Safety Systems and Fault-Finding

A safety system is not a feature you add. It is a set of things that must be true even when everything else has failed, including the part that was supposed to notice.

What electricity does to a person#

The damage is done by current through the body, and the path matters more than the total. Hand to hand, or hand to foot, crosses the chest. Hand to elbow on the same arm does not, which is why the one-hand rule exists.

The let-go threshold is the number to hold on to. Above roughly 10 mA, the muscles that close the hand overpower those that open it, so the grip tightens on the conductor. The victim cannot release, which is why bystanders must switch off rather than pull, and why an incident at 20 mA can be worse than a brief one at 200.

Why voltage matters at all#

Ohm's law: your body's resistance decides how much current a given voltage pushes. Hand to hand, dry skin: 10 kΩ to 100 kΩ. Damp, sweating, or with broken skin: 1 kΩ or lower.

At 230 V through 100 kΩ, that is 2.3 mA. Unpleasant. At 230 V through 1 kΩ, it is 230 mA, and that is fatal.

Nothing about the supply changed. The person did. This is why the same circuit is survivable in a dry workshop and lethal on a wet stage, why the rules tighten outdoors and near water, and why "I have touched that before and it was fine" is worthless as evidence.

You measured your own body resistance in Class 2, dry and damp. Look at the two numbers again now.

The protective devices, and what each one actually protects#

This is the section people get wrong most often, and the error is always the same: assuming the device protecting the cable is also protecting the person.

A fuse does not protect you. A 13 A fuse allows 13 amps to flow indefinitely. A lethal current is about 50 milliamps. The fuse is protecting the cable from catching fire, which is a real and different job.

How an RCD works#

An RCD compares the current flowing out in the live conductor with the current returning in the neutral. In a healthy circuit they are identical.

If some current is returning by another route — through a person, through damp insulation, through a damaged earth — the two no longer balance. The RCD detects the difference and opens the circuit, typically in under 30 milliseconds, at a difference of 30 milliamps.

Thirty milliamps and thirty milliseconds are chosen deliberately: below the level and above the speed that would cause fibrillation in most people. It is not a guarantee of survival. It is a substantial reduction in the probability of death, and it is why an RCD is mandatory on temporary supplies and outdoor events.

Test it. The test button proves the mechanism, and it should be pressed at intervals, and the RCD on a touring rig should be tested with a proper tester rather than the button, because the button only tests the trip mechanism and not the trip current or time.

Emergency stop, done properly#

An emergency stop is not a switch that turns something off. It is a system with specific properties, and a technical director is expected to be able to look at one and say whether it has them.

1. It is normally closed. The circuit is complete when everything is safe, and pressing the button breaks it. A cut cable, a corroded contact or a pulled connector therefore causes a stop. This is the Class 13 principle, and it is non-negotiable here.

2. It is latching. Pressing it stays pressed until deliberately released by twisting or pulling. An emergency stop that springs back is not an emergency stop.

3. Releasing it does not restart anything. After a reset, a separate deliberate action is required to start. A machine that restarts when the button is released will injure the person who released it, and this has happened often enough that it is written into every standard.

4. It removes power at the source. Not a request to the control software, which may have hung. The stop should drop a contactor, so the machine is de-energised by the absence of a signal rather than by the presence of one.

5. It is dual channel and monitored, for anything serious. Two independent contacts in two independent circuits, both broken by the same button, and a safety relay that watches for disagreement between them. If one channel fails closed, the relay sees the two channels disagree and refuses to allow a reset.

That fifth property is what separates a safety system from a switch. A single contact can weld closed and nobody would know until the day it was needed. Two channels with monitoring turn an undetectable failure into a machine that will not start, and a machine that will not start is a maintenance problem rather than an incident.

Interlocks#

An interlock stops something dangerous while a guard is open, a person is in a zone, or a condition is not met. Same principles: normally closed, monitored, defeat-resistant.

