How is unintended operation prevented on a wireless remote control?
Unintended operation is prevented by four layers: a unique pairing code, serial data integrity, no command accepted at power-up, and carrying discipline.
Unintended operation is prevented not with a single measure but with four overlapping layers: pairing each transmitter-receiver pair with a unique identity code, serial data integrity and error detection, a button held down while the device powers up not going through as a command, and site discipline covering the carrying and the storage of the remote control. IEC/EN 62745 addresses this heading directly.
The problem has two separate sources: human error and signal error. The two call for separate measures and neither takes the place of the other.
The measures on the signal side
- Each transmitter-receiver pair is paired with a unique identity/address code. The transmission of another remote control on the same site is not processed, because the code does not match.
- Serial data integrity and error detection prevents a corrupted packet being taken for a valid command.
- The establishment and the loss of the communication are monitored; if there is no valid signal the movement is released.
What this amounts to in practice is this: the receiver accepts not any remote control out of a box but only the identity taught to it. Verify this the other way round on site — try it with a second remote control that has not been taught, and no movement should occur. And to see whether interference is being processed as a command, repeat the test while the inverter and the welding machine are running.
The measures on the usage side
- When you power the remote control up, a button that has stayed pressed is expected not to go through as a command.
- When you clip the remote control to a belt or a strap, set up a way of carrying it in which the buttons are not subject to pressure; throwing it into a pocket is the most frequently overlooked risk.
- At the end of the shift switch the remote control off and store it in a locked cabinet; the prevention of unauthorised use is a heading of the same standard.
- Do not trigger critical movements outside the field of view of the operator.
Which risk is met by which layer
| Risk | The layer that meets it | Verification on site |
|---|---|---|
| A foreign transmitter drives the machine | Unique pairing code | Try it with a remote control that has not been taught |
| Interference processed as a command | Data integrity and error detection | Watch it while the inverter and the welding are running |
| A button held down at power-up | Not accepting a command at power-up | Hold the button pressed and switch the power on |
| A button pressed in a pocket | Carrying arrangement and switching off | Shift handover check |
| Use of a lost remote control | Teaching the receiver again | Try the old remote control and see that it drops out |
Keeping records is a layer too
Keep in writing which remote control has been taught to which receiver and who has it. Since more than one remote control can be taught to a receiver, without records nobody can know how many authorised devices there are on site. Two mistakes recur here: teaching a spare remote control and not recording it, and wiping the pairings wholesale by returning the receiver to its factory setting — the second drops the other working remote controls as well, so do not do it in the middle of a shift.
The division of responsibility becomes clear here as well: the manufacturer designs the identity code, the data integrity check and the power-up behaviour; keeping the pairing record, putting the remote control under lock and doing the shift handover are the job of the user. This second group is written in no document, is provided by site discipline, and when it is neglected all the measures in the first group are left ineffective.
Where these measures are not enough
All four layers protect the control chain; they do not protect the power circuit of the machine. If the machine moves of its own accord while the remote control is switched off, the cause is not on the remote control side: a welded relay contact, a contactor that has welded shut or a bridged interlock is more likely. A lost remote control can also drive the machine as long as it stays taught to the receiver; in that case the old device has to be put out of service by teaching the receiver again.
These items are a general standards approach. Confirm which mechanisms a particular set implements from the user manual, and have a wired emergency stop on the machine in addition.
The full topic: Wireless remote control installation: pairing, relays, safety