Case Studies

Catastrophic Press failure The review of a collision of press load and compression platens during production

1. Executive Summary

Ingenia has been engaged to assist xxxx personnel in investigating the cause/s of the catastrophic press failure.

The press includes the following main platens:

  • Load Platen (part of Load Device) – Powered by a single “Load cylinder” and its purpose is to load hay into the main press chamber; the platen then forms the side wall of the press box during Main Compression cycle. Direction of travel is North /South.
  • Main Compression Platen (part of Main Compression Device) – Powered by a single “Main Compression cylinder” and presses hay to the finished density.  The platen moves past the Load platen (southern wall) which is forming part of the press wall.  Direction of travel E/W.

The collision occurred because the Load Platen went in front of the Compression Platen prior to the Main Compression cylinder extending; the result was a sudden and catastrophic crash with no warning.  Extensive damage occurred to the weigh pan assembly, load and eject assemblies, fines conveyor system and associated safety fencing. 

The Load platen is not intended to move in front of the Compression platen. But witness marks on the Compression platen and Load platen indicate the Load platen moved in front of the compression platen by approximately 110mm just before the compression platen extended forward.  This occurred while the press was running in automatic mode. The operator was having difficulty with "Load Extension Faults" just prior to the crash where the Load Cylinder will not move forward because the Guillotine device is not in the home position.

After our investigation we have identified the four factors which have combined to allow the crash.  If any one of these four factors had not been present the crash would not have occurred.  Factors two to four are well understood however the first factor has two possible causes either of which could not be verified.  In our view the circumstances bringing together the four factors are complex and would have been very difficult to foresee by staff  at the time of the incident.

The first factor is that the Guillotine device was giving faults at the time of the crash.  The device must retract to a home position prior to the Load Platen being allowed to extend. This was causing many problems in the minutes leading up to the event.  The operator explained, and it is confirmed on the video, that a number of attempts to reset the and restart the press were made just prior to the crash.  The crash occurred after the press was returned to auto mode, restarted and beofre its current cycle was completed. The Guillotine faults were caused by worn wear strips and a missing bronze cutting strip support in the mechanism making it unreliable in reaching its home position. The fault had been reported over a few weeks and sprae parts were being organised. The problem is of the kind where the number of issues is likely to have been increasing. To reset this fault the operator's normal prcedure is to manually operate the Guillotine through a cycle back to home, and the Load Platen through a cycle. This pushes the hay into the press chamber and hence the Load Platen cannot be left in the home position (fully away from the press) but must be left in the extended position to close the side of the press because the Load Platen acts as the side wall during the main Compression cycle. This procedual action we believe left the Load Platen in the full extened position which in this case was overlapping the Compression Platen by 110mm, placing it in position for the crash. This action to extend the Load Platen cannot be fully proved but is explained in section 2.

An important press operating parameter is the following:

  • When the Load Platen reached 90” (Load Extend Safe) the Main Compression cylinder can start so long as other start permissives are met.  The Load Cylinder must travel nearly 6” to get to the observed overlap position in the same time that the Main Compression Cylinder travels only 0.5” in order to prevent overlap. (If the Compression beats the Load then a crash cannot occur; only rubbing of the Load Platen against the Compression Platen will occur which is safe, and witness marks support that this has occurred previously).  Therefore, the only way a crash can occur is if either the Load Platen is manually place in front of the Compression, or if there was a delay in the Main Compression starting, allowing the load to overlap.

This was not the first time that this Load extend reset procedure had been used, therefore other factors must have occurred to allow the overlap. The action being taken by the operator would not have been expected to cause a crash.

The second factor is that at some point prior to the crash the Load platen “Load Extend” position was increased from 94" to 98.5”.  This parameter  controls the stopping point of the Load Platen in automatic mode and it can be changed by operations. from evidence collected, operations were not aware that this was the only protection against a crash (all personnel interviewed believed that another interlock was present to protect the press from collission) However, after investigation, increasing this value to 98.5" would allow the Load Platen to overlap the Compression Platen. 

