The Safety Compendium

For the application of functional safety standards.

Contents

3
3.1
3.2
3.3
3.4
3.5
3.6
3.7
3.8
3.9

Standards, directives and laws
Standards, directives and laws in the European Union (EU)CE marking
Directives
Standards
International comparison of standards, directives and laws
Industrial robots, human-robot collaboration (HRC)
Safe programming in accordance with EN ISO 13849-1
Validation
Certification and accreditation

4
4.1
4.2
4.3
4.4

Safeguards
European Union standards, directives and laws relating to safeguards
GuardsProtective devices
Manipulation of safeguards

5
5.1
5.2
5.3
5.4
5.5

Safe control technology
Safety relays
Configurable safe small controllers
Safety and automation
Using safety controllers to achieve safe control technology
Safe control technology in transition

6
6.1
6.2

Safe communication
Basic principles of safety-related communication
Safe Ethernet communication with SafetyNET p

2017-08© Pilz GmbH & Co. KG, 2017

2 Product liability

Product liability

3 Standards, directives and laws

2

4 Safeguards

Preface
Authors

6 Safe communication

5 Safe control technology

11.1

1 Preface

The Safety Compendium

Contents

Safe motion
Definition of safe motion
Basic principle
Standard EN 61800-5-2
Safety functions
System examination
Examples of safe motion

8
8.1
8.2
8.3
8.4
8.5

Mechanical, pneumatic and hydraulic design
Introduction to mechanical, pneumatic and hydraulic design
Mechanical design
Pneumatic design
Hydraulic design
Safety requirements on hydraulic circuits

9
9.1
9.2

AppendixIndex
Exclusion of liability

2017-08© Pilz GmbH & Co. KG, 2017

9 Appendix

8 Mechanical, pneumatic and hydraulic design

7
7.1
7.2
7.3
7.4
7.5
7.6

7 Safe motion

The Safety Compendium

1
PrefaceChapter 1 Preface

1
1.1

Preface
Authors 

2017-08© Pilz GmbH & Co. KG, 2017

1 Preface

1 Preface
1-4

1-1Chapter 1 Preface

1 Preface

Mechanisation heralded in the first industrial
revolution when Edmund Cartwright introduced thefirst weaving looms in 1787. Back then, the main
motivation was to increase productivity and barely
anyone spared a thought for the safety of the
weaver. By contrast, today the spotlight is focused
equally on the efficiency of the production process
and the safety of the person.
In addition to communicating actual normative andtechnical principles, an important part of the Safety
Compendium is therefore highlighting the numerous
relationships between safety and economy. The oldsaying is true: if safety is taken into account andcorrectly dimensioned from the very start, it automatically leads to efficient procedures and highacceptance by the user.

and requirements such as data and IT security on
the other. And finally, the role of the human is being
reinterpreted in the smart factory: the human's
particular skills contribute to making production
better and even more efficient. In many areas, suchas robotics, this means that the human is closer tothe machine or that human and machine share aworkspace. The Safety Compendium clarifies therequirements this places on safety and explains how
these can be met.

1 PrefaceIts presence is always assumed; only when it isabsent is it actually noticed: safety. It has the task ofprotecting people, machinery and the environment.

Safety is no longer regarded as merely a normative
obligation that is at odds with the objectives of
efficiency or user-friendliness. Rather, maturesafety is today an incredibly important prerequisite
for making production available and efficient.
In this spirit I sincerely hope that reading the
Safety Compendium is a productive experience.

This 5th edition is not simply a newly printed,
updated version. Our experts have expanded this
Safety Compendium, now recognised as a standard
work, to include current topics such as ‘Safety inIndustrie 4.0’ and ‘Human-robot collaboration’.
After all, digital data and its efficient exchange willdefine the production process of the smart factoryin the future. There is a growing need here forsecure communication, which encompasses
aspects of machinery safety on the one hand

2017-08© Pilz GmbH & Co. KG, 2017

Renate Pilz
Managing Partner
Pilz GmbH & Co. KG

1-3

Chapter 1 Preface

1 Preface

1.1 Authors

Christian Bittner, Group Manager of the Consulting Services Group within
Pilz GmbH & Co. KG, he is a member of the standards committee for
EN ISO 12100, amongst others. He is in direct contact with customers:
his duties include performing risk assessments, producing safety concepts,
CE marking and other safety services.

Holger Bode is responsible for international project planning forpress upgrades and new installations in the Presses working group at
Pilz GmbH & Co. KG. Responsibilities include the development of fullconversion measures as well as the production of control concepts, hazard
assessments and safety concepts. He is also the Quality Manager of theaccredited inspection body at Pilz GmbH & Co. KG and is part of the
management team.

Arndt Christ is Head of the Customer Support Department at
Pilz GmbH & Co. KG. Within the department he is responsible forgroups such as Technical Support and the consulting units, as well as
system integration and the training team. He is familiar with customers'
requirements on all safety-related subjects, and so guarantees a user-friendly
implementation in the field of safety technology.

Roland Gaiser is Head of the Actuator Systems division in development
at Pilz GmbH & Co. KG. He also lectures on system development andsimulation at the Faculty of Mechatronics and Electrical Engineering
at Esslingen University. He has extensive knowledge in the field of basic
development of actuator systems.

Andreas Hahn is the Senior Manager for Networks, Control Systems andActuator Technology in Product Management at Pilz GmbH & Co. KG. He is amember of standards committees and working groups for various associations.
He has many years' experience in the design of automation solutions.

1-4© Pilz GmbH & Co. KG, 20172017-08

Chapter 1 Preface

1 Preface

1.1 Authors
Jürgen Hasel is a trainer and consultant at Festo Didactic SE.
His seminars focus on pneumatics, electropneumatics, valve terminals
and safety technology. Earlier in his career he worked in the development
department at Festo AG. He has been working closely with the training
department of Pilz GmbH & Co. KG for some years. At Pilz he teaches the
CMSE course (Certified Machinery Safety Expert) certified by TÜV Nord,as part of product-neutral training.

Prof. Dr. Thomas Klindt is a partner at the international law firm NOERR andis also honorary professor for Product and Technology Law at the Universityof Bayreuth. He is a member of the chamber's internal product safety &product liability practice group, which oversees national and international
product liability processes, product recalls and compensation claims.

Michael Moog is the Standardisation Specialist at Pilz GmbH & Co. KG and in
this role is responsible for coordination of the international standards committee
work. He himself is active in standards committees and combines theoretical workwith practical interpretation of standards for support within Pilz and for customers.
He specifically deals with the safety and product standardisation to be observed
worldwide along with the corresponding legal frameworks for particular countries
and shares his knowledge in seminars such as “Approval Procedures for Plant
and Machinery in North America”.

Dr. Alfred Neudörfer was a lecturer in the Department of MechanicalEngineering at Technische Universität Darmstadt. He was also a guest
professor in safety technology at Nagaoka University of Technology in Japan.
The subject of many of his lectures, seminars and technical papers has been
the design of safety-related products.

Andreas Schott is responsible for the Training and Education division within
Pilz GmbH & Co. KG. As Group Manager, he works with his team to produce
educational and practically relevant training concepts for both product-neutral
and product-specific courses. His many years of experience as a stateapproved electrical engineer and software programmer have familiarised
him with the practical requirements of customers when it comes to safety
technology.

2017-08© Pilz GmbH & Co. KG, 2017

1-5

Chapter 1 Preface

1 Preface

1.1 Authors

Eszter Sieber-Fazakas, LL.M. is a lawyer with the international law firm
NOERR. She is also a member of the chamber's internal product safety &product liability practice group, which oversees national and international
product liability processes, product recalls and compensation claims.

Klaus Stark is responsible for the Innovation Management division at
Pilz GmbH & Co. KG. He was previously Head of Product Management beginningin 1996, until he took over as Head of International Sales in 2008. He is actively
involved in various committees in support of automation, such as his role as
Chairman of the “Safety Systems in Automation” Technical Committee of the ZVEIor as a member of the Board of the technology initiative SmartFactory KL e. V.

Jochen Vetter is the Team Leader of Robotic Services at Pilz GmbH & Co. KG.
He is in direct contact with customers: one of his tasks is to implement services
regarding HRC, i.e.: the creation of risk assessments and safety concepts for
HRC applications. With the acceptance of HRC applications, his tasks also
include technical measurement checks of the biomechanical limit values inaccordance with TS 15066.

