Professional Documents
Culture Documents
Contents
5.0 Guards
5.0.1 Fixed guards
5.0.2 Movable guards
5.0.2.1 Type A
5.0.2.2 Type B
5.0.3 Adjustable guards
5.0.4 Guard switches
5.0.4.1 Function of a guard monitoring relay
5.1 Locking systems
95
5.1.1 Mechanical trapped key interlocking
Devices
Machinery Protection
5.1.2 Electrical control interlocking
5.1.2.1 Typical connections
5.2 Electrosensitive and optoelectronic devices
5.2.1 Optoelectronic selection criteria
5.2.2 Types of approach
5.2.3 Examples of machine guarding
5.2.3.1 Area guarding on an assembly line
5.2.3.2 Access guarding
5.2.3.3 Guarding the interior of a large press
5.2.4 Connection to control circuit
5.2.4.1 Typical connection
5.2.5 Muting
5.2.5.1 Typical connections
5.2.6 Pressure-sensitive safety devices
5.2.6.1 Typical connection
5.3 Emergency stop devices
5.3.1 Emergency stop switch
5.3.2 Emergency stop circuit
5.3.3 Final control element in a safety circuit
5.3.4 Typical connections
5.4 Two-hand controls
5.4.1 Typical connection
5.4.2 Programmable electronic systems (PES) for
two-hand control
96
Devices
Machinery Protection
5.0 Guards
Be robust
Not give rise to any additional risk
Not be easy to bypass or render non-operational
(fixed enclosing guard)
2 Be located an adequate distance away from the
danger zone (fixed distance guard)
97
Cause minimum obstruction, enabling essential
Devices
Machinery Protection
work to be carried out without dismantling the
guard.
5.0.2.1 Type A
Where possible, these must remain fixed to the machine. When
these guards are open they must be combined with a locking device
to prevent moving parts starting up while the danger zone is being
accessed. A stop command must be given when the guard is open.
5.0.2.2 Type B
These must be designed and incorporated into the control system so
that moving parts cannot start up while they are within the operator’s
reach. The exposed person must not be able to reach moving parts
once these are in motion. These guards can only be adjusted with
the aid of a tool or key. If any of the components on the guard fail,
the machine will be prevented from starting. If the machine has
already started up, all moving parts will be stopped. The function of
the associated locking device may be more or less sophisticated,
depending on the type of hazard, frequency of opening, etc.
This will be determined by the risk assessment. Guards that meet the
requirements of Type B must be regarded carefully. Does the
opening of the guard:
Devices
Machinery Protection
guarding control circuit has to be assessed as an individual item and
the relevant specifications consulted. A risk assessment will also
have to be performed. This type of interlocking is called control
interlocking (EN 1088).
6
Fig. 10: Two-channel control for Fig. 11: Two-channel control, high 101
position monitoring integrity
Devices
Machinery Protection
PNOZ
XM1
NB. Please refer to Pilz Safety Catalogue (1) for relay details.
5.1 Locking systems
ISOLATE
Removing the key
turns the electrical
supply OFF
103
EXCHANGE
Devices
Machinery Protection
The key from the
electrical supply is
trapped in the
mechanical exchange
box, allowing the
access keys to be
freed.
ACCESS
The access keys are
inserted into the access
locks to allow entry. A
second key can be
freed to provide
operator protection.
LINK
Key can transfer
to / from control
interlock
The two systems can also be combined so that safety keys can be
used to protect individuals, while access keys are used to limit access
to authorised personnel. This is particularly useful when a robot
needs to be put into “teach mode” or a machine has to be reset.
1 1 3
R
AmStop4 AmStop4 AmStop4
2 2 4
1 5 3 7 2 6 4
+V/L 0V/N
24VDC
Reset
105
Devices
Machinery Protection
13 23 33
A1 Y1 Y2
PNOZ X1
41 42 A2
14 24 34
0V
Fig. 14: AMSTOP from Fortress Interlocks connected to a Pilz PNOZ X1, complying
with category 1/2, EN 954-1
Typically this would connect the two normally closed output terminals
on the AMSTOP directly to the supply terminal on the Pilz PNOZ X1
safety relay. The supply voltage for this relay is 24 VDC. Auto reset
is available with this connection.
