Leuze – Improving Machine Safety: Practical Limits of Muting and Safer Alternatives
Muting enables uninterrupted material flow in automated systems, but incorrect implementation can create safety gaps that require alternative safety concepts.
www.leuze.com
Muting allows the safety function on machines or systems to be temporarily bypassed so that material can be fed in or out through protective devices such as light curtains or laser scanners without interrupting the production process. Personal safety must be guaranteed at all times. Muting applications repeatedly reach their limits in practice, allowing incorrect operation and manipulation. In such cases, alternative security concepts are required.
Unconscious risks
Various types of muting are used in industrial automation: 2-sensor, 4-sensor, time-controlled or sequence-controlled processes. The international standard DIN EN IEC 62046 regulates the requirements for entry and exit stations with muting and stipulates in particular:
• Muting must be activated via at least two independent bridging signals
• Muting must offer protection against foreseeable incorrect operation or manipulation
The standard thus defines clear requirements for the implementation of muting applications. In practice, however, it is not always fully complied with – either because the specific application requirements are not fully known and may therefore differ from real-life conditions, or because risky compromises are deliberately made to achieve high process stability. As a result, safety functions become less effective, and manipulation or incorrect operation are more likely. For operators, this means an unconsciously increased liability risk and potentially serious consequences for employee safety.
Hazard 1: Safety gap due to “pallet muting”
In automated systems, meshed containers or other objects that are difficult for muting sensors to detect are often fed onto or discharged from pallets (Figure 1). The openings in the mesh structure prevent the muting sensors from generating a stable switching signal, making it impossible to mute the safety device. In practice, the pallet itself is sometimes used as a muting trigger (Figure 2) – a procedure that is not permitted: A person could, for example, place an empty pallet in the safety device and thereby deliberately disable the protective device.
Muting on pallet
Solution: Smart Process Gating (SPG)
This safety gap can be reliably closed with Smart Process Gating (SPG). The bridging function is activated by two independent control signals without external muting sensors. The gating on the safety light curtain is activated by
• a CS switching signal (control signal) from the system control as the first (initiation) signal
• a PFI protective field interruption signal, triggered by the transported goods in the light curtain protective field, as a second (verification) signal
Figure 3: CS switching signal and PFI signal activate the bridging.
The gating function is activated by the correct sequence of CS switching signal and protective field violation and is monitored by the light curtain. Shortly before the transported goods enter the protective field, the process control system (PLC) sends the CS switching signal to the safety light curtains. The timing must be set so that the distance between the transported goods and the protective field is less than 200 millimeters, preventing another person from passing through immediately before the goods. If the transported goods enter the protective field within four seconds, the light curtain uses its own PFI signal and suppresses a safety shutdown. Gating ends either automatically immediately after the conveyed material has passed through and the protective field has been cleared, or by resetting the CS switching signal via the PLC. This method enables a particularly compact and space-saving system design, as no additional muting sensors are required directly upstream or downstream.
Hazard 2: Safety gap due to incompletely loaded pallets
If a pallet is only partially loaded, or if the transported objects are significantly narrower than the conveyor system, a gap will occur during muting. A person can enter the danger zone through this gap without the safety function being triggered. To close the safety gap, the standard limits the maximum permissible clearance next to the transported goods to 200 millimeters. In real-world applications, however, passage gaps are often significantly larger, making it easy to bypass the protective device.
Excessive distance during muting: A person could enter the danger zone unnoticed alongside the transported goods.
Solution: Access guarding with dynamic format adaptation
This hazard can be eliminated by means of access protection with dynamic format adjustment. Here, two safety laser scanners generate a joint, closed, vertical protective field. In addition, distance sensors installed on both sides of the conveyor belt detect the position and width of the goods on the pallet – alternatively, this can also be determined using the scanners’ integrated measuring function. The safety system uses this information to release a corresponding area in the protective field through which the transported goods can be conveyed without interruption. Access to the sides of the goods remains secured in accordance with standards. After the transported goods have passed through, the protective field is automatically closed again. If a person is walking or driving alongside them, this is also reliably detected. This safety solution’s innovative safety concept enables Performance Level d in accordance with EN ISO 13849-1 .
Figure 5: Access guarding with dynamic format adaptation
Hazard 3: Safety gap due to forklift truck muting
In this example, two induction loops or ultrasonic sensors serve as muting function triggers. As soon as the forklift truck enters the sensor area, muting is initiated and the light barrier’s safety function is deactivated. The forklift truck can enter the station. This solution is no longer permitted under the new draft of DIN EN 415-4 , as the hazard remains: a person could enter the danger zone assuming that the machine is in a safe state because the light curtain has been triggered, which is not the case during muting.
The forklift mutes the light barrier via two induction loops – the hazard remains.
Solution: Sequential restart
This safety solution ensures that hazardous movements are always stopped when the light curtain’s protective field is interrupted. When the forklift truck leaves the danger zone, specially arranged induction loops generate a defined sequence that enables the system to restart automatically. If induction loops cannot be installed in the floor, the forklift's movement can also be monitored using radar sensors. Both approaches meet functional safety requirements and reliably prevent tampering. This safety solution also complies with Performance Level d in accordance with EN ISO 13849-1.
Limits of muting and alternatives
In summary, muting makes it possible to distinguish between transported objects and people, contributing to automation and efficiency. However, the process must always be protected against foreseeable incorrect operation and manipulation. Alternative safety solutions are particularly necessary if muting sensors cannot reliably detect transported objects or if large variations in object width create gaps that are too wide alongside the transported goods. Muting on forklift trucks is no longer considered state of the art in terms of safety technology. In all these cases, the hazard area remains potentially accessible and dangerous. Safe and standard-compliant solutions are available for these challenges. Leuze provides support through a clearly structured development and testing process – from planning and programming to comprehensive validation and verification.
The path to a safe solution
The path to a safe solution from Leuze begins with the customer’s individual requirements: automated operation must be reliable and safe. After conducting a thorough analysis with risk or hazard assessment, a safety designer develops a customized concept and works out specific safety functions for the respective application. The engineering team selects, integrates, programs and tests the appropriate hardware and sensors. A consistent dual control principle ensures functionally safe implementation. Comprehensive functional tests ensure that all safety and standard functions work reliably.
Commissioning at the customer’s site will take place only after successful validation under real operating conditions. Finally, the customer receives complete documentation, including a validation plan and CE declaration of conformity.
This offers three key advantages:
• Simple – functional safety is complex, but Leuze’s expertise, engineering, and services make it simple for the customer.
• Safe – all solutions are strictly standards-based and fully documented, so that compliance can be verified at any time.
• Productive – functional safety and efficient processes are interlinked, ensuring reliable, cost-effective operation.
www.leuze.com