Gerd Wemmer works as an application engineer in Customer Support at
Pilz GmbH & Co. KG. He is responsible for consultancy, project engineeringand the preparation of safety concepts for customers, from machine
manufacturers to end users, and has many years of practical experiencein safety technology.

Harald Wessels is Divisional Manager for cross-product issues in ProductManagement at Pilz GmbH & Co. KG. His tasks include participation ininternational standards committees that deal with communication in industrial
applications. He has extensive knowledge of the fieldbus systems and networks
that are used in automation.

1-6© Pilz GmbH & Co. KG, 20172017-08

Chapter 1 Preface

1 Preface

1.1 Authors
Matthias Wimmer is active within the Pilz Standards Group to ensure informed
handling of standards and regulations. He is a member of the international
standards working group ISO/TC199/WG8 and plays a substantial role in shaping
the development of standards for functional safety (including EN ISO 13849-1).
He also imparts his knowledge to a broad audience, both inside and outside
the company, through training courses and seminars in the Pilz Academy.

Michael Wustlich is Group Manager of the Software, Application and Tests
division at Pilz GmbH & Co. KG. His duties include the development of user-levelsafety-related software in the form of standardised, certified products. Together
with his team he is responsible for the specification and design of systemised
application tests across all product groups.

2017-08© Pilz GmbH & Co. KG, 2017

1-7

2
Product liability

Chapter 2 Product liability

2 Product liability

The Product Liability Directive leaves the member
states much leeway for the implementation of theirnational liability regulations, e.g. this applies forthe option of inclusion of liability for development
risks (Article 15 para. 1 (B) of the Product Liability
Directive). Luxembourg, Finland and, to a limited
extent, France and Spain exercised this option.
As to the question of whether the Product Liability
Directive is only a minimum harmonisation, it must
be noted that the European Court of Justice (ECJ)
takes the position of full harmonisation according
to consistent case-law. The member states are
thereby prohibited from deviating from the directive
and extending the liability beyond the standard
defined by European law in the interest of consumer
protection.

2017-08© Pilz GmbH & Co. KG, 2017

This ECJ decision for a particular legal aspect
notwithstanding, the EU Product Liability Directive
has still not been uniformly adopted as national law
in the individual EU member states.
In addition to this, further product liability aspects
relating to national contract, liability and/or civil law
in the respective EU member state must also betaken into account when entering a market.

2 Product liability

The liability for faulty products was harmonisedin Europe with the European Product Liability
Directive 85/374/EEC. This statutory regulation tookeffect on 01.01.1990 and is only valid for productsthat have been placed on the market after this point
in time. The previous product liability law developed
based on case-law was not suspended by thisdirective; instead the provisions of the Product
Liability Directive apply in addition to the previous
rules of law. This is true not only for the German
Product Liability Act, but also for the law of eachindividual member state (Art. 13 of the Product
Liability Directive).

Such a complicated legal framework for thecurrent 28 EU member states cannot be discussed
in this Safety Compendium. The primary goal isrelaying basic knowledge on European machinery
safety.

2-13Standards,
directives
and laws

Chapter 3 Standards, directives and laws

3 Standards, directives and laws
Standards, directives and laws
Standards, directives and laws in the European Union (EU) 
CE marking The basis of machine safety: Machinery Directive and CE mark 
Legal principles 
CE marking of machinery 
Directives 
Machinery Directive Standards 
Publishers and scope EN engineering safety standards 
Generic standards and design specifications 
Product standards 
Application standards International comparison of standards, directives and laws 
Directives and laws in America Directives and laws in Asia 
Directives and laws in Oceania 
Summary Industrial robots, human-robot collaboration (HRC) 
Normative specifications for the use of industrial robots Robot applications from the perspective of EN ISO 10218-2 
Human-robot collaboration and ISO/TS 15066 
Validation 
Purpose of the measurement 
Safe programming in accordance with EN ISO 13849-1 
Safety-related software 
Software in relation to the risk assessment 
Basic requirements for software development 
Additional fault-prevention measures for increasing performance level Programming tools, languages and libraries 
Structuring and modularity of the software 
SRASW and non-SRASW in a component 
Software implementation and coding 
Testing Documentation 
Verification 
Configuration management 
Changes 
Summary 

2017-08© Pilz GmbH & Co. KG, 2017

3-3
3-5
3-5
3-5
3-6
3-16
3-17
3-18
3-18
3-19
3-21
3-36
3-39
3-40
3-40
3-45
3-49
3-51
3-52
3-53
3-54
3-54
3-57
3-58
3-60
3-60
3-61
3-62
3-63
3-63
3-63
3-64
3-64
3-65
3-66
3-66
3-66
3-66
3-66

3 Standards, directives and laws

3
3.1
3.2
3.2.1
3.2.2
3.2.3
3.3
3.3.1
3.4
3.4.1
3.4.2
3.4.3
3.4.4
3.4.5
3.5
3.5.1
3.5.2
3.5.3
3.5.4
3.6
3.6.1
3.6.2
3.6.3
3.6.4
3.6.5
3.7
3.7.1
3.7.2
3.7.3
3.7.4
3.7.5
3.7.6
3.7.7
3.7.8
3.7.9
3.7.103.7.11
3.7.12
3.7.133.7.143-1

Chapter 3 Standards, directives and laws

3 Standards, directives and laws

3 Standards, directives and laws

3.8
3.8.1
3.8.2
3.8.3
3.8.4
3.8.5
3.8.6
3.8.7
3.8.8
3.8.9
3.8.103.8.11
3.9
3.9.1
3.9.2
3.9.3
3.9.4

3-2

Validation 
Verification of safety functions in accordance with EN ISO 13849-1/2 
Verification of safety functions in accordance with EN 62061 
General information about the validation plan 
Validating through analysis Validating through testing 
Verification of safety functions 
Validation of software 
Validation of resistance to environmental requirements 
Production of validation report Conclusion 
Appendix Certification and accreditation 
Accreditation: Quality seal for customers 
Accreditation or certification 
Tests in accordance with the Ordinance on Industrial Safety and accreditation Conclusion © Pilz GmbH & Co. KG, 2017

3-67
3-68
3-68
3-69
3-70
3-70
3-70
3-72
3-73
3-73
3-73
3-74
3-76
3-76
3-79
3-80
3-81

2017-08

Chapter 3 Standards, directives and laws

3.1 Standards, directives and laws
in the European Union (EU)How are European laws, directives and standards
connected?

This explains how laws and directives areconnected, but doesn’t deal with the issue ofthe standards.

Initially, the EU formulates general safety
objectives via directives. These safety objectives
need to be specified more precisely; the actual
provision is made via standards.
EU directives generally deal with specific issues.
The directives themselves have no direct impact
on individual citizens or companies. They only
come into effect through the agreements ofindividual countries within the EU, who incorporate
these directives into their domestic law. In each
EU country, a law or regulation refers to the relevant
EU directive and thus elevates it to the status ofdomestic law. Between the time a directive is

EU government

initiates

adopted and the point at which it is incorporated
into domestic law there is inevitably a transition
period, during which time the directive is incorporated into domestic law in the individual countries.
However, for users this is generally unimportantbecause the directives themselves provide clear
indication on the respective validity date. So
although the titles of these documents describe
them almost harmlessly as directives, in practicethey have legal status within the EU.

Although the standards themselves makeinteresting reading, on their own they have no
direct legal relevance until they are published in
the Official Journal of the EU or are referenced indomestic laws and regulations. These are thepublications by which a standard can acquire“presumption of conformity”. Presumption ofconformity means that a manufacturer can assume
he has met the requirements of the corresponding
directive that are covered by the standard provided
he has complied with the specifications in the

EU treaties require national
implementation of EU documents
into national documents
writes

EU standards
EN ...

EU directives

3 Standards, directives and laws

The European Union is experiencing ever closer
union. For machine builders, this translates into
an increasing harmonisation of laws, rules andregulations. Not that long ago, each country
published its own guidelines on the different
areas of daily life and the economy, but today
you’ll find more and more standardised
regulations within Europe.

