PNOZsigma Appl Manual 1002430-En-05

Safety relays PNOZsigma
Application examples for project configuration –

safety relays PNOZsigma
Application Manual – October 2011 edition

Why does Pilz offer more?
Because the integrality

of our business activities
is what sets us apart.
Pilz is a solution supplier for all automation

functions. Including standard control func-
tions. Developments from Pilz protect man, Exclusion of liability
machine and the environment. That’s why
all our experience and knowledge goes into Our application manual has been compiled
individual products as well as consistently with great care. It contains information
sophisticated system solutions. about our company and our products. All
statements are made in accordance with the
• Sensor technology current status of technology and to the best
• Control technology of our know-ledge and belief. However, we
• Networks cannot except liability for the accuracy and
• Drive technology entirety of the information provided, except
• Operator and visualisation systems in the case of gross negligence. In particular
• Software it should be noted that statements do not
• Consulting and engineering have the legal quality of assurances or assu-
• Training red properties. We are grateful for any feed-
Pilz is a family business back on the contents.
Appropriate services relating to individual that’s closer to its customers Support –
components and independent generic Technical help round the clock!
services guarantee that our customers obtain Pilz has a tradition as a family-run company October 2011
customised automation solutions, all from one stretching back 60 years. Real proximity to Technical support is available from Pilz round
source. customers is visible in all areas, instilling the clock. This service is provided free of All rights to this publication are reserved by
confidence through individual consultation, charge beyond standard business hours. Pilz GmbH & Co. KG. We reserve the right to
You can find more details about Pilz and flexibility and reliable service. amend specifications without prior notice.
your products and services on the Inter- You can reach our Copies may be made for the user’s internal
net: We are your contact, guide and competency international hotline on: purposes. The names of products, goods
leader en route to an optimum automation and technologies used in this manual are
• www.pilz.com solution. • +49 711 3409-444 trademarks of the respective companies.
Safe Automation
Solution supplier for safety and standard
Pilz offers a universal concept for solutions Sensor technology, used in conjunction
Your requirements: Our solution: Supplementary
that can be applied right across industry. product ranges: with Pilz safe control technology, offers a
Whether you need safety or standard control coordinated, complete solution that's
functions, machine or plant, centralised or economical, approved and safe. The focus
decentralised, a single product or a total is always on the protection of man and
solution: With Pilz you will definitely find a machine, in compliance with the standards
solution for your automation function. PMD electronic and regulations.
monitoring relays
Are you looking for a flexible solution for Drive technology provides overall solutions
your automation functions? Sensor technology for automating your machinery. From
controller operation through to movement
• PMD: Electronic monitoring relays such of highly dynamic drives, including all safety
as voltage or true power monitors, for aspects.
PNOZ safety relays
example.
Operator and visualisation systems
• PNOZ: Safety relays for simple plant and provide diagnostic and visualisation devices,
machinery with up to 4 safety functions. Drive technology plus control and signal devices as part of
Safe monitoring of E-STOPs, safety gates the Pilz solution. The focus is always on fast,
and light curtains/light grids, for example. simple configuration. Machine downtimes
PNOZmulti configurable are clearly reduced thanks to the overall
control system
• PNOZmulti: The safety circuit is created diagnostic concept PVIS.
using a simple configuration tool.
Applicable from 4 safety functions. Software includes system software, user
Operator and software and software tools. Here you'll find
• PSS: Programmable control systems for visualisation systems the right tool for every task. From product-
use on complex machinery or distributed related software to diagnostic software,
plants, to monitor safety-related PSS programmable Software di configurazione
per la famiglia di sistemi PMI®
Licenza completa
Numero d‘ordine: 310 400
Software de configuración
para la familia de sistemas PMI®
Licencia completa
Número de pedido: 310 400
Logiciel de configuration
through to the PAScal Safety Calculator.
control systems
pour la gamme PMI®
Licence complète
functions and/or for complete machine

Référence : 310 400
PNOZmulti
PMI-PRO
Configurator
Configuration software CD-ROM Version100

Baugruppennummer: 5.50 SP7
544-17 CD-ROM Version 6.0.0
for the PMI®-Range © Pilz GmbH & Co. KG, 2008
English/Deutsch/Français/ Deutsch/English
Full licence Español/Italiano PVIS OPC Tools 1.4.0
Order Number: 310 400
Konfigurationssoftware
für die Systemfamilie PMI®
Vollizenz
control. Services in the field of machinery safety

Bestellnummer: 310400
Software are covered holistically by Pilz. From risk

• Industrial communication: Transfer input/ assessment through to ESPE inspection.
output signals and control data reliably Pilz also offers a comprehensive range of
and safely. training courses and seminars, covering
Industrial
communication networks Services generic issues relating to machinery safety
as well as Pilz products.
Contents
Standards and Directives 1.0
Standards and Directives 1.1
Application Examples 2.0
Emergency Stop Applications 2.1
Safety Gate Applications 2.2
ESPE Applications 2.3
Two-hand Applications 2.4
Further Applications 2.5
Service 3.0
Pre-sales, after sales, Your partner for practical traning, 3.0
3.1
Business terms and conditions
3.1
4.6
5.1
Standards and Directives
Contents Page

European directives and position of the standards in Europe 1.1-2
Risk assessment 1.1-4 1.1
Legal regulations outside Europe 1.1-5
and standards for functional safety
Safety-related parts of control systems – 1.1-6
General principles for design in accordance with EN ISO 13849-1
Functional safety and legal position of EN/IEC 61508 1.1-8
Functional safety in accordance with EN/IEC 62061 1.1-9
Risk parameters and categories in accordance with EN 954-1/EN ISO 13849-1 1.1-11
Pilz GmbH & Co. KG, Felix-Wankel-Straße 2, 73760 Ostfildern, Germany, Telephone: +49 711 3409-0, Telefax: +49 711 3409-133, E-Mail: pilz.gmbh@pilz.de 2008-09
1.1-1
European directives and position of the standards in Europe
Incorporation of the directives into domestic law (using Germany as an example)
European directives nied by a declar-ation of conformity. With a Key engineering directives: • Low voltage equipment (2006/95/EC)
declaration of conformity the manufacturer • Personal protective equipment (89/686/EEC)
The concept of a single European internal confirms that his product meets all the re- • General product safety (2001/95/EC) • Cable cars (2000/9/EC)
1.1
market in terms of the “New Approach” can quirements of the European directives that • Health and safety (89/391/EEC)
be traced right back to the start of the 70s: relate to his product. This means he can • Use of work equipment (89/655/EEC) The directives are addressed to member sta-
The low voltage directive is the first piece of launch and sell his product within the scope • Lifts (95/16/EC) tes, who are obliged to incorporate the Euro-
European legislation to take into account the of the EU without consideration of any natio- • Waste electrical and electronic equipment pean directives into domestic law. In Germany
approach towards harmonisation of a com- nal regulations. (2002/96/EC) this is normally achieved through the device
mon single market. • Electromagnetic compatibility (EMC) safety law.
(2004/108/EC)
Products that are covered by one or more • Devices for use in potentially explosive
of the following directives have to apply a areas (ATEX) (94/9/EC)
CE-mark, i.e. the product must be accompa- • Machinery (98/37/EC) / (2006/42/EC)
1.1-2
European directives and position of the standards in Europe
1.1
A standards have priority over all others EN ISO 12100 Safety of machinery
and deal with essential safety require- EN 1050 Risk assessment
ments for machinery
A
B1 standards deal with aspects EN 954-1 Safety-related parts
of safety EN 574 Two-hand controls
B2 standards deal with safety
devices
B1, B2 EN 418 Emergency stop equipment
C standards deal with EN 12415 Turning machines
C
specific types or groups EN 422 Blow moulding machi
of maschinery EN 692 Mech. presses
Standards pyramid
Position of the standards in Europe do not regularly have to be adapted to the directives. The regulatory authorities would in the Official Journal of the EU (e.g. on the
state of technology; member states can use therefore need to prove that a manufacturer Internet). Standards in Europe are subdivided
The legal position of standards is discussed their own legal system for incorporation and did not meet the legal requirements. into what are termed A, B and C standards.
again and again. Inside Europe, i.e. within manufacturers are free to select the ways in
the scope of the European directives that which they implement the requirements of However, should a manufacturer deviate
are subject to the CE-marking obligation, the directive. from the harmonised standards, he himself
a manufacturer is not bound by standards must prove how he has met the essential sa-
or other specifications. He simply needs to So what are the benefits of applying the fety require-ments. This is generally done via
comply with the health and safety require- standards? With so-called harmonised a hazard analysis. In practice one would en-
ments of the directive(s). The associated standards with presumption of conformity, deavour to apply the harmonised standards,
benefits of a division between standards and there is a shifting of the burden of proof, i.e. unless the products concerned are highly
legislation are obvious: It is easier for legis- if manufacturers apply these standards, it innovative and no harmonised standards
lators to agree on the essential requirements is presumed that they will also comply with yet exist. The standards for which this “pre-
than on technical details. Also, the directives the specific requirements of the European sumption effect” applies can be researched
1.1-3
Risk assessment
Risk assessment
Under the terms of the machinery directive,

a machine manufacturer must assess the ha-
zards in order to identify all the hazards that Start
apply to his machine. He must then design
and construct the machine to take account
of his assessment. This requirement also ap- Determination of the
limits of the machine Lifecycles, limits application area,
plies to operators who act as manufacturers training level, other groups of people,
etc.
under the terms of the machinery directive.
For example, this may occur with machines Hazard identification
Annex A of EN 1050
that are interlinked or for machinery that has Risk analysis point 4, EN 292-1
been upgraded and substantially modified. etc.
Risk assessment
Risk estimation
EN ISO 14121-1 contains “Principles for Extent, probability, group of people,
human factors, reliability of the safety
risk assessment” on machinery. These ap- function, possibility of defeat, etc.
proaches can be called upon as part of a Risk evaluation
comprehensive analysis. EN ISO 13849-1 ex-
pands on EN ISO 14121-1 with regard to the Hazard removed?
assessment of safety-related parts of control Is the Yes Protective measures appropriate?
User information sufficient?
machinery End
systems. safe?
No
The hazards emanating from a machine may
be many and varied, so for example, it is Risk reduction
necessary to consider not just mechanical 1.1
hazards through crushing and shearing, but
also thermal and electrical hazards and ha-
zards from radiation. Risk reduction is there-
fore an iterative process, i.e. it is carried out
before and during the planning phase and Iterative process in accordance with EN ISO 14121-1
after completion of the plant or machine.
1.1-4
Legal regulations outside Europe and standards for functional safety
Legal regulations outside Europe tain certification process. Machinery and any control systems. Irrespective of the techno-
corresponding technical accessories under- logy, this applies for the whole chain from
The situation is somewhat different in the USA: go a type approval test through a European the sensor to the actuator. The risk graphs
people there are mainly familiar with two types notified body, for example. This test is gene- and corresponding risk parameters can be
of standards: ANSI (American National Stan- rally recognised by a Russian-based appro- used to estimate the potential risk for danger 1.1
dards Institute) and OSHA (Occupational Safe- vals body. From the point of view of safety, zones on machinery. The category is then
ty and Health Administration). the same requirements apply as in Europe. established without the use of risk-reducing
measures.
OSHA standards are published by the state China, on the other hand, has introduced
and compliance is mandatory. ANSI stan- CCC certification. Similar to the position in
dards, on the other hand, are developed by Russia, technical products are subject to
private organisations and their application is mandatory certification through a national ap-
generally not absolutely essential. However, provals body in China. In addition, production
ANSI standards can still be found included sites are inspected. If a technical device falls
as part of a contract. Beyond that ANSI with the scope of the product list, which is
standards are being taken over by OSHA. subdivided into 19 categories, certification is
You can also still come across the NFPA mandatory, otherwise it will be necessary to
(National Fire Protection Association), which supply a type of “declaration of no objection”
developed NFPA 79 as a counterpart to EN from a national notified body.
60204-1, for example. The OSHA standards
can be compared with the European direc- Japan is currently in a transition period: The
tives. Unlike the European directives, OSHA plan is for Japan to adopt the European “new
standards are more involved with formulating approach” – in other words, to keep stan-
technical specifications than abstract re- dards and legislation separate. At the mo-
quirements. ment the international ISO and IEC standards
are being directly incorporated into national
The legal basis in the USA can be seen as a legislation, which is why people are currently
mix of product standards, fire codes (NFPA), confronted with frequent amendments to
electrical codes (NEC) and national laws. Lo- laws and lengthy implementation periods.
cal government bodies have the authority to
monitor that these codes are being enforced Standards for functional safety
and implemented.
Different standards may be called upon to
Russia and the CIS states have implemented observe functional safety on control sy-
GOST-R certification for some years now, in stems, depending on the application. In the
other words, technical devices that fall within area of machine safety, EN ISO 13849-1 is
a specific product area must undergo a cer- the main standard named for safety-related
1.1-5
Safety-related parts of control systems –
Determination of the required Performance Level (PL r)

Low risk
Required Performance Level PLr

S Severity of injury
S1 = Slight (normally reversible injury)
S2 = Serious (normally irreversible injury, including death)
F Frequency and/or exposure to a hazard

