What to do now that EN 954 has gone

There can be no denying that the more analytical approach of EN 13849 and EN 62061 is a significant improvement over EN 954, but it does place more demands on the abilities of machine designers. In many cases where safety-related control systems (SRCSs) are not composed of simple components specifically designed for safety use, it will be very difficult to get meaningful reliability figures and make a meaningful analysis. There also appears to be a lot of scope for dispute about the analysis of all but the simplest SRCSs.

EN 954 no longer gives a presumption of conformity with the Essential Health and Safety Requirements (EHSRs) of the Machinery Directive 2006/42/EC (MD). EN 13849, or EN 62061 for electrical systems, have been already been harmonised standards for some time, allowing manufacturers time to make a change if they wish, with EN 13849 being the standard that supersedes EN 954.

Many machine builders will therefore be asking themselves whether a machine designed to meet the requirements of EN 954 suddenly becomes unsafe and unsuitable for sale as of the start of 2012? There are several reasons why this is not the case.

1. The legal requirement is not to meet the requirements of any standard but to meet the requirements of the national legislation implementing the Machinery Directive. A machine builder (or person CE marking the machinery) can make their own justification of why the safety-related control system (SRCS) on their equipment is in fact safe without reference to standards if they wish. Compliance with a standard provides a convenient but not exclusive way of doing this. If the machine was considered safe enough using EN 954, it does not immediately become unsafe because a standard has changed.

2. A machine meeting the requirements of EN 954 is also quite likely to meet the requirements of EN 13849. In this case, the only thing gained by applying EN 13849 is a more rigorous and complex way of showing that the requirements of the new standard are met.

When you cannot use EN 954

The only case in which use of EN 954 is absolutely no longer acceptable is where a manufacturer is self-certifying MD Annex IV equipment by using a presumption of conformity with EN standards without a Notified Body certificate. In this case compliance with current harmonised standards provides the guarantee to the user that the equipment is safe enough and compliance with a non-harmonised standard is not permitted.

The only thing that has fundamentally changed with the new standards is a new, but similar, accepted definition of what 'safe enough' means for a control circuit; and there is a more sophisticated way of analysing whether a control system actually is 'safe enough'.

It is important to realise that control system safety is only a small part of overall machine safety. It is always preferable to design hazards out of machinery than to try to guard against them with a sophisticated control system. If it is practical to use a simple fixed guard, that will always be preferable to a complex interlocked one. A SRCS that meets the requirements of EN 13849 may still be prone to cheating or modification or even removal of guards. It also does not consider isolation. The majority of accidents relating to control systems are not caused by the design of the control system, but by its misuse or a reliance on the SRCS rather than isolation for cleaning and maintenance.

Most of the media buzz about EN 13849 comes from companies selling safety-related components. This is understandable, as they have product to sell and the introduction of a new standard focuses attention on control systems. Maybe it would not be totally unfair to say that there has been a degree of scaremongering. This was the case when EN 954 was published back in 1997, to the extent that the HSE became concerned about it. EN 13849 is a significant improvement over EN 954 and somebody needs to press for its adoption. It seems unlikely that there will be much pressure from enforcement authorities, users or machine manufacturers, so safety component manufacturers are providing a useful service here. They are also introducing new equipment and technologies that do make major improvements in machinery safety.

What should machine designers and users do now?

Most machinery users do not need to worry, but EN 13849 does provide them with a new tool for analysing whether their existing control systems are safe enough. A regular review of safety-related control systems and guarding, with an audit for weaknesses and modifications, is always a good idea.

Machine designers would be wise to check if their current SRCS do meet the requirements of EN 13849, but in many cases it will be found that no changes are necessary. They would also be wise to consider whether any new designs meet the requirements of EN 13849 or EN 62061, particularly if a C type standard suggests a particular PL (Performance Level) or SIL (Safety Integrity Level).

To summarise, the basic principles and practice of good machine design remain unchanged, the difference is a more rigorous way of analysing their adequacy.