This setting  was further confused as far as value is concerned, by the replacement (about four months prior to the crash) of the Load Linear Transducer LT, which measures the position of the Load Platen. The LT failed and was replaced with a longer unit (2,540mm versus 1,778mm) since the correct length spare was not available to continue production in a timely fashion.  The mechanism driving the LT was modified to suit the longer LT and the calibration set to allow the press to operate.  This calibration, however, resulted in a different scale, rather than a normal reading from 0 to 60” it now read 0 to approx. 98.5” for a Load cylinder stroke of 63”.   This is likely to have caused some confusion about the correct settings.

When the LT, was replaced, the Load extend position was set to 92", but then it was further adjusted to 94" as a response to concern of the cycle time for the Load Platen. In our review, we believe that the setting of 92" would not have allowed a crash, but the setting of 94" may have just caused a small overlap and light crash.

The third factor is that no second protection or interlock actually existed on the press to protect it from this overlap situation and potential crash.  

The complete Load device was replaced approx two years earlier, because the original unit was not extending evenly (crabbing).  The original design was a twin cylinder unit with light guiding system.  It included a mechanical stop to prevent crashes, but this stop was not reliable and we confirmed evidence of two minor overlap crashes (10mm overlap) with the old design.  The new design uses a single cylinder with heavy guides.  The mechanical stops were not included in the new design since it was believed  that an electrical interlock was present and that the improved alignment would reduce risk of repeat failures.  The uneven extension meant that the LT mounted on the western side, was not measurng the true extension correctly, allowing the easten edge to crash. The PLC program was reviewd and ladder logic exists indicating crash protection (refer Figure 3).

The program indicates that the Load position has a safe limit controlling when the Main Compression Cylinder is allowed to move.  If it is not in this position then it is not allowed to move.  Closer inspection of the program reveals the Load_Ext_Safe is the minimum Load extended position that must be reached before the Main Compression is allowed to move; it is not a maximum extended position after which the Main Compression is prevented from moving; i.e. it does not prevent movement when overlap has occurred. 

Review indicates that this protection is actually to prevent blow out or push back of the Load if it is not in a position to form the press wall.  At the time of the crash it was set to 90” (I.e. Compression allowed to start when extension is >= 90”) which is approximately 2” prior to overlap.  It does not in any way prevent overlap of the Load and Compression platens as was previously thought.  The text in the program could easily be misinterpreted to mean an interlock to avoid this collision. 

The press operated for over two years prior to the crash without an overlap crash so this lack of secondary protection cannot be the sole cause of the failure.

The fourth factor is that the Load cylinder was replaced 6 days prior to the crash, because the previous unit was suffering piston oil seal by-pass.  A brand new cylinder was installed but this cylinder allowed a 75mm extra travel of the Load platen to the press box, i.e. 75mm more overlap. This change was the reult of previous modifications. When the Load device was replaced (2 years previously) the then new Load cylinder was damaged during commissioning.  A spare was not available so the damaged rod which shortened it by 75mm.  The internal stop tube (part to limit travel) was also shortened by 75mm to give the same stroke. The new cylinder installed just prior to the crash incorporated a full length rod but the shorter stop tube was retained. This increased the available stroke from 1525 to 1600mm. this allowed the 110mm overlap to occur. The Load cylinder stroke was never seen as the primary protection for overlap since the original design of 1525mm would still allow 35mm overlap (based on 110mm overlap from witness marks - 75mm stroke change).  

In summary, we believe that the combination of the following factors was required before the crash could occur:

  1. Operator moving the Load Platen to full extend position to reset Guillotine fault (normal procedure)
  2. Load Extend position being moved from 94" to 98.5"
  3. Lack of second interlock to prevent over-extension
  4. Change in Load Cylinder to give 75mm extra stroke

2. Certainty of Findings

In the above analysis, the least understood factors are 1. and part of 2.