F1 = Seldom to less often and/or the exposure time is short
F2 = Frequent to continuous and/or the exposure time is long
Starting point
P Possibility of avoiding the hazard or limiting the harm for evaluation
P1 = Possible under specific conditions of safety
P2 = Scarcely possible functions
contribution to
risk reduction High risk
Safety-related parts of control systems Components/devices require the following Risk assessment in accordance with EN Parameters S, F and P are used on the risk
– General principles for design in accor- safety parameters: ISO 13849-1 graph to determine the required performance
dance with EN ISO 13849-1 level (PLr) for a safety function. The selection
• Category (structural requirement) Risk assessment is an iterative process, i.e. it of parameters is no different to the procedure
As the successor standard to EN 954-1, • PL: Performance level will need to be carried out more than once. The used in EN 954-1 (1996). However, the result 1.1
EN ISO 13849-1 is based on the familiar ca- • MTTFd: Mean time to dangerous failure risk must be estimated and the performance is no longer a category but a PL.
tegories. Equally, it examines complete safety • DC: Diagnostic coverage level defined for each hazard on which the risk
functions, including all the components in- • CCF: Common cause failure is to be reduced through control measures.
volved in their design. EN ISO 13849-1 goes The risk is estimated through consideration
beyond the qualitative approach of EN 954-1 The standard describes how to calculate of the severity of injury (S), the frequency and
to include a quantitative assessment of the the performance level (PL) for safety-related duration of exposure to the hazard (F) and the
safety functions. A performance level (PL) is parts of control systems, based on designa- possibility of avoiding or limiting the harm (P).
used for this, building upon the categories. ted architectures. EN ISO 13849-1 refers any
deviations to IEC 61508.
1.1-6
Safety-related parts of control systems –
Performance Levels (PL) Probability of a

in accordance with EN ISO 13849-1 dangerous failure
per hour [1/h]
a 10-5 < PFH < 10-4 1.1
b 3 x 10 < PFH < 10 111
-6 -5
c 11110-6 < PFH < 3 x 10-6

d 10-7 < PFH < 10-6
e 10-8 < PFH < 10-7
Performance level examined. A com-ponent’s MTTFD value is

usually provided by the manufacturer. The
The performance level (PL) classifies 5 levels standard provides tables and check lists for
of probability of failure. The table shows the calculating the other values.
relationship between PL and the probability Relationship between categories DC, MTTFd and PL
of dangerous failure per hour PFHD). It is also possible to calculate the achieved PFH/h-1
PL of an SRP/CL. The probability of dange-
Once the required PL has been established, rous failure of all the blocks that combine to 10-4
the PL achieved by the safety function (SRP/ form the safety function is added up: a
Performance Level
CL) is calcu-lated. To do this the SRP/CL can 10-5
be divided into logical blocks, such as input, PFHSystem =
b 3 years
logic solving and output for example. PFHInput + PFHLogic + PFHOutput
3 x 10-6
The PL achieved by an SRP/CL must be at c
Logic least as high as the PL required by the safety 10 years
Input solving Output 10-6
function.
If this condition is not met, the safety func- d 30 years
When using a designated architecture or an tion must be implemented differently. 10-7
architecture of similar structure, the achieved 100
e MTTFoc = low, MTTFoc = medium, MTTFoc = high years
PL can be calculated graphically using the
bar chart. To do this the architecture of the 10-8
Cat. B Cat. 1 Cat. 2 Cat. 2 Cat. 3 Cat. 3 Cat. 4
SRP/CL in divided into categories. MTTFD DCavg DCavg DCavg DCavg DCavg DCavg DCavg
and DCavg are also required. From Category = none = none = low = med. = low = med. = high
2 onwards, the CCF will also need to be
1.1-7
Functional safety and legal position of EN/IEC 61508
Functional safety with EN/IEC 61508? What is the legal status of EN/IEC 61508?
Machinery sector Medical sector
EN/IEC 61508 is regarded as a generic safe- As EN/IEC 61508 is not listed in the Official
ty standard, which deals with the functional Journal of the European Communities for im-
safety of electrical, electronic and program- plementation as a European directive, it lacks
mable electronic systems, irrespective of the the so-called “effect of presumption”, so if the IEC61
620
application. standard is used on its own, a control system IEC04
623
designer cannot presume that the relevant re-
One of the main tasks of EN/IEC 61508 is quirements of the specific European directive
to serve as a basis for the development of have been met.
application-oriented standards. Standards’
committees are currently busy in the areas
of machine safety with EN/IEC 62061, and
process safety with EN/EC 61511. IEC08
615
These sector-specific standards are intended
Transport sector
to continue the principle approaches of EN/
IEC 61508 and to implement the requirements
for the relevant application area in a suitably
practical manner.
IEC11
615 IEC13
615
1.1
Process sector Power station sector
Sector standards from EN/IEC 61508
1.1-8
Functional safety in accordance with EN/IEC 62061
Risk assessment and determination of required Safety Integrity Level (SIL)
Class Cl Frequency Probability of hzd. Avoidance

Consequences S 3-4 5-7 8-10 11-13 14-15 and duration Fr event Pr P 1.1
Death, losing an eye 4 SIL 2 SIL 2 SIL 2 SIL 3 SIL 3 £ 1 hour 5 Very high 5
or arm
Permanent, 3 OM SIL 1 SIL 2 SIL 3 > 1 h £ 1 day 5 Likely 4
losing fingers
Reversible, 2 OM SIL 1 SIL 2 > 1 day £ 2 wks 4 Possible 3 Impossible 5
medical attention
Reversible, first aid 1 OM SIL 1 > 2 wks £ 1 year 3 Rarely 2 Possible 3
> 1 year 2 Negligible 1 Likely 1
AM = Other measures recommended
Functional safety of safety-related elec- Risk estimation is an iterative process, i.e. it The required SIL is assigned using the table
trical, electronic and programmable elec- will need to be carried out more than once. above, where Cl = Fr + Pr + Av.
tronic control systems in accordance with The risk must be estimated and the SIL de-
EN/IEC 62061 fined for each hazard on which the risk is to
be reduced through control measures. The
EN/IEC 62061 represents a sector-specific risk is estimated through consideration of
standard under EN/IEC 61508. It describes the severity of injury (Se), the frequency and
the implementation of safety-related electrical duration of exposure to the hazard (Fr), pro-
control systems on machinery and examines bability of occurrence of a hazardous event
the overall lifecycle from the concept phase (Pr) and the possibility of avoiding or limiting
through to decommissioning. Quantitative the harm (Av).
and qualitative examinations of the safety
functions form the basis.
1.1-9
Functional safety in accordance with EN/IEC 62061
The following parameters are required in

Safety Integrity Level (SIL) Probability of a assessing hardware safety integrity:
in accordance with EN IEC 62061 dangerous failure
per hour [1/h] λD: Dangerous failure rate
No special safety requirement 10-5 < PFH < 10-4 T1: Proof test
T2: Diagnostic test interval
1 (1 failure in 100 000 h) 3 x 10-6 < PFH < 10-5111
DC: Diagnostic coverage
1 (1 failure in 100 000 h) 11110-6 < PFH < 3 x 10-6 β: Common cause failure
2 (1 failure in 1 000 000 h) 10-7 < PFH < 10-6
The calculated probability of failure (PFHD) of
3 (1 failure in 10 000 000 h) 10-8 < PFH < 10-7 each SRECS must be less than the probabi-
lity of failure required by the safety function.
The required probability of failure, depending
on the SIL, can be taken from the table. If
SIL assignment Requirements for hardware safety integrity, this condition is not met, the safety function
comprising must be implemented differently.
The safety integrity level (SIL) classifies three
levels of probability of failure. The table • Architectural constraints for hardware The achieved SIL can only be as high as the
shows the relationship between SIL and the safety integrity lowest SILCL (SIL Claim Limit) of a sub-
probability of dangerous failure per hour • Requirements for the probability of system involved in performing the safety
(PFHD). dangerous random hardware failures function.
The SRECS (safety-related electrical control plus requirements for systematic safety inte-
system) is divided into subsystems. The sub- grity, comprising
systems are assigned to actual devices. The
SIL must be defined for each subsystem. • Requirements for avoidance of failures and
1.1
• Requirements for the control of Safe failure Hardware fault Hardware fault Hardware fault
The probability of a dangerous failure is cal- systematic failures. fraction (SFF) tolerance tolerance tolerance
culated by adding the probabilities of failure 0 1 2
of all the subsystems of the SRECS:
< 60 % Not allowed SIL 1 SIL 2
PFHD = PFHD1 + .... + PFHDn 60 % < 90 % SIL 1 SIL 2 SIL 3
The selection or design of the SRECS must 90 % < 99 % SIL 2 SIL 3 SIL 3
always meet the following minimum require- 99 % SIL 3 SIL 3 SIL 3
ments:
1.1-10
Risk parameters and categories in accordance with EN 954-1/EN ISO 13849-11)
Risk parameters Category B be designed so that their safety function(s) are Category 3
checked at suitable intervals by the machine
S = Severity of injury: Basic category with no special requirements control system. The safety function(s) must Safety-related parts of control systems must
1 = Slight (normally reversible) injury = “good industrial standard” be checked: at the machine start-up and prior be designed so that a single fault in any of
2 = Serious (normally irreversible) injury, in- to the initiation of any hazardous situation; these parts does not lead to the loss of the 1.1
cluding death Category 1 periodically during operation, if the risk as- safety function.
sessment and the kind of operation show that Whenever reasonably practicable, the single
F = Frequency and/or exposure to the hazard: Safety-related parts must be designed and it is necessary. fault shall be detected at or before the next
1 = Seldom to quite often and/or exposure constructed using well-tried components and demand upon the safety function.
time is short well-tried safety principles. This check may be initiated automatically
2 = Frequent to continuous and/or exposure or manually. Automatically, for example, the This does not mean that all faults will be de-
time is long Well-tried means: the components have been check may be initiated by a signal generated tected. The accumulation of undetected faults
widely used in the past with successful results from a control system at suitable intervals. can lead to an unintended output signal and a
P = Possibility of avoiding the hazard: in similar applications, or they have been ma- The automatic test should be provided by hazardous situation at the machine.
1 = Possible under specific conditions nufactured using principles that demonstrate preference. The decision about the type of
2 = Scarcely possible its suitability and reliability for safety-related test depends on the risk assessment and Category 4
appli-cations. the judgement of the end user or machine
builder. If no fault is detected, operation may Safety-related parts of control systems must
Starting point for
Example: safety switch with forced-opening be approved as a result of the test. If a fault be designed so that a single fault in any of
risk estimation
Categories contacts. is detected, an output must be generated to these parts does not lead to a loss of the
initiate appropriate control action. A second, safety function; the single fault must be de-
Well-tried safety principles are circuits that are independent shutdown route is required for tected at or before the next demand upon the
Categories
constructed in such a way that certain faults this. safety functions (e.g. immediately at switch
can be avoided by the appropriate arrange- Notes: In some cases Category 2 is not ap- on, at the end of a machine operating cycle).
ment or layout of components. plicable because the checking of the safety If this detection is not possible, then an ac-
function cannot be applied to all components cumulation of faults shall not lead to a loss of
Example: avoiding a short circuit through ap- and devices. Moreover, the cost involved the safety function.
propriate separation, avoiding component fai- in implementing Category 2 correctly may
1)
Only applicable until November 2009.
lures that result from overdimensioning, using be considerable, so that it may make better Replaced by EN ISO 13849-1
the failsafe principle (on switching off). economic sense to implement a different ca-
Risk graph from EN 954 tegory.
Note: The occurrence of a fault can lead to In general Category 2 can be realised with
the loss of the safety function. electronic techniques. The system behaviour
Categories in accordance with EN 954-1 allows the occurrence of a fault to lead to the
Category 2 loss of the safety function between checks;
The control system requirements derived from the loss of the safety function is detected by
the risk graph are specified as follows: Safety-related parts of control systems must the check.
1.1-11
Emergency Stop Applications
Contents Page
Emergency stop applications

PNOZ s3 – Dual-channel operation,
contact expansion through contactor PL d of EN ISO 13849-1,
SIL 2 of EN 62061 2.1-2
contact expansion through PZE X4.1P PL e of EN ISO 13849-1,
SIL 3 of EN 62061 2.1-5
2.1
contact expansion through contactor PL e of EN ISO 13849-1,
SIL 3 of EN 62061 2.1-8
PNOZ s5 – Safe standstill of one drive PL e of EN ISO 13849-1,
SIL 3 of EN 62061 2.1-11
PNOZ s5 – Safe standstill of two drives PL e of EN ISO 13849-1,
SIL 3 of EN 62061 2.1-14
PNOZ s5 – Combined with two PNOZ s7 PL e of EN ISO 13849-1,
SIL 3 of EN 62061 2.1-19
PNOZ s7 – Combined with PNOZ s4 PL e of EN ISO 13849-1,
SIL 3 of EN 62061 2.1-23
PNOZ s9 – Combined with PNOZ s4,
safe standstill of one drive PL e of EN ISO 13849-1,
SIL 3 of EN 62061 2.1-26
PNOZ s10 – Combined with PNOZ s4 PL e of EN ISO 13849-1,
SIL 3 of EN 62061 2.1-29
Pilz GmbH & Co. KG, Felix-Wankel-Straße 2, 73760 Ostfildern, Germany, Telephone: +49 711 3409-0, Telefax: +49 711 3409-133, E-Mail: pilz.gmbh@pilz.de 2011-10 2.1-1
PL d of EN ISO 13849-1, SIL 2 of EN 62061
PNOZ s3 - Dual-channel operation, contact expansion through contactor
Feedback loop Pilz products

Features The positive-guided N/C contacts on
contactors KM1 and KM2 are monitored in Number Designation Order number
 Dual-channel operation feedback loop S12-S34 of safety relay 1 PNOZ s3 750 103
 Monitored reset with falling edge PNOZ s3 (K1). 1 PITestop Set1.1 400 410
 Contact expansion through positive-
guided contactors Safety assessment
 Feedback loop to monitor contact ex-  The safety relay K1 and contactors KM1
pansion and KM2 must bei installed in a single
mounting area (control cabinet) in order
to exclude a short across the output.
Description  Earth fault in the input circuit is detected.
 A fault on the device does not lead to the
E-STOP function loss of the safety function.
When the E-STOP pushbutton S1 is  The safety relay PNOZ s3 (K1) can be
operated, the input circuit on the safety started when the input circuit at K1 is
relay PNOZ s3 (K1) is interrupted, the safety closed first, followed by reset button S2.
contacts on K1 open. Contactors KM1 and This avoids an unwanted reset before the
KM2 de-energise. input circuit is closed or as a result of the
reset button being overridden. 2.1
Settings on the unit  If the position of the operating mode
 The terminator on the PNOZ s3 (K1) must selector switch (mode) is changed during
be connected. operation, an error message will be
 The operating mode selector switch triggered; the safety contacts on K1
(mode) on the safety relay PNOZ s3 (K1) open. This fault condition can only be
must be set to “Monitored reset, falling rectified by switching the supply voltage
edge without detection of shorts across on the safety relay PNOZ s3 (K1) off and
contacts (In2+)”. then on again.
Start/reset
The safety relay PNOZ s3 (K1) can be
started by pressing reset button S2 if:
 E-STOP pushbutton S1 has not been
operated and
 Contactors KM1 and KM2 have de-
energised.
5.1-
PL d of EN ISO 13849-1, SIL 2 of EN 62061
Safety-related characteristics in EN ISO 13849-1 Performance Level Safety-r elated parts

Safety-related
accordance with EN ISO 13849-1 of the contr ol system
control
Safety function: Machine shut down PL d Sensor (PITestop S1)
Prerequisites:
via E-STOP Logic (PNOZ s3)
 Common cause failure (CCF): Actuator (contactors KM1, KM2)
Requirements are considered to be met
(must be tested on implementation) Please note the further requirements of EN ISO 13849-1, e.g. requirements for avoiding systematic faults.
 Mission time: 20 years
 Operating interval (electromechanical
components): 2.1
- Sensor: One operation per week
- Actuator: One operation per week
 Characteristic data of contactors KM1/KM2:
B10d: 2,000,000
Safety-related characteristics in EN 62061 Safety Subsystems

accordance with EN 62061 Integrity Level
Safety-related Machine shut down SIL 2 Sensor (PITestop S1)
Prerequisites:
control function via E-STOP Logic (PNOZ s3)
 Common cause failure (CCF): ß = 2 % (SRCF): Actuator (contactors KM1, KM2)
(must be tested on implementation)
 Proof test interval: 20 years Please note the further requirements of EN 62061, e.g. requirements for systematic safety integrity.
components):
B10d: 2,000,000
Dangerous failure rate: 65%
Classification in accordance with EN 954-1
Depending on the application area and its

respective regulations, this connection example
is suitable for applications up to Category 3 of
EN 954-1.