The one to watch for in this industry is the defeated interlock. A magnet taped near a reed switch, a cable tie holding a limit switch closed, a jumper across a terminal. It is always done under time pressure with good intentions, and it always removes exactly the protection somebody designed in.

Finding a defeated interlock is a stop-work event. Not a note, not a mention at the production meeting. Stop.

The topology, in a browser#

Halt the microcontroller and confirm the chain still works. Then put the microcontroller in the chain and say, precisely and out loud, what you have just given away.

Read what that card says the simulation hides before you take any of this as a design. Contact ratings, forced-guided contacts, dual-channel monitoring, category ratings and a signed risk assessment are the difference between this picture and an interlock, and none of them are here.

Isolation and lock-off#

Before working on anything, prove it is dead and make it impossible for somebody else to make it live. The sequence:

1. Identify the correct isolation point. The correct one, verified, not the one that is probably right.
2. Isolate. Switch off and, where possible, physically disconnect.
3. Lock the isolator with your own lock, and keep the key on you. Not in a drawer. On you.
4. Tag it: who, when, why, and how to reach you.
5. Prove dead at the point of work, with the live-dead-live procedure from Class 2.
6. Discharge any capacitors, and prove that too.

The lock is the part that gets skipped and the part that matters. "I told him I was working on it" has killed people, because the person who was told went home and somebody else found a circuit switched off for no apparent reason.

One lock per person. If three people are working, three locks, and the isolation cannot be restored until all three have removed theirs.

Fault-finding as a method#

The rest of this class is the method, because a technical director's diagnostic value comes from process rather than from memory.

The six steps#

1. Do not touch anything yet. The state of a failed system is evidence. What is lit, what is warm, what smells, what was the last thing that changed. Somebody who starts unplugging destroys the evidence in the first thirty seconds.

2. Establish the boundary. What works and what does not, and where the line is. The fault is on that line. This single question eliminates most of the system in one pass.

3. Half-split. Test at the midpoint of the affected section. Sixteen possible points is four tests, not sixteen. Under pressure, methodical beats clever, every time.

4. One change at a time, written down. Reverse anything that did not help. A system where four things changed and the fault cleared is a system that will fail again for reasons nobody knows.

5. Prove the fix. Reintroduce the fault and confirm the symptom returns. If you cannot make it come back, you have not found the cause.

6. Write it up. Symptom, tests, cause, fix, and what would prevent a recurrence. Fifteen minutes, and it is what stops the same fault costing the same hours next year.

The things that make people slow#

• Believing the first plausible story. The first idea is a hypothesis, not a conclusion, and it should generate a test rather than a repair.
• Changing several things at once. Fast when it works, and it never teaches you anything, and it works less often than people remember.
• Trusting a report instead of observing. "It just stopped" almost never means that. Ask what changed, then look for yourself.
• Skipping the boundary question and going straight to the component somebody suspects.
• Not writing anything down, so that after twenty minutes you cannot remember whether you already tested the second run.

When to stop and escalate#

Three conditions, and recognising them is a professional skill rather than an admission:

• Anything involving mains, if you are not qualified for the work.
• Anything where the fault is a safety system. A safety system that has failed is not repaired under time pressure, and it is never bypassed to get through a performance.
• Anything where you have been going more than about thirty minutes with no boundary established. At that point another pair of eyes is faster than another twenty minutes of yours.

Risk assessment, which is a document and a habit#

Every rule on the safety card came from somebody doing this badly once. The formal version is a document; the useful version is a habit you run in your head before you touch anything.

