I've done a lot of work in industrial controls. It doesn't have to be in a glorious industry like aerospace. Almost every industrial machine has enough potential energy to cause serious injury or death. I have been around when people were injured. If you spend most of your time at a desk in an office, you'd probably be surprised at how dangerous most factory jobs can be (and certainly were until recently). Now we have better methods of machine safeguarding. Here's how it works in practice (though it varies from jurisdiction to jurisdiction):
There are OSHA standards in the US, and similar (usually more strict) guidelines in the EU. These generally start by requiring you to do an analysis of the risk. This means you make a list of all hazards and then categorize those hazards, taking into account things like how often a person would be exposed to the risk, how easy is it to avoid the risk (depends on speed, etc.), and what is the severity of the result (cut, amputation, death, etc.).
A lot of the analysis has to do with guarding hazards. If you put a big cage around your machine and bolt it up tight, then your machine is considered safe if the components of the machine can't breach the guarding. If you need a tool to get in, that's considered a maintenance task, and maintenance people are supposed to be trained on how to safely work on a machine. In reality, however, most machines need regular interaction with operators so we have to put access doors in the guarding, or light curtains, etc. Those doors and light curtains need to be monitored and the power to hazards that the operator is exposing themselves to has to be shut off in a "control reliable" way. This can be complicated if you have a machine that allows full body entry (can a person lock themselves inside?) or with potential energy other than electrical (is there a spinning component that needs to come to rest before the guard can be opened, or is there a vertical ram that needs to be locked in position before the door can be unlocked?)
Based on that analysis, the risk are put into various categories. A common classification scale is Category 1 to Category 4 (based on the EN 954-1 standard). Based on those categories, you are legally required to provide a certain level of machine guarding and safety.
Category 4, for instance, requires that:
A single fault in each of these parts
does not cause the loss of the safety
function.
The single fault is detected with or
before the next request to the safety
function, or if this is not possible,
an accumulation of faults may not
cause the loss of the safety function.
This can be difficult to achieve in practice, but is made simpler by the availability of standard components that are certified to Category 4. For instance, one common component in these systems is a Safety Relay. These are more than just mechanical relays:
- They are designed to monitor dual redundant input channels, so if you have a sensor that detects a fault condition (like a guard door open), it typically has two contacts with redundant circuits. The relay monitors both channels, and if either one opens, it drops out power to your actuators, but if they both don't drop out at the same time, then it enters a fault condition and the machine can't be restarted until repaired.
- The relay also uses electrical pulses on those lines and uses those signals to monitor for crossed or shorted wires, so it can detect a wiring fault.
- On the output side, it uses a set of dual circuits for driving the output coils, so if one faults into the "on" condition, the other should prevent the output from being energized. Additionally these are monitored and if a fault is detected, it prevents operation. The coils themselves are actually dual force guided relays meaning redundant physical relays on the output, plus guaranteeing that the contacts on each single relay are physically linked together so that one contact out of, say 4, can't be stuck by itself. These are also monitored.
- It also includes an input to monitor an auxiliary normally closed contact off the load you're controlling. If it turns off the output, it has to see the normally closed contact engage meaning it validates that it turned off the motor contactor, or whatever it was, before it's allowed to operate into the on condition again.
As you can tell, these are complicated devices. Typical costs are in the $200 to $600 range for each safety relay. Obviously there's software in these devices. In order to get your safety relay certified, you typically have to follow a design like this:
- Two redundant processors, typically sourced from different vendors, based on different designs.
- The code running on each processor has to be developed by two teams working in isolated conditions. This prevents a single software bug from being a single point of failure.
- The output of both processors has to agree or else the safety relay faults.
Once you design your safety system for your machine, using safety rated components, then you have to get the design reviewed and stamped by a Professional Engineer. Then you build the machine. Then the P.Eng. will review the construction of the machine making sure it was built to the design. They will document it, and will perform some tests on it to make sure it's working as expected. This is called a pre-start review (PSR) and is not done in every jurisdiction. After the PSR passes, then you're allowed to have an operator run the machine.
In recent years there have been some revolutions in safety systems. For a while nobody trusted transmitting safety data over a network, so what's typically called "distributed I/O systems" like DeviceNET and EtherCAT were not allowed in the safety part of the system. However, recent protocols now allow safety devices to run over these industrial networks. The protocols make use of time-stamped messages, and dual redundant processing on both ends of the connection.
Safety relays are slowly going the way of the dodo bird, replaced by more complicated Safety PLCs, which are like a way to build the safety logic in a function block diagram language. Again, these safety PLCs use redundant everything. When the program is approved, before the machine is put into service, the P.Eng. will stamp the program and the program/PLC will be locked with a password. It also takes a hash of the program and that hash is recorded in the documentation (that's what the P.Eng. is really stamping).
Now once you've designed your safety system, the logic you write to control the machine itself can be very seat-of-your-pants. Programmers frequently crash machines causing thousands of dollars of damage, but at least nobody's going to be injured.