Content
is identical

EU Official Journal
links EN standards
to EU directives

Governments of
EU statestranslate/adopt

write/
EU standard

National
laws

National standards
DIN/BS/...
national standards
are linked tonational laws

Relationship between harmonised standards and laws in the EU2017-08© Pilz GmbH & Co. KG, 2017

3-3

Chapter 3 Standards, directives and laws

3.1 Standards, directives and laws
in the European Union (EU)

3 Standards, directives and laws

standard. So presumption of conformity
confirms proper conduct, as it were. In a formal,
legal context this is called a reversal of the burdenof proof. Where the manufacturer applies a harmonised standard, if there is any doubt, misconduct
will need to be proven. Where the manufacturer
has not applied a harmonised standard, he willneed to prove that he has acted in compliancewith the directives.
If a manufacturer does not comply with a standard,
it does not necessarily mean that he has acted
incorrectly. Particularly in innovative industries,
relevant standards either may not exist or may
be inadequate. The manufacturer must thendemonstrate independently that he has taken thenecessary care to comply with the safety objectivesof the relevant directives. Such a route is usuallymore complex but, in an innovative industry inparticular, it is often unavoidable.
It’s important to stress that the EU does not publish
every standard in the Official Journal, so many arestill not harmonised. Even if such a standard isdeemed to have considerable technical relevance,
it will still not have presumption of conformity.
However, sometimes a standard that has not been
listed in the EU Official Journal does achieve astatus that’s comparable with harmonisation. Thisis the case, for example, when a standard that's
already been harmonised refers to the relevant
standard. The standard that is not listed in the
EU Official Journal is then harmonised "throughthe back door", as it were.

3-4© Pilz GmbH & Co. KG, 2017

2008-11

Chapter 3 Standards, directives and laws

3.2.1 The basis of machine safety:
Machinery Directive and CE markWhen the Machinery Directive (MD) was ratified
in 1993, the aim was to remove trade barriers andenable a free internal market within Europe. Aftera two-year transition period, the Machinery Directive
has been binding in Europe since 01.01.1995. It
describes standardised health and safety requirements for interaction between man and machineand replaces the host of individual state regulations
that existed on machinery safety. The Machinery
Directive 2006/42/EC has applied since 29.12.2009.
The CE mark stands for “Communauté
Européenne”. A manufacturer uses this mark to
document the fact that he has considered all theEuropean internal market directives that are
relevant to his product and applied all theappropriate conformity assessment procedures.
Products that carry the CE mark may be imported
and sold without considering national regulations.
That’s why the CE mark is also referred to as the“Passport to Europe”.

3 Standards, directives and laws

3.2 CE marking

Generally speaking, all directives in accordancewith the new concept (“new approach”) provide
for CE marking. Where a product falls under
the scope of several directives which provide forCE marking, the marking indicates that the productis assumed to conform with the provisions of allthese directives.
3.2.2 Legal principles
The obligation to affix CE marking extends to all
products which fall under the scope of directives
providing for such marking and which are destinedfor the single market. CE marking should therefore
be affixed to the following products that fall under
the scope of a directive:• All new products, irrespective of whether
they were manufactured in member statesor third-party countries• Used products imported from third-party
countries and second hand products• Products that have been substantiallymodified and fall under the scope of thedirectives as new products
The directives may exclude certain products
from CE marking.
The manufacturer uses the EC declarationof conformity to confirm that his product meetsthe requirements of the relevant directive(s).
The information that follows is intended to explain
CE marking in terms of the Machinery Directive.

2017-08© Pilz GmbH & Co. KG, 2017

3-5

Chapter 3 Standards, directives and laws

3.2 CE marking
3.2.3 CE marking of machinery
3.2.3.1 What is a machine?

For the purposes of the Directive, one definitionof a machine is:

3 Standards, directives and laws

An assembly of linked parts or components,
at least one of which moves, and which arejoined together for a specific application(see Article 2 of the Machinery Directive).

• Safety components (the issue of which
components to classify as safety components
is very controversial. Annex V of the Machinery
Directive contains an extremely comprehensive
list of safety components.)• Interchangeable equipment that can modify
the basic functions of a machine• Partly completed machinery that is intended to beincorporated into other machines/machine parts,
thereby forming machinery
3.2.3.2 CE-markingof plant and machinery
According to the Machinery Directive, a machine
manufacturer is anyone who assembles machines
or machine parts of various origins and places themon the market.
A manufacturer may be the actual machine builder
or – where a machine is modified – the operator,
who thereby becomes the manufacturer. In thecase of assembled machinery, it may be the
manufacturer, an assembler, the project manager,an engineering company or the operator himself
who assembles a new installation from various
machines so that the different machine parts
constitute a new machine.

Example of a machine for the purposes of the Directive

The following are also considered as machines
for the purposes of the Machinery Directive:• An assembly of machines or complex plants(complex plants include production lines andspecial purpose machinery made up of several
machines)

3-6

However, according to the Machinery Directive,
only one manufacturer is responsible for the design
and manufacture of the machine. This manufacturer
or his authorised representative takes responsibility
for implementing the administrative procedures forthe entire plant. The manufacturer may appoint anauthorised representative to assume responsibility
for the necessary procedures for placing the
product on the market:• Compiling the plant’s technical documentation• Produce the technical documentation• Providing operating instructions for the plant• Affixing the CE mark in a suitable position on
the plant and drawing up an EC declarationof conformity for the entire plant© Pilz GmbH & Co. KG, 20172017-08

Chapter 3 Standards, directives and laws

3.2 CE marking

3.2.3.3 Use of machineryin the European Economic Area
Irrespective of the place and date of manufacture,
all machinery used in the European Economic Area
for the first time from 01.01.1995 is subject tothe EU Machinery Directive and as such must be
CE certified.
3.2.3.4 Assembled machinery
On large production lines a machine may often
consist of several individual machines assembled
together. Even if each of these bears its own
CE mark, the overall plant must still undergoa CE marking process.

3.2.3.5 Importing a machinefrom a country outside the EU
When a machine is imported from a third country
for use within the EU, that machine must comply
with the Machinery Directive when it is madeavailable on the EU market. Anyone who places
a machine on the market for the first time within
the European Economic Area must have thenecessary documentation to establish conformity,or have access to such documentation. This applies
whether you are dealing with an “old machine” or
new machinery.
3 Standards, directives and laws

It’s important that the manufacturer considers
the safety aspect early, as the contracts are being
formulated or in the components’ requirement
manual. The documentation shall not be compiled
solely from the point of view of machine performance. The manufacturer is responsible for thewhole of the technical documentation and must
determine the part that each of his suppliers is
to undertake in this process.

3.2.3.6 Machinery for own use
The Machinery Directive also obliges users who
manufacture machinery for their own use to comply
with the Directive. Although there are no problems
in terms of free trade - after all, the machine is not
to be traded - the Machinery Directive is applied toguarantee that the safety level of the new machine
matches that of other machines available on themarket.

CE marking for individual machines and the overall plant2017-08© Pilz GmbH & Co. KG, 2017

3-7

Chapter 3 Standards, directives and laws

3.2 CE marking
3.2.3.7 Upgrading machinery
Essentially, the Machinery Directive describes
the requirements for new machinery. However, if
a machine is modified to such an extent that new

hazards are anticipated, an analysis will need tobe carried out to determine whether the upgradeconstitutes a significant modification. If this is thecase, the measures to be taken will be the same as
those for new machinery.

3 Standards, directives and laws

Modification

Is therea new hazard?

No

Yes

Does thenew hazard
lead to a risk?

Is therean escalationof an existing risk?

No

Yes

No

Yes

Are theexisting protective measuressufficient?

Yes

No

Can the risk
be eliminated or
sufficiently minimised
with simple
safeguards?

Yes

No
Significant
modification

No significant
modification“Significant modifications to machinery” decision tree, source: Federal Ministry of Labour and Social Affairs

3-8© Pilz GmbH & Co. KG, 20172017-08

Chapter 3 Standards, directives and laws

3.2 CE marking
A system can no longer be regarded as a single
machine if an event on one machine has a safetyrelated impact on another machine.
The fundamental principle applies: an interlinked
plant must comply with the current legal status(particularly with regard to the Machinery Directive)
and the conformity assessment procedure must be
repeated for the entire plant.
Normally, the newly added machine and theinterface between the new and existing machinemust first undergo a risk assessment to work out
the appropriate safety measures. On this basis asafety concept is developed, along with the safety
design (specification of safety requirements) andthe system integration. The process is completedwith validation of the safety functions, to demonstrate that the safety measures that have been
implemented meet all the requirements. And alsowith interlinked machinery, the process must end
with the EC declaration of conformity for the wholesystem.