9$&
9'& 9'&
/
/
/
) )
: 6 9'&
2(/)/(; &$
VWDUW
[TPP
UHVHW

6 .0 .0
(VWRS
:
2(/)/(;

[TPP
.0 .0
.
; ; ; ; ; ;
$ 6 6 6 6 6
3RZHU ,Q ,Q
,Q $ $
,Q .
312=69'& 2XW
5HVHW PRGH
$ )DXOW <
; ;
3(6&+
$
3/&
; 3(
,
2.1
8 9 :
$ $
312=DFWLYH .0 .0 0
0
$ $ a
9'& 9'&
3,/=
312=69'&

5HYLVLRQ 'DWH 0RXQWLQJSODFH

(1,623/G 3LO]*PE+ &R.* (PHUJHQF\VWRSH[WHQVLRQFRQWDFW 312=VB
1DPH 5'6 1DPH :('
)HOL[:DQNHO6WU E\FRQWDFWRUDQGPRQLWRUHGVWDUW
(16,/ 2VWILOGHUQ 3DJH
'HS &6
PL e of EN ISO 13849-1, SIL 3 of EN 62061
PNOZ s3 - Dual-channel operation, contact expansion through PZE X4.1P
Start/reset  If the position of the operating mode

Features The safety relay PNOZ s3 (K5) can be selector switch (mode) is changed during
started by pressing reset button S6 if: operation, an error message will be
 Dual-channel operation with  E-STOP pushbutton S5 has not been triggered; the safety contacts on K5
detection of shorts across contacts operated and open. This fault condition can only be
 Monitored reset with falling edge  Feedback loop Y1/Y2 on contact rectified by switching the supply voltage
 Contact expansion through PZE X4.1P expander module PZE X4.1P (K6) is on the safety relay PNOZ s3 (K5) off and
(contact expander module) closed and then on again.
 Feedback loop to monitor contact ex-  Contactors KM1 and KM2 have de-
pansion energised. 2.1
Pilz products
Feedback loop
Description The feedback loop on the safety relay PNOZ Number Designation Order number
s3 (K5) is connected to the feedback loop 1 PNOZ s3 750 103
E-STOP function on the contact expander module 1 PZE X4.1P 777 587
When the E-STOP pushbutton S5 is PZE X4.1P (K6). 1 PITestop Set1.1 400 410
operated, the input circuit on the safety The positive-guided N/C contacts on
relay PNOZ s3 (K5) is interrupted, the safety contactors KM1 and KM2 are monitored in
contacts on K5 open. As a result the input feedback loop S12-S34 of safety relay
circuit on the contact expander module PZE PNOZ s3 (K5).
X4.1P (K6) is interrupted, the safety
contacts on K6 open. Safety assessment
 The safety relay K1 and the contactors
Settings on the unit KM1 and KM2 must be installed in a
 The terminator on the PNOZ s3 (K5) must single mounting area (control cabinet) in
be connected. order to exclude a short across the
 The operating mode selector switch output.
(mode) on the safety relay PNOZ s3 (K5)  Earth faults and shorts between contacts
must be set to “Monitored reset, falling in the input circuit are detected.
edge with detection of shorts across  A fault on the device does not lead to the
contacts (In2-)”. loss of the safety function.
 The safety relay PNOZ s3 (K5) can be
started when the input circuit at K5 is
closed first, followed by reset button S6.
This avoids an unwanted reset before the
input circuit is closed or as a result of the
reset button being overridden.
PNOZ s3 - Dual-channel operation, contact expansion through PZE X4.1P

Safety-related
control
Safety function: Machine shut down PL e Sensor (PITestop S5)
Prerequisites:
 Common cause failure (CCF): Logic (PZE X4.1P)
Requirements are considered to be met Actuator (contactors KM1, KM2)
 Mission time: 20 years Please note the further requirements of EN ISO 13849-1, e.g. requirements for avoiding systematic faults.
components):
B10d: 2,000,000

Prerequisites:
 Common cause failure (CCF): ß = 2 % (SRCF): Logic (PZE X4.1P) 2.1
(must be tested on implementation) Actuator (contactors KM1, KM2)
 Proof test interval: 20 years
 Operating interval (electromechanical Please note the further requirements of EN 62061, e.g. requirements for systematic safety integrity.
components):
B10d: 2,000,000

EN 954-1.
5.1-

9$&
9'& 9'&
/
/
/

6
: VWDUW
) )
2(/)/(; UHVHW 9'&
[TPP &$

.0
6
(VWRS
.0

: .0
2(/)/(;
[TPP
<
. .0

<
. .

.
.
; ; ; ; ; ;
$

6

6

6

6

6
$ 8 . .
2.1
32:(5
3RZHU ,Q ,Q $
,Q $ $ 9 &+
,Q $
&+
3=(;3 .
312=69'&
2XW 9'&
5HVHW PRGH $
$ )DXOW <
; ;
3(6&+
$
3/&
; 3(
,
8 9 :
$ $
312=DFWLYH .0 .0 0
0
$ $ a
9'& 9'&
3,/= 3,/=
312=69'& 3=(;39'&

< <

(1,623/H 3LO]*PE+ &R.* (PHUJHQF\VWRSH[WHQVLRQFRQWDFW 312=VB
1DPH 5'6 1DPH :('
)HOL[:DQNHO6WU E\3=(;3DQGPRQLWRUHGVWDUW
'HS &6

Features The positive-guided N/C contacts on
contactors KM1 and KM2 are monitored in Number Designation Order number
 Dual-channel operation with feedback loop S12-S34 of safety relay 1 PNOZ s4 750 104
detection of shorts across contacts PNOZ s4 (K1). 1 PITestop Set1.1 400 410
 Monitored reset with falling edge
 Contact expansion through positive- Safety assessment
guided contactors  The safety relay PNOZ s4 (K1) and
 Feedback loop to monitor contact ex- contactors KM1 and KM2 must be
pansion installed in a single mounting area
(control cabinet) in order to exclude a
short across the output.
Description  Earth faults and shorts between contacts
in the input circuit are detected.
E-STOP function  A fault on the device does not lead to the
When the E-STOP pushbutton S1 is loss of the safety function.
operated, the input circuit on the safety  The safety relay PNOZ s4 (K1) can be
relay PNOZ s4 (K1) is interrupted, the safety started when the input circuit at K1 is
contacts on K1 open. Contactors KM1 and closed first, followed by reset button S2.
KM2 de-energise. This avoids an unwanted reset before the 2.1
Settings on the unit reset button being overridden.
 The terminator on the PNOZ s4 (K1) must  If the position of the operating mode
be connected. selector switch (mode) is changed during
 The operating mode selector switch operation, an error message will be
(mode) on the safety relay PNOZ s4 (K1) triggered; the safety contacts on K1
must be set to “Monitored reset, falling open. This fault condition can only be
edge with detection of shorts across rectified by switching the supply voltage
contacts (In2-)”. on the safety relay PNOZ s4 (K1) off and
then on again.
Start/reset
operated and
 Contactors KM1 and KM2 have de-
energised.
5.1-

Safety-related
control
Prerequisites:
components): 2.1
B10d: 2,000,000

Prerequisites:
 Common cause failure (CCF): ß = 2 % (SRCF): Actuator (contactors KM1, KM2)
components):
B10d: 2,000,000

EN 954-1.

9$&
9'& 9'&
/
/
/

) )
: 9'&
6 &$
2(/)/(;
VWDUW
[TPP
UHVHW

.0
6 .0
(VWRS
:
2(/)/(;

[TPP .0
.0

.
; ; ; ; ; ;
$ 6 6 6 6 6
3RZHU ,Q ,Q
,Q $ $
,Q .
312=69'& 2XW
5HVHW PRGH
$ )DXOW <
; ;
3(6&+
$
3/&
; 3(
,
2.1
8 9 :
$ $
312=DFWLYH .0 .0 0
0
$ $ a
9'& 9'&
3,/=
312=69'&


1DPH 5'6 1DPH :('
)HOL[:DQNHO6WU E\FRQWDFWRUDQGPRQLWRUHGVWDUW
'HS &6
PNOZ s5 - Safe standstill of one drive
Settings on the unit  A fault on the device does not lead to the  If the position of the operating mode
Features  The terminator on the PNOZ s5 (K1) must loss of the safety function. selector switch (mode) or the rotary
be connected.  The safety relay PNOZ s5 (K1) can be switch for the time setting is changed
 Dual-channel operation with detection  The operating mode selector switch started when the input circuit at K1 is during operation, an error message will
of shorts across contacts (mode) on the safety relay PNOZ s5 (K1) closed first, followed by reset button S2. be triggered; the safety contacts on K1
 Monitored reset with falling edge must be set to “Monitored reset, falling This avoids an unwanted reset before the open. This fault condition can only be
 Safe standstill of one drive after E- edge with detection of shorts across input circuit is closed or as a result of the rectified by switching the supply voltage
STOP contacts (In2-)”. reset button being overridden. on the safety relay PNOZ s5 (K1) off and
 Contact expansion through positive-  The delay time on the safety relay PNOZ  The delay time set for the safety relay then on again.
guided contactors s5 (K1) is set using the time selector PNOZ s5 (K1) must be longer than the 2.1
 Feedback loop to monitor contact ex- switch t[s] and the factor selector switch maximum braking time on the drive
pansion n. regulator A1.
 Stop category 1 in accordance with  The time delay must not be able to cause
EN 60204-1 Start/reset an additional hazard.
Description  E-STOP pushbutton S1 has not been Pilz products
operated and
E-STOP function  Contactors KM1 and KM2 have de- Number Designation Order number
When the E-STOP pushbutton S1 is energised. 1 PNOZ s5 750 105
operated, both the drive and the supply to 1 PITestop Set1.1 400 410
the drive are shut down after a delay time. Feedback loop
When the E-STOP pushbutton S1 is The positive-guided N/C contacts on
operated, the input circuit on the safety contactors KM1 and KM2 are monitored in
relay PNOZ s5 (K1) is interrupted, safety feedback loop S12-S34 of safety relay
contact 13-14 on K1 opens immediately and PNOZ s5 (K1).
triggers a “fast stop” at the drive controller
A1. Safety assessment
The delay-on de-energisation safety contact  The safety relay (K1) and contactors KM1
37-38 switches off contactors KM1and KM2 and KM2 must be installed in a single
after a delay. In this way, the drive controller mounting area (control cabinet) in order
A1 is isolated from the energy supply to exclude a short across the output.
(mains) after a delay. The delay-on de-  Earth faults and shorts between contacts
energisation time is set on the safety relay in the input circuit are detected.
PNOZ s5 (K1).
PNOZ s5 - Safe standstill of one drive

Safety-related
control
Prerequisites:
components):
B10d: 2,000,000

Prerequisites:
 Common cause failure (CCF): ß = 2 % (SRCF): Actuator (contactors KM1, KM2) 2.1
components):
B10d: 2,000,000

EN 954-1.
5.1-

9$&
9'& 9'&
/
/
/

: ) )
6 9'&
2(/)/(;
VWDUW &$
[TPP
UHVHW

6 .0
(VWRS
.0

:
2(/)/(;

[TPP
.0

.0

$ 8 9 :

.
. .

; ; ; ; ; ;
$

6

6

6

6

6

TXLFN
2.1
VWRS
3RZHU ,Q ,Q

,Q $ $
,Q
312=69'& 2XW
5HVHW PRGH WV Q 8 9 :
$ )DXOW <
; ;
3(6&+
$
3/&
; 3(
,
8 9 :
$ $
312=DFWLYH .0 .0 0
0
$ $ a
9'& 9'&
3,/=
312=69'&


(1,623/H 3LO]*PE+ &R.* 6DIHVWRSSLQJRIDGULYH 312=VB
1DPH 5'6 1DPH :('
)HOL[:DQNHO6WU E\HPHQUJHQF\VWRS
'HS &6
PNOZ s5 - Safe standstill of two drives
de-energisation time is set on the safety  the feedback loop on safety relay PNOZ
Features relay PNOZ s5 (K2). As a result the input s9 (K3) is closed.
circuit on safety relay PNOZ s9 (K3) is
 Dual-channel operation with detection interrupted, the safety contacts on K3 Feedback loop
of shorts across contacts switch off after a delay. The delay-on de- The positive-guided N/C contacts on
 Monitored reset with falling edge energisation contact 17-18 on K3 switches contactors KM3, KM4, KM5 and KM6 are
 Safe standstill of two drives after E- off contactors KM5 and KM6 after a delay. monitored in feedback loop S12-S34 of
STOP In this way, the drive controller A3 is isolated safety relay PNOZ s5 (K2). The feedback
 Contact expansion through positive- from the energy supply (mains) after a delay. loop on the safety relay PNOZ s5 (K2) is
guided contactors The delay-on de-energisation time is set on connected to the feedback loop on the
 Feedback loop to monitor contact ex- the safety relay PNOZ s9 (K3). safety relay PNOZ s9 (K3).
pansion
 Stop category 1 in accordance with Settings on the unit
EN 60204-1  The connector between the safety relays Pilz products
PNOZ s5 (K2) and PNOZ s9 (K3) must be
connected. Number Designation Order number
Description  The operating mode selector switch 1 PNOZ s5 750 105
Both drive controllers A2 and A3 have (mode) on the safety relay PNOZ s5 (K2) 1 PNOZ s9 750 109
different braking times, so it must be must be set to “Monitored reset, falling 1 PITestop Set1.1 400 410
possible to separate them from the mains edge with detection of shorts across 2.1
independently in terms of time. contacts (In2-)“.
 The delay time on the safety relays
E-STOP function PNOZ s5 (K2) and PNOZ s9 (K3) is set
When the E-STOP pushbutton S3 is using the time selector switch t[s] and the
operated, both the drives and the supply to factor selector switch n.
the drives are shut down after a delay time.  The operating mode selector switch
When the E-STOP pushbutton S3 is (mode) on the safety relay PNOZ s9 (K3)
operated, the input circuit on the safety must be set to “Delay-on de-
relay PNOZ s5 (K2) is interrupted, safety energisation, not retriggerable”.
contacts 13-14 and 23-24 on K2 open
immediately and trigger a “fast stop” at both Start/reset
the drive controllers A2 and A3. The safety relay PNOZ s5 (K2) can be
The delay-on de-energisation safety contact started by pressing reset button S4 if:
37-38 on K2 switches off contactors KM3  E-STOP pushbutton S3 has not been
and KM4 after a delay. In this way, the drive operated and
controller A2 is isolated from the energy  Contactors KM3, KM4, KM5 and KM6
supply (mains) after a delay. The delay-on have dropped out and
5.1-
Safety assessment  If the position of the operating mode

 The safety relays PNOZ s5 (K2), PNOZ s9 selector switch (mode) at K3 or the rotary
(K3) and contactors KM3, KM4, KM5 and switch for the time settings is changed
KM6 must be installed in a single during operation, an error message will
mounting area (control cabinet) in order be triggered; the safety contacts on K3
to exclude a short across the output. open. This fault condition can only be
 Earth faults and shorts between contacts rectified by switching the supply voltage
in the input circuit are detected. on the safety relay PNOZ s9 (K3) off and
 A fault on the device does not lead to the then on again.
loss of the safety function. 2.1
 The safety relays PNOZ s5 (K2) and
PNOZ s9 (K3) can be started when the
input circuit at K2 is closed first, followed
by reset button S4. This avoids an
unwanted reset before the input circuit is
closed or as a result of the reset button
being overridden.
 The delay time set for the safety relay
PNOZ s5 (K2) must be longer than the
maximum braking time on the drive
regulator A2. The delay time set for the
safety relay PNOZ s9 (K3) must be longer
than the maximum braking time on the
drive regulator A3.
 The time delay must not be able to cause
an additional hazard.
 If the position of the operating mode
selector switch (mode) at K2 or the rotary
switch for the time setting is changed
during operation, an error message will
be triggered; the safety contacts on K2
and K3 open. This fault condition can
only be rectified by switching the supply
voltage on the safety relay PNOZ s5 (K2)
off and then on again.

