Why NOT to Wire E-Stops in Series

khelza said:

I have never heard of this or seen this used...



I have seen many systems with multiple estops, and never seen it required to test every estop when there is a fault. Normally, the safety relay or PLC will require the dual inputs to be reset, and if they are wired in series, it doesn't know which estop is being reset, only that it WAS reset with a change of state.

Maybe I am not understanding what you are trying to say...

Click to expand...

General practice for safety in the US is a bit Wild West as compared to Europe. Over there the standards are statistics based, and the concept of Diagnostics Coverage (how do I know what is wrong with my safety system) is very important in determining "how safe" a safety system really is.

Over there, dual channel wiring is only half the battle. If you can't detect faults it drops the safety rating way down.

kekrahulik said:

As for the operator "cannot just choose to test 1 E-stop"... Oh yes he can. He's not supposed to, but with the series wiring he most certainly can and I will guarantee that some definitely will.

Click to expand...

Just 1 E-Stop per sadety relay is definetely safer. And if you assume that the operators will do as you wrote (basically not caring about their own safety) then it may be necessary.
There are ISO 12100 "C"-standards for different areas of business. Some of the specifications in these standards relate to some machine specific topic. But other specifications can only be explained by that the persons working in the area are all "bubbas". They dont write that of course, but it must be the explanation for some of the things I have seen.

khelza said:

I have seen many systems with multiple estops, and never seen it required to test every estop when there is a fault.

Click to expand...

With "fault" I mean that the safety relay indicates there is a hardware error, not just that it is tripped.
And I mean every safety device connected to that safety relay, not all safety devices on a complete machine.
When a fault appears, you must activate and reset all safety devices one by one, without the fault appearing again. It is not enough to get the fault to clear on the safety relay for one of the safety devices.

Isn't there is a rule that more than three components in a safety channel would decrease the performance level by one?

This has been a really good thread. I hadn't heard the explanation about 2 devices in series before. From now on I will always design, and require designs from outside, to have dedicated safety inputs for each safety device.

:site:

LadderLogic said:

Isn't there is a rule that more than three components in a safety channel would decrease the performance level by one?

Click to expand...

I believe there is a table in 13849 (Table 11 maybe? don't have it with me at the moment) that has a chart for this.

You have to add up the total number of your lowest PL devices and based on that count you will maintain that level or drop a level. I haven't seen it used much.

One of the gotcha's to my understanding is that a safety PLC counts as 3 devices. Someone please correct me on this one if it is incorrect. So with an input device, output device and safety PLC you are at 5 devices and will drop down a PL.

I dont think that generally you can say that a certain no of devices will drop down a PL.
Even if you have many devices in series, if these devices are of high quality, i.e. the MTTFd will be very high, then the calculated PFHd will still be low, and a high PL maintained.

JOLTRON said:

One of the gotcha's to my understanding is that a safety PLC counts as 3 devices. Someone please correct me on this one if it is incorrect. So with an input device, output device and safety PLC you are at 5 devices and will drop down a PL.

Click to expand...

I have just recently been told by a consultant, that safety relays and safety PLCs only count as the "logic" part, i.e. each only count once. Would like to hear opinions about that.

My understanding is that for complex systems it is near impossible to achieve PL=e unless you use a safety PLC. This is because regardless of the complexity, you only have to take the safety PLC into account once. In a similar system with several safety relays etc. you will have to account for each safety relay.

JesperMP said:

I dont think that generally you can say that a certain no of devices will drop down a PL.
Even if you have many devices in series, if these devices are of high quality, i.e. the MTTFd will be very high, then the calculated PFHd will still be low, and a high PL maintained.

Click to expand...

Correct, doing the actual calculations will tell you the actual PL. The table offers a quick solution that avoids math, but uses mid level values. So when you use this quick method and you have 4 PLd devices it drops it to a PLc. Where when you do the actual calculations you could still maintain the PLd. The instructor told us to use this table with a grain of salt...

JesperMP said:

I have just recently been told by a consultant, that safety relays and safety PLCs only count as the "logic" part, i.e. each only count once. Would like to hear opinions about that.
.

Click to expand...

I would also like to hear others chime in on this, since it was a consultant that told me relays count as a single device, but safety PLC's count as 3. I will try to dig up my notes on the topic tonight.

You can download a trial software from Pilz (Pascal) for looking at components in series etc. Naturally, the majority of components thus are Pilz, but there is 3rd party "generic" parts.

Steve Etter said:

This has been a really good thread.

:site:

Click to expand...

I agree! This discussion took off a lot more than I was expecting, so thanks everyone for your input

The issue at play is "fault masking".


Let's forget e/stops for a moment, and talk about dual-channel guard switches.


You put two guard switches in series, Guard 1 and Guard 2. Guard 2 develops a fault, and one contact welds shut. Next time you open Guard 2, the safety relay/PLC sees the discrepancy and locks the safety out. Fault detected, everyone is happy.