2017-08© Pilz GmbH & Co. KG, 2017

A particular challenge exists if existing machinery
is to be linked to new machinery, which has been
built with reference to different standards. In particular this is the case if a machine built to EN 954-1
is to be linked to another machine, which has been
manufactured to 13849-1. EN 954-1 was valid until
31.12.2011. It included the integration of safety
technology, but not the validation of components.
The current standard EN ISO 13849-1 requires
safety functions to be validated. In this case, thedata for the safety functions for both machines
is available in different forms, which makes it moredifficult to validate the new, interlinked machine.
With its extensive experience, Pilz can provide
support in such cases. As an authorised representative, Pilz can perform the whole EC conformity
assessment procedure for third parties, always
taking current standards into account.

3 Standards, directives and laws

3.2.3.8 Interlinked machinery

3-9Chapter 3 Standards, directives and laws

3.2 CE marking
3.2.3.9 Eight steps to a CE mark1. Categorise the product

2. Check the application of additional directives

3. Ensure that safety regulations are met

3 Standards, directives and laws

4. Perform the risk assessment

5. Validation

6. Compile the technical documentation

7. Issue the declaration of conformity

8. Affix the CE mark

Step 1: Categorise the product• Is the product listed in Annex IVof the Machinery Directive?
Annex IV of the Machinery Directive lists machinerythat is considered “particularly hazardous”, such aspresses, woodworking machinery, service lifts, etc.
In this case, CE marking and the declaration ofconformity must meet special requirements.
• Is the machine a subsystem orpartly completed machinery?
Manufacturers issue an EC declaration of conformity
for functional machines that meet the full scope ofAnnex I of the Machinery Directive. For subsystems,
e.g. robots, which cannot yet meet the full scope ofAnnex I, the manufacturer issues a declaration ofincorporation in accordance with Annex II B.
From the moment Machinery Directive 2006/42/EC
becomes valid, all partly completed machinery mustbe accompanied by a declaration of incorporation inaccordance with Annex II. At the same time, themanufacturer must perform a risk assessment andprovide assembly instructions in accordance with
Annex VI. Effectively the manufacturer's declaration
or declaration of incorporation bans the subsystemfrom being put into service, as the machine is incomplete and as such may not be used on its own.

The CE marking process starts by categorising
the product. The following questions need to beanswered:• Is the product subject to the Machinery Directive?
Products to which individual European guidelines
apply and where the hazards from a machine arerecorded more precisely are no longer listed
separately in the Machinery Directive 2006/42/EC• Machines for medical purposes(medical device directive)• Steam boilers and pressure vessels(pressure equipment directive)• Cableways, including funicular railways(cableway directive)• Lifts (lifts directive/regulation)

3-10© Pilz GmbH & Co. KG, 20172021-07

Chapter 3 Standards, directives and laws

3.2 CE marking• Is it a safety component?
Safety components are treated as machinery inaccordance with Machinery Directive 2006/42/EC
and will therefore be given a CE mark.

Machinerylisted in
ANNEX IV?

No

Yes

Not considered or only partially considered

Documentation
by manufacturer
ANNEX VII

Checks on
manufacture
by manufacturer
ANNEX VIII

Harmon.
standards
appliedARTICLE 7

Documentation
by manufacturer
ANNEX VII

Full quality
assurance bymanufacturer
ANNEX X

3 Standards, directives and laws

“Completed”
machinery

Checks on
manufacture
by manufacturer
ANNEX VIII

Yes

Documentation
by manufacturer
ANNEX VII

Checks on
manufacture
by manufacturer
ANNEX VIII

Full quality
assurance bymanufacturer
ANNEX X

EC-typeexamination
ANNEX IX

CE marking
by manufacturer

Potential assessment procedures in accordance with the new Machinery Directive

2013-11© Pilz GmbH & Co. KG, 2017

3-11

Chapter 3 Standards, directives and laws

3.2 CE marking
Step 2: Check the application of
additional directives
Where machinery is also subject to otherEU directives, which cover different aspects but
also provide for the affixing of the CE mark, theprovisions of these directives must be met before
the CE mark is applied. If the machine contains
electrical equipment, for example, it will often be
subject to the Low Voltage Directive and, possibly,
the EMC Directive too.

3 Standards, directives and laws

Step 3: Ensure that safety regulations are met
It is the responsibility of the machine manufacturer
to comply with the essential health and safety
requirements in accordance with Annex I of theMachinery Directive. The formulation of theserequirements is relatively abstract, but specifics
are provided through the EU standards.
The EU publishes lists of directives and therelated harmonised standards. Application of thesestandards is voluntary, but compliance does provide
presumption of conformity with the regulations. Thiscan substantially reduce the amount of evidence
required, and a lot less work is needed to incorporate the risk assessment.

3-12© Pilz GmbH & Co. KG, 2017

2008-11

Chapter 3 Standards, directives and laws

3.2 CE marking
Step 4: Perform the risk assessment

  
  
Pilz
GmbH & Co. KG
Pilz  GmbH  &  Co.  KG  PilzGmbH & Co. KG
    Risikoeinschätzung  und  -­bewertung  Risk estimation and risk evaluation
Risk
estimation and risk evaluation
Schwere  der  möglichen  Verletzung:  Degree of possible harm:
Degreeof possibleAharm:
Möglichkeit  des  uftretens  eines  Probabilityof occurrence of a
Gefahr  bringenden  Ereignisses:  dangerous
event:
Probability of occurrence of adangerous
event:
Pilz  Hazard  Rating  (PHR):  Pilz Hazard Rating (PHR):
   Pilz Hazard Rating (PHR):

11  
11
11
2.5  
2.5
2.5
343  
343
343

Möglichkeit  zur  Vermeidung:  Possibility of avoidance:
Possibility of avoidance:
Häufigkeit  der  Exposition:  Frequency of exposure:
Frequency of exposure:
Risikohöhe:  Risk level:
Risk level:

3 Standards, directives and laws

HazardIdentification
HazardNo:
2.14
Identifizierung  der  Gefährdung  Gefahren-­Nr.:  2.14  
Hazard Identification
Hazard No:
2.14
Title
Hazards
generatedbyquasi-static
contact
between
the
robot
and
parts
of
the
systemTitel  Gefährdungen  durch  quasi-­statischen  Kontakt  zwischen  Roboter  und  Anlagenteilen  Title
Hazards generated by quasi-static contact between the robot and parts of the system
Robot,
robot area (working range ofOrt  Kamera-Öffnung  in  der  Tischplatte    Location
the robot)
Robot,
robot area (working range of
  Gefährdungs-­
Location
Obere  Extremitäten  therobot)
auswirkung  ImpactofFinger, Hand ND
hazard of
ImpactNormalbetrieb,  Einrichten,  Wartung,  Lebensphase   Finger, Hand ND
hazardInstandhaltung,  und  Reparatur  Normaloperation, setup,
Life phasemaintenance,servicingand repair
Normaloperation,
setup,
Tätigkeit  Be-, Entladen  der  Applikation,  
  
Life
phase
maintenance, servicing and repair
Bergen  von  losgelassenen  Teilen,  Activity
Automatic
mode, semiautomaticmode,
tooling/adjusting,
Activity
Rüsten/Einstellen,  Programmieren/  Automatic
mode, semiautomatic
programming/testing,eliminating
mode,
tooling/adjusting,
Testen,  Beseitigen  von  Störungen      disruptionsin the workflow,
programming/testing,eliminating
im  Arbeitsablauf,  Beobachten  von  monitoringproduction
processes,
disruptionsin the workflow,
Fertigungsläufen,  Fehlersuche  und  troubleshooting
and fault
monitoringproduction
processes,-beseitigung,  Reinigung/Wartung    rectification, cleaning/maintenance,
troubleshooting
and fault
Tätigkeits-  Manuelle  Tätigkeit  in  dem  repairrectification,cleaning/maintenance,
Erklärung  Arbeitsbereich  des  Roboters,    repairExplanationn/abei  bestimmungsgemäßem  Betrieb.  
  ofactivity
Explanationn/aofArt  der  activity
Mechanische  Gefährdung    Gefährdung  Type of hazard Mechanical hazard
Ursprung      Quetschen    Typeof hazard Mechanicalhazardoder  Folgen    Originor
Shearing, crushingconsequences
OriginorBeschreibung  Während  des  Betriebes  und  der  damit  verbundenen  Bewegungen  des  Roboterarms  Shearing,
crushing
consequences
besteht  die  Gefahr,  dass  Gliedmaßen  zwischen  Roboterarm  und  festen  nlagenteilen  Description
Duringoperation and the associated movements of the robot arm there is a A
dangerof limbs
  bei  der  Fahrt  zur  Kamera  gequetscht  werden  können.  
betweencrushed andor severed
betweenmovements
the robot arm
androbot
fixedarmpartsof theDescription
During operation
the associatedof thethere
is asystem.
danger of limbs
  between crushed or severed between the robot arm and fixed parts of the system.

