Chapter 3.6
Safety Swtiches
Doors, lids and covers must be monitored to ensure the machine control system can stop movements before a person enters a hazard zone. The safety switches used for monitoring are often also referred to as guard, door safety or position switches.
Rules for safety swtiches
The switches fitted to guards are called “interlocking devices” in standards and come in four types:
1. Switches that are mechanically actuated by a rail, plate or cam on the guard or even by the guard itself. These switches are all uncoded. Popular types are the roller lever, roller plunge and hinge switches. But they are rarely used today, because their installation requires quite some design and assembly effort.
If you use them, ensure the following:
- Install them so they cannot move from their installation position just because a screw is not tightened properly (ensure this by means of locating pins or notches on the switch). This is required to prevent maladjustment and then premature switching or no switching at all.
- Fasten the switch so it cannot be demounted with standard tools (use one-way screws, rivets, a hole drilled in the screw heads …)
- On guards for high risk situations, be sure to use two switches with opposite switching logic (one closing, one opening when the door is opened)
2. Switches that are actuated by a mechanic mating piece or key that is mounted to the guard. It is referred to as the “actuator”. To this day, this is the “bread and butter” safety switch. It is easy to install and comes in single or double channel technology. Many switches can also be set up (or supplemented) for guard locking, holding the guard closed with a magnetically powered pin or lever.
Unfortunately, safety switches with separate actuators are very easy to defeat: Just remove the actuator from the door and plug it into the switch; then the machine will run with open door.
To prevent this dangerous manipulation:
- Use switches with coded actuators (not every actuator fits every switch). However, most manufacturers offer only a few different codes.
- Be absolutely sure the actuator cannot be removed with standard tools (use one-way screws, rivets, a hole drilled in the screw heads …)
- If there is no coding or low/medium coding (less than 1000 different codes), install the switch so the actuator cannot be plugged in, when the door is open or hide the switch from the operator. Both are quite difficult to achieve. Because of the high engineering effort required, this probably can be done only on series manufactured machinery. If you cannot do it, choose switch type 4 described further on.
3. Proximity switch, uncoded. These are very similar to the mechanical switches with separate actuator. They are not actuated mechanically, but electronically when the actuator is near the switch. For guard locking you need an extra mechanical locker (many switch manufacturers offer both functions in one unit). Like the uncoded mechanical switches, uncoded proximity switches are easily defeated and the additional requirements shown for type 2 also apply to them
4. Proximity switch, coded. There are three different coding levels in (EN) ISO 14119 standard. It is also referenced in ANSI B11.19 for USA and CSA Z432 for Canada:
A long standing technology in this field is the so called key transfer system also referred to as a "trapped key system" in the USA and the UK.
Basic function of a key transfer system:
- A door opening key is “trapped” in a control box at the machine until the machine is switched off (1,2)
- Then the key can be removed and used to open a locked guard on the machine (3,4)
- As long as the guard is not closed and locked, the key is now trapped at the guard, preventing the machine from being powered up (5)
Such key transfer sets come with high level coding and therefore reliably prevent manipulation of the guard.
There is a wide variety of options for key transfer systems:
- The key may release several other keys for different doors.
- They key may also be used to enable operation of a switch for safe shut-down of a machine section etc.
- The operating sequence can be controlled closely, and delays be integrated to allow machinery to come to a complete standstill before access.
- Electronic keys may be used, which are presence-sensed.
- Electronic keys may not switch the machine off completely, but enable some operating modes in the machine, while disabling others.
- Electronic keys may be assigned to staff with different qualifications and access right levels.
Emergency stop
Emergency stop is generally considered a selectable safeguarding measure, but it is not.
Emergency stop is a required additional function.
The Machinery Directive and Machinery Regulation both say:
“The emergency stop function must be available and operational at all times, regardless of the operating mode. Emergency stop devices must be a back-up to other safeguarding measures and not a substitute for them.” (MD Annex I/MR Annex 3 section 1.2.4.3)
The only exceptions are:
- The machine is hand-held and letting go of its control button will cause stop anyway.
- An emergency stop in a machine would not reduce the risk.
The stop categories
Emergency stop comes in two so-called “stop categories”:
- 0 – The emergency stop causes immediate disconnection of all drives of hazardous movements from their energy sources
- 1 – The emergency stop causes a controlled stand-still of the drive (usually by applying brakes). It may also trigger a function achieving safety. Once the desired condition is reached, all drives are disconnected from their energy sources
EN/IEC 60204-1 also describes a stop category 2, but it must not be used for emergency stop.
Emergency switching off
This term is not used very often. It refers to an emergency stop circuit with electromechanical components only.
Until the late 1980s all safety-related control functions were achieved by electromechanical switchgear. Today however, we are using all kinds of electronic and even microprocessor-controlled safety devices, often even controlled by software. Today however, we are using all kinds of electronic and even microprocessor controlled safety devices, often controlled by software.
Emergency switching off is different from emergency stop in two ways:
- It is always in stop category 0
- It must use electromechanic equipment only (no electronics and software allowed)
Normally, the only emergency switching off device on machinery today is the main switch. If it is meant for use in case of emergency, then it must be red and yellow. A black or gray main switch must not be switched off in case of emergency as this could prevent braking of hazardous movements.
The international standard for emergency stop devices is (EN) ISO 13850.
