Many new cranes and hoists are supplied with remote controls and they are an increasingly popular choice when modernising existing cranes. This article is intended to provide those who specify, install and use remote controls with an overview of the relevant European legislation, standards and current good practice. It is not intended to be a comprehensive guide, but rather to serve as a starting point.
European legislation and standards
In legislation and standards remote controls are usually referred to as cable-less controllers. There are variations in the capability of the products on the market, and therefore choices to be made when selecting a product for a particular application. As with many situations where there is a choice, there can be a downside if the wrong decision is made, particularly if the safety performance of an application is compromised. It is therefore essential that users and installers have a clear understanding of how they function and how they should be installed, maintained and operated.
Firstly, it must be understood that most cable-less controllers on the market are multipurpose, for example, they can be used to control a wide variety of equipment, not just lifting machines. Systems marketed within Europe are required to be CE marked and to have an EC Declaration of Conformity (DoC) indicating which Directives the CE mark relates to. For cable-less controllers operating by radio, the DoC should refer to the Radio Equipment and Telecommunications Terminal Equipment Directive (99/5/EC), which covers the frequency range 9kHz to 3,000Ghz.
The DoC may refer to the Low Voltage Directive (2006/95/EC) and the Electromagnetic Compatibility Directive (2004/108/EC), although Directive 99/5/EC includes requirements for electrical safety and electromagnetic compatibility by cross references to them. The point to understand is these Directives do not address functional safety.
Functional safety
Functional safety relates to that aspect of risk reduction associated with the correct functioning of a control system. Factors that influence the functional safety performance of a control system include its ability to avoid, tolerate and detect faults, which is influenced by component reliability, system architecture, and avoidance of systematic errors.
Cranes and other lifting machines are within the scope of the Machinery Directive (98/37/EC to be replaced by 2006/42/EC on 29th December 2009). The Machinery Directive includes specific “Essential Health and Safety Requirements” (EHSRs) that relate to functional safety, and several harmonised standards have been developed to provide methods for designing control systems so that the functional safety performance satisfies these EHSRs.
A harmonised standard provides a method of satisfying particular “Essential Requirements” of a European Directive. Compliance with it grants a presumption of conformity with the essential requirements within its scope.
There are three levels of harmonised standards that apply to the Machinery Directive. Type A deal with basic safety of all types of machinery. Type B deal with particular safety aspects and safeguards. Type C are specific to particular types of machinery and are generally developed by tailoring the requirements of Type A and Type B standards to the particular machine. Functional safety is one aspect of a machine’s safety performance, and so the relevant harmonised standards are at the Type B level.
Similarities and differences with pendant controllers
A cable-less controller has some similarities with a pendant controller. The commands are generated in the same way by using actuators such as buttons or joysticks on the operator station and the base station responds by switching a corresponding output to the various motions. The requirements for these common aspects are exactly the same. For example, the need for electrical and mechanical interlocks to prevent the ‘up’ and ‘down’ motions being energised simultaneously.
The big difference lies in the connection between the actuators and the outputs. Whereas conventional pendant controllers use simple hard-wired connections, the cable-less controller involves highly complex electronics. By its very nature, wireless communication is more open to interference and corruption. It is therefore imperative that cable-less controllers are designed and tested in accordance with a suitable methodology, such as that offered by the relevant standards.
To communicate a command by a cable-less control system requires the following:
(1) operation of the actuator on the operator station;
(2) encoding of the actuator command;
(3) transmission of the encoded command;
(4) reception by base station of encoded command;
(5) de-coding the received command;
(6) switching the appropriate output.
The cable-less controller must be designed so that for each of these actions there are sufficient checks to detect, and if necessary prevent, any corruption of the command. For example, the code for a particular command will be a digital string or ‘telegram’. It may suffer some corruption in transmission but, if it is sufficiently complex and sufficiently distinct from the other command codes, it can still be read and correctly interpreted. If the extent of corruption is such that it cannot be read, then the system must fail to safety. A higher level of integrity can be achieved if each command is transmitted by two independent signals and received by two independent receivers and de-coders and then compared.
Essential health and safety requirements
The EHSRs of the Machinery Directive include requirements for control system safety and reliability, and its behaviour in the event of a failure. In the current Machinery Directive (98/37/EC), these requirements are covered by two separate EHSRs (1.2.1 and 1.2.7 respectively), whereas they have been consolidated into a single EHSR (1.2.1) in the revised Machinery Directive (2006/42/EC). The revised Machinery Directive also states that “For cable-less control, an automatic stop must be activated when correct control signals are not received, including loss of communication.”