1 1 3
R
AmStop4 AmStop4 AmStop4
2 2 4
1 5 3 7 2 6 4
+V/L 0V/N
Reset
11
106 24
13 23
Devices
Machinery Protection
A1 S33 S34
PNOZ X5
S11 S12 A2
14 S12 S22
Fig. 15: AMSTOP from Fortress Interlocks connected to a Pilz PNOZ X5, complying
with category 3, EN 954-1
R
AmStop4 AmStop4 AmStop4
2 2 4
1 5 3 7 2 6 4
+V/L 0V/N
12 Reset
13 23 24
107
Devices
Machinery Protection
A1 S33 S34
PNOZ X2
S21 S22 A2
14 S11 S12
Fig. 16: AMSTOP from Fortress Interlocks connected to a Pilz PNOZ X2, complying
with category 4, EN 954-1
INTERLOCK
FORTRES
INTERLOCK
FORTRES
2 2 4 4
AutoLok4
1 1
R Y
INTERLOCK
INTERLOCK
FORTRES
FORTRES
INTERLOCK
INTERLOCK
FORTRES
FORTRES
AutoLok4
2 AutoLok4
2
2 14 5 7 6 12 1 13 3 4
+V/L
0V/N
1 2
+ -
Reset 13
108
13 23 24
Devices
Machinery Protection
A1 S33 S34
PNOZ X2
S21 S22 A2
14 S11 S12
Fig. 17: AMLOK from Fortress Interlocks connected to a Pilz PNOZ X2, complying with
category 4, EN 954-1
Features are the same as in the previous example. Here, the locking
feature on the AMLOK must be used.
1 1 3 3
INTERLOCKS
FORTRESS
INTERLOCKS
FORTRESS
AmLok
2 2 4 4
1 1
R YL
INTERLOCKS
INTERLOCKS
FORTRESS
INTERLOCKS
FORTRESS
INTERLOCKS
FORTRESS
FORTRESS
AmLok AmLok
2 2
2 14 5 7 6 12 1 13 3 4
0V/N
+V/L
1 2
+ - K1
13 23 24
Unlock A1 17 25 35 Y1 Y2
A1 S33 S34
PZA
14 PNOZ X 2.
Devices
Machinery Protection
K1
Start
Stop
K1
Fig. 18: AMLOK from Fortress Interlocks connected to a Pilz PNOZ X2 and PZA safety
timer, complying with category 4, EN 954-1
L1
L2
L3
24VDC
1 1 3 3
INTERLOCK
FORTRES
INTERLOCK
FORTRES
2 2 4 4
AutoLok4
1 1
R Y
INTERLOCK
INTERLOCK
FORTRES
FORTRES
INTERLOCK
INTERLOCK
FORTRES
FORTRES
AutoLok4
2 AutoLok4
2
2 14 5 7 6 12 1 13 3 4
+V/L
0V/N
1 2
+ - Unlock
K
13 23 24
A1 S33S34 A1 13 23 41 L1 L2 L3
PSWZ
15
110 PNOZ X 2.
14 24 42 Y30 Y31Y32 Y1 Y2 A2
Devices
Machinery Protection
S21S22 A2 0 V + 24 V out
K
14 S11S12
S1 K2
K
M
S0 K
K
0V
K K K K
Fig. 19: AMLOK from Fortress Interlocks connected to a Pilz PNOZ X2 and PSWZ
standstill monitor, complying with category 4, EN 954-1
Fig. 18:
With the AMLOK normally closed output contacts closed, the PNOZ
X2 will energise, making its safety outputs 13 and 14. When the start
button is depressed, K1 will energise, opening its normally closed
contact. The PZA will then de-energise, opening its safety contacts
17 and 18. When the stop button is pressed, K1 will energise,
allowing the PZA to perform its delay time function. After the pre-set
time has elapsed, PZA will energise, closing its safety contacts 17
and 18. The optional release switch can now be pressed, allowing
the AMLOK solenoid to release the lock.
