Interlocking Principles
Interlocking Principles
Interlocking Principles
A
it should be to override the switch or system. The level of estimated risk should also be a factor at this stage. Switches are available with various levels of security ranging from resistance to impulsive tampering, to being virtually impossible to defeat. It should be noted at this stage, that if a high degree of security is required, it is sometimes more practical to achieve this by the way in which the switch is mounted. For example, if the switch is mounted as in Figure 6.1 with a covering track, there is no access to the switch with the guard door open. The nature of any cheating prevention measures taken at the installation stage will depend on the operating principle of the switch.
Reliability
An interlock switch must operate reliably even under extreme conditions and rough treatment. The operating mechanism should be kept as simple as possible and all materials used in its manufacturer should be of the highest quality. The design should ensure that component wear is kept to a minimum. The mechanism should be enclosed in a strong, sealed case.
n important type of protective device is a safety interlock switch which interlocks a guard door with the power source of the hazard. When the guard door is opened, the power is isolated, ensuring that the machine is safe when the operator requires access. There are many variations of interlock switches, each with its own characteristics. It is important to ensure that the type of device chosen is correct for its application. Later in this chapter we will look at a series of logical decisions leading to the exact choice of device to be used. First, let's familiarize ourselves with some of the general features and requirements which make devices suitable for interlocking duties.
Security
The security of an interlock switch is dependent on its ability to withstand attempts to cheat or defeat the mechanism. An interlock switch should be designed so that it cannot be easily defeated. In some circumstances, personnel may be tempted to override the switch in some way. Information concerning the use of the machine, gathered at the risk assessment stage, will help to decide whether this is more or less likely to happen. The more likely it is to happen, then the more difficult
Standards
The International Standard ISO 14119 - Interlocking devices associated with guards gives guidance. It is intended to be used in conjunction with IEC 60947-5-1 for electromechanical switches.
Fig. 6.1
OMRoN SCIENTIFIC TECHNoLoGIEs, INC. USA Tel. 1/888/510-4357 Canada Tel. 1/866/986-6766
A51
A
Positive Mode Operation (also referred to as direct operation)
ISO 12100 explains that if a moving mechanical component inevitably moves another component along with it, either by direct contact or via rigid elements, these components are said to be connected in the positive mode. With single mechanical type interlocking switches, when the guard is opened the movement of the guard should be connected in the positive mode to the Safety-Related contacts of the switch. This ensures that the contacts are physically pulled apart or force disconnected by the movement of the guard. The switch should not rely solely on spring pressure to open the contacts, as the force exerted may not be able to overcome sticking or welded contacts. There is also the possibility that the switch could fail to danger if the spring breaks and there is no other way to open the contacts. Figure 6.2(A) shows a typical negative (or non-positive) mode operating system. There is no direct link between the guard door and the safety contacts, so the system relies entirely on spring pressure to open the contacts. In the event of spring failure, contact weld or sticking, the system will fail to danger and is therefore unacceptable. This type of system is easily defeated by pushing the plunger while the guard is open. Even worse, the switch can be tripped accidentally by an operator leaning onto or into the machine while the guard is open. Figure 6.2(B) shows a simple example of positive mode operation giving forced disconnection of the contacts. A cam is mounted on the door hinge so that it directly operates the contacts whenever the guard door is open. Spring pressure can only close the contacts when the guard is fully closed. Any spring breakage will only result in a failure to a safe condition.
Fig. 6.2 (A) Negative operation Never use negative-operation switches alone in safety applications. Category B or 1 (using approved parts) Normal operation Contacts closed (door closed} Abnormal operation a) No reset due to contact welding (door open) (B) Positive operation Positive-operation switches are recommended when used alone as the switches offer a higher level of safety than negative-operation switches. B, 1, 2, 3, 4 Normal Operation Contacts closed (door closed) Abnormal operation a) Contact not open due to abrasion (door open)
Safety
Operating status b) Contact not open due to improper cam position (door open)
Opened directly by externally operating unit like cam or dog. NC contacts (O)
Enclosure
The positive mode operation principle shown in Figure 6.2 is used wherever it is relevant in safety interlock switches. They also avoid any possible abuse by enclosing the contact block and cam in a
strong and secure enclosure. This means that the cam and the contact block cannot become separated and it is impossible to defeat the switch by cutting another slot in the cam.