2.5  
2.5
2.5
5  
5
5
Hohes  Risiko  High risk
High risk

Konzept  zur  Risikominderung  Referenz  Risk
reduction concept
Reference
Risk
reduction
concept
Reference
Risikominderung  1:  Konstruktive  Schutzmaßnahmen:  Risk
reduction 1: Design safeguards:
EN ISOEN  349  12100
Anlagenteile  müssen  so  gestaltet  werden,  dass  sie  gemäß  EN  349  mit  dem  Roboter  EN ISOEN  ISO  10218-­2  13849-1
Systemparts must
be designed
in such a way according to EN 349 that they
Risk reduction
1: Design
safeguards:
12100
keine  gefährlichen  Quetsch-­  und  Scherstellen  bilden.  Wenn  dies  konstruktiv  nicht  EN 349cannothazardous
crush
shear
pointswith thetorobot.
Anythatremaining
ISOTS  15066  13849-1
Systemformpartsanymust
be designed
in or
such
a way
according
EN 349theymöglich  ist,  müssen  die  möglichen  Kollisionsflächen möglichst groß sein.
ENISO
10218-2
crush
pointsmust
bedesignedinaccordance
with
ISO
TS
15066.
349
cannot form any hazardous crush or shear points with the robot. Any remaining
Risikominderung  2:  Technische  Schutzmaßnahmen:  
EN
ISO
13857
10218-2
crush
points mustdesignedsafeguards:
in accordance with ISO TS 15066.
Risk reduction
2:beTechnical
Quetsch-­  und  Scherstellen  sind  durch  Begrenzung  der  Freiheitsgrade  des  13850
EN ISO 13857
Optimisationof therobot path safeguards:
in order to avoid crush and shear points.
Risk
reduction
2: Technical
Robotersystems  so  weit  als  möglich  zuvermeiden.
ISOISOTS 15066
EN
13850
The followingof
measurestakentousing
safetysoftwarein
Optimisation
the robotmust
path bein orderavoid
crushprovenand shearpoints.
Verbleibende  Quetschstellen  sind  durch  Begrenzung  der  Roboter-Dynamik    ISO TS 15066
accordance
TS 15066:
The
followingwith
measuresmust be taken using safety proven software inund  -Leistung  abzusichern.  Es  müssen  die  biomechanischen  Grenzwerte  der    - Reduction invelocity
accordancewith
TS 15066:
TS  15066  eingehalten  werden.  
force- Reduction in velocity
  - Reduction
in force

Risk Assessment:
Robot Manufacturing Application/Trade Fair
Document-No.:
01_CORA
Risk
Assessment:
Robot
Manufacturing Application/Trade Fair   Risikobeurteilung  –  Roboter-Fertigungsapplikation/Messe
Version:
V1.4
Document-No.:
01_CORACORB  

Version:

V1.4

Page 69 of 107

1  Page 69 of 107

Extract from a risk assessment by Pilz GmbH & Co. KG

2017-08© Pilz GmbH & Co. KG, 2017

3-13

Chapter 3 Standards, directives and laws

3.2 CE marking
The manufacturer is obliged to carry out a risk
assessment to determine all the hazards associatedwith his machine. The result of this assessment
must then be considered in the design andconstruction of that machine. The contents andscope of a risk assessment are not specified in any
directive, but EN ISO 12100 describes the generalprocedure.

3 Standards, directives and laws

All relevant hazards must be identified, based on
the intended use – taking into consideration all the
lifecycles once the machine is first made available
on the market. All the various groups who comeinto contact with the machine, such as operating,cleaning or maintenance staff for example, are also
considered.
The risk is assessed and evaluated for eachhazard. Risk-reducing measures are establishedin accordance with the state of the art and incompliance with the standards. The residual risk
is assessed at the same time: if the residual risk
resulting from a danger point cannot be reduced
to an acceptable level, additional measures are
required. This iterative process is continued until
the necessary safety is achieved.
Step 5: Validation
Validation is one of the key steps in the conformity
assessment procedure. Essentially it proves that amachine complies with safety regulations. All information about validation is available in Chapter 3.6.

3-14

Step 6: Compile the technical documentation
In accordance with the Machinery Directive,
technical documentation specifically comprises:• An overall drawing of the machinery anddrawings of the control circuits• Full, detailed drawings (accompanied by any
calculation notes, test results, etc. required tocheck the conformity of the machinery with theessential health and safety requirements)• A list of the essential requirements of thisdirective, standards and other technicalspecifications used in the design of themachinery, a description of the protective
measures implemented to eliminate hazards
presented by the machinery (generally coveredby the risk analysis)• Technical reports or certificates; reports
or test results showing conformity• The machine's operating instructions• A general machine description• Declaration of conformity or declarationof incorporation plus the assembly instructions• Declarations of conformity for the machines ordevices incorporated into the machinery
This documentation does not have to bepermanently available in material form. However,it must be possible to assemble it and make itavailable within a period of time commensuratewith its importance. It must be retained for at leastten years following the date of manufacture andbe available to present to the relevant national
authorities. In the case of series manufacture, that
period shall start on the date that the last machineis produced.

© Pilz GmbH & Co. KG, 20172017-08

Chapter 3 Standards, directives and laws

3.2 CE marking
Step 7: Issue the EC declaration of conformity
By issuing the EC declaration of conformity, themanufacturer declares that they have considered all
the directives that apply for the product. The person
signing an EC declaration of conformity must be
authorised to represent his company. This meansthat the signatory is legally entitled to execute alegal transaction, such as signing the EC declarationof conformity, on account of their job function.

Step 8: Affix the CE marking

20

10
5
1

The declaration may also be signed by anauthorised representative.
The Machinery Directive requires the declaration
to name the person authorised to compile thetechnical documentation. This person must be
established in the EU.

2017-08© Pilz GmbH & Co. KG, 2017

0

1

5

10

17

20

27

37

3 Standards, directives and laws

When an authorised employee of the company
adds their valid signature to an EC declaration ofconformity, they trigger the liability of the natural
responsible person and, if applicable, the company
as a legal entity.

CE mark characteristics

The CE mark may be affixed once theEC declaration of conformity has been issued.
It’s important that CE marking for the complete
machine is clearly distinguishable from any otherCE markings, e.g. on components. To avoid
confusion with any other markings, it is advisable toaffix the CE marking for the complete machine tothe machine type plate, which must also contain thename and address of the manufacturer.

3-15

Chapter 3 Standards, directives and laws

3.3 Directives

3 Standards, directives and laws

Of the almost 30 active directives now available,
only a small selection is relevant to the typicalmachine builder. Some directives may have a very
long or bureaucratic title in addition to the directive
number (e.g. 2006/42/EC). Variations can be seenin the last part of the directive number. This willcontain EC, EU, EG, EWG or some other abbreviation, depending on the language area and issue

date. As a result it is generally very difficult to namethe directive. These long titles are often abbreviatedseparately, even though this can also lead tomisunderstandings. Here is a list of some of the key
directives with both their official title and their usual,though unofficial, abbreviated title:

Directive

Abbreviated title (unofficial)

Official title

2006/42/EC

Machinery Directive

Directive 2006/42/EC of the European Parliamentand of the Council of 17 May 2006 on machinery,
and amending Directive 95/16/EC (recast)

2001/95/EC

Product Safety Directive

Directive 2001/95/EC of the European Parliament andof the Council of 3 December 2001 on general product safety

2014/30/EU

EMC Directive

Directive 2014/30/EU of the European Parliament andof the Council of 26 February 2014 on the harmonisationof the laws of the Member States relating to electromagnetic
compatibility (recast)

2014/53/EU

Radio Equipment Directive

Directive 2014/53/EU of the European Parliament andof the Council of 16 April 2014 on the harmonisationof the laws of the Member States relating to the making
available on the market of radio equipment and repealing
Directive 1999/5/EEC

2003/10/EC

Noise Directive

Directive 2003/10/EC of the European Parliament andof the Council of 6 February 2003 on the minimum healthand safety requirements regarding the exposure of workers to
the risks arising from physical agents (noise)

2014/35/EU

Low Voltage Directive

Directive 2014/35/EU of the European Parliament andof the Council of 26 February 2014 on the harmonisationof the laws of the Member States relating to the making
available on the market of electrical equipment designed
for use within certain voltage limits

Regulation (EU)2016/425

PPE Directive

Regulation (EU) 2016/425 of the European Parliamentand of the Council of 9 March 2016 on personal protective
equipment and repealing Council Directive 89/686/EC(89/686/EEC applicable with a transition period until 20. April 2019)

The aim of the directives is to guarantee the freemovement of goods within the EU. The full textsof the directives are available online. Of all these
directives, only the Machinery Directive will be
examined here in any further detail. However,the list of relevant standards will naturally refer tostandards that relate to other directives.

