Preparing for the arrival of ISO 14119:2013

The new standard ISO 14119:2013 ‘Safety of machinery - Interlocking devices associated with guards - Principles for design and selection’ is set to replace EN 1088 within 18 months.
 

The updated standard includes some of the newer interlocking technologies, such as RFID or electromagnetic guard locking; classifies interlocking switches; and regulates more clearly the specifications for installing guards. The new regulations are particularly significant with regard to protection against guard manipulation, also known as defeating of guards.

ISO 14119 will replace all other national standards on this subject and will be valid worldwide. 

“Although there is an 18 month transition from EN 1088, machine builders who design safety gate systems will be at an advantage if they aim to comply with the new ISO 14119 now,” said David Collier, business development manager at Pilz UK. “Technologies exist which can overcome challenges, like fault masking, and when deployed can provide added peace of mind as well as compliance with the more exacting requirements of this new standard.”

“The publication of the new standard has been commented upon widely by the safety engineering community,” said Rob Lewis, managing director of Fortress Interlocks. “This is hardly surprising given that it is the first major re-write since 1995. 

The inclusion of definitions for locking units’ release systems – for example, to allow an operator trapped inside a safeguarded space to exit safely – has placed more emphasis on manufacturers to design compatible product ranges, while machine manufacturers, through the risk assessment process, must decide if they are needed.

 “Fortress Interlock products are designed to comply with this standard, although our emphasis has not just been on escape release functionality,” continued Lewis.  The Fortress design team has been focused on product developments to prevent operators being trapped inside the safeguarded space. “The use of ‘safety keys’ protects operators from the danger of unexpected start up, and a recent development ensures that keys must be removed from an interlock before entering a safeguarded space,” he said.

“The issue of fault masking has been raised frequently, by both machine builders and interlock manufacturers and while ISO 14119:2013 does not directly cover the topic a technical report ISO/TR24119, on the subject, is currently in preparation,” said Lewis.

If safety switches are wired in series the ability of the safety system to detect a fault is reduced, reducing the diagnostic coverage. In applications required to meet PLe, the highest level of diagnostic coverage is required, so gate switches wired in series would fall short. “Trapped key interlocks from Fortress have been designed and tested to meet PLe, even in multiple door applications,” said Lewis.

“Historically the practise of series-wired safety switches has arisen because it saved money on cabling and safety relays, and because such dual channel wiring translated to Category of 3 of the now-withdrawn standard EN 954-1. Category 3 lives on in the standard EN ISO 13849-1 in which clause 6.2.6 requires that for Category 3 to apply specific conditions must be met which include: a single fault must not lead to a loss of the safety function, that an accumulation of undetected faults can lead to the loss of the safety function, and importantly as an addition over and above EN 954-1’s requirements that at least 60% of faults have to be detected in a diagnosis mechanism. The ability of a system to detect 60% of dangerous faults can be impacted by fault masking which can dramatically reduce the diagnostic coverage and consequently the Performance Level,” said Collins. 

The requirement for coded actuators was raised in a 2007 amendment of ISO14119, but it is laid out more clearly in the 2013 version. The driver behind this is given away in the title of the 2007 amendment ‘Design to minimise defeat possibilities.’ Lewis has seen the issue from both sides, having implemented ISO14119:1998 in his previous role managing a forge. “Crucially,” he said, “the guidance is for machine builders to create equipment that does not give rise to a situation where anyone would want to be inside the safeguarded space when they should not be.

“If an engineer really wants to be inside the safeguarded space while machinery is running there is nothing that that they will not find a way of getting around. So, it is best to make sure there is no reason for them to want to be inside when the machinery is running. In my experience, most machinery has a teach, slow speed or jog function, and by providing the opportunity to be inside the safeguarded space while the machinery is in one of these modes any motivation to defeat the safety system is removed.”

However, in some cases it may not be possible to provide the teach/jog/slow mode function and so ISO 14119:2013, much like its predecessor, provides some examples of making the safety system harder to defeat. These include, but are not limited to, hiding/shielding/obscuring the entrance to the interlock, using cyclic testing to ensure the interlock is not permanently on, or using an interlock with an actuator that has 1000 codes.

In relation to defeating interlocking devices, Collins believes that the standard implies an increased burden on the designer to ensure that interlocked guards cannot be defeated, which in turn requires the designer to understand how the machine will be used at every stage of its life – production, maintenance, setting, and cleaning, etc. 

ISO 14119:2013 draws on ISO 13849-1:2006 on the topic of fault exclusions, but also claims that in order to achieve PLe ‘it is not normally justifiable to exclude faults, such as broken actuators.’ Further on the reader is referred back to ISO 13849-1:2006  and ISO 13849-2:2012 for compliance with fault exclusions and additional notes also appear to contradict the earlier statement.

“In order to avoid confusion on this subject, Fortress has over dimensioned its stainless steel actuators and sought third-party certification to PLe,” said Lewis. “Our actuators are stronger than the gates and hinges they are fitted to, so until the day comes that two sets of guarding are required, just one of our interlocks is sufficient for a PLe rating.”

which the manufacturer, not the user, can demonstrate through repeatable, certifiable tests,” said Collins.

Some interlocked guards are not opened often, so forced testing by manual functional opening and closing at regular intervals is required to check for possible accumulated faults.  ISO 14119 specifies for PLe a monthly test and for PLd a 12 monthly test. “This is important, even in dual channel systems,” said Collins. “Faults can only be revealed by placing a demand on the guards. It is recommended that the control system of a machine demands these tests at the required intervals, For example, by visual display unit or signal lamp. The control system should monitor the tests and stop the machine if the test is omitted or fails.”

In conclusion, ISO 14119:2013 provides machine builders and users with much wider scope to use a broader range of technologies when interlocking guards, it also places more responsibility on the designer to prevent foreseeable, deliberate bypassing of guards, and it will change the way in which guard interlocking devices are connected across machines.