Machine Safety: When should 2 mechanical safety switches be used on an access door?
European colleagues have many opinions about mechanical safety switches on access doors, especially in light of ISO 13849-1 and 2. Is this standard considered normative (mandatory) or informative in the U.S.?
Boy oh boy, is there ever a lot of chatter on the internet over the question of using two mechanical safety switches on access doors. Our European colleagues have lots of opinions especially in reference to the Safety of Machinery standard ISO 13849-1 & 2. However, in the U.S. is this standard considered normative (mandatory) or informative?
First of all let’s agree that this question only pertains to the SRP/CS (safety-related parts of the control system). Secondly, let’s agree that there is a hazard of some level beyond the access door. And, as stated in the question, we’re dealing with applications in the United States and our indigenous related design requirements.
We should first look at our domestic standards and regulations to establish the design requirements. However, to begin the design of the control system and its SRC/CS, we first need what? (I hope you've been paying attention.)
That’s right. We need a current risk assessment. (In all the chatter forums I read, there’s lots of talk about single channel, dual channel, fault exclusions, tampering, foreseeable misuse, common cause failure, mechanical failure, and much more. But, I didn't see one word about risk assessment.) Whether we’re using domestic or international standards and regulations, we first need to know the level of the hazard, and secondly the extent of mitigation required to reach an acceptable level of hazard. Doesn’t this become the design requirement?
In the U.S. we might likely use the ANSI B11.0 – 2010, Safety of Machinery – General Requirements and Risk Assessment standard. This is a U.S. standard for Risk Assessment and Table 4 in 7.2.9 Safety-related parts of control system is excellent for determining the corresponding system design requirements for a given Cat level (B, 1, 2, 3 and 4).
For example, a Cat 4 hazard requires a circuit design of “Redundancy w/ continuous self-checking (e.g., Dual channel w/continuous monitoring)." For this circuit design we’re also required – “the use of well-tried safety principles shall apply. Safety-related parts shall be designed, so that a single fault in any of these parts does not lead to a loss of the safety function, and the single fault is detected at or before the next demand upon the safety function, but that if this detection is not possible, an accumulation of undetected faults shall not lead to loss of the safety function.”
Most designers and maintenance personnel I know can easily follow these guidelines and meet the compliance requirements for applications within the U.S. Furthermore, the advice most often stated is to error on the up-side when selecting components for the circuit including the safety switches. So, in my opinion, mandatory application of two mechanical safety switches depends on the Risk Assessment and could be mandatory based on the applied hazard mitigation plan.
Now, for those who choose follow International Standards like ISO 13849-1 & 2, there are many more factors consider for circuit design and component selection. However, it is practical (and required) to complete a Risk Assessment first and secondly to establish the PLr (Performance Level required). I call PLr the design goal because of the design rule that the PL must equal or exceed the PLr.
Has this presented you with any new perspectives? Add your comments or thoughts to the discussion by submitting your ideas, experiences, and challenges in the comments section below.