Fig. 19:
16 In some cases, for example, where the guarded machine has uneven
rundown times, it is not efficient to use a delay timer because it has to 111
be set permanently to the maximum rundown time. The PSWZ
Devices
Machinery Protection
standstill monitor uses the regenerated voltage on two separate coils
of the motor and compares this with a pre-defined set point. With the
AMLOK normally closed contacts closed, the PNOZ X2 energises,
making its safety contacts 13 and 14, allowing a star delta start by
depressing S1. When the PSWZ detects voltage at points L1, L2 and
L3, its safety contacts 23 and 24 will open. When the stop relay S0 is
pressed, K2 will de-energise and disconnect the motor from the
supply, allowing the PSWZ to monitor the regenerated voltage. When
the pre-determined voltage level is reached, safety contacts 23 and
24 on the PSWZ will close. This means the optional release switch
S3 can be pressed, energising the AMLOK solenoid and releasing
the lock.
5.2 Electrosensitive and optoelectronic devices
prEN 999 provides the following general formula for calculating the 113
minimum distance from the danger zone:
Devices
Machinery Protection
S = (K * T) + C,
where:
Angular
Parallel.
Direction of
Direction of penetration
penetration
AO
PD
ß
H AOPD
AOPD
H H
Perpendicular
approach
Devices
Machinery Protection
d > 70 mm No. of Recommended
multi-beam S = 1600T + 850 Beams heights
4 300, 600, 900, 1200 mm
3 300, 700, 1100 mm
2 400, 900 mm
single beam S = 1600T + 1200 1 750 mm
21
AOPD: resolution 14 mm
116 Hazardous
zone
A
Y mm
Devices
Machinery Protection
Floor
Fig. 23: Perpendicular approach: point of operation guarding combined with area guarding
Hazardous zone
Floor
Devices
Machinery Protection
the risk of a person entering the hazardous zone undetected by
passing under the AOPD. In such a case you would need to install
an additional device, based on the risk assessment.
Fig. 25 shows the results of both these methods. Operating constraints
will enable you to decide which is best for your application.
Advantages Disadvantages
Solution no. 1 Higher productivity because Safety device is more
S = 320 mm the operator is closer. expensive.
The short distance between the
vertical barrier and the hazardous
zone enables material to be stored
close to the machine.
Solution no. 2 Safety device is less expensive. Operator much further away.
S = 1336 mm Enables access to be guarded, Difficult to store products on the
regardless of the height of ground because the barrier takes up
hazardous zone “A”. a great deal of space.
Lower productivity.
Higher productivity cost.
1106 mm minimum
on all sides with access
to the machine
23
Hazardous zone
118 1100
AOPD = 160 ms
700 where H = 300 mm
Floor
Devices
Machinery Protection
safety categories will differ.
T
RISK
on
OSSD / FSD off
T
protection field or by internal
checking.
120 on
Accumulation of faults may
lead to loss of the safety
1 function.
off
The system shall be designed
Devices
Machinery Protection
device.
The single fault is detected
on at or before the next demand
1 on the safety function. If the
off
detection is not possible then
on an accumulation of faults
OSSD / FSD 2 shall not lead to a loss of the
off
safety function.
+ 24 VDC
FGS
5 6 7 3 4 2
K1M 25
121
Devices
Machinery Protection
13
A1 S52 S12 S22 S21 13 23 33 41 Y36
Reset
14
PNOZ 8 K1
2 K2M
3 1 3 2 1 3 K2
24V
Y32 K3
Y35 K1 K2 K3
0V
M
S11 Y1 Y2 A3 14 24 34 42 Y37 A2
3
K1M
K2M
Fig. 28: Typical connection of a category 4 device (Pilz PNOZ 8) with a Sick FGS light
curtain, manual reset
5.2.5 Muting
The muting of protective devices raises the problem of an
installation’s safety. For example, EN 415-4 (Palletizers and
depalletizers) relates to packaging machinery on which all operations
on the palletised load are carried out entirely and automatically by
machine. Under normal operating conditions, there is a risk at both
the entrance and exit of the interior zone. The AOPD must be muted
at the moment the pallet passes through, but it must also be possible
to detect the presence of an operator. The muting system must
therefore be able to discriminate between the pallet and the operator.
The diagrams below show how a light curtain can be used to meet all
these requirements. The device incorporates a system of temporary
muting by automatic discrimination. The AOPD is muted by the
sensor pairs A1/A2 and B1/2. In this case the distance between A1
and B2 must be less than the length of the pallet. The light curtain
can also be used to define the maximum duration of the muting
period, in stages of 1 second.
