Do you have a specific task? We will get back to you with a recommendation.
When a force measurement takes on a protective function, such as the overload cut-off of a crane or rope force monitoring above a stage, an ordinary sensor is not enough. The measuring chain has to detect faults and move into the safe state by itself if one occurs. For this we develop and manufacture redundant load pins, force transducers and load cells and the matching measuring electronics for safety functions up to SIL 3 according to EN IEC 61508 and PL e according to EN ISO 13849-1.
One point first: a sensor on its own has neither a SIL nor a PL. What is rated is the safety function as a whole, i.e. sensor, evaluation and actuator. We supply the components, the architecture and the figures that allow your safety function to reach the required level.
up to SIL 3 / PL e
dual-channel, with safety controller
2 full bridges
independent and galvanically isolated in the same spring body
SIL 1 / PL c
protective function inside the amplifier, no safety controller
MTTFD, DC, FMEA
figures for SISTEMA and similar tools
SIL and PL: two standards, one goal
Both standards aim to reduce the risk of a dangerous failure to an acceptable level. Which one applies depends on the industry and the risk assessment.
SIL, Safety Integrity Level
according to EN IEC 61508, specified for machinery in EN IEC 62061. Levels SIL 1 to SIL 4, relevant for machinery up to SIL 3. Common for complex electronic systems and in the process industry.
PL, Performance Level
according to EN ISO 13849-1, levels PL a to PL e. The usual route in mechanical and plant engineering, calculated for example with SISTEMA. Besides the failure probability, category, diagnostic coverage and measures against common cause failures are taken into account.
| Performance Level | Probability of dangerous failure PFHD per hour | roughly corresponds to |
|---|---|---|
| PL a | 10−5 to < 10−4 | – |
| PL b | 3 · 10−6 to < 10−5 | SIL 1 |
| PL c | 10−6 to < 3 · 10−6 | SIL 1 |
| PL d | 10−7 to < 10−6 | SIL 2 |
| PL e | 10−8 to < 10−7 | SIL 3 |
The assignment via failure probability is a guide. In lifting and stage technology, SIL 3 or PL e is usually required today.
Measuring on two channels: how the architecture works
A single-channel sensor cannot reach the highest levels: if it fails unnoticed, the protective function is gone. For safety-related applications we therefore measure on two channels in a 1oo2 architecture (one out of two). Both channels measure the same force, and a single channel is enough to bring the machine into the safe state.
What matters is that a single fault cannot hit both channels at once. We avoid such common cause failures (CCF) at the design stage.
How we build redundant sensors
Redundancy starts in the spring body and ends at the connector. Three points are decisive:
Two independent full bridges
on the same spring body: they capture the same force but work galvanically isolated. Strain gauge application and manufacture of the spring bodies are done in-house.
Separate signal paths
the internal wiring is routed physically separately, and the connection uses separate cable outlets or isolated multi-pin connectors. A single cable break therefore cannot cut both signals.
Signals with diagnostics
for example opposing analog signals: channel A delivers 4…20 mA, channel B 20…4 mA, and the sum must always be 24 mA. Or digital safety protocols such as CANopen Safety or PROFIsafe, which monitor latency, data integrity and telegram loss.
What this looks like in a load pin is shown on the page load pins and measuring axles.
Two routes to safe evaluation
The sensor is only one part of the safety function. For the evaluation we offer two series, depending on the required level and on whether a safety controller is present.
All devices of both series are listed under measurement electronics SIL / PL.
Figures for plant certification
For certifying the plant, a redundant sensor is only useful with the matching evidence. We supply the data for calculation with SISTEMA or similar tools:
| Figure | Meaning for plant certification |
|---|---|
| MTTFD | Mean Time To dangerous Failure: average time until a dangerous failure |
| B10D | for electromechanical components: number of cycles until 10 % of the components have failed dangerously |
| DC | Diagnostic Coverage: the share of dangerous faults detected by the diagnostics |
| FMEA | Failure Mode and Effects Analysis to assess possible weaknesses in the design |
Important for planning: these figures describe the component. The level your safety function reaches only follows from the overall architecture, the diagnostic measures and the evaluation. We back the design with FEM calculation and laboratory and field tests.
Sensors for the safety chain
The first link in the safety chain is the sensor. We make these in redundant versions:
Load pins
replace existing pins in rope pulleys, joints and anchor points, see load pins and measuring axles
Load cells and force transducers
for tension and compression, see load cells and force transducers
Custom transducers
if there is no catalogue transducer for the installation point, we design one with redundant architecture, see custom force transducers
Typical applications
Safety-related sensors from octogon are used wherever a failure could endanger people or cause major damage:
Lifting and cranes
overload protection and load moment limitation on mobile, tower and overhead cranes
Stage technology
rope force monitoring above audience and performer areas
Automated guided vehicles and robotics
safe force and torque monitoring in human-robot collaboration
Presses and forming
securing closing forces in heavy machinery
From safety function to figure
We support you from sensor design to the certification-relevant figures, develop the matching measuring electronics if needed and, on request, calibrate the measuring chain according to ISO 17025 in our own laboratory. If a complete test setup is part of the job, we also handle the test bench construction.
What we need for the design
With this information we propose sensor, architecture and evaluation:
- Safety function: what is to be prevented, and what is the safe state
- Required level: PL and category or SIL, if already defined
- Rated load, overload and load direction
- Installation: drawing of the existing part or the available space
- Evaluation: existing safety controller and required signal, for example 4…20 mA, CANopen Safety or PROFIsafe
- Environment: temperature range, protection class, hazardous area
- Quantity and required date
Frequently asked questions about functional safety
Does a sensor with two bridges automatically have SIL 3?
No. SIL and PL refer to the complete safety function. The redundant sensor is the prerequisite; the level reached follows from architecture, evaluation, diagnostics and the figures of all components involved.
What does 1oo2 mean?
One out of two: two channels measure the same thing, and one of them is enough to trigger the safety function. If the channels deviate from each other, the evaluation detects the fault.
Do I need a safety controller?
For SIL 3 / PL e yes, because it compares the two channels. For SIL 1 / PL c there are amplifiers with a built-in protective function that switch by themselves.
SIL or PL: which standard applies to me?
In machine building, EN ISO 13849-1 with the Performance Level is the usual route, EN IEC 62061 with SIL is the alternative. You decide which one to apply in your risk assessment; we support you with both.
Which documents do I receive?
Figures such as MTTFD and DC, B10D for electromechanical components, plus the FMEA. On request we calibrate the measuring chain according to ISO 17025.
Are you planning a system according to EN ISO 13849 or EN IEC 61508? Describe the safety function via the quotation form or write to office@octogon.org. We will propose sensor, architecture and evaluation.