3-16© Pilz GmbH & Co. KG, 20172017-08

Chapter 3 Standards, directives and laws

3.3 Directives
3.3.1 Machinery Directive

3.3.1.2 Validity

2006/42/EC has special significance in terms of
the functional safety of machinery. This directive,
generally known as the “Machinery Directive”, isconcerned with the standardisation of European
safety requirements on machinery.

The Machinery Directive 2006/42/EC replaced
the previous version 98/37/EC with effect from29.12.2009. There was no transition period.
3.3.1.3 Standards relating to
the Machinery Directive

3.3.1.1 Contents• Scope, placing on the market,
freedom of movement• Conformity assessment procedures• CE marking• Essential health and safety requirements• Categories of machinery and the applicableconformity assessment procedures• EC declaration of conformity andtype-examination• Requirements of notified bodies

2017-08© Pilz GmbH & Co. KG, 2017

At this point, it makes no sense to name all thestandards that are listed under the Machinery
Directive and are therefore considered as
harmonised. As of Winter 2016, there were morethan 750 standards listed directly. To then add
all the standards that are relevant indirectly via
the standards that are listed directly would go
far beyond the scope of this compendium. The
following chapters will therefore concentrate on
those standards for the Machinery Directive
which are of general significance.

3 Standards, directives and laws

The Machinery Directive covers the key aspectsof machine safety. The contents of the Machinery
Directive are as follows:

3-17

Chapter 3 Standards, directives and laws

3.4 Standards
3.4.1 Publishers and scope

3.4.1.2 National standards

At European level, harmonisation of the legislation
also triggered harmonisation of the standards.
Traditionally, almost every country has one ormore of its own standards institutes. There arealso some international cooperative organisations.
This means that the same standard is publishedat different levels under different names. In most
if not all cases, the generic name of the standard
is continued and recognisable as part of thenational standard name. More about that below.

The diversity of national standards and standards
institutes within all of Europe is almost unmanageable. In the EU at least, the aim is to produce themajority of standards directly as an EN standard,
which is then reflected at national level, i.e. theEN standard is declared a national standard or thenational standard is introduced as an EN standard.

3 Standards, directives and laws

3.4.1.1 International standards
At international level, the most important
publishers of engineering standards are probably
the International Electrotechnical Commission (IEC)and the International Organization for Standardization (ISO), both of which are based in Geneva. While
the IEC is primarily concerned with electrical andelectronic issues, ISO deals mainly with mechanicalissues. Well over 100 countries are currently
members of the two organisations, which gives
considerable weight to those standards developed
by IEC and ISO.
The EN standards are applied at European level.
EN standards are normally developed throughCEN and CENELEC as an EU initiative. As with
IEC and ISO, CEN and CENELEC divide up thestandards. CENELEC is responsible for electricalissues.
Today, many standards are developed almost
in a package as an IEC or ISO standard in
co-operation with the EU via CEN and CENELEC.
EN IEC or EN ISO standards are the result of
these efforts.

In Germany for example, the German Institutefor Standardization (Deutsches Institut für Normung DIN) is responsible for publishing national standards. Today it’s common practice for DIN standards
to be developed directly in conjunction with CENor CENELEC as DIN EN ISO or DIN EN. The only
difference between these standards is usually thenational preface to the EN, ISO or IEC standard.
The same standard will come into effect at
EU level as an EN ISO or EN IEC standard, while
the identical German standard is called DIN EN ISO
or DIN EN. In other European countries, theprocedure is virtually the same except that adifferent institute publishes the standard.
In Austria, this would be the Austrian Standards
Institute (Österreichisches Normungsinstitut ÖNorm), while Great Britain has the British
Standards Institute (BSI).
If an ISO standard becomes an EN standard, its title
will be EN ISO. If it then becomes a DIN standard,
its full title will be DIN EN ISO. The more local theinstitute, the further forward it appears in the name.
One curious aside: if an IEC standard becomes an
EN standard, the IEC name is dropped. IEC 61508
becomes the European standard EN IEC 61508 or
the German DIN EN IEC 61508.
While many countries such as China or Switzerland,for example, also follow the European procedure fora centralised standards institute, there are still somenasty surprises to be had elsewhere. In the USA,
standards are published by ANSI, OSHA, RSA and
UL, among others.

3-18© Pilz GmbH & Co. KG, 20172017-08

Chapter 3 Standards, directives and laws

3.4 Standards
There is no intention at this point to provide acomplete list of the European engineering safety
standards. Over 760 standards are listed as

harmonised under the Machinery Directive alone.
The following section addresses a selection of thegeneral safety standards. They are explained invarious degrees of detail, depending on the significance of the individual standard.

Standard

Harmonised

Title

EN 349:2008

Yes

Safety of machinery
Minimum gaps to avoid crushing of parts of the human body

EN 547-1 to -3:2008

Yes

Safety of machinery
Human body measurements

EN 574:2008

Yes

Safety of machinery
Two-hand control devices – Functional aspects
Principles for design

DIN EN ISO 14120:2016
replaces EN 953:2009

Yes

Safety of machinery
Guards – General requirements for the design and constructionof fixed and movable guards

EN 1005-1 to -4:2008
EN 1005-5:2007

Yes
No

Safety of machinery
Human physical performance

EN 1037:2008
Identical to
ISO 14118:2000

Yes

Safety of machinery
Prevention of unexpected start-up

EN ISO 14119(Replaces EN 1088:2008
and ISO 14119:2006)

Yes

Safety of machinery
Interlocking devices associated with guards. Principles for designand selection

DIN EN ISO 11161:2010

Yes

Safety of machinery
Integrated manufacturing systems – Basic requirements

EN ISO 12100:2010
Replaces
EN ISO 12100-1 and 2;
EN ISO 14121; EN 292

Yes

Safety of machinery
General principles for design – Risk assessment and risk reduction

EN 12453:2000

No

Industrial, commercial and garage doors and gates
Safety in use of power operated doors – Requirements

EN ISO 13849-1:2015
replaces
EN ISO 13849-1:2009

Yes

Safety of machinery
Safety-related parts of control systems – Part 1:
General principles for design

EN ISO 13849-2:2012

Yes

Safety of machinery
Safety-related parts of control systems – Part 2:
Validation

EN ISO 13855:2010

Yes

Safety of machinery
Positioning of safeguards with respect to the approach speedsof parts of the human body

EN ISO 13857:2008

Yes

Safety of machinery
Safety distances to prevent hazard zones being reached
by upper and lower limbs

2017-08© Pilz GmbH & Co. KG, 2017

3 Standards, directives and laws

3.4.2 EN engineering safety standards

3-19Chapter 3 Standards, directives and laws

3 Standards, directives and laws

3.4 Standards

3-20Standard

Harmonised

Title

ISO/TR 23849:2010
identical to
IEC/TR 62061-1:2009

No

Guidance on the application of ISO 13849-1 and IEC 62061
in the design of safety-related control systems for machinery

EN 60204-1:2010

Yes

Safety of machinery
Electrical equipment of machines - Part 1: General requirements

