The requirement for a safety-related evaluation of the operating mode selection is justified by the fact that when switching from one operating mode to another, various safety-related devices on the machine are switched on and off. A very simple example of a machine with only two operating modes - automatic and set-up mode - shows why this is the case:

In automatic mode, a safety gate is in use on the machine as a safety-related device, protected by a safety switch. If the door is opened, the machine switches off and enters a safe state. For commissioning in set-up mode, however, it is necessary that the machine can also be operated with the safety door open - but not with all the functions of automatic mode. For this purpose, the operating mode of the machine is switched to set-up mode. This means: In this operating mode, the safety switch on the safety door is bypassed so that the machine can be put into operation. At the same time, an enabling switch is used as a safety device and the control system is switched to a safely reduced speed. Furthermore, not all axes and functions are in operation.

In this example, the safety device 'safety gate' becomes ineffective due to the switchover of the operating mode from automatic to set-up mode. At the same time, two other safety functions take over the protection of the employee: the enabling switch and the reduced speed. Switching between different safety devices must fulfill a performance level (PL) in accordance with EN ISO 13849-1. This is the only way to ensure that switching is performed correctly. Both the C standard for lathes (EN ISO 23125) and the standard for grinding machines (EN ISO 16089) require a PL c for the changeover. The same will apply to the new standard for milling machines (EN ISO 16090), which is due to be published soon.

The normative assessment

In order to be able to assess an operating mode selector switch in terms of standards, its components must be considered. In the case of a key switch, this is initially the key itself. It is not a safety-relevant part - or is it? This is where the German language causes us a little difficulty, as the term safety is used in different ways. In principle, a key is definitely a safety-relevant part - even if not in the sense of EN ISO 13849-1. For this standard, 'safety' means protecting people from the machine or from an accident involving the machine. In English, the term 'safety' or 'functional safety' is used for this type of safety.

Abstract representation of the operating mode selection.

© Euchner

Instead, a key prevents unauthorized access to the machine from outside and is used to switch from one operating mode to another. There is currently no specific term or standard for this type of safety technology in the world of machinery. Even C standards do not make any demands here. Future standards will use the English term 'security' for this type of safety technology. However, EN ISO 13849-1 is not responsible for assessing security.

The key itself therefore does not have to be assessed according to the standard. Nevertheless, a certain level of security should also be maintained here. This results from the Machinery Directive, i.e. from the law. Annex I requires that either a key switch is used or that access to the operating mode selection is restricted to a certain group of people in some other way. This results in a problem in day-to-day use: the key for selecting the operating mode is always inserted in most machines. This means that any employee can switch the operating mode and thus carry out work on a machine, even if they have not been trained to do so.

In the event of an accident, this is precarious: for the operator, because the key is always inserted, and for the manufacturer, because he is aware of this fact and cannot ignore it. Better access restrictions have been in place for many years! In practice, however, there are even worse solutions than the key switch - for example, password access protection. Everyone knows it at some point and it never changes. It is often even written on a piece of paper directly on the machine or in the control cabinet. This means that there is no real protection against unauthorized access to the machine.

The electronic access restriction

The better, more secure alternative is an electronic access restriction system such as the Electronic-Key-System (EKS) from Euchner. This is a system based on transponder technology that consists of a read/write station and one or more Electronic-Keys with programmable memory and is used for electronic access management or access control. It also offers the option of storing additional information and data such as process parameters or functions on the key and transmitting them to the control unit. In the FSA (For Safety Application) version, the system can also be used to implement a touch panel as a safe operating mode selection - even with PL e.

Block diagram of the safe operating mode selection with EKS FSA and touch panel, which is included in this form in the C standards.

© Euchner

The safety-related consideration of an operating mode selector switch in the form of a key switch is simple: one or two switching elements are used, which are connected to a safe evaluation device and thus fulfill PL c or higher.

A selector switch with one or two NO contacts is used as the selection system for the key switch. Although a normally open contact is not a safety-proven component, since there is no safety principle available for a selector switch in accordance with EN ISO 13849-2, a way must be found to assess these contacts. The Institute for Occupational Safety and Health of the German Social Accident Insurance (IFA) recognized this problem a long time ago and provides assistance in the BGIA 2/2008 report: the table of safety values from Annex C of EN ISO 13849-1 has been expanded. Table D.2 from the report lists position switches and pushbuttons for normally open contacts and for normally closed contacts with the note "if fault exclusion is not possible for positively opening contacts" with two different B10D values. This allows a key switch to be evaluated. The downstream safety evaluation and the activation system are not a problem anyway.

Operating mode selection via touch panel

Safe operating mode selection with EKS and buttons.