A52
OMRoN SCIENTIFIC TECHNoLoGIEs, INC. USA Tel. 1/888/510-4357 Canada Tel. 1/866/986-6766
Fig. 6.3
A
VOLTAGE CROSSOVER GALVANIC ISOLATION BARRIER
Any failure which will cause all duplicated components (or channels) to fail at the same time must be protected against. Suitable measures may include using diverse technologies for each channel or ensuring an oriented failure mode.
Galvanic Isolation
On contact blocks with two sets of contacts a galvanic isolation barrier is required if it is possible for the contacts to touch each other back-to-back in the event of contact weld or sticking (Figure 6.3).
CONTROL INTERLOCKING
POWER INTERLOCKING
MECHANICAL DEVICES
NON-CONTACT DEVICES
OMRoN SCIENTIFIC TECHNoLoGIEs, INC. USA Tel. 1/888/510-4357 Canada Tel. 1/866/986-6766
A53
A
Typical Forms of Interlocking Devices
In the broadest terms there are two basic types of electrical interlocking systems: Power interlocking - The power source of the hazard is directly interrupted due to the opening of the guard. Control interlocking - The power source of the hazard is interrupted by the switching of a circuit which controls the power switching device. The following text deals with the
KEY TRAPPED MAIN SUPPLY ON
interlocking of electrical power supplies as this is by far the most common requirement, but the same basic principles can be applied to hydraulic and pneumatic systems.
Power Interlocking
The movement of the guard is interlocked with the direct switching of the power to the hazard. For equipment using low voltage and power, most types of interlock switches can be used for power
A A
MACHINE IS NOW STOPPED AND THE ELECTRICAL SUPPLY HAS BEEN ISOLATED. ACCESS DOOR CAN NOW BE OPENED. WHEN DOOR IS OPEN, KEY IS TRAPPED.
MACHINE IS NOW STOPPED AND THE ELECTRICAL SUPPLY HAS BEEN ISOLATED. ACCESS DOOR CAN NOW BE OPENED. WHEN DOOR IS OPEN KEY A IS TRAPPED KEY B IS TAKEN INTO THE GUARDED AREA TO ENSURE THE DOOR CANNOT BE LOCKED BY A THIRD PARTY.
interlocking. But because most industrial machinery uses a relatively high power three phase supply, we need specially designed power interlocking systems with the power interrupting switch capable of handling and breaking the load reliably. The most practical method of power interlocking is a trapped key system such as the Prosafe system (see Figure 6.5). The power isolation switch is operated by a key which is trapped in position while the switch is in the on position. When the key is turned the isolation switch contacts are locked open (isolating the power supply) and the key can be withdrawn. The guard door is locked closed and the only way to unlock it is by using the key from the isolator. When this key is turned to release the guard locking unit it is trapped in position and cannot be removed until the guard is closed and locked again. Therefore, it is impossible to open the guard without first isolating the power source and it is also impossible to switch on the power without closing and locking the guard. This type of system is extremely reliable and has the advantage of not requiring electrical wiring to the guard. The main disadvantage is that because it requires the transfer of the key every time, it is not suitable if guard access is required frequently. Whenever whole body access is required, the use of a personnel key is recommended (see Figure 6.6 and 6.7). The Prosafe range is available in double key versions to meet this requirement. The use of a personnel key ensures that the operator cannot be locked in the guarded area. The key can also be used for robot teach mode switches, inch mode controls etc. By using double key locking units and keys with different codes together with a key exchange unit, complex systems
Fig. 6.6
A54
OMRoN SCIENTIFIC TECHNoLoGIEs, INC. USA Tel. 1/888/510-4357 Canada Tel. 1/866/986-6766
Fig. 6.7
A
1. The lock can only be operated by the dedicated key. This means that it should not be possible to cheat the lock by using screwdrivers etc., or defeat the mechanism by mistreating it in any straightforward manner. Where there is more than one lock on the same site it also means that the specifying of key codes must in itself prevent any possibility of spurious operation. 2. It is not possible to obtain the key in any way other than the intended manner. This means that (for example) once the key is trapped, any excessive force applied to it will result in a broken key as opposed to a broken lock.
