ANSWERS
MACHINE SAFETY Klaus Matzker, Posital-Fraba
Safety-certified and diverse-redundant encoders for motion control For motion control systems, a key to improving operational safety is ensuring the sensors the system relies on to maintain control are trustworthy.
S
afety should always be an important design objective. This is especially true for machinery such as lifts and elevators, industrial robots or construction machinery where equipment malfunction or loss of control could result in serious injuries or damage. In some jurisdictions, formal safety analyses to reduce the risk of serious accidents are legally required. For motion control systems, a key to improving operational safety is ensuring the sensors the system relies on to maintain control are trustworthy. Sensors such as encoders, inclinometers, and others must provide dependable feedback on the motion/ position of the mechanical components being controlled. In the event of a sensor malfunction, these devices must provide the control system with a clear message the feedback loop has failed and actions should be taken to limit or halt operations. A widely-used method of ensuring motion control systems are reliable and fail-safe is to incorporate a degree of redundancy into the feedback loops. If the control system receives similar signals from two different sensors set up to measure the same KEYWORDS: machine safety, machine encoders, motion mechanical property, it is reasonable to control assume that both are functioning propSafety should be a major facet erly. Discrepancies between the readings of any heavy machinery design. would indicate a fault.
M More ANSWERS
Safety-certified encoders can help streamline the development of safety-critical systems. Magnetic and optical encoders also can help improve safety.
ONLINE See additional stories about motion control and machine safety at www.controleng.com.
CONSIDER THIS How could motion sensors help your machine safety and motion control challenges?
34
•
September 2020
Safety-certified encoders
Encoders are available from several sensor manufacturers that feature builtin redundancy in the form of two separate rotation measurement modules installed in one housing, sharing one shaft. A special verification chip monitors outputs from these two modules to check for consistent measurements. If a discrepancy is detected, this chip will block the transmission questionable
control engineering
data to the controller, indicating a fault. With this fail-safe feature, these encoders can be certified to Performance Level PL d, Cat. 3 (according to the safety standard ISO 13849) or SIL 3 (according to IEC 61508). Certification is carried out by special licensed agencies. Safety-certified encoders can be used to streamline the development of safety-critical systems since they are guaranteed to provide the control system with either verified position data or a clear indication it has developed a fault. However, there are drawbacks. This approach can be inflexible when handling failure situations: since these sensors simply switch off, they provide no guidance on how to transition the machinery to a safe state. Certified devices also can be more expensive than ordinary encoders because of the cost of certification by an independent lab. Moreover, they are only available in a limited number of mechanical configurations, so the machine builder may be obliged to use adaptors to make them fit into a design.
Selecting diverseredundant encoders
Diverse-redundant sensors provide a less expensive, more flexible alternative to certified encoders for safety-related motion control systems. Like their certified counterparts, these devices have two measurement modules built into a shared housing (redundancy). However, in this case, signals from both measurement systems are transmitted to the controller (such as a programmable logic controller or industrial computer) via a CANopen network. The supervising controller is responsible for comparing the output of the two semi-independent measurement systems to verify both are functioning correctly. To reduce the danger of common cause faults, these devices are built with magnetic and optical measurement technologies. These measurement www.controleng.com