Safety-related
control
Safety function 1: Machine shut down PL e Sensor (PITestop S1)
Prerequisites:
Logic (PNOZ s9)
 Operating interval (electromechanical Actuator (contactors KM5, KM6)
components):
- Sensor: One operation per week Please note the further requirements of EN ISO 13849-1, e.g. requirements for avoiding systematic faults.
 Characteristic data of contactors KM3/KM4/
KM5/KM6:
B10d: 2,000,000

Prerequisites: 2.1
control function 1 via E-STOP Logic (PNOZ s5)
 Common cause failure (CCF): ß = 2 %
(SRCF1): Actuator (contactors KM3, KM4)
(SRCF2): Logic (PNOZ s9)
components): Actuator (contactors KM5, KM6)
- Actuator: One operation per week Please note the further requirements of EN 62061, e.g. requirements for systematic safety integrity.
 Characteristic data of contactors KM3/KM4/
KM5/KM6:
B10d: 2,000,000

EN 954-1.
5.1-

9'& 9'&

6
VWDUW
UHVHW
:
2(/)/(; .0
[TPP

.0
6
(VWRS
:
2(/)/(; .0
[TPP

.0

.
.
;
$
;
6
;
6
;
6
;
6
;
6
;
$
;
6
;
6

2.1
3RZHU WLPH
3RZHU ,Q ,Q

,Q
,Q $ $
,Q
,Q
312=6 312=69'& 2XW
2XW
9'& 5HVHW
5HVHW PRGH WV Q PRGH WV Q
)DXOW
$ )DXOW < $
; ; ;
$
3/&
,
312=DFWLYH
9'& 9'&
3,/= 3,/=
312=69'& 312=69'&


(1,623/H 3LO]*PE+ &R.* 6DIHVWRSSLQJRIWZRGULYHV 312=VB
1DPH 1DPH :('
)HOL[:DQNHO6WU E\HPHUJHQF\VWRS
'HS &6

9$& 9$&
9'& 9'& 9'& 9'&
/ /
/ /
/ /
) ) ) )

9'& 9'&
&$ &$

.0 .0

.0 .0

$ 8 9 : $ 8 9 :

. . . .

TXLFN TXLFN
VWRS VWRS
8 9 : 8 9 :
3(6&+ 3(6&+
; 3( ; 3(
2.1
8 9 : 8 9 :
$ $ $ $
.0 .0 0
0 .0 .0 0
0
$ $ a $ $ a
9'& 9'& 9'& 9'&


(1,623/H 3LO]*PE+ &R.* 6DIHVWRSSLQJRIWZRGULYHV 312=VB
1DPH 5'6 1DPH :('
)HOL[:DQNHO6WU E\HPHUJHQF\VWRS
'HS &6
PNOZ s5 - Combined with two PNOZ s7
Settings on the unit Safety assessment  If the position of the operating mode
Features  The connector between the safety relays  The safety relays K4, K5, K6 and the selector switch (mode) or the rotary
PNOZ s5 (K4) and PNOZ s7 (K5) must be contactors KM1 and KM2 must be switch for the time setting is changed
 Dual-channel operation with detection connected. installed in a single mounting area during operation, an error message will
of shorts across contacts  The terminator on the PNOZ s7 (K6) must (control cabinet) in order to exclude a be triggered; the safety contacts on K4
 Monitored reset with falling edge be connected. short across the output. open. This fault condition can only be
 Contact expansion through two  The operating mode selector switch  Earth faults and shorts between contacts rectified by switching the supply voltage
PNOZ s7 (mode) on the safety relay PNOZ s5 (K4) in the input circuit are detected. on the safety relay PNOZ s5 (K4) off and
 Contact expansion through positive- must be set to “Monitored reset, falling  A fault on the device does not lead to the then on again.
guided contactors edge with detection of shorts across loss of the safety function. 2.1
 Feedback loop to monitor contact ex- contacts (In2-)”.  The safety relays PNOZ s5 (K4), PNOZ s7
pansion  On the safety relay PNOZ s5 (K4), the (K5) and PNOZ s7 (K6) can be started
 No delayed safety contacts (time selec- time selector switch t[s] must be set to when the input circuit at K4 is closed
tor switch t[s] set to “0”) “0” and the factor selector switch n to first, followed by reset button S6. This
“1”. avoids an unwanted reset before the
Description Start/reset reset button being overridden.
E-STOP function started by pressing reset button S6 if:
When the E-STOP pushbutton S5 is  E-STOP pushbutton S5 has not been Pilz products
operated, the input circuit on the safety operated and
relay PNOZ s5 (K4) is interrupted, the safety  Safety relay PNOZ s7 (K6) has de- Number Designation Order number
contacts on K4 open. As a result the input energised and 1 PNOZ s5 750 105
circuit on the contact expander module  the feedback loop on contact expander 2 PNOZ s7 750 107
PNOZ s7 (K5) is interrupted, the safety module K5 is closed and 1 PITestop Set1.1 400 410
contacts on K5 open. As a result the supply  Contactors KM1 and KM2 have de-
voltage on the contact expander module energised.
PNOZ s7 (K6) is interrupted, the safety
contacts on K6 open. Feedback loop
As the time selector switch t[s] is set to 0, all The positive-guided N/C contact on the
the safety contacts on the safety relay safety relay PNOZ s7 (K6) and the positive-
PNOZ s5 (K4) switch off immediately. guided N/C contacts on contactors KM1
und KM2 are monitored in feedback loop
S12-S34 of safety relay PNOZ s5 (K4).
PNOZ s5 - Combined with two PNOZ s7

Safety-related
control
Prerequisites:
 Common cause failure (CCF): Logic (PNOZ s7)
Requirements are considered to be met Logic (PNOZ s7)
 Operating interval (electromechanical Please note the further requirements of EN ISO 13849-1, e.g. requirements for avoiding systematic faults.
components):
B10d: 2,000,000

Prerequisites:
 Common cause failure (CCF): ß = 2 % (SRCF): Logic (PNOZ s7) 2.1
(must be tested on implementation) Logic (PNOZ s7)
 Proof test interval: 20 years Actuator (contactors KM1, KM2)
components): Please note the further requirements of EN 62061, e.g. requirements for systematic safety integrity.
B10d: 2,000,000

EN 954-1.
5.1-

9'& 9'&

6 )
: VWDUW 9'&
2(/)/(; UHVHW &$
[TPP

.

6
(VWRS
: .0 .
2(/)/(;
[TPP

.0

.
.
.
; ; ; ; ; ; ; ;
$

6

6

6

6

6

$

$

2.1
3RZHU ,Q ,Q
,Q ,Q
,Q $ $
,Q ,Q
,Q
312=69'& 312=69'& 2XW 312=69'& 2XW
2XW
5HVHW PRGH WV Q
)DXOW )DXOW
$ )DXOW < $ $
; ; ; ;
$
3/&
,
312=DFWLYH
9'& 9'&
3,/= 3,/= 3,/=

312=69'& 312=69'& 312=69'&


1DPH 5'6 1DPH :('
)HOL[:DQNHO6WU E\WZR312=VDQGPRQLWRUHGVWDUW
'HS &6

9$&
9'& 9'&
/
/
/
) )
9'&
&$

.0

.0

.

3(6&+
; 3(
2.1
8 9 :
$ $
.0 .0 0
0
$ $ a
9'& 9'&


1DPH 5'6 1DPH 5'6
)HOL[:DQNHO6WU E\WZR312=VDQGPRQLWRUHGVWDUW
'HS &6
PNOZ s7 - Combined with PNOZ s4
Start/reset unwanted reset before the input circuit is

Features The safety relay PNOZ s4 (K4) can be closed or as a result of the reset button
started by pressing reset button S4 if: being overridden.
 Dual-channel operation with  E-STOP pushbutton S3 has not been  If the position of the operating mode
detection of shorts across contacts operated and selector switch (mode) is changed during
 Monitored reset with falling edge  The safety contacts on the contact operation, an error message will be
 Contact expansion through PNOZ s7 expander module PNOZ s7 (K5) are open triggered; the safety contacts on K4
(contact expander module) and positi-  Contactors KM1 and KM2 have de- open. This fault condition can only be
ve-guided contactors energised and rectified by switching the supply voltage
 Feedback loop to monitor contact ex-  The feedback loop on the contact on the safety relay PNOZ s4 (K4) off and 2.1
pansion expander module PNOZ s7 (K5) is then on again.
closed.
Description Feedback loop Pilz products

The positive-guided N/C contacts on
E-STOP function contactors KM1 and KM2 are monitored in Number Designation Order number
When the E-STOP pushbutton S3 is feedback loop S12-S34 of safety relay 1 PNOZ s4 750 104
operated, the input circuit on the safety PNOZ s4 (K4). 1 PNOZ s7 750 107
relay PNOZ s4 (K4) is interrupted, the safety The feedback loop on the safety relay PNOZ 1 PITestop Set1.1 400 410
contacts on K4 open. As a result the input s4 (K4) is connected to the feedback loop
circuit on the contact expander module on the contact expander module
PNOZ s7 (K5) is interrupted, the safety PNOZ s7 (K5).
contacts on K5 open. Contactors KM1 and
KM2 de-energise. Safety assessment
 The safety relays K4 and K5 and
Settings on the unit contactors KM1 and KM2 must be
 The connector between the safety relays installed in a single mounting area
PNOZ s4 (K4) and PNOZ s7 (K5) must be (control cabinet) in order to exclude a
connected. short across the output.
 The operating mode selector switch  Earth faults and shorts between contacts
(mode) on the safety relay PNOZ s4 must in the input circuit are detected.
be set to “Monitored reset, falling edge  A fault on the device does not lead to the
with detection of shorts across contacts loss of the safety function.
(In2-)”.  The safety relays PNOZ s4 (K4) and
by reset button S4. This avoids an

Safety-related
control
Prerequisites:
components):
B10d: 2,000,000

Prerequisites:
components):
B10d: 2,000,000

EN 954-1.
5.1-

9$&
9'& 9'&
/
/
/

) )
: 9'&
6 &$
2(/)/(;
VWDUW
[TPP
UHVHW

.0
6 .0
(VWRS
:
2(/)/(;

[TPP .0
.0

.
.
; ; ; ; ; ; ;
$

6

6

6

6

6

$

2.1
3RZHU ,Q ,Q
,Q
,Q $ $
,Q
,Q
2XW
.
312=69'& 2XW 312=69'&
5HVHW PRGH
)DXOW
$ )DXOW < $
; ; ;
3(6&+
$
3/&
; 3(
,
8 9 :
$ $
312=DFWLYH .0 .0 0
0
$ $ a
9'& 9'&
3,/= 3,/=
312=69'& 312=69'&


1DPH 5'6 1DPH :('
)HOL[:DQNHO6WU E\312=VDQGFRQWDFWRU
(16,/ 2VWILOGHUQ
PRQLWRUHGVWDUW 3DJH
'HS &6
PNOZ s9 - Combined with PNOZ s4 - safe standstill of one drive
Settings on the unit Safety assessment  The delay time set for the safety relay
Features  The connector between the safety relays  The safety relays PNOZ s4 (K11) and PNOZ s9 (K12) must be longer than the
PNOZ s4 (K11) and PNOZ s9 (K12) must PNOZ s9 (K12) and contactors KM1 and maximum braking time on the drive
 Dual-channel operation with detection be connected. KM2 must be installed in a single regulator A1.
of shorts across contacts  The operating mode selector switch mounting area (control cabinet) in order  The time delay must not be able to cause
 Monitored reset with falling edge (mode) on the safety relay PNOZ s4 (K11) to exclude a short across the output. an additional hazard.
 Safe standstill of one drive after E- must be set to “Monitored reset, falling  Earth faults and shorts between contacts  If the position of the operating mode
STOP edge with detection of shorts across in the input circuit are detected. selector switch (mode) or the rotary
 Contact expansion through positive- contacts (In2-)“.  A fault on the device does not lead to the switch for the time setting is changed
guided contactors  The operating mode selector switch loss of the safety function. during operation, an error message will
 Feedback loop to monitor contact ex- (mode) on the safety relay PNOZ s9 (K12)  The safety relays PNOZ s4 (K11) and be triggered; the safety contacts on K11 /
pansion must be set to “Delay-on de- PNOZ s9 (K12) can be started when the K12 open. This fault condition can only
 Stop category 1 in accordance with energisation, not retriggerable”. input circuit at K11 is closed first, be rectified by switching the supply
EN 60204-1  The delay time on the safety relay PNOZ followed by reset button S10. This avoids voltage on the safety relay PNOZ s4 (K11)
s9 (K12) is set using the time selector an unwanted reset before the input circuit / PNOZ s9 (K12) off and then on again.
switch t[s] and the factor selector switch is closed or as a result of the reset button
Description n. being overridden.
E-STOP function Start/reset

When the E-STOP pushbutton S9 is The safety relay PNOZ s4 (K11) can be Pilz products 2.1
operated, both the drive and the supply to started by pressing reset button S10 if:
the drive are shut down after a delay time.  E-STOP pushbutton S9 has not been Number Designation Order number
When the E-STOP pushbutton S9 is operated and 1 PNOZ s4 750 104
operated, the input circuit on the safety  Contactors KM1 and KM2 have de- 1 PNOZ s9 750 109
relay PNOZ s4 (K11) is interrupted, safety energised 1 PITestop Set1.1 400 410
contact 14 on K11 opens immediately and and
triggers a “fast stop” at the drive controller  The feedback loop on safety relay PNOZ
A1. s9 (K12) is closed.
As a result the input circuit on safety relay
PNOZ s9 (K12) is interrupted and the delay- Feedback loop
on de-energisation safety contacts on K12 The positive-guided N/C contacts on
switch off contactors KM1 and KM2 after a contactors KM1 and KM2 are monitored in
delay. In this way, the drive controller A1 is feedback loop S12-S34 of safety relay K11.
isolated from the energy supply (mains) after The feedback loop on the safety relay PNOZ
a delay. The delay-on de-energisation time s4 (K11) is connected to the feedback loop
is set on the safety relay PNOZ s9 (K12). on the contact expander module
PNOZ s9 (K12).
5.1-
PNOZ s9 - Combined with PNOZ s4 - safe standstill of one drive

Safety-related
control
Prerequisites:
components): 2.1
B10d: 2,000,000

Prerequisites:
 Common cause failure (CCF): ß = 2 % (SRCF): Logic (PNOZ s9)
components):
B10d: 2,000,000

EN 954-1.