These “functional safety” EHSRs are addressed by the following three Type B harmonised standards:
– EN 954-1:1996 – Safety of machinery – Safety related parts of control systems – General principles for design;
– EN ISO 13849-1:2006 – Safety of machinery – Safety-related parts of control systems – General principles for design;
– EN 62061:2005 – Safety of machinery – Functional safety of safety-related electrical, electronic and programmable electronic control systems.
Specific requirements for cable-less controllers
For lifting machines, specific requirements for cable-less controllers can be found in the following harmonised standards:
– EN 60204-32: 1998 – Safety of machinery – Electrical equipment of machines – Part 32: Requirement for hoisting machines;
– EN 13557:2003 + A2:2008 – Cranes – Controls and control stations.
These standards have a wide scope, covering many types of cranes, hoists and winches. They set out requirements for the overall control systems and control stations of cranes, hoists and winches, and include specific requirements for their cable-less control aspects. Some of these requirements for cable-less control are referred to within Type C product standards for particular types of lifting equipment.
A cable-less controller that complies with relevant parts of these harmonised standards should, in those aspects covered by their scopes, support the machine’s conformity with the Machinery Directive. So when selecting a cable-less controller for use on a lifting machine, in addition to the CE marking, compliance with these harmonised standards is also relevant. If a cable-less controller does not comply with these harmonised standards, then conformity with the Machinery Directive cannot be presumed and additional work is required to demonstrate conformity.
Emergency stop devices
With few exceptions, the Machinery Directive requires machines to be equipped with one or more emergency stop devices that enable actual or impending danger to be averted. Relevant harmonised standards for the Machinery Directive, such as the EN 60204 series and EN ISO 13850 (Safety of machinery – Emergency stop – Principles for design) reflect this requirement.
Clause 9.2.7.3 of EN 60204-32 requires a separate and clearly identifiable means of initiating an emergency stop function. It also refers to those situations when a stop function must be automatically initiated, such as when a fault has been detected or when no valid signal has been detected within a specified time.
Annex C of EN 13557 contains specific requirements for the cable-less controller’s stop function, stating that it is a safety-related part of the control system and, as such, shall be designed to category 3 or higher of EN 954-1. In effect this means using well-tried safety principles, that a single fault in any part shall not lead to the loss of the safety function and whenever reasonably practicable, single faults shall be detected at or before the next demand upon the safety function.
An emergency stop actuator on a pendant controlled lifting machine is a red button which, when pressed, latches in and de-energises the main contactor that supplies power for all motions of the lifting machine. It must be re-set before the pendant control becomes active again. Although the stop facility on a cable-less control normally works in the same way, EN 60204:32 specifically prohibits this from being labelled or marked as an emergency stop.
This constraint is because the Machinery Directive requires emergency stop devices to be clearly identifiable, clearly visible and quickly accessible. Whilst these criteria would generally be satisfied from the perspective of an operator who is in possession of the control station, its portability may mean that this is not the case when other persons and situations are considered.
There are potentially several situations in which the stop facility would not be considered adequate in an emergency. For example, the control station may not be available to the person who needs to initiate an emergency stop if:
(1) the operator drops it or leaves it unattended;
(2) the person, being someone other than the operator, is unable to locate it.
Clause 9.2.7 of EN 60204-32:1998 actually includes the requirement that where the operator control station could be dropped and not be immediately retrievable, other means to stop the hoisting machine shall be provided within the working area of the operator.
In a situation where there are several machines operating in the same area, the lack of association between a cable-less control station and its associated machine could result in the wrong emergency stop being pressed, or the emergency stop on an inactive control station being pressed. In an emergency situation it is natural for someone to reach for the nearest emergency stop.
With a pendant controlled crane, the location of the pendant’s emergency stop is always obvious and therefore meets the criteria of being clearly identifiable, clearly visible and quickly accessible. However, because an emergency stop device on a cable-less control station might not meet these criteria, it will be necessary to provide another emergency stop facility at an appropriate location.
For simple installations, this should not be a problem. An emergency stop button located in a prominent and accessible position can interrupt the power supply to the crane or hoist. The situation becomes more complex if the crane can travel a long distance, or if there are several cranes sharing the same down shop power feed system. In the former case, emergency stop buttons may be required at several locations to ensure that they are readily accessible. In the latter case, activating the emergency stop would stop all of the cranes. If there are several cranes each with independent power feed systems, it might also be difficult to identify which emergency stop applies to which crane. It is therefore not possible to give general guidance on how best to provide the emergency stop facility as each installation will have to be individually risk assessed.
