3
$\begingroup$

If air dumps safely release pneumatic pressure from an industrial machine when an E-Stop is pressed, why is it also standard practice to cut electrical control power from the valves with a safety relay? This would be useful if the air dump failed, but those are already incredibly safe so I feel like there must be a better reason to reasonably justify the added cost and complexity.

The air dump removes pneumatic potential energy from the system (assuming no closed-center valves or check valves). How does a safety relay reduce the potential for motion?

Maybe it has nothing to do with machine safety, but is rather for maintenance reasons? I have seen machines that can be put in "maintenance mode" that leaves air enabled but disables electrical control, and then trained maintenance personnel can enter the machine without fear of it automatically moving for any reason but can still manually move actuators using the override buttons present on most valves.

Cat 4 Dump Valve $\mathrm{MTTF_D}=95 \ \textrm{yr}$

Edit: Actually going through the calculation, I found that Category 3 / Category 4 dump valves are not nearly as safe as I thought. For example, the SMC VP544-X538 dual residual pressure release valve (air dump) is rated with $B_{10\text{D}} = 10\,000\,000 \ \mathrm{cycles}$, where $B_{10\text{D}}$ is the number of cycles until a dangerous failure occurs for 10% of the components. Assuming 100% uptime, a 30 second cycle time, and an operator entering a machine every cycle to load/unload it, we can calculate the dump completes about one million operations every year.

$$ \begin{align} \mathrm{n_{op}} &= \frac{365 \ \mathrm{day/yr}\times24 \ \mathrm{hr/day}\times3600 \ \mathrm{s/hr}}{30 \ \mathrm{s/cycle}}\\ &= 1\,051\,200 \ \left.\mathrm{cycle}\middle/\mathrm{yr}\right.\\ \end{align} $$

Then using the formulas helpfully laid out in the Festo Guideline: Functional Safety (and originally from ISO 13849-1), the mean time to dangerous failure $\mathrm{MTTF_D}$ is calculated at just 95 years.

$$ \begin{align} \text{MTTF}_\text{D} &= \frac{B_{10\text{D}}}{0.1\times\mathrm{n_{op}}}\\ &= \frac{10\,000\,000 \ \text{ cycles}}{0.1\times1\,051\,200 \ \left.\mathrm{cycle}\middle/\mathrm{yr}\right.}\\ &= 95.1 \ \mathrm{yr} \end{align} $$

Assuming a factory has at least 100 of these dump valves, then on average a dangerous failure would be expected every 10 years (assuming only 10% of the components have a dangerous failure).

Although I am slightly confused SMC has the same $B_{10\text{D}}$ rating for both their single-valve Cat 1 and dual-valve Cat 3 dumps. I'm not sure how to account for increased safety from dual valves versus a single valve, so perhaps I am missing something else with the $\mathrm{MTTF_D}$ calculation that would significantly reduce the risk for dual-valve dumps.

Improve this question
$\endgroup$
6
  • $\begingroup$ E-Stop is safety first, so redundancy is a good thing. Given the reality of sloppy practices by people in a hurry, there is clear benefit to automatically de-powering as much of the circuitry as possible when safety doors open etc. Not sure that is the actual reason tho, unless we are talking about circuits with mains voltage -- most automation stuff is 24VDC. $\endgroup$
    – Pete W
    Dec 15, 2021 at 19:18
  • $\begingroup$ @PeteW Good point, I was thinking of 24VDC control power. Maybe this standard practice is from a time when mains voltage control was more common? $\endgroup$
    – Micah Lindstrom
    Dec 15, 2021 at 19:47
  • $\begingroup$ And while redundancy is a good thing, it also adds cost. I have no problem saving money with a Category 1 air dump instead of a Category 3 air dump in low-hazard areas, for example a dump for conveyor stops on light-duty conveyance. If we cannot identify how the system is made safer by cutting control power, then I have trouble justifying the added cost of safety relays for guard area. One relay and the additional wiring doesn't cost much, but it adds up across an entire factory. $\endgroup$
    – Micah Lindstrom
    Dec 15, 2021 at 19:54
  • $\begingroup$ Also, "de-powering as much of the circuitry as possible" would suggest cutting power to sensors and field I/O blocks as well, which I've never heard anyone consider in a risk assessment. $\endgroup$
    – Micah Lindstrom
    Dec 15, 2021 at 19:55
  • $\begingroup$ I agree with your last point. You could try also asking in the EE forum, there are a handful of people there who could go in more detail for industrial automation. My observation from the point of view of a niche automation-component vendor is that the bigger integrators who drive the market seem to design very defensively, and component cost is not too high on their list of concerns, readily traded for uniformity and reduced complexity. I can't speak to the standards and practices more than that. $\endgroup$
    – Pete W
    Dec 15, 2021 at 20:43

2 Answers 2

Reset to default
1
$\begingroup$

Because the air dump isn't fail-safe

And because just de-energizing doesn't remove the pneumatic hazard. It's is all about safety.

Improve this answer
$\endgroup$
3
  • $\begingroup$ Sorry, "air dump isn't fail-safe" isn't sufficient. It appears you can buy fail-safe valves as described at pneumatictips.com/…, and anyway it's common to use Cat 3 / Cat 4 dump valves like static.smc.eu/binaries/content/assets/smc_global/… which are very unlikely to fail, right? In my original question I even said "This would be useful if the air dump failed, but those are already incredibly safe so I feel like there must be a better reason." $\endgroup$
    – Micah Lindstrom
    Dec 14, 2021 at 23:07
  • $\begingroup$ @MicahLindstrom, does your application uses these fail-safe monitored dumpvalves? $\endgroup$
    – Tiger Guy
    Dec 15, 2021 at 22:54
  • $\begingroup$ I have not used fail-safe valves before, I just felt it was a good counter-point. However, I have edited my question to actually calculate the MTTF_D of a typical Cat 3 dump valve, and found they are far from fail-safe. If we assume air dumps are not particularly fail-safe, then the obvious answer is that disabling control power prevents the machine from resuming normal cycling without warning if/when the air dump fails. If you add this to your answer, I will accept your answer. $\endgroup$
    – Micah Lindstrom
    Dec 16, 2021 at 3:16
0
$\begingroup$

Failsafe design and engineering requires a total conceptual understanding of every aspect of the sequence of operations for the system under consideration, together with all subsystems. Countless examples of flawed "failsafe" systems are available. No good answer can be given off the cuff.

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.