9$&
9'& 9'&
/
/
/

6 ) )
: VWDUW 9'&
2(/)/(; UHVHW &$
[TPP

.0
.0
6
(VWRS
:
2(/)/(; .0
[TPP . . .0

$ 8 9 :
.
.
; ; ; ; ; ; ; ; ;
TXLFN
$ 6 6 6 6 6 $ 6 6 VWRS
3RZHU WLPH
3RZHU ,Q ,Q

,Q
,Q $ $
,Q
,Q
312=69'& 312=69'& 2XW
2XW
5HVHW 8 9 :
5HVHW PRGH PRGH WV Q
)DXOW
$ )DXOW < $
; ; ;
3(6&+
$
3/&
; 3(
,
2.1
8 9 :
$ $
312=DFWLYH .0 .0 0
0
$ $ a
9'& 9'&
3,/= 3,/=
312=69'& 312=69'&


(1,623/H 3LO]*PE+ &R.* 6DIHVWRSSLQJRIDGULYH 312=VB
1DPH 5'6 1DPH :('
)HOL[:DQNHO6WU E\HPHQUJHQF\VWRS
'HS &6
Start/reset being overridden.

Features The safety relay PNOZ s4 (K1) can be  If the position of the operating mode
started by pressing reset button S2 if: selector switch (mode) is changed during
 Dual-channel operation with  E-STOP pushbutton S1 has not been operation, an error message will be
detection of shorts across contacts operated and triggered; the safety contacts on K1
 Monitored reset with falling edge  Contactors KM1 and KM2 have de- open. This fault condition can only be
 Contact expansion through PNOZ s10 energised and rectified by switching the supply voltage
(contact expander module)  the feedback loop on the contact on the safety relay PNOZ s4 (K1) off and
 Feedback loop to monitor contact ex- expander module PNOZ s10 (K2) is then on again.
pansion closed. 2.1
Feedback loop
Description The positive-guided N/C contacts on Pilz products
contactors KM1 and KM2 are monitored in
E-STOP function feedback loop S12-S34 of safety relay Number Designation Order number
When the E-STOP pushbutton S1 is PNOZ s4 (K1). 1 PNOZ s4 750 104
operated, the input circuit on the safety The feedback loop on the safety relay PNOZ 1 PNOZ s10 750 110
relay PNOZ s4 (K1) is interrupted, the safety s4 (K1) is connected to the feedback loop 1 PITestop Set1.1 400 410
contacts on K1 open. As a result the input on the contact expander module
circuit on the contact expander module PNOZ s10 (K2).
PNOZ s10 (K2) is interrupted, the safety
contacts on K2 open. Safety assessment
 The safety relays PNOZ s4 (K1) and
Settings on the unit PNOZ s9 (K2) and the contactors KM1
 The connector between the safety relays and KM2 must be installed in a single
PNOZ s4 (K1) and PNOZ s10 (K2) must mounting area (control cabinet) in order
be connected. to exclude a short across the output.
 The operating mode selector switch  Earth faults and shorts between contacts
(mode) on the safety relay PNOZ s4 must in the input circuit are detected.
be set to “Monitored reset, falling edge  A fault on the device does not lead to the
with detection of shorts across contacts loss of the safety function.
(In2-)“.  The safety relays PNOZ s4 (K1) and
by the reset button S2. This avoids an
unwanted reset before the input circuit is
closed or as a result of the reset button

Safety-related
control
Prerequisites:
components):
B10d: 2,000,000

Prerequisites:
components):
B10d: 2,000,000

EN 954-1.
5.1-

9$&
9'& 9'&
/
/
/
) )
: 6 9'&
2(/)/(; VWDUW &$
[TPP UHVHW

.0
6 .0
(VWRS
:
2(/)/(;

[TPP .0
.0

.
.
; ; ; ; ; ; ;
$

6

6

6

6

6

$

2.1
3RZHU ,Q ,Q
,Q
,Q $ $
,Q
,Q
2XW
.
312=69'& 2XW 312=6
9'&
5HVHW PRGH
)DXOW
$ )DXOW < $
; ; ;
3(6&+
$
3/&
; 3(
,
8 9 :
$ $
312=DFWLYH .0 .0 0
0
$ $ a
9'& 9'&
3,/= 3,/=
312=69'& 312=69'&


1DPH 5'6 1DPH :('
)HOL[:DQNHO6WU E\312=VDQGPRQLWRUHGVWDUW
'HS &6
Safety Gate Applications
Contents Page
Safety gate applications

Safety switch PSEN cs2.1p PL e of EN ISO 13849-1,
SIL 3 of EN 62061 2.2-2
PNOZ s4 – Safety switch PSEN me2/2AS PL e of EN ISO 13849-1
SIL 3 of EN 62061 2.2-5
2.2
PNOZ s3 – Dual-channel operation, Safety switch PSEN cs2.1p
Start/reset  If the position of the operating mode

Features The safety relay PNOZ s3 (K2) can be selector switch (mode) is changed during
started by pressing reset button S4 if: operation, an error message will be
 Dual-channel operation with detection  The safety gate is closed and triggered; the safety contacts on K2
of shorts across contacts via safety  The semiconductor outputs on the safety open. This fault condition can only be
switch switch S3 are closed and rectified by switching the supply voltage
 Monitored reset with falling edge  Contactors K3 and K4 have de- on the safety relay K2 off and then on
 Contact expansion through positive- energised. again.
guided contactors
 Feedback loop to monitor contact ex- Feedback loop
pansion The positive-guided N/C contacts on Pilz products
contactors K3 and K4 are monitored in the
feedback loop S12-S34 of the safety relay Number Designation Order number
Description K2. 1 PNOZ s3 750 103
1 PSEN cs2.1p 540 100
Safety gate function Safety assessment
The opening and closing of a safety gate is  The safety relay K2 and contactors K3
signalled to the safety relay PNOZ s3 (K2) and K4 must be installed in a single 2.2
via the semiconductor outputs on the safety mounting area (control cabinet) in order
switch PSEN cs2.1p (S3). The to exclude a short across the output.
semiconductor outputs on safety switch S3  Earth faults and shorts between contacts
are opened as soon as the safety gate is in the input circuit are detected through
opened. As a result the input circuit on the the safety switch S3.
safety relay PNOZ s3 (K2) is interrupted and  A fault on the device does not lead to the
the safety contacts on the PNOZ s3 (K2) loss of the safety function.
open. Contactors K3 and K4 de-energise.  The safety relay PNOZ s3 (K2) can be
Settings on the unit closed first, followed by reset button S4.
 The terminator on the PNOZ s3 must be This avoids an unwanted reset before the
connected. input circuit is closed or as a result of the
 The operating mode selector switch reset button being overridden.
(mode) on the safety relay PNOZ s3 must  Increased protection against
be set to “Monitored reset, falling edge manipulation is required for hazardous
without detection of shorts across machinery such as presses. In this case
contacts (In2+)“. we recommend using two safety
switches per safety gate.
5.1-
PNOZ s3 – Dual-channel operation, Safety switch PSEN cs2.1p

Safety-related
control
Safety function: Machine shut down PL e Sensor (PSEN cs)
Prerequisites:
when a safety gate is opened Logic (PNOZ s3)
 Common cause failure (CCF): Actuator (contactors K3, K4)
components):
- Sensor: Two operations per hour
- Actuator: Two operations per hour
 Characteristic data of contactors K3/K4: 2.2
B10d: 2,000,000

Safety-related Machine shut down SIL 3 Sensor (PSEN cs)
Prerequisites:
control function when a safety gate is opened Logic (PNOZ s3)
 Common cause failure (CCF): ß = 2 % (SRCF): Actuator (contactors K3, K4)
components):
 Characteristic data of contactors K3/K4:
B10d: 2,000,000

EN 954-1.

9$&
9'& 9'&
/
/
/
) )
: 9'&
/L<&< EU ZV UV UW
[TPP &$
6
VWDUW
UHVHW .
6

.

3RZHU)DXOW
75$16321'(5
6DIHW\*DWH
.

,QSXW
.

36(1&63
.
36(1&6

; ; ; ; ; ;
: $ 6 6 6 6 6
/L<&< JQ JE JU EO
[TPP 3RZHU ,Q ,Q
,Q $ $
,Q .
312=69'& 2XW
5HVHW PRGH
$ )DXOW <
; ;
3(6&+
$ $
2.2
3/& 3/&
; 3(
, ,
8 9 :
$ $
VDIHW\JDWH 312=DFWLYH . . 0
0
$ $ a
9'& 9'&
3,/=
312=69'&


(1,623/H 3LO]*PE+ &R.* 6DIHW\JDWHZLWK36(1FVS 312=VB
1DPH 5'6 1DPH :('
)HOL[:DQNHO6WU DQGPRQLWRUHGVWDUWRI312=V
'HS &6
PNOZ s4 - Safety switch PSEN me2/2AS
Start/reset Pilz products

Features The safety relay PNOZ s4 (K9) can be
 Dual-channel operation with detection started by pressing reset button S13 if: Number Designation Order number
of shorts across contacts  The safety gate is closed and 1 PNOZ s4 750 104
 Safety gate switch with separate  The contacts on safety switches S11 and 2 PSEN me2/2AS 570 200
actuator S12 are closed and
 Monitored reset with falling edge  Contactors K10 and K11 have de-
 Contact expansion through positive- energised.
guided contactors
 Feedback loop to monitor contact ex- Feedback loop
pansion The positive-guided N/C contacts on
contactors K10 and K11 are monitored in
feedback loop S12-S34 of safety relay K9.
2.2
Description
Safety assessment
Safety gate function  The safety relay PNOZ s4 (K9) and
The opening and closing of a safety gate is contactors K10 and K11 must be
signalled to the safety relay PNOZ s4 (K9) installed in a single mounting area
via the contacts on the two safety switches (control cabinet) in order to exclude a
PSEN me2/2AS (S11, S12). short across the output.
The contacts on safety switches S11, S12  Earth faults and shorts between contacts
are opened as soon as the safety gate is in the input circuit are detected.
opened. As a result the input circuit on the  A fault on the device does not lead to the
safety relay PNOZ s4 (K9) is interrupted and loss of the safety function.
the safety contacts on K9 open. Contactors  If the position of the operating mode
K10 and K11 de-energise. selector switch (mode) is changed during
operation, an error message will be
Settings on the unit triggered; the safety contacts on K9
 The terminator on the PNOZ s4 must be open. This fault condition can only be
connected. rectified by switching the supply voltage
 The operating mode selector switch on the safety relay K9 off and then on
(mode) on the safety relay PNOZ s4 must again.
be set to “Monitored reset, falling edge
with detection of shorts across contacts
(In2-)“.
PNOZ s4 - Safety switch PSEN me2/2AS

Safety-related
control
Safety function: Machine shut down PL e Sensor (PSEN me S11, S12)
Prerequisites:
when a safety gate is opened Logic (PNOZ s4)
 Common cause failure (CCF): Actuator (contactors K10, K11)
components):
B10d: 2,000,000

2.2
Safety-related Machine shut down SIL 3 Sensor (PSEN me S11, S12)
Prerequisites:
control function when a safety gate is opened Logic (PNOZ s4)
 Common cause failure (CCF): ß = 2 % (SRCF): Actuator (contactors K10, K11)
components):
B10d: 2,000,000

EN 954-1.
5.1-

9$&
9'& 9'&
/
/
/
6 ) )

6 9'&
VWDUW &$
UHVHW

. .

36(10($6

. .

.
6

; ; ; ; ; ;
$ 6 6 6 6 6
3RZHU ,Q ,Q .

