures that whenever the guard door is not closed the hazard power will be switched off. This approach involves the use of an interlocking switch fitted to the guard door. The control of the power source of the hazard is routed through the switch section of the unit. The power source is usually electrical but it could also be pneumatic or hydraulic. When guard door movement (opening) is detected the interlocking switch will initiate a command to isolate the hazard power supply either directly or via a power contactor (or valve).

Some interlocking switches also incorporate a locking device that locks the guard door closed and will not release it until the machine is in a safe condition. For the majority of applications the combination of a movable guard and an interlock switch with or without guard locking is the most reliable and cost effective solution.

Tongue Interlock Switches

Tongue operated interlocks require a tongue-shaped actuator to be inserted and removed from the switch. When the tongue is inserted, the internal safety contacts close and allow the machine to run. When the tongue is removed, the internal safety contacts open and send a stop command to the safety related parts of the control system. Tongue operated interlocks are versatile as they can be used on sliding, hinged or removable guards as shown in Figure 51.

Figure 51: Tongues Interlocks on Sliding, Hinge or Removable Guards

Some of the latest functional safety standards focus on the need for complete fault tolerance as part of the requirements for device that is being used for high risk levels (e.g. SIL 3 or PLe). Because, in theory, mechanical tongue operated switches have single points of failure (e.g. the tongue actuator) even though they have two electrical switching channels. This means that non-contact switches may be preferred in these cases because they do not generally have the single mechanical failure points.

Tongue interlocks have three basic features that allow them to have a safety rating: defeatability, galvanic isolation, and direct opening action.

Defeatability

The security of an interlock switch is dependent on its ability to withstand attempts to "cheat" or defeat the mechanism. An interlock switch should be designed so that it cannot be defeated by simple tools or materials which may be readily available (like screwdrivers, coins, tape, or wire).

Figure 52: Tongue Shaped Actuators with Dimensional Features to Help Prevent Defeatability

This is accomplished by making the actuator a special shape, as shown in Figure 52. When maintenance is required on the machine, the interlocks may have to be bypassed. If this is done, other safeguarding methods for protection must be provided. Access to spare actuators must be controlled by management operating procedures. Some actuators, like the one on the left in Figure 52, have a spring that prevents the tongue from fully entering and operating the interlock switch unless it is correctly fixed to the guard.

In some circumstances personnel may be tempted to override the switch in some way. Information concerning the use of the machine, gathered at the risk assessment stage, will help to decide whether this is more likely or less likely to happen. The more likely it is to happen then the more difficult it should be to override the switch or system. The level of estimated risk should also be a factor at this stage. Switches are available with various levels of security ranging from resistance to impulsive tampering, to being virtually impossible to defeat.

It should be noted at this stage that if a high degree of security is required it is sometimes more practical to achieve this by the way in which it is mounted.

For example, if the switch is mounted as in Figure 53 with a covering track, there is no access to the switch with the guard door open. The nature of any "cheating" prevention measures taken at the installation will depend on the operating principle of the switch.

Figure 53: Switch and Actuator Hidden

Direct Opening Action

ISO 12100-2 explains that if a moving mechanical component inevitably moves another component along with it, either by direct contact or via rigid elements, these components are said to be connected in the positive mode. IEC 60947-5-1 uses the term Direct Opening Action and defines it as achievement of contact separation as the direct result of a specified movement of the switch actuator through non-resilient members (for example not dependent upon springs). This standard provides a set of test that can be used to verify Direct Opening Action. Products that meet the requirements of Direct Opening Action display the symbol shown in Figure 54 on their enclosure.

Figure 54: Symbol of Direct Opening Action

Figure 55 shows an example of positive mode operation giving forced disconnection of the contacts. The contacts are considered normally-closed (N.C.) when the actuator is inserted into the switch (i.e., guard closed). This closes an electrical circuit and allows current to flow through the circuit when the machine is allowed to run. The closed circuit approach allows for the detection of a broken wire which will initiate a stop function. These switches are typically designed with double break contacts. When the guard is opened, the tongue is removed from the operating head and rotates an internal cam. The cam drives the plunger which forces the spanner to open both contacts, breaking potentially welded contacts.

