For cranes with powered hoists and lifting gears, the electronics of overload safety devices must meet category 2. Cranes moving molten steel must meet category 3.

Now the task of the overload safety device manufacturer and supplier is to determine its structure and components. We examine how overload safety devices can meet the requirements of categories 2 and 3. It is also possible for overload safety devices to be type-approved by third party organisations, but this is not a topic of the article.

An overload safety device can be reduced to two components: a sensor S and an alarm unit M. The sensor S converts forces acting directly or indirectly on it into a proportionate electrical signal. The size of the electrical signal is interpreted by the alarm unit M and changed depending on error and load condition for the downstream control system into simple signals. (In below, changes of switching status are indicated with a delta !.

The sensor and alarm unit need a power source. Usually the overload safety device or parts of it are used for other technical tasks, such as weight determination or proportional controls. If we regard the resilience of the overload safety device to errors, then we must consider errors in the power supply and the reactions of these systems on the output signals of the alarm unit.

The selection of elements for the sensor and alarm unit is discussed in Ref [1].

A danger analysis [1] specifies the categories B, 1, 2, 3 or 4 that specify requirements of the overload safety device.

It becomes clear looking at category 2 that the structure of the OSD and its connection to the control system tk, and the reactions of the control system, contribute to the safety of the system.

Achieving category B

The sensor and alarm unit must be manufactured according to generally valid rules. These rules are held in manufacturing and test standards and are examined and re-examined by suitable quality assurance systems. Data sheets cover the functionality of both types of components in standard conditions.

Achieving category 1

Sensor and alarm units must remain functional with critical loads and afterwards. In some cases there may be higher error values, which have no influence on the OSD operability. Manufacturing or pre-production samples should be type-tested before and after critical loads to prove operability during and after critical loads. The results of these examinations lead to manufacturing and test standards. The permissable critical loads of both components are likewise described in data sheets.

This consideration of critical loads reduces the potential of Category 1-compliant devices compared to Category B.

The probability that a component does not fail is one of the guarded secrets of sensor manufacturers. Likewise overload safety device operators frequently cloak themselves in silence. From the history of sensors and subsequent electronics that were installed in powered hoists and lifting machines, however, approximate values can be given [4].

– Ps = 0.9945, the DMS sensor does not fail in the first two years of use,

– PAM = 0.9865, the alarm unit, inclusive of upstream analog amplifier, which can be integrated in the sensor, does not fail in the first two years of use.  

– PDM = 0.9945, the alarm unit, inclusive of upstream AD transducer, does not precipitate in the first two years of use.

Achieving category 2

This category treats the sensor and alarm unit as an overall system. In addition, errors in the supply of power, and the reactions of the OSD, may not be ignored in considering the alarm unit output signals.

In table 4, possible errors, the resistance of the system and its reactions are summarized. It assumes a circuit amplifier BS 805 and digital interface DI301DP,2x. Both devices are equipped with AD transducers. The voltage supply for the DMS sensor is realized by the alarm units BS 805.01 and/or DI301DP,2x.  Voltage supply for a DMS sensor M analog amplifier is realized by the alarm unit BS 805.02. 

There are four types of error effects from the OSD reaction.

A. The OSD indicates the loss of safety function by the monitoring circuit before the demand

B. The OSD relates the error by internal functions without loss of safety function

C. Certain error effects are mitigated tk by suitable non-technical means, i.e. organisational measures during the demand, without loss of the safety function

D. No protection exists against certain error effects.

While the error effects of the group of A are recognizable immediately by the monitoring circuit and so that require an immediate examination of the UELS, the error effects of the group B, C and D are recognizable only by cyclic examination of the UELS.

The combination of DMS sensor and/or DMS – sensor with integrated amplifier [ 3 ] and alarm unit (circuit amplifier BS 805 and/or digital interface DI301Dp.2x [ 3 ]) is suitable to meet the requirements of Category 2.

Category 2-compliant OSDs are either protected from errors, or indicate the loss of safety functions.

Errors do not lead to the loss of safety functions because of internal error corrections or because of external monitoring circuit, use of two redundant relays, or adjusting the parameters of the safety device.

The system indicates the loss of safety functions either internally or externally. It indicates the loss through internal examination of some functions and external announcement by the monitoring circuit. Or it indicates the loss through external examinations, and test cycles, and with announcement of an error by the monitoring circuit.

It is important to arrange the test cycle to recognise the error effects in B, C and D.

Because of such considerations the DMS sensor is very often equipped with two recognition bridges tk and the bridge signals delta U are supplied to an alarm unit individually in each case (fig. 2).

Such an arrangement supplies two signals delta !1 and delta !2 independent of in each case the other the alarm unit.  The downstream control system can check the signal with existing error effects. 

Table 5 represents the probability of the Nichtausfalles tk of the UELS by similar combinations as shown in fig. 2.

For calculations, the values HP = 0.9945 for the DMS sensor and PDM = 0.9945 for the alarm units were used from the section 3,2.  The sensors must naturally lie in the same force direction. 

Variant No. 2 corresponds to the fig. 2 in the representation and the intended purpose.  Apart from the redundancy of the alarm units, this variant is used in order to use the technological signals for separate subsequent treatment or as replacement for a failed alarm unit, resulting independently in the alarm units M1 and M2.

Variant No. 3 is favored i.d.R. tk if the demand exists for safety above category 2 and the two sensors have for example the same demand experience (e.g. in pairs of measuring axles in cross beams).  The alarm unit must take feeds from both channels.

For the technological processing of the two sensor signals it is advantageous if the alarm unit is able to supply both the single signals and a combination signal (sum, difference…) (e.g. digital interface DI301DP.2x [ 3 ]).

Neither the variant No. 2, because of the sensor, nor the variant No. 3, because of the alarm unit, are suitable for the safety category 3, because of:

– aging processes and environmental influences, such as torques on measuring axles, affect the two DMS-bridges equally:  [Table 4, 2d],

– in the variant No. 3 only one alarm unit is available despite the two signal paths.

The requirements of the category 3 are fulfilled with the variant 4 of the table 5.  This variant results from the independent signal guidance of two category 2 OSDs after section 3.3. This combination of two UELS is suitable because:

1.  An individual error does not lead to the loss of the safety function.  If individual errors arise, then the further safety function is ensured by the redundant structure.

2.  Some errors are recognized and corrected: 

– internally by certain error corrections,

– externally by use of the monitoring circuit, by redundant use of two relays for each signal path, by redundant use of the two independent signal paths, and/or by adjusting the parameters of the safety device.

3.  The accumulation of unidentified errors can lead to the loss of the safety function. In particular, this can occur if homogeneous errors arise at the same time in the parallel signal paths.

An OSD can be made compliant with category 3 if:

– there are two separate category 2-compliant OSDs in the same force path,

– the secondary control must evaluate both the redundant signal, in the simplest case, and the series connection of relays, and the plausibility of the signals relative to each other, and evaluate and react accordingly,

-the operator is organizationally able to accomplish the requested examinations for error recognition and localization.

Sample application: bridge crane

A hot metal ladle crane is to be secured with a category 3-compliant overload safety device. The structure in principle is shown in Fig. 3.

Often a measuring axle is built into the rope reeving to measure the load. Only the category 2 is guaranteed also with redundantly implemented axle.  Category 3 can be realised with a second OSD according to this article.  With small rope movements, the use of a rope guard KSW or Ksw-2r on the rope beside the equalising sheave is a meaningful addition.