LCU-P output
in ON state
AOPD output
A1
A2
B1
B2
Muting
< 50 ms > 50 ms
Devices
Machinery Protection
A1 A2 B1 B2 LCU
Fig. 30: Muting: the conveyed material is identified; no muting signal is emitted
A1 A2 B1 B2 LCU
Fig. 31: Muting: the operator is identified; the light curtain initiates an (emergency) stop
5.2.5.1 Typical connections
S24 S12
X1
X2
PST 1 S23 S11 S1 K1
Reset
K2
LC
28 Y36 Y37 Y2
124 PNOZ 8
Devices
Machinery Protection
K1 K2
NB. Please refer to Pilz Safety Catalogue (1) for relay details.
3 4
B SERIES
RECEIVER 2
24VDC
1
A1 A2
S12 13
3 4
14
B SERIES 2
PILZ
S22
EMITTER 24VDC PNOZ X5
1
S33 23
24
S34
L N E
F1 1A
29
24VDC
125
POWER SUPPLY
eg. LUTZ 722-930
Devices
Machinery Protection
0V
F2 2A
24V
B1 B2 S11 S12
A1 A2 S33 S34
S21 13
S11 13 PILZ SAFETY O/P 1
MUTE 1
PNOZ X3 14
PILZ 14
PNOZ X2.1 23
S22
S12 SAFETY O/P 2
24
S31
MUTE 2 S21 23 33
SAFETY O/P 3
24 34
S32
S22
S33 S34
NOTES
1) MUTE 1 & 2 INPUTS SHOULD BE FORCED FEEDBACK FROM
BREAK LIMIT SWITCHES EXTERNAL
MONITORED CONTACTORS
2) IF THE APPLICATION REQUIRES A FAILSAFE MAN. RESET.
MUTE INDICATOR, A UNIT WITH FAILSAFE
MONITORING OF THE MUTE DEVICE
SHOULD BE USED
NB. Please refer to Pilz Safety Catalogue (1) for relay details.
5.2.6 Pressure-sensitive safety devices
Another alternative to mechanical guarding is to use a device that will
sense presence by contact, i.e. a pressure-sensitive device. The two
most common types are contact-sensing bumpers and pressure mats.
These devices are manufactured following the guidance of EN 1760-1
(Safety of machinery. Pressure-sensitive protective devices).
Reset
NB. Please refer to Pilz Safety Catalogue (1) for relay details.
5.3 Emergency stop devices
Devices
Machinery Protection
machine actuators, all brakes or mechanical devices
being activated (i.e. an uncontrolled stop).
Mushroom-headed buttons
Bars
Levers
Kick-plates
Pressure-sensitive cables.
The colour or the actuator must be red. Where used, the background
colour must be yellow.
Devices
Machinery Protection
clearly defined, this could lead to failure to closed circuit. However,
the aim of these categories is to achieve good design using well-tried
components and, if a failure does occur, the risk to the operator or
environment is low.
E-Stop
Reset
E-Stop
Reset
Reset
Devices
Machinery Protection
a single fault should not lead to the loss of the safety function and
that this fault, wherever practicable, should be detected.