Figure 55: Double-Break with Direct Opening Action

Figure 56: Daisy Chain of Multiple 2 N.C. Interlocks

Most tongue interlocks also have a set of normally-open (N.O.) contacts. These contacts typically close by the force of the return spring. If the spring breaks, proper contact operation cannot be performed with a high enough degree of reliability. Therefore, they are typically used to signal the machine control system that the guard is open.

Normally-open spring-return contacts can be used as a secondary channel in a safety system. This approach provides diversity to the safety system to help prevent common cause failures. The monitoring safety relay or safety PLC must be designed to accommodate this diverse N.O. + N.C. approach.

Figure 56: Daisy Chain of Multiple Two N.C. Interlocks

Figure 57: Multiple Interlocks with N.C. and N.O. Contacts

One advantage of using two normally closed contacts with interlocks is reduction in the wiring when multiple gates must be monitored. Figure 56 shows how multiple gates can be daisy chained. This may be practical for a small number of gates, but becomes more challenging to troubleshoot when too many gates are connected in series.

Where the risk assessment deems the use of diverse contacts, the N.C. contacts are connected in series and the N.O. contacts are connected in parallel. Figure 57 shows a basic schematic of this approach when multiple interlocks are monitored by a monitoring safety relay. The N.O. contacts in the Channel 2 circuit are connected in parallel.

Duplication (also referred to as Redundancy)

If components which are not inherently safe are used in the design, and they are critical to the safety function, then an acceptable level of safety may be provided by duplication of those components or systems. In case of failure of one component, the other one can still perform the function. It is usually necessary to provide monitoring to detect the first failure so that, for example, a dual channel system does not become degraded to a single channel without anybody being aware of it. Attention also must be given to the issue of common cause failures.

Protection must be provided against failure, which will cause all duplicated components (or channels) to fail at the same time Suitable measures may include using diverse technologies for each channel or ensuring an oriented failure mode.

Galvanic Isolation

Figure 58 shows contact blocks with two sets of contacts. A galvanic isolation barrier is required if it is possible for the contacts to touch each other back to back in the event of contact weld or sticking.

Figure 58: Galvanic Isolation of Contacts

Mechanical Stops

Interlock switches are not designed to withstand the stopping of a gate. The machine designer must provide an adequate stop while also providing enough travel for the actuator to fully insert into the switch (Figure 59).

Figure 59: Mechanical Stops

The guard-mounted tongue needs to remain reasonably well aligned with the entry hole in the switch body. Over time, hinges may wear and guards may bend or twist. This adversely affects the alignment of the actuator to the head. The machine designer should consider metal bodied interfaces and flexible actuators, as shown in Figure 60.

Figure 60: Metal Interface with Flexible Actuator

Contact operation affects performance of the switch in the safety/control system and must be taken into account by the machine designer. This performance is only important when both the normally closed contacts are used by the safety system and the normally open contacts are used to indicate guard status to the PLC.

Contact operation is either slow-acting or snap-acting. In slow-acting operation, two types exist. Break before make (BBM) describes the operation where the normally closed contacts open before the normally open contacts close. Make before break (MBB) describes the operation where the normally closed contacts open after the normally open contacts close.

Figure 61: MBB and BBM Contacts—Conflicting Messages

Due to wear, damaged, or other changes to the guarding over time, pressure may be applied to the door forcing it open slightly. If the door moves between to the point where the change-over occurs, the safety system and machine control system will get conflicting messages, as shown in Figure 61.

Fixes for this include latching the door closed or using snap acting contacts. Selection of the appropriate tongue interlock involves many considerations: plastic or metal body, number of contacts, contact operation, size of guard, alignment of guard, movement of the guard, space available and washdown. Tongue operated switches can be difficult to clean thoroughly. Thus, food/beverage and pharmaceutical industries generally prefer non-contact interlocks.