Five steps, and they are the same five whether the output is a form or a decision made in ten seconds:

1. Identify the hazard. The thing with the potential to harm: stored energy, a moving mass, a live conductor, a person working alone.
2. Decide who might be harmed, and how. Not just you. Performers, audience, the cleaner at 06:00 who does not know the trap is unlocked.
3. Evaluate: how likely, and how bad. Likelihood times severity is the usual grid, and its purpose is not the number, it is forcing the two questions to be asked separately.
4. Control, in order of effectiveness. This order is not a preference, it is the hierarchy every standard uses.
5. Record it, and review it when anything changes. A risk assessment written for the get-in and never looked at again is paperwork; one that is revisited when the design changes is engineering.

The hierarchy of control#

PPE is last for a reason. It protects one person, only if worn, only if correct, and only if it has not been damaged. Everything above it protects everybody in the room whether or not they were paying attention. A production that reaches for PPE before it has considered the four above it has skipped the effective options.

PPE, arc flash, and working near live equipment#

The shock hazard is the one everybody thinks about. The other one is arc flash: a short circuit in a distribution board releases its energy as an explosion of plasma, molten metal and pressure, in a few milliseconds. The temperature at the arc is several times the surface of the sun, and the injury is thermal rather than electrical.

It is a hazard of energy available at the fault, not of voltage. A 400 A distribution panel is far more dangerous in this respect than a 230 V socket, which is why the rules tighten as you move upstream toward the incoming supply.

What this means for you, on the productions you will actually run:

• The controls are the same four you already know. De-energise, lock off, prove dead, and do not work live. Nearly all arc flash incidents happen during live work that did not need to be live.
• If work must be live, that is a specialist with a permit, arc-rated clothing, a face shield and insulated tools. It is not you, and "the show is in an hour" does not change that.
• Ordinary PPE still earns its place. Safety glasses when cutting, drilling or soldering. Gloves when handling sharp-edged chassis. Hearing protection near a genny. Nothing exotic, and people still skip all three.
• No jewellery, watch or lanyard near a panel. A metal bracelet across two busbars is both a short circuit and a bracelet that cannot be removed.

At the bench#

Two hours.

Block A — Watch: proving dead on mains (25 min)#

The technician performs the full sequence on a real circuit: identify, isolate, lock, tag, prove dead with live-dead-live, discharge.

You watch, take notes, and then write the procedure out from memory. Two people are then asked to read theirs aloud, and the class corrects them.

Block B — Dissect an RCD (20 min)#

A sectioned RCD and a demonstration rig. Watch the trip on an earth fault of 30 mA. Measure the trip time with the tester. Then create an overload with no imbalance and watch the RCD do nothing at all, because it is not an overload device.

Write down the two currents and the two outcomes. That contrast is the most examinable idea in the class.

Block C — Build a dual channel E-stop (40 min)#

On the safety relay trainer: two channels, a safety relay, a contactor, a lamp as the machine.

Prove all five properties. Then introduce faults: weld one channel closed, cut one channel, cut both, and try to reset with the button still latched. Record what the relay does in each case.

The interesting result is the welded channel: the machine will not start, and nothing appears to be broken. Sit with that for a moment, because that is exactly what a monitored safety system is for.

Block D — Fault-finding under time pressure (35 min)#

Three faulted systems, ten minutes each, working in pairs. One electrical, one data, one control logic.

You are marked on the log, not the time. A pair who established the boundary, half-split correctly and ran out of time has done better work than a pair who found it by luck, because only one of those methods works on a fault nobody has seen before.

Numbers from this class#

Self test with model answers

Answer it yourself first, out loud or on paper, then open the answer. Reading the answer without attempting the question teaches you almost nothing.

1. 1Why does no fuse or breaker protect a person?
2. 2Explain how an RCD detects a fault, and name two things it will not save you from.
3. 3A machine has one big red latching button that removes power. Which properties of an emergency stop does it still lack?
4. 4Why does isolation need your own lock rather than telling a colleague?
5. 5Why does half-splitting beat working along the chain, and by how much on a sixteen-point system?

Note. These are model answers, not the only correct ones. If yours differs and you can defend it with the arithmetic and a measurement, that is worth more than matching the wording.