© Euchner

Touch panels are increasingly forming the interface between the operator and the machines or systems. However, as a touch panel cannot be evaluated in terms of safety, other mechanisms must be used. Euchner has developed a procedure for this, which has been tested and confirmed by the IFA and works as follows:

The EKS FSA initiates a pulse at output LA (L stands for 24 V, A for channel A) when an Electronic-Key is inserted, which starts a predefined sequence in the safe control system. As a result, an expectation is created for the touch panel and the PLC, which is also a non-safe unit: If the system responds correctly within a specified short period of time, both systems will work correctly. At the same time, a selected data word is sent via the bus. The data patterns for the various access levels for operating mode selection are selected in such a way that the requirements of EN ISO 13849-1 are met and falsification is detected with a sufficiently high probability.

EN ISO 13849-1 also requires that a parameter entry must be made not just once, but twice. The input mechanisms must be different from each other. This method is well known from PCs, where an input is often answered with the question of whether the action should really be carried out. When selecting the operating mode, this question has a safety-related significance. Together with the test mechanisms started by the second channel of the EKS via LA, a touch panel can then fulfill PL e.

Two new operating modes - what's behind them?

By using the EKS, a very high quality of access restriction can be achieved. This is important for the machine operator in the event of an accident, as it can be used to prove the authorized use of an Electronic-Key. The machine manufacturer can also offer additional training for operators and document this on the EKS Electronic-Key. This is particularly necessary for two new operating modes that have been introduced together with the description of the operating mode selection in the C standards: 'Automatic mode with manual intervention' and 'Service'.

In both operating modes, working on a machine is particularly dangerous. In 'Automatic with manual intervention', for example, scratching a workpiece at full machine speed can be permitted - if possible, at least in conjunction with an enabling switch. Nevertheless, this type of work requires very specific knowledge of the risk, which the manufacturer can impart to its customers in training courses. Only then is a suitable electronic key issued for the EKS.

The second new operating mode, 'Service', is specially designed for machine manufacturers. Here, work can be carried out very freely. And this is also necessary when setting up a machine for the first time. Today, manipulated safety devices are often used for this work. For example, safety switches can often be seen lying on the floor - with the actuator inserted, of course, because the machine parts must be able to run! However, this is a clear violation of the Ordinance on Industrial Safety and Health, which is often justified by the fact that there is no other way to set up a machine. This is precisely why the new operating mode 'Service' was created, which provides for assembly and other service work and thus legalizes it.

The 'Service' operating mode, which every machine manufacturer must actually provide for in his machine, is particularly dangerous. For this reason, an end user should never be able to select this operating mode. Password protection is certainly no longer sufficient. And a special key is difficult to handle. Electronic keys with copy protection are better and also more tamper-proof.

Operating mode selection with EKS and buttons

Last but not least, the EKS can also be used for operating mode selection with buttons - with the same advantages as already described. The buttons in the control panel are enabled with the authorization stored on the EKS Electronic-Key. For example, these buttons flash according to the content of the Electronic-Key. This can be implemented with the standard PLC, as access to the operating mode selection does not have to fulfill a PL. In order to achieve a PL for the selection and activation of an operating mode, single-channel keys are used for PL c or dual-channel keys for PL d. The signals are read into the safe control system and the selected operating mode is signaled, for example, by a permanent light in the button, with the machine switching to the new operating mode at the same time. This type of operating mode selection can already be found in some machines and can often be easily retrofitted.

The regulations of the C standards will certainly be transferred to other machine types. The safety-related advantage is so great that acceptance is currently increasing rapidly. In particular, the legalization of the service mode and the possibility of being able to carry out manual work in automatic mode are extremely important.

Author: Jens Rothenburg is a standards and safety expert at Euchner.

The EKS in brief

The EKS electronic key system consists of a read station, the Electronic-Key adapter and at least one electronic key with a writable RFID transponder. Each Electronic-Key can be personalized and assigned individual authorizations. In the event of loss, the immediate blocking of the Electronic-Key guarantees the security of the system.

The Electronic-Key adapters with USB, Ethernet TCP/IP, Profibus and Profinet interface are also available in the FSA (For Safety Applications) version for safety-related applications. This version has additional switched outputs that can be used to generate a safe shut-off signal.

Last but not least, the electronic key system is also available in a version in which the evaluation of the Electronic-Key is already carried out in the EKS itself. The result is forwarded to the control unit via five outputs. This device can be operated on any control inputs or on safe control inputs. The Electronic-Key structure is defined and a program is available for writing the Electronic-Keys. The use of this 'Light' version is particularly suitable as a retrofit solution or if only the operating mode is to be selected.