The incertainty around the first factor revolves around why the crash occurred on this cycle and not earlier. This is not the first time that the operators would have reset the Guillotine and Load after factors 3. and 4. were active (ie in the previous 6 days). Possible explanations are:

  • The Guillotine issue was getting worse, requiring more concurrent reset actions. If this is true, the Load Cylinder could be cycled a few times beofre reset with each cycle further compressing the hay, allowing it to extend further, and eventually leading to this event. This would require the hay to resist the Load extension preventing it from reaching the Load Extend position of 98.5" until this cycle.
  • The Load Extend position was adjusted to 98.5" just prior to the last reset. The operator indictaed that this was not the case, and it does not fit with the normal method to reset the press.
  • The particular bale at the time of the crash was smaller, allowing the Load to extend to the full 98.5", where previous bales had not. However, no evidence was found to validate that the bale was small.

an alternative fist factor is that the Main Compression cylinder did not start to move immediatley when requested, with the delay allowing time for the overlap. This could be caused by a particle in the oil causing the Main Compression logic valve to stick momentarily.  The valves were stripped and checked and no defect was found, however this potential cause cannot be eliminated entirely. Further evidence may become apparent during the recommissioning of the press, following repair.

It is certain that factors 2., 3. and 4. were all required to be present before the crash could have occurred, ie the Load Cylinder had to be capable of giving 110mm overlap, the Load Extend position setting had to allow movement to the overlap position, and a second protection had to not be in existance to prevent this overlap.

For the second factor, it is not clear when the Load Extend position was adjusted from 94 to 98.5". Evidence indicates that it occurred in the proceding 6 weeks. We believe that if it occurred soon after the Load Cylinder was changed 6 days before the crash, then there would have been a high chance that the crash could have occurred sooner than it did, since the only active protection would have been lost as soon as the adjustment was made.

3. Load Cycle Details

3.1 Calibration change after replacement of Load LT (4 months prior to crash)

Note the LT records a movement of approximately 98.5” where the actual movement can only be around 63”.  There was a stroke length of 63” after the replacement of the Load cylinder. Prior to this it was 1575mm or 60”.  The exact relationship could not be established since damage prevented accurate measurement of relative LT and cylinder positions after the crash.  Approximate calibration = 98.5/ 66 = 1.49” LT: 1” Cylinder. This change on its own will not cause the crash.

3.2 Process Steps

  1. Guillotine moves to closed position – signal to PLC via proximeter switch
  2. Scale pan fully extended – load extend – signal to PLC via proximeter switch
  3. Main cylinder moves to fully retracted position – signal to PLC via compression transducer (LT =0 ( ~ 2” dead band?))
  4. Load begins to extend – the following are readings of the Load LT during extension based on best known calibration prior to crash

1.      0-55”                     Full Speed (ramps up by main vane pump & digital valve CETOP8)

2.      55”                        Load Extend DO6 Valve Off shut CETOP8 digital valve (to decelerate (slow down))

3.      55”                        Load Extend Vane Pump Off distance

4.      55”-81”                 Load extend decelerate distance -Aux circuit proportional PGV valve continues to supply oil for extension.

                                    PGV ramps closed from 280 down to 160 to continue deceleration

5.      81”-90”                 Slower constant extension of load platen

6.      90”                        Load Extension Safe for Compress Pulse - Compression platen signalled to start to move **

7.      90”-98.5”              Load moves forward

8.      98.5”                    Load Extend Position -  Final Load position, PGV closes and Load Platen stops

9.      Comp at 96”        Comp Load Release Pos MMStop - Compression Platen at 96” based on Compression LT allows load to go home ***

** This is the critical position of the Load Platen where the signal is given to the Compression Platen to extend provided the other permissive of eject home is active.

** This setting is known as MMS position and from interview and the first part of the RCA, it was understood as "Main Motoe Stop", and considered to be the Load position where the main hydraulic motor was stopped to prevent crashing.  However thorough examination of the PLC program revealed that it is actually based on Compression movement (Compression LT) and represents the position where manual retraction (“Manual Movement”) of the Load away from the compression is allowed, ie safe position where retraction of the press wall (provided by the Load Platen) is allowed without blowing hay out of the press.  As explained above, the PLC program does describe "Collision Avoidance" controls. However, this circuit does not actually prevent overlap of the Load Platen with the Compression Platen. The terminology used in the PLC program is unclear, and includes this reference, which could have misled personnel to believe that there was a secondary (electronic) interlock.