But let's say you open Guard 1. Both channels to your safety relay turn off together. Safety relay is happy (although tripped, of course). Then you open Guard 2. Both channels are already broken by Guard 1, so safety relay still happy. Then you close Guard 2. Safety relay still happy. Then you close Guard 1. Both inputs come back on together, so the safety relay is happy and can now be reset. You opened and closed a guard with a faulty guard switch, and the fault was not detected - that is, the fault was masked. Safety relay happy, safety inspector, not happy!


Let's take it a step further, and suggest that maybe Guard 1 and Guard 2 are on a set of doors where Guard 1 closes over the top of Guard 2. This means that you physically can't open Guard 2 until Guard 1 is opened, and you will always close Guard 2 before closing Guard 1. If that's the case, you will never detect the fault on the Guard 2 guard switch. It will sit like that for years, until the other channel welds shut. Then it'll sit like that right up until someone closes Guard 1 with Guard 2 still swinging in the breeze, resets the safety circuit, and fires the machine up with a guard open. Safety relay happy, safety inspector (very) unhappy!


To swing back around to e/stops: there are different schools of thought on this, but some say that you can put them in series, and still meet Cat 4. The reasoning goes something like this...


For Cat 4, you have to establish that all faults will be detected at or before the next demand on the safety device. i.e. if a contact on your guard switch or e/stop fails open, you detect it immediately (before the next demand on the safety device), and if it fails closed (welds shut) you detect it next time you open the guard or press the e/stop (at the next demand on the safety device), because the safety circuit sees the discrepancy between channels when one of them opens and the other doesn't.



So, why can't you do it with guard switches, but can with e/stops? Because, you never press more than one e/stop. You press an e/stop, the machine stops. What rationale do you have for pressing another one? So from an operational point of view, it's easy to say that you will never have more than one e/stop pressed at a time, and to assess the chances of fault masking by virtue of these devices being in series as being negligible. Guard switches are a different matter. When you need to access a machine, you almost always open multiple guards to do so. So the likelihood of fault masking is much higher.


This is, of course, open to interpretation. But I've overseen many safety validations from internationally-renowned safety companies, and in most cases these machines have 10-15 e/stops into one pair of safety inputs (with a non-safety input for feedback as to which device is operated), and then every guard switch into it's own pair of inputs - and they get successfully validated as Cat 4. So those companies and their assessors obviously subscribe to this view.

ASF
+1

Some will argue though that operators will use E-stops as operational stops.
I think that the detection of faults that you describe, and the previous discussion about resetting/testing the safety after a fault comes down to operator behaviour.

After long discussions with consultants, I have learned this: The general assumption is that operators must be instructed in the safety system and its proper use.
You can always decide to do better than the requirements, so if there is a suspicion that operators wont behave well, then you can decide to use 1 safety relay per E-stop. That is part of the risk assessment that one must do.
Same as for the C standards. Within a business area, the C standard may instruct you to certain measures that may be stricter than normal.

JesperMP said:

ASF
+1

Some will argue though that operators will use E-stops as operational stops.
I think that the detection of faults that you describe, and the previous discussion about resetting/testing the safety after a fault comes down to operator behaviour.

After long discussions with consultants, I have learned this: The general assumption is that operators must be instructed in the safety system and its proper use.
You can always decide to do better than the requirements, so if there is a suspicion that operators wont behave well, then you can decide to use 1 safety relay per E-stop. That is part of the risk assessment that one must do.
Same as for the C standards. Within a business area, the C standard may instruct you to certain measures that may be stricter than normal.

Click to expand...

I think the standard in American courts is that the designer is responsible for preventing obvious mis-use. Sometimes you can get away with warnings "don't put hand into business end of lawnmower" or "choking hazard, don't give to your kid if under 3/stupid enough to eat things that aren't food". Those don't go over so well in workplace situations, the judge/jury will hammer you if you used a warning/operator training in place of an extra guard or safety device.

mk42 said:

I think the standard in American courts is that the designer is responsible for preventing obvious mis-use.

Click to expand...

Yes, misuse is to be taken into account. But do you mean that any kind of misuse is to be avoided ?
I know that the misuse part is one that is unclear and assessing it takes some personal judgement.
However, a blanket statement that any misuse must be prevented would have huge ramifications. Not just for E-stops.

I believe that the previous statement that mutiple E-stops are not supposed to be activated at the same time, allows for multiple E-stops to be connected in series.
But if you assess that operators may misuse E-stops (because they are reckless in an abnormal way), then yes you should connect each E-stop to its own safety relay.

JesperMP said:

But do you mean that any kind of misuse is to be avoided ?

Click to expand...

Lets put it this way. The example that I always hear from safety guys is a company getting in trouble because an operator/maintenance tech removed a machine guard without permission and then hurt themselves. It was apparently decided that was "foreseeable misuse", somehow.

My understanding is that in the EU you have rules that if the machine builder is judged to have followed them, they are off the hook. In the good ol' US of A, you pay either way when something happens; if you're judged to have broken the rules you pay extra.