Control Interlocking
Control interlocking is the most commonly used method of interlocking. An interlock switch is attached to the guard to detect movement and open the switch contacts whenever the guard is not fully closed. The contacts are connected via a control circuit to the hazard source primary control element (contactor). So first, let's look at the different types of devices suitable for control interlocking (Figure 6.4). The first major distinction is between devices without guard locking and with guard locking.
Fig. 6.9a (Top) Double access guard doors interlocked with the Power Isolation Switch. Key A is trapped in the isolation switch. Both B keys are trapped in a Key Exchange Unit. Power is ON and there is no access available to the machine through the locked guard doors. Fig.6.9b (Bottom) Rotate and remove Key A from power isolator. Power is then OFF. To gain access through guard doors Key A is inserted and rotated in Key Exchange Unit. Both B Keys are then released for guards locks. Key A is trapped preventing power being switched on. Two C Keys are released from the guard door locks for use in the next sequence step or as personnel keys.
can be formed. Besides ensuring that the power is isolated before access can be gained, it is also possible to use the system to enforce a pre-defined sequence of operation.
Required Features
Because the safety of this type of system depends on its mechanical operation, it is critical that the principles
and materials used are suitable for the expected demand made on them. If an isolation switch is part of the system, it should have positive mode operation and it should satisfy the requirements of the relevant parts of IEC 60947. The integrity and security of the system revolves around the fact that under certain conditions the keys are trapped in place, therefore two basic features need to be ensured:
OMRoN SCIENTIFIC TECHNoLoGIEs, INC. USA Tel. 1/888/510-4357 Canada Tel. 1/866/986-6766
A55
A
Interlock Switches Without Guard Locking
These devices do not restrict access and the guard door can be opened at any time; but as soon as it is opened the switch isolates the power to the hazard via the contactor control circuit. If the hazard always ceases immediately, then the requirements are satisfied because the operator cannot reach the parts while they are dangerous. If the hazard does not cease immediately, there is a possibility that an operator can reach it while it is running down and still dangerous. To avoid this unacceptable situation, there are three alternatives as illustrated in Figures 6.8, 6.9 and 6.10. Note: The integrity of the braking device needs to be considered both in terms of fault resistance and wear characteristics. If a precise calculation is required, the International Standard ISO 13855 deals with the positioning of protective equipment with respect to approach speeds of parts of the human body. At present it does not specifically cover interlocked guard doors, but its principle for the positioning of other safety devices based on approach speed and machine stopping time can reasonably be extrapolated to cover interlocked guard doors without guard locking. The next subdivision for interlocking devices without guard locking is their designation as mechanical actuation or non-contact actuation.
Fig. 6.8
1
Use an interlocking device with guard locking to prevent guard opening before the hazard has ceased.
Fig. 6.9
2
Install some form of braking device to achieve a fast stop.
Fig. 6.10
3
S
The separation distance between the hazard and the guard door should be such that it takes longer for the operator to reach the hazard than it does for the hazard to stop.