,Q $ $
36(10($6
312=69'&
,Q 2.2
2XW
5HVHW PRGH
$ )DXOW <
; ;
3(6&+
$
3/&
; 3(
,
8 9 :
$ $
312=DFWLYH . . 0
0
$ $ a
9'& 9'&
3,/=
312=69'&


(1,623/H 3LO]*PE+ &R.* 6DIHW\JDWHZLWKWZR36(1PH$6 312=VB
1DPH 5'6 1DPH :('
)HOL[:DQNHO6WU DQGPRQLWRUHGVWDUWRI312=V
'HS &6
ESPE Applications
Contents Page
ESPE applications
PNOZ s4 – PSEN op4H light curtain PL e of EN ISO 13849-1,
SIL 3 of EN 62061 2.3-2
2.3
1.3
ESPE Applications
PNOZ s4 - PSEN op4H light curtain
Settings on the unit  The safety relay PNOZ s4 (K2) can be  If the position of the operating mode
Features  The terminator on the PNOZ s4 must be started when the input circuit at K2 is selector switch (mode) is changed during
connected. closed first, followed by reset button S3. operation, an error message will be
 Dual-channel operation with detection  The operating mode selector switch This avoids an unwanted reset before the triggered; the safety contacts on K2
of shorts across contacts via light (mode) on the safety relay PNOZ s4 must input circuit is closed or as a result of the open. This fault condition can only be
curtain be set to “Monitored reset, falling edge reset button being overridden. rectified by switching the supply voltage
 Monitored reset with falling edge without detection of shorts across on the safety relay K2 off and then on
 Light curtain with semiconductor contacts (In2+)“. again.
output
 Contact expansion through positive- Start/reset
guided contactors The safety relay PNOZ s4 (K2) can be Pilz products
 Feedback loop to monitor contact ex- started by pressing reset button S3 if:
pansion  The light curtain is not interrupted and Number Designation Order number
 The semiconductor outputs on safety 1 PNOZ s4 750 104
light curtain B1/B2 are closed and 2.3
1 PSEN op4H-30-150 630 159
Description  Contactors K3 and K4 have de-
energised.
Light curtain function
The interruption of light curtain PSEN op4H Feedback loop
(B1/B2) is signalled to the safety relay PNOZ The positive-guided N/C contacts on
s4 (K2) via the two semiconductor outputs contactors K3 and K4 are monitored in
on receiver B2. feedback loop S12-S34 of the safety relay.
The semiconductor outputs on the safety
light curtain’s receiver B2 are opened as Safety assessment
soon as the light curtain is interrupted. As a  The safety relay PNOZ s4 (K2) and
result the input circuit on the safety relay contactors K3, K4 must be installed in a
PNOZ s4 (K2) is interrupted and the safety single mounting area (control cabinet) in
contacts open. Contactors K3 and K4 de- order to exclude a short across the
energise. output.
The top and bottom DIP switches on the  Earth faults and shorts between contacts
receiver B2 must be set at the same in the input circuit are detected via the
position. For the light curtain to reset light curtain.
automatically, number 4 on both DIP  A fault on the device does not lead to the
switches must be switched to ON. loss of the safety function.
 A single fault in the light curtain is
detected.
5.1-
ESPE Applications
PNOZ s4 - PSEN op4H light curtain

Safety-related
control
Safety function: Machine shut down PL e Sensor (PSEN op4H)
Prerequisites:
when the safety light curtain Logic (PNOZ s4)
 Common cause failure (CCF): is interrupted Actuator (contactors K3, K4)
components):
B10d: 2,000,000
2.3
Safety-related Machine shut down SIL 3 Sensor (PSEN op4H)
Prerequisites:
control function when the safety light curtain Logic (PNOZ s4)
 Common cause failure (CCF): ß = 2 % (SRCF): is interrupted Actuator (contactors K3, K4)
components):
- Actuator: Two operations per hour 1.3
B10d: 2,000,000
Classification in accordance with EN 954-1 2

EN 954-1.

9$&
9'& 9'&
/
/
/
% %
) )
9'& 9'&
9'&
&$

9 9 6
VWDUW
7HVW6WDUW UHVHW
QE .

QE 0XWLQJ .

0XWLQJ .

266' .

266'
.
/$03
6$)( +,*+$/,*1 ; ; ; ; ; ;
/2:$/,*1
21
$ 6 6 6 6 6
%5($.
3RZHU ,Q ,Q
32:(521 6$)(
,Q $ $

,Q .
3( 3( 312=69'& 2XW
5HVHW PRGH
36(1RS+

$

)DXOW <

2.3
; ;
6HQGHU (PSIlQJHU
3(6&+
$
3/&
; 3(
,
8 9 :
$ $
312=DFWLYH . . 0
0
$ $ a
3(
9'& 9'&
3,/=
312=69'&


(1,623/H 3LO]*PE+ &R.* (63(36(1RS+ 312=VB
1DPH 5'6 1DPH :('
)HOL[:DQNHO6WU ZLWKPRQLWRUHGVWDUWRI312=V
'HS &6
Two-hand Applications
Contents Page
Further applications
PNOZ s6 – Requirements in accordance with
EN 574 Type IIIC, Contact expansion
through contactors PL e of EN ISO 13849-1,
SIL 3 of EN 62061 2.4-2
PNOZ s6 – Requirements in accordance with
EN 574 Type IIIC, Contact expansion
through PNOZ s10 PL e of EN ISO 13849-1,
SIL 3 of EN 62061 2.4-6
PNOZ s6.1 – Requirements in accordance with
EN 574 Type IIIA PL b of EN ISO 13849-1 2.4-10
2.4
PNOZ s6 - Requirements in accordance with EN 574 Type IIIC, contact expansion through contactors
Start/reset Pilz products

Features The two-hand control device PNOZ s6 can
be started by operating pushbuttons S1 and Number Designation Order number
 Dual-channel operation with S2 simultaneously when contactors KM1 1 PNOZ s6 750 106
detection of shorts across contacts and KM2 have de-energised.
 Simultaneity monitoring
 Contact expansion through positive- Feedback loop
guided contactors The positive-guided N/C contacts on
 Feedback loop to monitor contact ex- contactors KM1 and KM2 are monitored in
pansion feedback loop S12-S34 of the two-hand
 Requirements in accordance with control device.
EN 574 Type IIIC 2.4
Safety assessment
Description  The two-hand control device PNOZ s6

(K1) and contactors KM1 and KM2 must
Function be installed in a single mounting area
The two-hand control device PNOZ s6 (K1) (control cabinet) in order to exclude a
is activated by operating both pushbuttons short across the output.
S1 and S2 simultaneously (simultaneity  Earth faults and shorts between contacts
max. 500 ms), the safety contacts on K1 in the input circuit are detected.
close. Contactors KM1 and KM2 energise.  A fault on the device does not lead to the
Releasing one or both pushputtons S1 / S2 loss of the safety function.
will interrupt the input circuit on the two-  The distance of both pushbuttons S1 and
hand control device K1, the safety contacts S2 from the nearest danger zone must be
at K1 open. Contactors KM1 and KM2 de- large enough that if one of the
energise. The safety contacts on the two- pushbuttons is released, the dangerous
hand control device PNOZ s6 (K1) will not movement is interrupted before the
reclose until both pushbuttons S1 and S2 operator can reach the danger zone or
have been released and then re-operated before the operator can reach into the
simultaneously. danger zone (see EN 999 „The
positioning of protective equipment in
Settings on the unit respect of approach speeds of parts of
The terminator on the PNOZ s6 must be the human body“).
connected.
5.1-

Safety-related
control
Safety function: Pushbuttons are operated simulta- PL e Sensor (pushbutton S1/S2)
Prerequisites:
neously with both hands, to keep the Logic (PNOZ s6)
 Common cause failure (CCF): operator away from the danger zone. Actuator (contactor KM1, KM2)
Requirements are considered to be met Hazardous movement is stopped by
(must be tested on implementation) releasing one or both pushbuttons;
 Mission time: 20 years reactivation is possible once both
 Operating interval (electromechanical pushbuttons are released.
components): Further requirements relevant to
- Sensor: 60 operations per hour two-hand circuits in accordance
- Actuator: 60 operations per hour with EN 574 Type IIIC.
 Characteristic data of pushbuttons S1/S2:
B10d: 20.000.000 Please note the further requirements of EN ISO 13849-1, e.g. requirements for avoiding systematic faults.
B10d: 2,000,000 (note oversizing)
2.4

Safety-related Pushbuttons are operated simulta- SIL 3 Sensor (pushbutton S1/S2)
Prerequisites:
control function neously with both hands, to keep the Logic (PNOZ s6)
 Common cause failure (CCF): ß = 2 % (SRCF): operator away from the danger zone. Actuator (contactor KM1, KM2)
(must be tested on implementation) Hazardous movement is stopped by
 Proof test interval: 20 years releasing one or both pushbuttons;
 Operating interval (electromechanical reactivation is possible once both
components): pushbuttons are released.
- Sensor: 60 operations per hour Further requirements relevant to
- Actuator: 60 operations per hour two-hand circuits in accordance
 Characteristic data of pushbuttons S1/S2: with EN 574 Type IIIC.
2.4
B10d: 20.000.000
Dangerous failure rate: 50 % Please note the further requirements of EN 62061, e.g. requirements for systematic safety integrity.
B10d: 2,000,000
Dangerous failure rate: 65% (note
oversizing)

EN 954-1.
5.1-

9$&
9'& 9'&
/
/
/
) )
9'&
&$
.0

6 6 .0
WZR WZR
KDQG KDQG .0

.0
.
; ; ; ; ; ;
$ 6 6 6 6 6
3RZHU
,Q
,Q .
312=69'& 2XW
5HVHW
$ )DXOW <
; ;
3(6&+
$ 2.4
3/&
; 3(
,
8 9 :
$ $
312=DFWLYH .0 .0 0
0
$ $ a
9'& 9'&
3,/=
312=69'&


(1,623/H 3LO]*PE+ &R.* 7ZRKDQGRSHUDWLRQ 312=VB
1DPH 5'6 1DPH :('
)HOL[:DQNHO6WU UHTXHVWW\SH,,,&(1
(16,/ 2VWILOGHUQ
H[WHQVLRQFRQWDFWE\FRQWDFWRUV 3DJH
'HS &6
PNOZ s6 - Requirements in accordance with EN 574 Type IIIC, contact expansion through PNOZ s10
Settings on the unit  The distance of both pushbuttons S3 and

Features The connector between the safety relays S4 from the nearest danger zone must be
PNOZ s6 (K2) and PNOZ s10 (K3) must be large enough that if one of the
 Dual-channel operation with connected. pushbuttons is released, the dangerous
detection of shorts across contacts movement is interrupted before the
 Simultaneity monitoring Start/reset operator can reach the danger zone or
 Contact expansion through PNOZ s10 The two-hand control device PNOZ s6 can before the operator can reach into the
(contact expander module) be started by operating pushbuttons S3 and danger zone (see EN 999 „The
 Feedback loop to monitor contact ex- S4 simultaneously when the feedback loop positioning of protective equipment in
pansion in the contact expander module PNOZ s10 respect of approach speeds of parts of
 Meets requirements in accordance (K3) is closed and contactors KM1 and KM2 the human body“).
with EN 574 Type IIIC have de-energised. 2.4
The feedback loop on the safety relay PNOZ
Description s6 (K2) is connected to the feedback loop Number Designation Order number
on the contact expander module 1 PNOZ s6 750 106
Function PNOZ s10 (K3). 1 PNOZ s10 750 110
The two-hand control device PNOZ s6 (K2) The positive-guided N/C contacts on
is activated by operating both pushbuttons contactors KM1 and KM2 are monitored in
S3 and S4 simultaneously (simultaneity feedback loop S12-S34 of the two-hand
max. 500 ms), the safety contacts on K2 control device.
close. The contact expander module PNOZ
s10 (K3) is started. Safety assessment
Releasing one or both pushputtons S3 / S4
will interrupt the input circuit on the two-  The two-hand control devices PNOZ s6
hand control device K2, the safety contacts (K2), PNOZ s10 (K3) and contactors KM3
at K2 open. The contact expander module and KM4 must be installed in a single
K3 shuts down. The safety contacts on the mounting area (control cabinet) in order
two-hand control device PNOZ s6 (K2) will to exclude a short across the output.
not reclose until both pushbuttons S3 and  Earth faults and shorts between contacts
S4 have been released and then re- in the input circuit are detected.
operated simultaneously.  A fault on the device does not lead to the
loss of the safety function.
5.1-

Safety-related
control
Safety function: Pushbuttons are operated simulta- PL e Sensor (pushbutton S3/S4)
Prerequisites:
neously with both hands, to keep the Logic (PNOZ s6)
 Common cause failure (CCF): operator away from the danger zone. Logic (PNOZ s10)
Requirements are considered to be met Hazardous movement is stopped by Actuator (contactor KM1, KM2)
(must be tested on implementation) releasing one or both pushbuttons;
 Mission time: 20 years reactivation is possible once both
 Operating interval (electromechanical pushbuttons are released.
components): Further requirements relevant to
- Sensor: 60 operations per hour two-hand circuits in accordance
- Actuator: 60 operations per hour with EN 574 Type IIIC.
 Characteristic data of pushbuttons S3/S4:
B10d: 20.000.000 Please note the further requirements of EN ISO 13849-1, e.g. requirements for avoiding systematic faults.
B10d: 2,000,000 (note oversizing)
2.4

Safety-related Pushbuttons are operated simulta- SIL 3 Sensor (pushbutton S3/S4)
Prerequisites:
control function neously with both hands, to keep the Logic (PNOZ s6)
 Common cause failure (CCF): ß = 2 % (SRCF): operator away from the danger zone. Logic (PNOZ s10)
(must be tested on implementation) Hazardous movement is stopped by Actuator (contactor KM1, KM2)
 Proof test interval: 20 years releasing one or both pushbuttons;
 Operating interval (electromechanical reactivation is possible once both
components): pushbuttons are released.
- Sensor: 60 operations per hour Further requirements relevant to
- Actuator: 60 operations per hour two-hand circuits in accordance
 Characteristic data of pushbuttons S3/S4: with EN 574 Type IIIC.
2.4
B10d: 20.000.000
Dangerous failure rate: 50 % Please note the further requirements of EN 62061, e.g. requirements for systematic safety integrity.
B10d: 2,000,000
Dangerous failure rate: 65% (note
oversizing)

EN 954-1.
5.1-

9$&
9'& 9'&
/
/
/
) )
9'&
&$
.0

6 6 .0
WZR WZR
KDQG KDQG .0

.0

.
.
; ; ; ; ; ; ;
$ 6 6 6 6 6 $
3RZHU
,Q
,Q
,Q
,Q
2XW
.
312=69'& 2XW 312=6
9'&
5HVHW
)DXOW
$ )DXOW < $
; ; ;
3(6&+
$ 2.4
3/&
; 3(
,
8 9 :
$ $
312=DFWLYH .0 .0 0
0
$ $ a
9'& 9'&
3,/= 3,/=
312=69'& 312=69'&


(1,623/H 3LO]*PE+ &R.* 7ZRKDQGRSHUDWLRQ 312=VB
1DPH 5'6 1DPH :('
)HOL[:DQNHO6WU UHTXHVWW\SH,,,&(1
(16,/ 2VWILOGHUQ
H[WHQVLRQFRQWDFWE\312=V 3DJH
'HS &6
PL b of EN ISO 13849-1
PNOZ s6.1 - Requirements in accordance with EN 574 Type IIIA
Safety assessment Pilz products

Features
 Earth faults in the input circuit are Number Designation Order number
 Dual-channel operation detected. 1 PNOZ s6.1 750 126
 Simultaneity monitoring  A fault on the device does not lead to the
 Requirements in accordance with loss of the safety function.
EN 574 Type IIIA  The distance of both pushbuttons S1 and
S2 from the nearest danger zone must be
large enough that if one of the
Description pushbuttons is released, the dangerous
movement is interrupted before the
Function operator can reach the danger zone or 2.4
The two-hand control device PNOZ s6.1 before the operator can reach into the
(K1) is activated by operating both danger zone (see EN 999 „The
pushbuttons S1 and S2 simultaneously positioning of protective equipment in
(simultaneity max. 500 ms), the safety respect of approach speeds of parts of
contacts on K1 close. Contactor KM1 the human body“).
energises.  The two-hand control device PNOZ s6.1
Releasing one or both pushputtons S1 / S2 may not be used on pr ess contr
press ollers
controllers
ollers. It
will interrupt the input circuit on the two- is only suitable for use where the risk
hand control device K1, the safety contacts analysis has established a low level of
at K1 open. Contactor KM1 de-energises. risk.
The safety contacts on the two-hand control
device PNOZ s6.1 (K1) will not reclose until
both pushbuttons S1 and S2 have been
released and then re-operated
simultaneously.
Settings on the unit

The terminator on the PNOZ s6.1 must be
connected.
Start/reset
The two-hand control device PNOZ s6.1 can
be started by operating pushbuttons S1 and
S2 simultaneously when contactor KM1 has
de-energised.
5.1-
PL b of EN ISO 13849-1
PNOZ s6.1 - Requirements in accordance with EN 574 Type IIIA

Safety-related
control
Safety function: Pushbuttons are operated simulta- PL b Sensor (pushbutton S1, S2)
Prerequisites:
neously with both hands, to keep the Logic (PNOZ s6.1)
 Mission time: 20 years (Contactor KM1 operator away from the danger zone. Actuator (contactor KM1)
must be changed after 3.8 years) Hazardous movement is stopped by
 Operating interval (electromechanical releasing one or both pushbuttons;
components): reactivation is possible once both
- Sensor: 60 operations per hour pushbuttons are released.
- Actuator: 60 operations per hour Further requirements relevant to
 Characteristic data of pushbuttons S1/S2: two-hand circuits in accordance
B10d: 20.000.000 with EN 574 Type IIIC.
 Characteristic data of contactor KM1:
B10d: 2,000,000 Please note the further requirements of EN ISO 13849-1, e.g. requirements for avoiding systematic faults.
Depending on the application area and its 2.4

EN 954-1.