E-Stop
37
133
Devices
Machinery Protection
Reset
Y2
R1 R2
Fig. 39: The normally closed contact of the final control element is monitored by the
feedback loop Y1/Y2
Y1
Y1
E-Stop
Y2
38
134
Devices
Machinery Protection
Reset
Y2
R1 R2
Fig. 40: The normally closed contacts of the final control elements R1 and R2 are
monitored by the feedback loop Y1/Y2
R2
Y1
Y1
E-Stop
Y2
39
135
Devices
Machinery Protection
Reset
Y2
R1
Fig. 41: The normally closed contacts of the final control elements R1 and R2 are
monitored by the feedback loop Y1/Y2
5.3.4 Typical connections
L1
L2
L3
F0
Control Circuit
Fuses Q1
Main
Isolator
T1
Control
Transformer
40
Fuses F1
136
F0 K1M
Devices
Machinery Protection
F21
Thermal
Overload
S1
Emergency
Stop F2
Thermal
Overload
S2 Relay
Stop
S3 K1M
Start
M
K1M
Direct-on-line
Starter
L2
L3
F0
Control Circuit
Fuses Q1
Main
Isolator
T1
Control
Transformer
41
F0 Fuses F1
Control Circuit 137
fuse
K1M
Devices
Machinery Protection
Main Contactor
S1 F21
Emergency Thermal
Stop Overload
S2
Stop
F2
S3 Thermal
K1M Overload
Start
Relay
K1M
A1 13
Y1
PNOZ X7
S4
Reset
Y2
A2 14
M
K1M
Direct-on-line
Starter
Fig. 43: Simplified E-Stop circuit for category 2 (Pilz PNOZ X7)
L1
L2
L3
F0
Control Circuit
Fuses Q1
Main
T1 Isolator
Control
Transformer
Fuses F1
42 F0
Control Circuit
fuse K1M
138 Contactor
F2
Thermal
Devices
Machinery Protection
Overload
S2
Stop
S1 K2M
Emergency Contactor
Stop S3 K1M K2M
Start
F2
K1M Thermal
A1 T11 T12 T22 13 33 Overload
T33 Relay
K2M Reset
PNOZ 1
T34
A2 14 34
K1M K2M
M
Direct-on-line
Starter
L2
L3
F0
Control Circuit
Fuses Q1
Main
T1 Isolator
Control
Transformer
Fuses F1
F0
Control Circuit
43
fuse K1M
Contactor 139
F2
Thermal
Devices
Machinery Protection
Overload
S2
Stop
K2M
S1
Contactor
Emergency
Stop S3 K1M K2M
Start
F2
K1M Thermal
A1 S21 S22 S31 S32 13 33 Overload
S33 Relay
K2M Reset
PNOZ X3
S34
A2 14 34
K1M K2M
M
Direct-on-line
Starter
Fig. 45: Simplified E-Stop circuit for category 4 (Pilz PNOZ X3)
24V
Monitored dump valves
E-Stop P P
V1 V2
1
1
3 3 2
2
24V 2
44 3
1 2 3
140 0V
Devices
Machinery Protection
0V
Fig. 46: Pilz E-Stop relay used with Norgren monitored dump valves
5.4 Two-hand controls
Devices
Machinery Protection
The hazard present
The risk assessment
The experience of the technology used
Other factors, such as the prevention of accidental
actuation and wilful defeat.
EN 574 (Safety of machinery. Two-hand controls) defines 3 types of
two-hand controls, setting out the minimum measures of safety for
each device, as shown in the table below:
Requirements Types
I II III
A B C
Use of both hands (simultaneous actuation) X X X X X
Relationship between input signals and output signal X X X X X
Cessation of the output signal X X X X X
Prevention of accidental operation X X X X X
Prevention of defeat X X X X X
Re-initiation of the output signal X X X X
46 Synchronous actuation X X X
142 Use of category 1 (EN 954-1: 1996) X X
Use of category 3 (EN 954-1: 1996) X X
Devices
Machinery Protection
Operators shall use both hands during the same time period;
this is simultaneous action and is independent of any time
lag between the two input signals
The two activating signals shall initiate and maintain the
output as long as both signals are present
The release of one or both activating signals will stop the
output
The risk of accidental operation shall be minimised
Prevention of accidental operation or prevention of defeat
shall be mainly achieved via mechanics and ergonomics
It shall only be possible to reinitiate the output signal after
both inputs have been released
The output signal may only appear when both inputs are
activated within 0.5 seconds of each other. If the inputs are
not actuated synchronously, the output will be prevented
until the inputs are re-applied within this time scale. This is
called synchronous actuation.
In the case of failure, the parts of the two-hand control device shall
behave in accordance with EN 954-1.
Devices
Machinery Protection
PLC
Output supply
Outputs
Input supply
Y1
P2HZ X1
Y2
Enable
machine
movement
NB. Please refer to Pilz Safety Catalogue (1) for relay details.
5.4.2 Programmable electronic systems (PES) for two-hand
control
There is still a considerable amount of development to be done into
the ways in which programmable electronic systems can be validated
for use in safety systems. However, where such systems are being
used to achieve the functional characteristics of a two-hand control,
the hardware and software shall be validated in accordance with the
risk assessment and the PES guidelines from the HSE (please refer
to Chapter 6, Programmable Safety Systems).
It is clear, however, that EN 574 requires that the output signal for
Types IIIB and IIIC two-hand controls should not be generated solely
48 by a single-channel programmable electronic system.
144
Devices
Machinery Protection