EN 60947-5-1:2009
EN 60947-5-2:2012
EN 60947-5-3:2005
EN 60947-5-4:2003
EN 60947-5-5:2013
EN 60947-5-6:2001
EN 60947-5-7:2003
EN 60947-5-8:2006
EN 60947-5-9:2007

Yes

Low-voltage switchgear and controlgear
Part 5: Control circuit devices and switching elements

EN 61326-3
Parts 1+2:2008

No

Electrical equipment for measurement, control andlaboratory use – EMC requirements

EN 61496-1:2010

Yes

Safety of machinery
Electrosensitive protective equipment – Part 1:
General requirements and tests

IEC 61496-2:2013
CLC/TS 61496-2:2006

No

Safety of machinery
Electrosensitive protective equipment – Part 2:
Particular requirements for equipment using active optoelectronic
protective devices (AOPDs)

CLC/TS 61496-3:2008
Replaces
EN 61496-3:2003

No

Safety of machinery
Electrosensitive protective equipment – Part 3:
Particular requirements for active optoelectronic protective devices
responsive to diffuse reflection (AOPDDR)EN 61508
Parts 1-7:2010

No

Functional safety of safety-related electrical, electronic andprogrammable electronic control systems

EN 61511
Parts 1-3:2004

No

Functional safety – Safety instrumented systems
for the process industry sector

EN 61784-3:2010

No

Industrial communication networks – Profiles – Part 3:
Functional safety fieldbuses – General rules and profile definitions

EN 61800-5-2:2007

Yes

Adjustable speed electrical power drive systems – Part 5-2:
Safety requirements – Functional

IEC/TS 62046:2008

No

Safety of machinery
Application of protective equipment to detect the presence of persons

EN 62061:2016

Yes

Safety of machinery
Functional safety of safety-related electrical, electronic andprogrammable electronic control systems

IEC/TR 62685:2010

No

Industrial communication networks – Profiles – Assessment guideline
for safety devices using IEC 61784-3 functional safe communication
profiles (FSCPs)

NFPA 79:2013

No

Industrial machinery© Pilz GmbH & Co. KG, 20172017-08

Chapter 3 Standards, directives and laws

3.4 Standards
3.4.3 Generic standards anddesign specifications
3.4.3.1 EN ISO 12100 and EN ISO 14121
Standard

Harmonised

Title

EN ISO 12100:2010
Replaces
EN ISO 12100-1 and -2;
EN ISO 14121-1

Yes

Safety of machinery
General principles for design – Risk assessment and risk reduction

The diagram overleaf (see page 3-22) identifies
the individual elements examined in this standard.
The standard provides a good selection of thehazards, risk factors and design principles thatneed to be considered.

2017-08© Pilz GmbH & Co. KG, 2017

Elements within the diagram that have a dark
yellow background are the areas covered by theuser standards EN ISO 13849-1 and EN/IEC 62061
and are examined there in greater detail. Where
possible the diagram refers to the corresponding
sections dealing with the relevant aspect within thestandards. Some points can certainly be found inseveral standards, but the level of detail generally
varies.

3 Standards, directives and laws

In 2010, EN ISO 12100 provided a further
summary of EN 12100-1 and -2 plus EN 14121-1.
This standard is identical in content to the named
standards and simply summarises them within one
document.

3-21

Chapter 3 Standards, directives and laws

3.4 Standards
Risk assessment
Clause 5

The following versionsFof thestandards have been quoted:d
EN ISO 12100
2010
EN ISO 13849-1
2015
EN/IEC 62061
2015

START

Risk analysis

Determination of the limits of machinery
space, time, environmental conditions, use
Clause 5.3

Hazard and task identification
for all lifecycles and operating modes

Yes

Clause 5.4 and Annex B

3 Standards, directives and laws

Separatefor each risk
Risk estimation
Severity, possibility of avoidance, frequency, duration

Clause 5.5

Risk evaluationin accordance with C standards or risk estimation
Clause 5.6

No

Has the risk
been adequately reduced?
Clause 6

Yes

Documentation
Clause 7No

END

Assess measures independently and consecutively
Risk reduction
Clause 6.2-6.4

Can
the hazard
be removed?

No

Yes

Are otherhazards generated?

Risk reduction byinherently safe design measures
Clause 6.2

Can the risk be
reduced by inherently
safe design
measures?

Is the intended
risk reduction
achieved?

Yes

Yes

No

No

Can the risk be
reduced by guards andother safeguards?

Risk reduction bytechnical protective
measuresYes Implementation ofcomplementary
protective measures
Clause 6.3

No
Does theprotective
measure depend
on a control
system?

Yes

IntegrationofEN 13849/
EN 62061

Is theYesintendedrisk reduction
achieved?

No
No
Can the limits
be specified again?

No

Risk reduction by
information for use
Clause 6.4
Yes

Is theintended risk reduction
achieved?

Yes

No

Risk assessment and risk reduction in accordance with EN ISO 12100

3-22© Pilz GmbH & Co. KG, 20172017-08

Chapter 3 Standards, directives and laws

3.4 Standards
3.4.3.2 IEC/TR 62685 Test requirements and EMC
Standard

Harmonised

Title

IEC/TR 62685:2010

No

Industrial communication networks – Profiles –Assessment guideline for safety devices using IEC 61784-3 functionalsafety communication profiles (FSCPs)

document is more relevant to safety component
manufacturers than plant and machine builders.
However, as the document contains a goodcomparison of EMC requirements, it may also beof interest to machine builders.
3 Standards, directives and laws

IEC/TR 62685 was produced from the test requirements of the German BGIA document GS-ET-26
and covers the requirements of safety components
within a safety function. It covers the issue oflabelling and EMC as well as mechanical andclimatic tests. This closes some of the gaps left
by EN ISO 13849-1 and EN 61784-3. Overall the

3.4.3.3 EN 61784-3 Safe fieldbuses
Standard

Harmonised

Title

EN 61784-3:2010

No

Industrial communication networks – Profiles – Part 3:
Functional safety fieldbuses –General rules and profile definitions

The EN 61784-3 series of standards covers a whole
range of safety enhancements for different fieldbus
profiles, based on the specifications of EN 61508.
These enhancements are handled as security
profiles and describe the mechanisms and technicaldetails of these profiles. For the average machinebuilder, at most the generic part of EN 61784-3
will be of interest, as this is the part that describes
the general safety principles. The profile documents
EN 61784-3-x are mainly intended for device
manufacturers who wish to build their own safety

2011-11© Pilz GmbH & Co. KG, 2017devices in accordance with one of the publishedprofiles. In this case, it makes sense to work in cooperation with the relevant user groups behindthese profiles and to be familiar with the basic
profiles described in the series EN 61784-1 and -2,
as well as EN 61158. A complete profile consistingof the relevant parts of EN 61784 and EN 61158
will contain between 500 and 2,000 pages. All the
profiles together amount to around 10,000 pages.

3-23Chapter 3 Standards, directives and laws

3.4 Standards

3 Standards, directives and laws

3.4.3.4 EN ISO 13849-1
Standard

Harmonised

Title

EN ISO 13849-1:2015

Yes

Safety of machinery
Safety-related parts of control systems – Part 1:
General principles for design

EN ISO 13849-2:2012

Yes

Safety of machinery
Safety-related parts of control systems – Part 2:
Validation

Contents

Scope

EN ISO 13849-1 addresses the issue of assignmentof suitable reliability classes for risks using a risk
graph and also deals with the assessment ofsafety functions based on structural and statisticalmethods. The objective is to establish the suitabilityof safety measures to reduce risks. EN ISO 13849-2
describes the validation aspect pertinent to
EN ISO 13849-1. So together, both standards arepractically equal (but not identical) to EN 62061.

EN ISO 13849-1 is a generic standard for functionalsafety. It has been adopted at ISO level and within
the EU is harmonised to the Machinery Directive.
It therefore provides presumption of conformity
within the EU. The scope is given as the electrical,
electronic, programmable electronic, mechanical,
pneumatic and hydraulic safety of machinery.

The work involved in making the calculations
required under this standard can be reduced
considerably if appropriate software is used.
Calculation tools such as the Safety Calculator
PAScal are available as free software:
https://www.pilz.com/de-INT/eshop/
00105002187038/PAScal-Safety-Calculator,
webcode: web150431

Risks are assessed in EN ISO 13849-1 with theaid of a graph. The assessed criteria include severityof injury, frequency of exposure to the risk and thepossibility of avoiding the risk. The outcome of theassessment is a required performance level (PLr) for
the individual safety functions intended to minimise
the risks.