9$&
9'& 9'&
/
/
/
) )
9'&
&$

.0

6 6 .0
WZR WZR
KDQG KDQG
.
; ; ; ; ; ;
$ 6 6 6 6 6
3RZHU
,Q
,Q .

2.4
312=6 2XW
9'&
5HVHW
$ )DXOW <
; ;
3(6&+
$
3/&
; 3(
,
8 9 :
$
312=DFWLYH .0 0
0
$ a
9'& 9'&
3,/=
312=69'&


(1,623/E 3LO]*PE+ &R.* 7ZRKDQGRSHUDWLRQ 312=VB
1DPH 5'6 1DPH :('
)HOL[:DQNHO6WU UHTXHVWW\SH,,,$(1
2VWILOGHUQ 3DJH
'HS &6
Further Applications
Contents Page
Further applications
PNOZsigma
contact ex-
pander module – PNOZ s7.1 and PNOZ s7.2 with
base unit PNOZ s4 PL e of EN ISO 13849-1,
SIL 3 of EN 62061 2.5-2
PNOZsigma
contact ex-
pander module – PNOZ s7.1 and PNOZ s7.2 with
base unit PNOZ X4 PL e of EN ISO 13849-1,
SIL 3 of EN 62061 2.5-7
2.5
PNOZsigma contact expander module - PNOZ s7.1 and PNOZ s7.2 with base unit PNOZ s4
Start/reset triggered; the safety contacts on K1

Features The safety relay PNOZ s4 (K1) can be open. This fault condition can only be
started by pressing reset button S2 if: rectified by switching the supply voltage
 Dual-channel operation with detection  E-STOP pushbutton S1 has not been on the safety relay PNOZ s4 (K1) off and
of shorts across contacts operated and then on again.
 Monitored reset with falling edge  Safety relays K2 to K4 have de-energised
 Contact expansion through PNOZ s7.1 and
and PNOZ s7.2  Contactors KM1 to KM6 have de- Pilz products
 Feedback loop to monitor contact ex- energised.
pansion Number Designation Order number 2.5
 Supply voltage via Feedback loop 1 PNOZ s4 750 104
PNOZsigma connector The positive-guided N/C contacts on 1 PNOZ s7.1 750 167
contactors KM1 to KM6 are monitored in 2 PNOZ s7.2 750 177
feedback loop S12-S34 of safety relay 1 PITestop Set1.1 400 410
Description PNOZ s4 (K1).
E-STOP function Safety assessment

When the E-STOP pushbutton S1 is
operated, the input circuit on the safety  The safety relays PNOZ s4, PNOZ s7.1,
relay PNOZ s4 (K1) is interrupted, the safety PNOZ s7.2 and contactors KM1 to KM6
contacts on K1 open. As a result, the input must be installed in a single mounting
circuit on the contact expander modules area (control cabinet) in order to exclude
PNOZ s7.1 (K2) and PNOZ s7.2 (K3-K4) is a short across the output.
interrupted via the PNOZsigma connector,  Earth faults and shorts between contacts
the safety contacts at K2 to K4 open. in the input circuit are detected.
 A fault on the device does not lead to the
Settings on the unit loss of the safety function.
 The connectors between the safety relays  The safety relays PNOZ s4 (K1), PNOZ
PNOZ s4 (K1), PNOZ s7.1 (K2) and PNOZ s7.1 (K2) and PNOZ s7.2 (K3-K4) can be
s7.2 (K3-K4) must be connected. started when the input circuit at K1 is
 The terminator on the PNOZ s7.2 (K4) closed first, followed by the reset button
must be connected. S2. This avoids an unwanted reset before
 The operating mode selector switch the input circuit is closed or as a result of
(mode) on the safety relay PNOZ s4 (K1) the reset button being overridden.
must be set to “Monitored reset, falling  If the position of the operating mode
edge with detection of shorts across selector switch (mode) is changed during
contacts (In2-)”. operation, an error message will be
5.1-

Safety-related
control
Prerequisites:
 Common cause failure (CCF): Logic (PNOZ s7.1)
 Operating interval (electromechanical Logic (PNOZ s7.1)
components): Logic (PNOZ s7.2 K3)
- Sensor: One operation per week Actuator (contactors KM3, KM4)
- Actuator: One operation per week Safety function 3: Machine shut down PL e Sensor (PITestop S1)
 Characteristic data of contactors KM1 to via E-STOP Logic (PNOZ s4)
KM6: Logic (PNOZ s7.1)
B10d: 2,000,000 Logic (PNOZ s7.2 K4)
Actuator (contactors KM5, KM6)
Please note the further requirements of EN ISO 13849-1, e.g. requirements for avoiding systematic faults.
2.5

Prerequisites:
 Common cause failure (CCF): ß = 2 % (SRCF 1): Logic (PNOZ s7.1)
components): (SRCF 2): Logic (PNOZ s7.1)
- Sensor: One operation per week Logic (PNOZ s7.2 K3)
2.5
- Actuator: One operation per week Actuator (contactors KM3, KM4)
 Characteristic data of contactors KM1 to Safety-related Machine shut down SIL 3 Sensor (PITestop S1)
KM6: control function 3 via E-STOP Logic (PNOZ s4)
B10d: 2,000,000 (SRCF 3): Logic (PNOZ s7.1)
Dangerous failure rate: 65% Logic (PNOZ s7.2 K4)
Actuator (contactors KM5, KM6)
Please note the further requirements of EN 62061, e.g. requirements for systematic safety integrity.

EN 954-1.
5.1-

9'& 9'&

6
VWDUW
UHVHW
:
2(/)/(; .0 .0
[TPP

6 .0 .0
(VWRS
:
2(/)/(;
[TPP .0 .0

.
.
.
.
; ; ; ; ; ; ; ; ;
$ 6 6 6 6 6 $ < %
3RZHU
3RZHU ,Q ,Q
,Q ,Q ,Q
,Q $ $
,Q ,Q ,Q
,Q
312=69'& 312=6 2XW 312=6 2XW 312=6 2XW
2XW
5HVHW PRGH
)DXOW
$ )DXOW < $ < %
; ; ; ; ;
2.5
9'& 9'&
3,/= 3,/= 3,/= 3,/=

312=69'& 312=6 312=6 312=6


(1,623/H 3LO]*PE+ &R.* &RQQHFWEDVHXQLW312=VLJPDZLWK 312=VB
1DPH 5'6 1DPH 5'6
)HOL[:DQNHO6WU FRQWDFWH[SDQVLRQPRGXOH312=VDQG
(16,/ 2VWILOGHUQ
FRQWDFWH[SDQVLRQPRGXOH312=V 3DJH
'HS &6

9$&
9'& 9'&
/
/
/
) ) ) ) ) )

9'& 9'& 9'&
&$ &$ &$

.0 .0 .0

.0 .0 .0

. . .
2.5
3(6&+ 3(6&+ 3(6&+
; 3( ; 3( ; 3(
8 9 : 8 9 : 8 9 :
$ $ $ $ $ $
.0 .0 .0 .0 .0 .0 0
0 0
0 0
0
$ $ $ $ $ $ a a a
9'& 9'&


(1,623/H 3LO]*PE+ &R.* &RQQHFWEDVHXQLW312=VLJPDZLWK 312=VB
1DPH 5'6 1DPH 5'6
)HOL[:DQNHO6WU FRQWDFWH[SDQVLRQPRGXOH312=VDQG
(16,/ 2VWILOGHUQ
FRQWDFWH[SDQVLRQPRGXOH312=V 3DJH
'HS &6
PNOZsigma contact expander module - PNOZ s7.1 and PNOZ s7.2 with base unit PNOZ X4
 Contactors KM1 to KM4 have de- Pilz products

Features energised.
Number Designation Order number
 Dual-channel operation with detection Feedback loop 1 PNOZ X4 774 730
of shorts across contacts The positive-guided N/C contact on the 1 PNOZ s7.1 750 167
 Monitored reset safety relay PNOZ s7.1 (K2) is monitored in 1 PNOZ s7.2 750 177
 Contact expansion through PNOZ s7.1 feedback loop Y1-Y2 of safety relay PNOZ 1 PITestop Set1.1 400 410
and PNOZ s7.2 X4 (K1).
 Feedback loop to monitor contact ex-
pansion Safety assessment
 The safety relays PNOZ X4, PNOZ s7.1,

Description PNOZ s7.2 and contactors KM1 to KM4
must be installed in a single mounting
E-STOP function area (control cabinet) in order to exclude
When the E-STOP pushbutton S1 is a short across the output.
operated, the input circuit on the safety  Earth faults and shorts between contacts
relay PNOZ X4 (K1) is interrupted, the safety in the input circuit are detected.
contacts on K1 open. As a result the input  A fault on the device does not lead to the
circuit on the contact expander module loss of the safety function. 2.5
PNOZ s7.1 (K2) is interrupted, the safety  The safety relays PNOZ X4 (K1), PNOZ
contacts on K2 and K3 open. s7.1 (K2) and PNOZ s7.2 (K3) can be
Settings on the unit closed first, followed by the reset button
 The connector between the two safety S2. This avoids an unwanted reset before
relays PNOZ s7.1 (K2) and PNOZ s7.2 the input circuit is closed or as a result of
(K3) must be connected. the reset button being overridden.
 The terminators on PNOZ s7.1 (K2) and
PNOZ s7.2 (K3) must be connected.
Start/reset
The safety relay PNOZ X4 (K1) can be
operated and
 Safety relays PNOZ s7.1 (K2) and PNOZ
s7.2 (K3) have de-energised and

Safety-related
control
Prerequisites:
via E-STOP Logic (PNOZ X4)
 Common cause failure (CCF): Logic (PNOZ s7.1)
via E-STOP Logic (PNOZ X4)
 Operating interval (electromechanical Logic (PNOZ s7.1)
components): Logic (PNOZ s7.2)
2.5
- Sensor: One operation per week Actuator (contactors KM3, KM4)
 Characteristic data of contactors KM1 to Please note the further requirements of EN ISO 13849-1, e.g. requirements for avoiding systematic faults.
KM4:
B10d: 2,000,000
5.1-

Prerequisites:
control function 1 via E-STOP Logic (PNOZ X4)
 Common cause failure (CCF): ß = 2 % (SRCF 1): Logic (PNOZ s7.1)
control function 2 via E-STOP Logic (PNOZ X4)
components): (SRCF 2): Logic (PNOZ s7.1)
- Sensor: One operation per week Logic (PNOZ s7.2)
- Actuator: One operation per week Actuator (contactors KM3, KM4)
 Characteristic data of contactors KM1 to
KM4: Please note the further requirements of EN 62061, e.g. requirements for systematic safety integrity.
B10d: 2,000,000

is suitable for applications up to Category 4 of 2.5
EN 954-1.

9'& 9'&
)
: 9'&
&$ .0
2(/)/(;
[TPP

.0
6 .
(VWRS
: .0
2(/)/(;
[TPP

.0

.
.
.
$ 6 6 6 6 6 6 6 ; ; ; 2.5

$ < %
3RZHU
$
,Q ,Q
9
,Q ,Q
$ 312=;9'& 2XW 2XW
312=6 312=6
$ < < < < 6 6 )DXOW

$ < %
; ; ;

6
VWDUW
UHVHW
9'& 9'&
3,/= 3,/= 3,/=

312=;9'& 312=6 312=6


(1,623/H 3LO]*PE+ &R.* &RQWDFWH[SDQVLRQPRGXOH312=VDQG 312=VB
1DPH 5'6 1DPH 5'6
)HOL[:DQNHO6WU FRQWDFWH[SDQVLRQPRGXOH312=V
(16,/ 2VWILOGHUQ
ZLWKRXWEDVHXQLW312=VLJPD 3DJH
'HS &6

9$&
9'& 9'&
/
/
/
) ) ) )

9'& 9'&
&$ &$

.0 .0

.0 .0

. .

