# Why do pneumatic valves need both a Safety Relay and an Air Dump to be safe?

If air dumps safely release pneumatic pressure from an industrial machine when an E-Stop is pressed, why is it also standard practice to cut electrical control power from the valves with a safety relay? This would be useful if the air dump failed, but those are already incredibly safe so I feel like there must be a better reason to reasonably justify the added cost and complexity.

The air dump removes pneumatic potential energy from the system (assuming no closed-center valves or check valves). How does a safety relay reduce the potential for motion?

Maybe it has nothing to do with machine safety, but is rather for maintenance reasons? I have seen machines that can be put in "maintenance mode" that leaves air enabled but disables electrical control, and then trained maintenance personnel can enter the machine without fear of it automatically moving for any reason but can still manually move actuators using the override buttons present on most valves.

# Cat 4 Dump Valve $$\mathrm{MTTF_D}=95 \ \textrm{yr}$$

Edit: Actually going through the calculation, I found that Category 3 / Category 4 dump valves are not nearly as safe as I thought. For example, the SMC VP544-X538 dual residual pressure release valve (air dump) is rated with $$B_{10\text{D}} = 10\,000\,000 \ \mathrm{cycles}$$, where $$B_{10\text{D}}$$ is the number of cycles until a dangerous failure occurs for 10% of the components. Assuming 100% uptime, a 30 second cycle time, and an operator entering a machine every cycle to load/unload it, we can calculate the dump completes about one million operations every year.

\begin{align} \mathrm{n_{op}} &= \frac{365 \ \mathrm{day/yr}\times24 \ \mathrm{hr/day}\times3600 \ \mathrm{s/hr}}{30 \ \mathrm{s/cycle}}\\ &= 1\,051\,200 \ \left.\mathrm{cycle}\middle/\mathrm{yr}\right.\\ \end{align}

Then using the formulas helpfully laid out in the Festo Guideline: Functional Safety (and originally from ISO 13849-1), the mean time to dangerous failure $$\mathrm{MTTF_D}$$ is calculated at just 95 years.

\begin{align} \text{MTTF}_\text{D} &= \frac{B_{10\text{D}}}{0.1\times\mathrm{n_{op}}}\\ &= \frac{10\,000\,000 \ \text{ cycles}}{0.1\times1\,051\,200 \ \left.\mathrm{cycle}\middle/\mathrm{yr}\right.}\\ &= 95.1 \ \mathrm{yr} \end{align}

Assuming a factory has at least 100 of these dump valves, then on average a dangerous failure would be expected every 10 years (assuming only 10% of the components have a dangerous failure).

Although I am slightly confused SMC has the same $$B_{10\text{D}}$$ rating for both their single-valve Cat 1 and dual-valve Cat 3 dumps. I'm not sure how to account for increased safety from dual valves versus a single valve, so perhaps I am missing something else with the $$\mathrm{MTTF_D}$$ calculation that would significantly reduce the risk for dual-valve dumps.

• E-Stop is safety first, so redundancy is a good thing. Given the reality of sloppy practices by people in a hurry, there is clear benefit to automatically de-powering as much of the circuitry as possible when safety doors open etc. Not sure that is the actual reason tho, unless we are talking about circuits with mains voltage -- most automation stuff is 24VDC. Dec 15, 2021 at 19:18
• @PeteW Good point, I was thinking of 24VDC control power. Maybe this standard practice is from a time when mains voltage control was more common? Dec 15, 2021 at 19:47
• And while redundancy is a good thing, it also adds cost. I have no problem saving money with a Category 1 air dump instead of a Category 3 air dump in low-hazard areas, for example a dump for conveyor stops on light-duty conveyance. If we cannot identify how the system is made safer by cutting control power, then I have trouble justifying the added cost of safety relays for guard area. One relay and the additional wiring doesn't cost much, but it adds up across an entire factory. Dec 15, 2021 at 19:54
• Also, "de-powering as much of the circuitry as possible" would suggest cutting power to sensors and field I/O blocks as well, which I've never heard anyone consider in a risk assessment. Dec 15, 2021 at 19:55
• I agree with your last point. You could try also asking in the EE forum, there are a handful of people there who could go in more detail for industrial automation. My observation from the point of view of a niche automation-component vendor is that the bigger integrators who drive the market seem to design very defensively, and component cost is not too high on their list of concerns, readily traded for uniformity and reduced complexity. I can't speak to the standards and practices more than that. Dec 15, 2021 at 20:43