A56
OMRoN SCIENTIFIC TECHNoLoGIEs, INC. USA Tel. 1/888/510-4357 Canada Tel. 1/866/986-6766
A
Mechanically Actuated Devices
With these devices the guard door is linked mechanically to the control circuit contacts of the switch using positive mode operation. There are three main types of mechanical actuation. These are: Actuator Operated With the tongue interlock switch, as shown in Figure 6.11, the guard mounted actuator opens or closes the contacts via the internal mechanism. Features: The actuator and mechanism are designed to prevent easy cheating of the switch. These devices are straightforward to install and are very reliable. They can be used on sliding, hinged and lift-off guards and because of their versatility they are one of the most commonly used types of interlock switches. For consideration: The guard mounted actuator needs to remain reasonably well aligned with the entry hole in the switch body. Actuator operated switches can be difficult to clean thoroughly. This may be a problem in industries such as food manufacturing and pharmaceuticals. Hinge Operated Actuation The device is mounted over the hingepin of a hinged guard. The opening of the guard is transmitted via a positive mode operating mechanism to the control circuit contacts (Figure 6.12). Features: When properly installed, these types of switches are ideal for most hinged guard doors where there is access to the hinge center line. They can isolate the control circuit within 3 of guard movement and they are extremely difcult to defeat without dismantling the guard. For consideration: Care must be taken on very wide guard doors, as an opening movement of only 3 can still result in a significant gap at the opening edge. It is also important to ensure that a heavy guard does not put undue strain on the switch actuator shaft.
OMRoN SCIENTIFIC TECHNoLoGIEs, INC. USA Tel. 1/888/510-4357 Canada Tel. 1/866/986-6766
A57
A
Cam Operated Actuation This type of arrangement usually takes the form of a positive mode acting limit (or position) switch and a linear or rotary cam. It is usually used on sliding guards and when the guard is opened the cam forces the plunger down to open the control circuit contacts (see S2 in Figure 6.13). Features: The simplicity of the system enables the switch to be both small and reliable. For consideration: It cannot be used on hinged or lift-off guards. It is extremely important that the switch plunger can only extend when the guard is fully closed. This means that it may be necessary to install stops to limit the guard movement in both directions. It is necessary to fabricate a suitably profiled cam which must operate within defined tolerances. The guard mounted cam must never become separated from the switch as this will cause the switch contacts to close. This system can be prone to failures due to wear especially in the presence of abrasive materials or with badly profiled cams. It is often advisable to use two switches as shown in Figure 6.13. Non-Contact (Non-Mechanical) Actuation With these devices, the guard door is linked to the control circuit contacts of the switch via a magnetic or electronic field. To make these types of devices suitable for interlocking applications, they must incorporate enhancements to ensure proper operation. Because they do not have the benefit of true mechanical positive mode operation, they must have other ways of ensuring that they cannot fail to a dangerous condition. This is achieved by either oriented failure mode principles or by the use of duplication and monitoring. The MA Series uses the principle of oriented failure mode. Due to the use of special components, the only safety critical fault likely to occur would be a welding of the reed contacts due to excessive current being applied to the switch. As shown in Figure 6.14, this is prevented by the non-resettable overcurrent protection device. There is a large margin of safety between the rating of this device and the reed contacts. Because it is non resettable, the switch should be protected by a suitably rated external fuse.
S2
S1 S1 S2
Negative operation
Positive operation
S2
S1
S2
S1
Negative operation
Positive operation
It is important that the switch is only operated by its intended actuator. This means that ordinary proximity devices which sense ferrous metal for example are not appropriate. The switch should be operated by an active actuator.
ACTUATION FIELD
A58
OMRoN SCIENTIFIC TECHNoLoGIEs, INC. USA Tel. 1/888/510-4357 Canada Tel. 1/866/986-6766
Fig. 6.15
HAZARD AREA
STOP SWITCH ACTUATOR
The security can be further improved by coding such as on the CM Series. This switch uses the same oriented failure mode principle as the MA Series but has higher security due to its coded actuator and sensor. Features: Non-contact devices are available in fully sealed versions which makes them ideal for hygiene sensitive applications, as they can be pressure cleaned and have no dirt traps. They are extremely easy to install and have a considerable operating tolerance, which means that they can accept some guard wear or distortion and still function properly. Solid-state non-contact door switches are now available and offer increased performance for certain environmental conditions such as vibration. The D40A non-contact switch is a solid state switch that works on the principle of Hall Effect. Up to thirty switches can be connected to a single G9SX-NS controller and be
SLIDING GUARD
monitored to category 3 (see Figure 6.16). For consideration: For the simpler actuation types, if security is an important issue, it may be necessary to install them as shown in Figure 6.15 so that they cannot be accessed while the guard is open. It is important, particularly for the non-coded types, that they are not subjected to extraneous interference by fields which are the same as their operating principle.