Many cable-less controls are configured to keep the main contactor energised for a certain period of time after each motion command. This is to avoid excessive operations of the main contactor, which will remain energised until:
(1) the operator presses the stop button;
(2) no valid signal is being detected (eg due to loss or corruption);
(3) a set time has elapsed since the last motion command.
This configuration means that, until the main contactor is de-energised, a malfunction in the electronics of the cable-less controller could result in an unwanted motion command. So, if for some reason the control station is left unattended before the main contactor has de-energised, then the availability of a separate, clearly identifiable, clearly visible and quickly accessible hard-wired, emergency stop facility is highly appropriate.
Reducing dependency on a separate emergency stop
There are measures which can be taken to lessen the dependency upon a separate emergency stop. Some of these relate to features of the control station, whilst others relate to aspects of user management.
The controls for a lifting machine should be of the ‘hold to run’ type. Therefore in the event of a malfunction, the first action for the operator is to release the control. If that is not effective, the second is to activate the emergency stop button.
The situations which can lead to the control station being unavailable can be addressed as follows:
Control features
(1) The control station can be fitted with a neck strap to prevent it being dropped accidentally.
(2) The control station can be fitted with an isolating key lock to prevent unauthorised use. This can be of the ‘pull out’ type which will automatically de-energise the main contactor. If the key is attached to the operator by a lanyard, this ensures the main contactor is always de-energised before the control station is left unattended. It also gives additional security if the control station is accidentally dropped.
(3) The control station can have a separate ‘hold to run’ button which holds in the main contactor. This requires two-handed operation but will automatically de-energise the main contactor when the control station is left unattended. If fitted, this facility should have the same level of integrity as the emergency stop, for example, a single fault shall not lead to loss of safety function and, whenever reasonably practicable, shall be detected at or before the next demand on the safety function.
User management
(1) The user should ensure that the system is properly maintained, particularly the control station. Wear or damage to the seals around buttons or joysticks and damage to the casing enable dirt, water and other contaminants to enter which can cause false commands.
(2) There should be a designated storage place for the control station when not in use.
(3) Operators should be trained in good practice particularly:
(a) ensuring that the battery has adequate charge;
(b) use of the neck strap to prevent accidentally dropping the control station;
(c) use of the key lock and lanyard if provided;
(d) ensuring that the main contactor is always de-energised before leaving the control station unattended;
(e) ensuring that the control station is always returned to the designated storage place when not in use.
Installation on existing cranes and other safety issues
There are several other safety issues relevant to remote controls. In particular these relate to installing them on existing cranes, training and maintenance.
Installation on existing cranes
(1) The whole machine should be risk assessed prior to installing a cable-less control system to ensure that the use of a cable-less controller will not impact on the safe use of the machine, or its electrical control system. There can be cases where the original control system has a built-in safety feature and fitting a cable-less control system in place of the pendant can disable this function, unless the remote system also has this feature available.
(2) Addendum wiring diagrams should be produced to ensure that a complete record of the electrical system on the lifting machine is held in the technical file. A copy of the wiring diagram should be available in the control panel of the machine.
(3) In accordance with appropriate standards, a warning beacon or sounder must be fitted to the lifting machine, indicating when the lifting machine is under cable-less control.
(4) Direction legends should be clear and unambiguous using a compass rose with corresponding legends, or coloured direction arrows on both the control station and the crane, gantry or runway. Simple white and black direction arrows on the control station are potentially dangerous in the event of an emergency.
Training
Training in the use of the system should be provided for all lifting machine operators including those who may already be trained in pendant control.
Maintenance
The control station should be disabled during any maintenance work, by the removal of the key, unless the maintenance engineer requires the use of it. In this case it should be kept under the engineer’s control.
Clearly there are some significant issues to address when specifying, installing or using remote controls for cranes or hoists. However, by selecting a system with the necessary facilities and level of security, installing it in accordance with the harmonised standards to ensure an adequate level of functional safety, and applying best practice when operating and maintaining it, the full advantages of cable-less control can be obtained with few, if any, disadvantages.
About the author
Derrick Bailes is technical consultant (formerly chief executive) for the Lifting Equipment Engineers Association, 3 Osprey Court, Kingfisher Way, Hinchingbrooke Business Park, Huntingdon, PE29 6FN, tel: +44 (0)1480 432 801, fax: +44 (0)1480 436 314, email: info@leea.co.uk
For more info
Check out an archive of Bailes’ long-running series on our website at www.hoistmagazine.com/leea
