What is a Safety Category?
Safety sensors are designed to protect machine operators when opening doors, casings or covers, by preventing any dangerous machine movements.
The type of sensors used depends on the machine’s safety level. When designing machines, manufacturers firstly have to define any potential injuries that may occur when operating their machines. Secondly, they must determine the respective safety level.
To be completely safe, the system must be able to continue operating correctly under any envisaged conditions. How are machines classified in terms of safety categories?
The latest safety standards (EN/ISO 13849-1, EN/ISO 62061) are based on the Safety Integrity Level (SIL) and Performance Level (PL) concepts.
The Safety integrity level (SIL) is defined as a relative level of risk-reduction provided by a safety function, or to specify a target level of risk reduction. In simple terms, SIL is a measurement of performance required for a safety instrumented function.
The International Safety Standard is not limited to "reducing faults by increasing quality”, but also includes "routinely checking for faults", "maintaining safety in the event of a failure" and "stopping operations when a fault is detected". Consequently, ISO 13849, a safety standard which applies to parts of machinery control systems that are assigned to providing safety functions, defines each level of safety maintenance in the event of a fault. This is called safety categorisation.
The below graph helps you check if the Performance Level of your safety function is higher than the PLr (required Performance Level) for your machine, thereby helping you check that you have the correct Safety Level for your system.
Based on the old EN 954-1 standard, there are 5 safety categories:
- Category B: no specific protection required.
- Category 1: Well-tried components and well-tried safety principles must be used.
- Category 2: The safety function(s) must be checked when the machine is switched on and periodically by the machine control system. If a fault is detected, a safe state is initiated or if this is not possible, a warning is raised.
- Category 3: The system must be designed so that if there is a single fault in any of its parts, safety functions are not lost.
- Category 4: a single fault is detected at or before the next safety function requirement. If a fault fails to be detected, then a subsequent accumulation of faults shall not lead to a loss of any safety functions.
TO SUMMARIZE :
The aim of Category 1 is to PREVENT faults. This is achieved by using appropriate design principles, components and materials. Simplicity of concept and design, together with the use of materials with stable and predictable characteristics are the essential parts in this category.
Categories 2, 3 and 4 require that if faults cannot be prevented, they must be DETECTED (and appropriate action must be taken). Monitoring and checking are the fundamental requirements in these categories. The most common (but not the only) method of monitoring is to duplicate the safety critical functions (i.e. redundancy) and compare their operation.