What is the maximum Performance Level can I achieve with my interlocks in series?
Performance Level is limited to a maximum of d but it will depend on a number of factors described in ISO TR24119:2015
When interlocks are connected in series the possibility of fault masking is introduced. For example, if a correctly functioning interlock is open, the system will not know if another interlock has opened but with the contact welded – the fault is masked (unable to be detected).
This single fault does not necessarily lead to a loss of the safety function immediately. However since it has not been detected it can lead to further faults and an accumulation of faults may lead to the loss of the safety function.
To calculate Performance Levels (PLs) of a system there are 4 parameters to be considered:
System Architecture (Categories) – whether the system is single or dual channel and what monitoring/testing is done.
Mean Time to Dangerous Failure (MTTFD) – how likely the system is to have a dangerous fault.
Diagnostic Coverage (DC) – How likely a dangerous fault is to be detected if it occurs as a percentage.
Common Cause Failure (CCF) – Ensure multiple faults are not likely to occur from the same cause.
To calculate Performance Levels (PLs) of a system there are 4 parameters to be considered:
System Architecture
System Architecture (Categories) – whether the system is single or dual channel and what monitoring/testing is done.
Mean Time to Dangerous Failure
Mean Time to Dangerous Failure (MTTFD) – how likely the system is to have a dangerous fault.
Diagnostic Coverage
Diagnostic Coverage (DC) – How likely a dangerous fault is to be detected if it occurs as a percentage.
Common Cause Failure
Common Cause Failure (CCF) – Ensure multiple faults are not likely to occur from the same cause.
ISO 13849-1 shows how differing values for each of these parameters allows a system to meet each Performance Level. CCF must meet a minimum requirement for any dual channel system (Category 3 or 4).
Fault masking by putting interlocks in series will affect the Diagnostic Coverage as dangerous faults are less likely to be detected if they can be masked. ISO TR24119:2015 which gives guidance on the maximum achievable DC depending on the numbers and usage of interlocks being connected in series.
NB – the DC will still need to be estimated or calculated using the details in ISO 13849, the following information is purely to determine the maximum DC that is permissible due to the interlocks being in series. The following table is the simplest way of determining the maximum DC achievable. However, if it is foreseeable that more than one guard will be open at any time then the DC immediately becomes None.
Notes
• Frequently used is more than once per hour.
• If the number of operators capable of opening separate guards is more than one then the number of frequently used moveable guards increases by 1.
• Number of additional moveable guards can be reduced by one if the minimum distance between any of the guards is more than 5m AND none of the additional moveable guards is directly reachable.
TR24119 also gives further tables for the maximum achievable DC depending on the position switch arrangement, cabling arrangement and types. However the highest achievable DC is always medium and the PL is always limited to a maximum of d. The DC is still always limited to None if it is foreseeable to have more than one guard open at the same time.
Summary:
If it is foreseeable that fault masking will occur (e.g. multiple guards will be open at the same time as part of normal operation or service) then the DC is limited to none. With a DC of none the maximum achievable Performance Level is PLc. Even without foreseeable fault masking, having interlocks in series limits the PL to a maximum of d since the occurrence of faults cannot be fully known and since placing the interlocks in series degrades the diagnostics function this is not acceptable for the highest levels of risk.
In order to avoid fault masking and be able to achieve a PLe system, the advice in TR24119 is to:
• use additional contacts individually connected to a monitoring device in combination with appropriate diagnostic procedures to avoid fault masking;
• avoid connecting in series of interlocking devices and use individual safety inputs for each interlocking device;
• use interlocking devices with internal diagnostics and monitored outputs.
Products Mentioned in this Article
mGard
amGardpro
Click Here to Download Article
Case studies
Design to Minimize Motivation to Defeat Possibilities of Interlocking Devices
Case studies
Enhancing Lockout / Tagout Procedures – How Do I Perform Full Power Isolation?
Case studies