3(6&+ 3(6&+
; 3( ; 3(
2.5
8 9 : 8 9 :
$ $ $ $
.0 .0 .0 .0 0
0 0
0
$ $ $ $ a a
9'& 9'&


(1,623/H 3LO]*PE+ &R.* &RQWDFWH[SDQVLRQPRGXOH312=VDQG 312=VB
1DPH 5'6 1DPH 5'6
)HOL[:DQNHO6WU FRQWDFWH[SDQVLRQPRGXOH312=V
(16,/ 2VWILOGHUQ
ZLWKRXWEDVHXQLW312=VLJPD 3DJH
'HS &6
Service
Contents Page
Service
Pre-sales/after sale
Professional services 3.1-2
Your partner for practical training
Customised training concepts 3.1-3
Delivery and payment- 3.1-4
terms
3.1
3.1-1
Service
Pre-sales/after sales
Professional services
Risk Assessment Plant Assessment Certificates and Approvals

Assessment of the hazards and Analysis and assessment of the Pilz is certified to DIN ISO 9001.
risks on plant and machinery, safety-related condition of your International approvals and
based on norms and standards. plant and machinery. Proposal of certification from recognised test 3.1
basic recommendations for improvement. houses confirm our products’ suitability for
worldwide use.
Safety Concept
Based on the risk analysis, ap- Training and Education Internet
propriate protective measures A wide range of seminars and Our homepage at www.pilz.
can be selected and a safety training courses on machinery com provides the latest informa-
concept drawn up. safety helps to communicate the tion, electronic shopping, direct
fundamentals for minimising risk and assur- dialogue and enquiry functions as well as
Safety Design ing your success. extensive download options.
As part of the safety design, Pilz
produces detailed documenta- Technical Support
tion regarding the implementa- Our engineers can support you E-Business
tion, taking into account the safety concept. in the selection, use and appli- The focus of Pilz’s E-Business
cation of our products. They are activities is to strengthen cus-
We can provide consulting and engineering, System Implementation in constant contact with customers from the tomer orientation through the
training and support, from the project con- Pilz undertakes all the tasks widest range of areas and industrial sectors use of new media and to increase added
figuration phase through to commissioning. required to implement a project: and are happy to answer your queries at any value via a supplementary business model
component selection, prepa- time. for Business-to-Business.
ration of circuit diagrams, programming, con-
trol cabinet, installation, commissioning. Worldwide Representatives
E-Mail: Our worldwide network of
Safety Validation techsupport@pilz.de subsidiaries and sales partners
All the relevant safety-related ensures comprehensive sup-
documents are examined, check 24-hour hotline: port and assistance with your questions and
lists are created and the plant +49 711 3409-444 problems.
and machinery checked.
CE Marking Supply and Repair Service

Co-ordination and implementa- From a fast, economical repair
tion of all the activities neces- through to a long supply guaran-
sary for the CE conformity of tee to safeguard your investment
plant and machinery. – always expect more from Pilz.
3.1-2
Service
Your partner for practical training
Customised training concepts
Benefit from the expertise of one of the Whether you need a basic seminar or an ad-
leading brands in automation technology vanced course, we can help to prepare you in-
dividually in the best way possible for everyday
As a result of many years’ experience, work work situations. We will happily do this at your
with the standards’ committees and tho- premises, directly on the machine.
rough expertise in the area of safe automa-
tion technology, Pilz is the ideal partner for More information on our complete seminar
practical training. Pilz offers a large number program, conditions of registration and se-
of seminars and courses on the widest range minar venues can be found on the Internet,
of subjects to both manufacturers and users where you also have the opportunity to regi-
alike – worldwide, in various languages, to ster directly online:
the samed standard. For example:
• www.pilz.com
• General safety-related issues
• New machinery safety standards Why not find out more about our attractive
• Programming and maintenance range of training courses!
• Error evaluation and diagnostics
3.1
3.1-3
Service
Terms of delivery and payment
3.1
The terms of delivery and of payment of the

respective Pilz company with whom a sales
contract is closed are applied. As a rule this
is the Pilz company that places the order.
Please select the legal contract partner from
the order confirmation.
3.1-4
AT CH ES IE MX PT
© Pilz GmbH & Co. KG, 2009

2-6-2-0-003, 2011-10 Printed in Germany
Pilz Ges.m.b.H. Pilz lndustrieelektronik GmbH Pilz lndustrieelektronik S.L. Pilz Ireland Industrial Automation Pilz de México, S. de R.L. de C.V. Pilz Industrieelektronik S.L.
Sichere Automation Gewerbepark Hintermättli Safe Automation Cork Business and Technology Park Automatización Segura R. Eng Duarte Pacheco, 120
Modecenterstraße 14 Postfach 6 Camí Ral, 130 Model Farm Road Circuito Pintores 170 4 Andar Sala 21
1030 Wien 5506 Mägenwil Polígono Industrial Palou Nord Cork Cd. Satélite 4470-174 Maia
Austria Switzerland 08400 Granollers Ireland Naucalpan, Méx. 53100 Portugal
Telephone: +43 1 7986263-0 Telephone: +41 62 88979-30 Spain Telephone: +353 21 4346535 Mexico Telephone: +351 229407594
Telefax: +43 1 7986264 Telefax: +41 62 88979-40 Telephone: +34 938497433 Telefax: +353 21 4804994 Telephone: +52 55 5572 1300 Telefax: +351 229407595
E-Mail: pilz@pilz.at E-Mail: pilz@pilz.ch Telefax: +34 938497544 E-Mail: sales@pilz.ie Telefax: +52 55 5572 1300 E-Mail: pilz@pilz.es
Internet: www.pilz.at Internet: www.pilz.ch E-Mail: pilz@pilz.es Internet: www.pilz.ie E-Mail: info@mx.pilz.com Internet: www.pilz.es
Internet: www.pilz.es Internet: www.pilz.com.mx
AU CN IT SE
Pilz Australia Pilz Industrial Automation FI Pilz ltalia Srl NL Pilz Skandinavien K/S
Safe Automation Trading (Shanghai) Co., Ltd. Pilz Skandinavien K/S Automazione sicura Pilz Nederland Safe Automation
Suite C1, 756 Blackburn Road Safe Automation Safe Automation Via Meda 2/A Veilige automatisering Energigatan 10 B
Clayton, Melbourne VIC 3168 Rm. 704-706 Nuijamiestentie 5 A 22060 Novedrate (CO) Postbus 186 43437 Kungsbacka
Australia No. 457 Wu Lu Mu Qi (N) Road 00400 Helsinki Italy 4130 ED Vianen Sweden
Telephone: +61 3 95446300 Shanghai 200040 Finland Telephone: +39 031 789511 Netherlands Telephone: +46 300 13990
Telefax: +61 3 95446311 China Telephone: +358 9 27093700 Telefax: +39 031 789555 Telephone: +31 347 320477 Telefax: +46 300 30740
E-Mail: safety@pilz.com.au Telephone: +86 21 62494658 Telefax: +358 9 27093709 E-Mail: info@pilz.it Telefax: +31 347 320485 E-Mail: pilz.se@pilz.dk
In some countries, InduraNET p®, Pilz®, PIT®, PMCprotego®, PMI®, PNOZ®, Primo®, PSEN®, PSS®, PVIS®, SafetyBUS p®, SafetyEYE®,
E-Mail: pilz.fi@pilz.dk
SafetyNET p®, the spirit of safety® are registered, protected trademarks of Pilz GmbH & Co. KG. Text and graphics in this leaflet are
Internet: www.pilz.com.au Telefax: +86 21 62491300 Internet: www.pilz.it E-Mail: info@pilz.nl Internet: www.pilz.se
E-Mail: sales@pilz.com.cn Internet: www.pilz.fi Internet: www.pilz.nl
Internet: www.pilz.com.cn
BE LU JP TR
Pilz Belgium FR Pilz Japan Co., Ltd. NZ Pilz Emniyet Otomasyon
Safe Automation DE Pilz France Electronic Safe Automation Pilz New Zealand Ürünleri ve Hizmetleri Tic. Ltd. Şti.
Bijenstraat 4 Pilz GmbH & Co. KG 1, rue Jacob Mayer Shin-Yokohama Fujika Building 5F Safe Automation Kayışdağı Cad. Beykonağı Plaza
9051 Gent (Sint-Denijs-Westrem) Felix-Wankel-Straße 2 BP 12 2-5-9 Shin-Yokohama 5 Nixon Road No:130 K:2 D:2
Belgium 73760 Ostfildern 67037 Strasbourg Cedex 2 Kohoku-ku Mangere Kayışdağı-İstanbul
Telephone: +32 9 3217570 Germany France Yokohama 222-0033 Auckland Turkey
simply intended to give an overview of the system. No responsibility accepted for errors or omissions.
Telefax: +32 9 3217571 Telephone: +49 711 3409-0 Telephone: +33 3 88104000 Japan New Zealand Telephone: +90 216 5775550
E-Mail: info@pilz.be Telefax: +49 711 3409-133 Telefax: +33 3 88108000 Telephone: +81 45 471-2281 Telephone: +64 9 6345350 Telefax: +90 216 5775549
Internet: www.pilz.be E-Mail: pilz.gmbh@pilz.de E-Mail: siege@pilz-france.fr Telefax: +81 45 471-2283 Telefax: +64 9 6345352 E-Mail: pilz.tr@pilz.de
Internet: www.pilz.de Internet: www.pilz.fr E-Mail: pilz@pilz.co.jp E-Mail: t.catterson@pilz.co.nz Internet: www.pilz.com.tr
Internet: www.pilz.jp Internet: www.pilz.co.nz
BR
Pilz do Brasil DK GB US CA
Automação Segura Pilz Skandinavien K/S Pilz Automation Technology KR PL Pilz Automation Safety L.P.
Rua Ártico, 123 - Jd. do Mar Safe Automation Safe Automation Pilz Korea Ltd. Pilz Polska Sp. z o.o. 7150 Commerce Boulevard
09726-300 Ellegaardvej 25 L Willow House, Medlicott Close Safe Automation Safe Automation Canton
São Bernardo do Campo - SP 6400 Sonderborg Oakley Hay Business Park 9F Jo-Yang Bld. 50-10 ul. Marywilska 34H Michigan 48187
Brazil Denmark Corby Chungmuro2-Ga Jung-Gu 03-231 Warszawa USA
Telephone: +55 11 4337-1241 Telephone: +45 74436332 Northants NN18 9NF 100-861 Seoul Poland Telephone: +1 734 354 0272
Telefax: +55 11 4337-1242 Telefax: +45 74436342 United Kingdom Republic of Korea Telephone: +48 22 8847100 Telefax: +1 734 354 3355
E-Mail: pilz@pilz.com.br E-Mail: pilz@pilz.dk Telephone: +44 1536 460766 Telephone: +82 2 2263 9541 Telefax: +48 22 8847109 E-Mail: info@pilzusa.com
Internet: www.pilz.com.br Internet: www.pilz.dk Telefax: +44 1536 460866 Telefax: +82 2 2263 9542 E-Mail: info@pilz.pl Internet: www.pilzusa.com
E-Mail: sales@pilz.co.uk E-Mail: info@pilzkorea.co.kr Internet: www.pilz.pl
Internet: www.pilz.co.uk Internet: www.pilzkorea.co.kr
… Technical support
In many countries we are +49 711 3409-444
represented by sales partners.
Please refer to our homepage

for further details or contact our
headquarters.
Pilz GmbH & Co. KG
Felix-Wankel-Straße 2
73760 Ostfildern, Germany
Telephone: +49 711 3409-0
Telefax: +49 711 3409-133
E-Mail: pilz.gmbh@pilz.de
Internet: www.pilz.com

PNOZsigma Appl Manual 1002430-En-05

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

PNOZsigma Appl Manual 1002430-En-05

Uploaded by

Copyright:

Available Formats

Safety relays PNOZsigma

Application examples for project conﬁguration –

Application Manual – October 2011 edition

Because the integrality

Pilz is a solution supplier for all automation

functions and/or for complete machine

Conﬁguration software CD-ROM Version100

control. Services in the ﬁeld of machinery safety

Software are covered holistically by Pilz. From risk

Standards and Directives 1.0

Standards and Directives 1.1

Application Examples 2.0

Emergency Stop Applications 2.1

Safety Gate Applications 2.2

ESPE Applications 2.3

Two-hand Applications 2.4

Further Applications 2.5

Standards and Directives

Incorporation of the directives into domestic law (using Germany as an example)

C standards deal with EN 12415 Turning machines

Under the terms of the machinery directive,

Determination of the required Performance Level (PL r)

Required Performance Level PLr

F  Frequency and/or exposure to a hazard

Performance Levels (PL) Probability of a

c 11110-6 < PFH < 3 x 10-6

Performance level examined. A com-ponent’s MTTFD value is

Sector standards from EN/IEC 61508

Risk assessment and determination of required Safety Integrity Level (SIL)

Class Cl Frequency Probability of hzd. Avoidance

AM = Other measures recommended

The following parameters are required in

Emergency stop applications

Feedback loop Pilz products

Safety-related characteristics in EN ISO 13849-1 Performance Level Safety-r elated parts

Safety-related characteristics in EN 62061 Safety Subsystems

Classification in accordance with EN 954-1

Depending on the application area and its

  9'& 9'& 

5HYLVLRQ  'DWH  0RXQWLQJSODFH

Start/reset  If the position of the operating mode

Safety-related characteristics in EN ISO 13849-1 Performance Level Safety-r elated parts

Safety-related characteristics in EN 62061 Safety Subsystems

Classification in accordance with EN 954-1

Depending on the application area and its

  9'& 9'& 

5HYLVLRQ  'DWH  0RXQWLQJSODFH

Feedback loop Pilz products

Safety-related characteristics in EN ISO 13849-1 Performance Level Safety-r elated parts

Safety-related characteristics in EN 62061 Safety Subsystems

Classification in accordance with EN 954-1

Depending on the application area and its

  9'& 9'& 

5HYLVLRQ  'DWH  0RXQWLQJSODFH

Safety-related characteristics in EN ISO 13849-1 Performance Level Safety-r elated parts

Safety-related characteristics in EN 62061 Safety Subsystems

Classification in accordance with EN 954-1

Depending on the application area and its

  9'& 9'& 

5HYLVLRQ  'DWH  0RXQWLQJSODFH

Safety assessment  If the position of the operating mode

Safety-related characteristics in EN ISO 13849-1 Performance Level Safety-r elated parts

Safety-related characteristics in EN 62061 Safety Subsystems

Classification in accordance with EN 954-1

F Frequency and/or exposure to a hazard

9'& 9'&

5HYLVLRQ 'DWH 0RXQWLQJSODFH

9'& 9'&

5HYLVLRQ 'DWH 0RXQWLQJSODFH

9'& 9'&

5HYLVLRQ 'DWH 0RXQWLQJSODFH

9'& 9'&

5HYLVLRQ 'DWH 0RXQWLQJSODFH

9'& 9'&

9'& 9'&

5HYLVLRQ 'DWH 0RXQWLQJSODFH

) ) ) )

9'& 9'& 9'& 9'&

5HYLVLRQ 'DWH 0RXQWLQJSODFH

9'& 9'&

9'& 9'&

3,/= 3,/= 3,/=

5HYLVLRQ 'DWH 0RXQWLQJSODFH

9'& 9'&

5HYLVLRQ 'DWH 0RXQWLQJSODFH

9'& 9'&

5HYLVLRQ 'DWH 0RXQWLQJSODFH

9'& 9'&

5HYLVLRQ 'DWH 0RXQWLQJSODFH

9'& 9'&

5HYLVLRQ 'DWH 0RXQWLQJSODFH

9'& 9'&

5HYLVLRQ 'DWH 0RXQWLQJSODFH

6 ) )

3RZHU ,Q ,Q .

9'& 9'&

5HYLVLRQ 'DWH 0RXQWLQJSODFH

9'& 9'&

5HYLVLRQ 'DWH 0RXQWLQJSODFH

9'& 9'&

5HYLVLRQ 'DWH 0RXQWLQJSODFH