machines. They provide interlocking of the hazard power source with guard movement and also prevent the opening of the guard until it is safe to do so. These devices can be divided into two types: Unconditional and conditional guard unlocking. Unconditional Guard Unlocking These devices are manually operated and the guard can be opened at any time. A handle or knob which releases the guard lock also opens the control circuit contacts. On a device such as a time delay bolt switch, a time delay is imposed (Figure 6.17). The bolt which locks the guard in place also operates the contacts. The bolt is withdrawn by turning the operating knob. The first few turns open the contacts but the locking bolt is not fully retracted until the knob is turned many more times (taking up to 20 secs.). The Prosafe trapped key system (see power interlocking section) can be used to provide unconditional guard locking. Features: These devices are simple to install and they are extremely rugged and reliable. The time delay bolt switch is suitable mainly for sliding guards.
Swinging doors
Sliding doors
Up to 30 Switches
Fig. 6.16 Up to 30 D40A switches can be monitored to Category 3.
OMRoN SCIENTIFIC TECHNoLoGIEs, INC. USA Tel. 1/888/510-4357 Canada Tel. 1/866/986-6766
A59
A
of the guard until it is safe. Because an externally generated signal is required for lock release, it makes them particularly suitable for use with PLC or other programmable electronically controlled machines. The usual type of interlocking device for these purposes is a solenoid-operated locking switch such as the TL4019, TL4024, D4BL, D4NL, D4GL OR D4JL. Figure 6.18 shows the basic components common to the D4NL solenoid operated locking switches. For less frequently accessed applications, the Prosafe trapped key system (see power interlocking section) can be configured to operate in this way. In the example shown in Figure 6.19, the hazard ceases as soon as power is isolated by switching the machine off at the normal controls. The guard cannot be opened until the contactor has switched off. Once the guard is opened the control circuit contacts ensure that the contactor
Fig. 6.17
For consideration: The stopping time of the hazard being guarded must be predictable and it must not be possible for the bolt to be withdrawn before the hazard has ceased. It must only be possible to extend the bolt into its locked position when the guard is fully closed. This means that it will usually be necessary to install stops to restrict the travel of the guard door. Conditional Guard Unlocking With these devices, the guard can only be opened on receipt of a signal showing that: the contactor is OFF. a pre-set time interval has elapsed or alternatively that dangerous motion has ceased.
These signals are usually derived from the auxiliary contacts of a safety monitoring relay with OFF-Delay outputs, or a Stop Motion Detection Monitoring Relay such as the G9SX-SM. They provide interlocking of the hazard power source with guard movement and also prevent the opening
A60
OMRoN SCIENTIFIC TECHNoLoGIEs, INC. USA Tel. 1/888/510-4357 Canada Tel. 1/866/986-6766
cannot be re-energized until the guard is closed and locked. With the configuration shown in Figure 6.20 the switch will not release the guard until the contactor is off and a pre-set time interval has elapsed. The time range can be set from 0.1 seconds to 30 seconds. The longest stopping time of the machine should be predictable and constant. It should not rely on braking methods which may degrade with use. The system shown in Figure 6.20 will not apply power to the solenoid of the switch until a specified period of time has elapsed. This "Delayed ON" function of the SR209 controller is used with "power to unlock" solenoid locking switches. Figure 6.21 shows a configuration where the switch will not release the guard until the contactor is off and all motion has stopped.
41 51 63 E1 E2
LOCK RELEASE SOLENOID
42 11
12 22 33 34
52 21 64
INDICATION CIRCUIT
Shown in machine run condition. Simplified circuit shown for clarity with no emergency stop. Fig. 6.19
LATCHING E-STOP
E1
A1 SR209 A2
Fig. 6.20
A1
K1
START
K1
STOP
SOLENOID
SAFETY CONTACTS
Fig. 6.21
OMRoN SCIENTIFIC TECHNoLoGIEs, INC. USA Tel. 1/888/510-4357 Canada Tel. 1/866/986-6766
A61