Interlocking Principles and Devices
An important type of protective device is a safety interlock switch which interlocks a guard door with the power source of the hazard.
When the guard door is opened, the power is isolated, ensuring that the machine is safe when the operator requires access.
There are many variations of interlock switches, each with its own characteristics. It is important to ensure that the type of device chosen is correct for its application. Later in this chapter we will look at a series of logical decisions leading to the exact choice of safety switch to be used. First, let's familiarize ourselves with some of the general features and requirements which make devices suitable for interlocking duties.
Standards
The European Standard EN 1088 - “Interlocking devices associated with guards” gives guidance. It is intended to be used in conjunction with EN 60947-5-1 for electromechanical switches.
Reliability
An safety switch must operate reliably even under extreme conditions and rough treatment. The operating mechanism should be kept as simple as possible and all materials used in its manufacturer should be of the highest quality. The design should ensure that component wear is kept to a minimum. The mechanism should be enclosed in a strong, sealed case.
Security
The security of a safety switch is dependent on its ability to withstand attempts to “cheat” or defeat the mechanism. A safety switch should be designed so that it cannot be easily defeated.
 In some circumstances, personnel may be tempted to override the safety switch in some way. Information concerning the use of the machine, gathered at the risk assessment stage, will help to decide whether this is more or less likely to happen. The more likely it is to happen, then the more difficult it should be to override the safety switch or system. The level of estimated risk should also be a factor at this stage. Safety switches are available with various levels of security ranging from resistance to impulsive tampering, to being virtually impossible to defeat.
It should be noted at this stage, that if a high degree of security is required, it is sometimes more practical to achieve this by the way in which the safety switch is mounted.
For example, if the safety switch is mounted as in fig. 44 with a covering track, there is no access to the switch with the guard door open. The nature of any “cheating” prevention measures taken at the installation stage will depend on the operating principle of the safety switch.
Positive Mode Operation (also referred to as direct operation)
EN 292 explains that if a moving mechanical component inevitably moves another component along with it, either by direct contact or via rigid elements, these components are said to be connected in the positive mode. With single mechanical type interlocking switches, when the guard is opened the movement of the guard should be connected in the positive mode to the safety related contacts of the safety switch. This ensures that the contacts are physically pulled apart or “force disconnected” by the movement of the guard.
The safety switch should not rely solely on spring pressure to open the contacts, as the force exerted may not be able to overcome sticking or welded contacts. There is also the possibility that the safety switch could fail to danger if the spring breaks and there is no other way to open the contacts.
Fig. 45 shows a typical negative (or non-positive) mode operating system. There is no direct link between the guard door and the safety contacts, so the system relies entirely on spring pressure to open the contacts. In the event of spring failure, contact weld or sticking, the system will fail to danger and is therefore unacceptable. This type of system is easily defeated by pushing the plunger while the guard is open. Even worse, the safety switch can be tripped accidentally by an operator leaning onto or into the machine while the guard is open. Fig. 46 shows a simple example of positive mode operation giving forced disconnection of the contacts. A cam is mounted on the door hinge so that it directly operates the contacts whenever the guard door is open. Spring pressure can only close the contacts when the guard is fully closed. Any spring breakage will only result in a failure to a safe condition.
Enclosure
The positive mode operation principle shown in fig. 46 is used wherever it is relevant in safety interlock switches. They also avoid any possible abuse by enclosing the contact block and cam in a strong and secure enclosure. This means that the cam and the contact block cannot become separated and it is impossible to defeat the switch by cutting another slot in the cam. The principle is adapted further for actuator operated interlock switches as shown in fig. 47. These devices are widely used as they are simple to mount at the opening edge of the guard and can be used on sliding, hinged and removable guard doors. The actuator is mounted on the guard door and opening the guard causes it to force disconnect the contacts. The switch mechanism is enclosed and is designed to resist tampering.
Fitness for Purpose
As a minimum, all designs and materials must be able to withstand the expected operating stresses and external influences.
Other Safety Principles
For non-mechanical devices, there is usually no physical contact between the safety switch and actuation method. Therefore, positive mode operation cannot be used as the way of ensuring the switching action and we need to use other methods as follows.
Oriented Failure Mode
With simple devices, we can use components with an oriented failure mode as explained in EN 292-2: 3.7.4. This means using components in which the predominant failure mode is known in advance and always the same. The device is designed so that anything likely to cause a failure will also cause the device to switch off.
An example of a device using this technique is the MA Series non-contact magnetically actuated interlock switch. The contacts are protected by being in series with an internal nonresettable overcurrent protection device. Any overcurrent situation in the circuit being switched will result in an open circuit at the protection device which is designed to operate at a current well below that which could endanger the safety related contacts.
Duplication (also referred to as Redundancy)
EN 292-2: 3.7.5 explains that components which are not inherently safe are used in a design and they are critical to the safety function, then an acceptable level of safety may be provided by duplication of those components or systems. In case of failure of one component, the other one can still perform the function. It is usually necessary to provide monitoring to detect the first failure so that, for example, a dual channel system does not become degraded to a single channel without anybody being aware of the fact. Attention also needs to be given to the issue of common cause failures.
Any failure which will cause all duplicated components (or channels) to fail at the same time must be protected against . Suitable measures may include using diverse technologies for each channel or ensuring an oriented failure mode.
Galvanic Isolation
On contact blocks with two sets of contacts a galvanic isolation barrier is required if it is possible for the contacts to touch each other back-to-back in the event of contact weld or sticking (fig. 48).
|