3.3 incident Timeline

Some events are included in the timeline even though they are not contibuting factors for this crash, (eg side wall plate failure and modification did not contribute to the crash).

3.4 Platen Movement Analysis

Assuming that Load LT position 98.5” allowed the Load to move in front of the Compression Platen by 4” then the overlap point would be approximately 92.5” according to LT.  Therefore, after the Load reaches 90” it would need to travel the following approximate distances for the crash to occur:

  • Interference point 2.5” of LT or 1.7 cylinder inches.
  • Distance to crash point 8.5” of LT or 5.7 cylinder inches

These are approximate +/- 0.5”.

The Compression Platen home position is only just away from the edge of the Load Platen, approximately 0.5”.

The PLC control after inspection does not include any form of interlock to prevent the movement of the Compression Platen based on the position of Load Platen being too far extended.

We have concluded that for the accident to have occurred the Load Platen would have needed to travel approximately 5.7” +0.5”/-0.5” in less time than the Compression cylinder travels 0.5”; or the Compression would need to be delayed by sufficient time for the Load cylinder to overlap by 4”.

Load Platen speed of 1.5m/s is based on the average speed; the actual speed from position LT 90” will be slower.

Compression Platen Speed of 0.7m/s is based on average Compression cylinder speed.

Therefore, after Compression is allowed to start it takes 5.65 times longer for the load to reach a 4” overlap than it would take the Compression platen to get in front of the Load platen.  If the Compression platen gets in front of the Load platen then only minor scuffing of the face will occur – i.e. no major damage.

We have concluded that the 4” overlap can only have been caused by:

  1. The Load Platen being manually extended in front of the Compression platen before press re-start in auto, or
  2. Compression Platen start is delayed because another interlock not being reached –delay required is > 0.096 seconds which is small.  

4. Recommendations

The following interim actions have been determined:

  • Develop a detailed repair, installation and commissioning plan for putting BL2 press back in to service ensuring no crashes occur during commissioning. 
  • Machine the Load cylinder stop tube to prevent overlap of the Load Platen in front of the Compression Platen.
  • Design and install a reliable mechanical stop system to provide long term primary protection against overlap of the Load Platen in front of the Compression Platen. 
  • Design and install an electronic interlock to provide secondary protection against overlap of the Load platen in front of the Compression Platen.  This will create a situation where 2 rigorous points of failure are required before this particular crash could occur again. 
  • Review and document Load and Compression extend and retract positions to ensure settings required to prevent overlap.  Set setting limits in control screen to prevent inappropriate setting being made. 

It is our recommendation that the following long term considerations be implemented to prevent the occurrence of similar incidents in the future:

  1. Complete a HAZOP for both BL1 and BL2 to identify other critical interfaces to ensure potential collision or other serious failure hazards are identified and controls developed to prevent occurrence as far as is reasonably possible. 
  2. Define and fully document a critical spare parts management system to ensure correct parts are available when required. 
  3. Fully document all machine settings and log all changes made with fully explained reasoning. Keep a log of all settings in maintenance documentation.
  4. Improve documentation of press settings and specification for BL1 and BL2 to improve visibility to all staff of any setting changes.  This will help ensure that no other setting change could un-expectantly contribute to a major incident.  

5. Conclusion

The most likely cause of this event was a combination of four casual factors:

  1. Manual extension of load to full extension prior to restarting in auto mode, to reslove a press defect in the guillotine area.
  2. Adjusted Load Extend position setting from 94" to 98.5".
  3. Lack of secondary safety interlock to prevent overlap of Load Platen with Compression Platen.
  4. A modifies Load Cylinder installed that allowed more extension of the Load Platen.

We cannot eliminate an alternate possible cause instead of 1. above, where a defect in the Main compression Cylinder logic valve may have resulted in momentary sticking due to contamination. No evidence was found to support this contributing factor, but it is sill a possibility.

In our opinion, the contributing causes are complex and would have been very difficult to forsee by personnel in the time leading up to the crash. Formal HAZOP risk analysis is recommended to assess if any other crash hazards exist in the machine. This HAZOP process will need to involve all stakeholders, including the Hydraulics and Control contractors.