Watch out for the changing of the guard

These accidents caused serious injuries and affected the future careers of the workers involved. They included the loss of fingers in some cases to extensive burns to hands in others not to mention heavy fines for the manufacturers that were found to be at negligent.

Such accidents may sometimes result from workers cutting corners or disabling guards to get access to equipment to clear blockages, etc, a process known as "manipulation of guards"​. But, even where guarding is used properly, safe operation is not always assured, according to one safety control systems specialist.

Major safety issues​

David Collier, a machinery safety expert with Pilz Automation Technology, says there are machines in the UK fitted with multiple physical guards or 'gates', which are monitored in one circuit by series connected safety switches that could pose major safety issues.

"There will be plenty of machines in the food and drink industry that are affected,"​ says Collier. He cites the example of 16 guards connected in series guarding a single-axis necking process on a drinks can-making line.

"The bigger the machine, the greater the likelihood that designers have put guards in series,"​ he adds. But it is likely to be a problem on many other items of food processing and packaging equipment, says Collier.

From extruders, depositors and bottling lines to bulk handling conveyor systems; from carton erectors, shrink wrapping machines to form, fill and fill machines and palletisers, they all could pose potential risks, he says. Collier warns that many companies are unaware they have a serious problem.

Pilz is calling on designers of safety guards and associated circuits on new machines, and those responsible for existent machines to review safety guard circuits where safety switches are connected in series.

Historically, series-wired safety switches have been used to save money on cabling and safety relays and because dual channel wiring of the switches met the Category 3 safety standard of the withdrawn standard EN 954, says Piltz.

Category 3 lives on in the replacement standard EN ISO 13849-1, which requires that for Category 3 to apply at least 60% of faults have to be detected the diagnostic coverage (DC) in a diagnosis mechanism.

But the ability of a guarding control system to detect 60% of dangerous faults can be impacted by a phenomenon known as 'fault masking'. This can dramatically reduce the DC and consequently the performance level, says Collier.

Pilz has identified situations with series-wired safety switches where an undetected fault in a safety circuit could result from the clearing of the fault by the simultaneous opening of two gates.

An additional, subsequent fault could cause the whole interlocked guard system to fail to danger, warns Pilz. Collier notes: "Unexpected start-up is one of the most hazardous occurrences with machinery."​

Fault masking​

In the current standard EN ISO 13849-1, the maximum DC that the switch can achieve is restricted, depending on the masking probability. In practice, a single switch pair that is evaluated by a safety relay can achieve a DC which equals 99%.

In the current draft of EN ISO 14119 (which will soon replace the current interlocking standard EN 1088), the maximum DC for a group of interlinked switches is dependent upon the number of switches connected in series and their frequency of operation.

If more than one guard can be opened with a frequency of greater than once an hour, or there are more than four of them in series, the statistical chance of a fault occurring and being masked is high with the result that DC is reduced to less than 60%.

According to EN ISO 13849-1 this is equivalent to no DC. Under these circumstances, if your original risk assessment required Category 3 protection, your system is no longer compliant, warns Collier.

Collier suggests three possible cures for fault masking. The first involves changing the wiring of existing series-connected switches to individually wired switches. But this could prove costly. Secondly, companies could 'zone' the guard monitoring switches into distributed input/output systems.

The third option involves the replacement of volt-free contact based switches with radio frequency identification coded, self-monitoring switches, which can be wired in series and maintain 99% DC individually.

Collier notes that series connection of emergency stop devices is unlikely to incur a loss of DC, because it is unlikely that any two emergency stops would be actuated simultaneously or as frequently as once an hour. Therefore, it is reasonable to wire such devices in series.