{"id":3830,"date":"2019-05-07T15:36:31","date_gmt":"2019-05-07T15:36:31","guid":{"rendered":"https:\/\/novanta.com\/robotics-automation\/technical-paper\/position-sensors-for-safety-applications\/"},"modified":"2026-01-29T04:40:44","modified_gmt":"2026-01-29T04:40:44","slug":"position-sensors-for-safety-applications","status":"publish","type":"novanta_tech_paper","link":"https:\/\/novanta.com\/robotics-automation\/technical-paper\/position-sensors-for-safety-applications\/","title":{"rendered":"Position Sensors for Safety Applications"},"content":{"rendered":"\n
\n

Position sensors are a core element in modern control systems. In many cases, if a position sensor fails there is no implication for safety, whereas in other cases the consequences could be catastrophic. This paper outlines the design techniques that engineers should adopt with regards to position sensors<\/a> to ensure safe and reliable equipment operation.<\/strong><\/p><\/div>\n<\/div>\n\n

\n
<\/div>\n<\/div>\n\n
\n

Firstly, we should define some terminology. For clarity and brevity, we will be using the term \u2018position sensor\u2019 to cover devices such as encoders<\/a>, transducers and transmitters that measure angle<\/a>, linear displacement, angular or linear speed and correspondingly output an electrical signal. Such devices can take a variety of formats such as potentiometers, resolvers, optical<\/a> and inductive encoders. <\/p>\n\n

In particular, \u2018failure\u2019 needs to be considered carefully. For the purposes of this paper, we consider three types of failure: <\/p>\n\n

  1. No output \u2013 the sensor stops reporting its output signal either permanently or intermittently <\/li><\/ol>\n\n
    1. Incorrect output with error flag \u2013 output from sensor is incorrect but this is flagged by the sensor <\/li><\/ol>\n\n
      1. Incorrect output with no error flag \u2013 sensor outputs an apparently correct reading but is actually reporting incorrect position. <\/li><\/ol>\n\n

        Case #3 is typically the most serious type of failure. <\/p>\n\n

        Other useful terms are \u2018safety relevant\u2019 and \u2018safety critical\u2019. These terms are often mistakenly used interchangeably by those unskilled in the art. Safety relevant generally refers to an instance where position sensor failure may have some safety implications whereas safety critical generally means that failure has significant safety implications. \u2018Intrinsic safety\u2019 is yet another term but it is not especially relevant to this discussion as it refers to sensors which operate in potentially hazardous or explosive environments. Intrinsically safe sensors prevent ignition in such atmospheres through various techniques such as encapsulation, sensor packaging, limiting the amount of stored energy etc. <\/p><\/div>\n<\/div>\n\n

        \n

        Safety Related Applications<\/h2>\n\n

        When designing any position sensor into a safety related application it is useful to think in terms of a spectrum ranging from zero safety relevance to safety critical. As the degree of safety relevance increases, the most appropriate sensor arrangement changes. It is also worthy of note that as the safety relevance increases, generally the cost of the most appropriate solution also increases.<\/p><\/div>\n<\/div>\n\n

        \n
        \n
        \"\"<\/figure>\n

        Figure 1<\/strong> \u2013 A spectrum of design approaches for position sensors as safety demands increase.<\/em><\/p><\/div>\n<\/div>\n\n

        \n

        An application with zero safety relevance is pretty straightforward. If we take the example of the potentiometer which controls the volume of a domestic radio then its failure typically results in only a minor inconvenience and there is no need for the potentiometer\u2019s performance to be monitored.<\/em><\/p>\n\n

        As safety relevance increases, the first step in the engineer\u2019s armoury is to employ a sensor which can carry out some self-diagnostics often referred to as Built-In\u2013Test or BIT. If the sensor fails one or more of its internal diagnostic tests, the sensor outputs an error flag instead of or as well as its output signal. Such error flags can take a variety of forms. For example, with an analogue sensor with a 0.5 to 10V output then the output can be reduced to <0.5V as an error signal. Similarly, devices such as modern inductive encoders (or \u2018IncOders<\/a>\u2019) with digital outputs like SSI<\/a> or SPI, can be configured so their communication protocol carries an error flag if necessary. Examples of built-in-tests include internal watchdog timer, internal flash data memory check or a timeout for receipt of a clock signal. Such sensors can continue to operate but the output contains a caveat which tells the host system “I\u2019m giving you this data but watch out \u2013 it may be wrong”. The receipt of such a flag by the host system should then be used to trigger going to a fail-safe state. A sensor which outputs its own error flag is said to be internally referenced.<\/p>\n\n

        As safety relevance increases further, sensors should be referenced externally and, in turn, both internally and externally. We can illustrate with an example of a microwave satellite communications antenna on a ship. Such antennas are typically required to move within a (software) defined arc so that on-board personnel or other equipment are not affected by the microwave energy. The failure of a position sensor on one of the antenna\u2019s axes can potentially lead to unsafe conditions. Such antennas are typically driven in azimuth and elevation axes by electric motors driving through a gearbox. The angle of the gearbox output shaft is typically measured by an absolute angle encoder whose failure can be internally monitored by the sensor itself and referenced by an internally generated error flag. Additionally, the output from a resolver or encoder on the motor<\/a>\u2019s shaft (input to the gearbox) can be counted by the host system and used as a rough guide to the approximate angle of the antenna axis. Should the two measurements differ outside of expected bands then the microwave energy may be halted as the fail-safe condition.<\/p>\n\n

        The next step along the safety spectrum is to use redundant or duplex arrangements whereby two sensors are used to measure the same parameter \u2013 such as the rotation angle of a shaft. The safety of such arrangements can be increased further by using different types or constructions of sensor so that their failure modes differ.<\/p>\n\n

        An example of a duplex (electrically redundant) sensor is shown below in which the first sensor is shown on the inner ring and the second is shown on the outer ring. Whilst both sensors have a common mechanical housing, each operates electrically independently. Each has its own set of 10 built-in-tests and corresponding error flagging functionality. The inner and outer devices differ by virtue of different numbers of winding pitches on inner and outer rings and their electronics may also be chosen to be different \u2013 for example<\/p>\n\n