Risk assessment/risk analysis

In subsequent stages of the risk assessment,
the levels determined using the graph are alignedwith the selected risk reduction measures. For
each classified risk, one or more measures must
be applied to prevent the risk from occurring or
to sufficiently reduce the risk. The quality of themeasure, expressed as the performance level, mustat least correspond to the level determined for therespective risk.

PAScal Safety Calculator

3-24© Pilz GmbH & Co. KG, 20172017-08

Chapter 3 Standards, directives and laws

3.4 Standards
Just three parameters need to be examined toassess the performance level (PL):Severity of injury

S

Slight (normally reversible injury)

S1

Serious (normally irreversible injury
including death)

S2

Frequency and/or
duration of exposure to a hazard

F

Seldom to less often and/or
exposure time is short

F1

Frequent to continuous and/or
the exposure time is long

F2

Possibility of
avoiding the hazard

P

Possible under specific conditions

P1

Scarcely possible

P2

The required performance level PLr is calculatedusing the following graph and the classification of
the individual parameters. Assessment of the risk
begins at the starting point on the graph and thenfollows the corresponding path, depending on therisk classification. The required performance level
PLr a, b, c, d or e is determined once all theparameters have been assessed.
A new addition in the latest version of the standard
is the option of assessing the probability of occurrence of a hazard. With the conclusion that thisprobability is too low, the previously determined PLr
can be reduced by one level. The devil is in thedetails in this case: namely, that comparable
machinery should be used to assess this question.
This comparable machinery is equipped with
sufficient safety measures, however, as otherwise
it would not be available on the market. A low
occurrence of accidents on comparable machines
is thus not sufficient justification for classifying
the associated hazards as low. Instead this would
prove that the implemented safety measures
were appropriate (and a reduction of these would
be misguided).

3 Standards, directives and laws

Determination of the required
performance level PLr

Required
performance level PLr

Low contribution to risk reduction

Starting point
for evaluation of safetyfunction's contribution
to risk reduction

High contribution to risk reduction
Risk graph in accordance with EN ISO 13849-1

2017-08© Pilz GmbH & Co. KG, 2017

3-25

Chapter 3 Standards, directives and laws

3.4 Standards
Assessing the implementation/examining
the system

3 Standards, directives and laws

EN ISO 13849-1 works on the assumption that
there is no such thing as a safe device. Devices
only become suitable through an appropriate designfor use in applications with increased requirements.
As part of an assessment each device is given
a PL (performance level), which describes its
suitability. Simple components can also be
described via their MTTFd (mean time to dangerous
failure) or B10d value (mean number of cycles until
10 % of the components fail dangerously).
The following considerations examine how the
failure of devices or their components affects thesafety of the system, how likely these failures areto occur and how to calculate the PL.

PL assessment
IEC ISO 13849-1 uses the diagnostic coverage (DC),system category and the system’s MTTFd to determine the PL. The DC depends on λDD (failure rate ofdetected dangerous failures) and λDtotal (failure rate of
total dangerous failures).
In the simplest case this is expressed as:
DC = Σλ DD /Σλ Dtotal

On complex systems, an average DCavg is
calculated:
DC1
DC2
DCN
+ ... ++
MTTFd1
MTTFd2
MTTFdN
DCavg =
1
1
1+
+ +MTTFd1
MTTFd2 ... MTTFdN

Determination of common cause failure –CCF factor
The assessment of measures against common
cause failures comprises several individual factors.
Structural aspects such as separation of thechannels as well as organisational aspects suchas training of the designers have an effect here.
An evaluation scale is used, on which a score of
between 0 and 100 % can be achieved.
Requirement

Score

Physical separation ofsafety circuits and other circuits

15 %Diversity (use of different
technologies)

20 %Design/application/experience

20 %Assessment/analysis

5%Competence/training

5%

Environmental influences(EMC, temperature, ...)

35 %The DC value is assigned a size range:
Diagnostic coverage

Range of DC

None

DC < 60 %Low

60 % ≤ DC < 90 %Medium

90 % ≤ DC < 99 %High

99 % ≤ DC

With homogeneous or single-channel systems, the
MTTFd value can be established approximately as
the sum of the reciprocal values of the individualcomponents, corresponding to the MTTFd value ofa single channel:
N

1
1=
MTTFd ΣMTTFd,ii=1With EN ISO 13849-1, the effect of the CCF
is deemed acceptable if the total score achievedis ≥ 65 %.

3-26© Pilz GmbH & Co. KG, 20172017-08

Chapter 3 Standards, directives and laws

3.4 Standards

MTTFd =

2
MTTFd, C1 + MTTFd, C2 3

1
1

1

+
MTTFd, C1 MTTFd, C2

Here too, a table is used to derive a qualitativeevaluation from the numeric value, which is thenused in subsequent considerations.
MTTFd assessment

MTTFd

Low

3 years ≤ MTTFd < 10 years

Medium10 years ≤ MTTFd < 30 years

High

30 years ≤ MTTFd < 100 years

The system architecture can be divided into
five different categories. The achieved category
depends not only on the architecture, but on thecomponents used and diagnostic coverages.
Note that the safety functions are broken down
into parts so that the failure of one part would
render the entire safety function non-functional(often called a subsystem). Each of thesesubsystems can have its own category.
In a final assessment stage, a graphic is used
to assign the PL based on the recently calculated
values.
The most practical approach is to select thecolumn for Category and DC first. Then choose
the relevant MTTFd range from the bar. The PL
result can now be read from the left-hand scale.
In most cases, some interpretation will still be
required, as often there is no clear relationshipbetween the MTTFd range and the PL.

3 Standards, directives and laws

With dual-channel, diverse systems, the MTTFd
value of both channels needs to be calculated
separately. Both values are included in thecalculation of the combined MTTFd, using theformula below.

In category 4, larger MTTFd values (andtherefore smaller probability of dangerous failures
per hour - PFHd values) can also be used thanshown in the graphic. Annex K of the standard
DIN EN ISO 13849-1 must be applied here.
The final step is to compare the required PLr levelfrom the risk assessment with the achieved PL.
If the achieved PL is greater than or equal to therequired PLr, the requirement for the implementationis considered to have been met.

Relationship between the categories DC, MTTFd and PL

10-4
a
10-5
b
3x10-6
c
10-6
d
10-7
e
10-8

PFH d
Performance level3 years
10 years
30 years
MTTFd = low,Cat. BDCavg= none

MTTFd = medium,Cat. 1DCavg= noneCat. 2DCavg= low

MTTFd = highCat. 2DCavg= med.

Cat. 3
DCavg
= low

100
years
Cat. 3DCavg= med.

Cat. 4*DCavg= high* In Cat. 4 MTTFd up to 2,500 a is possible

Graph to determine the PL in accordance with EN ISO 13849-1

2017-08© Pilz GmbH & Co. KG, 2017

3-27

Chapter 3 Standards, directives and laws

3.4 Standards
3.4.3.5 EN ISO 13855
Standard

Harmonised

Title

EN ISO 13855:2010
Replaces EN 999

Yes

Safety of machinery
Positioning of safeguards with respect tothe approach speeds of parts of the human body

3 Standards, directives and laws

EN ISO 13855 primarily defines human approach
speeds. These approach speeds need to beconsidered when designing safety measures andselecting the appropriate sensor technology.
Different speeds and sizes are defined, dependingon the direction and type of approach. Even an
indirect approach is considered.
The problem regarding measurement of theoverall stopping performance is consideredalongside the measurement of safety distances.
Clear specifications are provided as to how theoverall stopping performance should and should
not be measured.

Safeguards prevent operatorsfrom approaching hazardous movements.

3.4.3.6 EN ISO 13857
Standard

Harmonised

Title

EN ISO 13857:2008

Yes

Safety of machinery
Safety distances to prevent hazard zones being reached
by upper and lower limbs

EN ISO 13857 was first published in 2008 andexamines the safety distances required to prevent
hazard zones being reached by the upper andlower limbs. It is worth stressing that this standard
makes it clear that different anthropometric data
(size, length of limbs…) may apply for otherpopulations or groups (e.g. Asian countries,

3-28

Scandinavia, children) and that this could give rise
to other risks. Application of this standard may
therefore be restricted, particularly in the publicdomain or when exporting to other countries.

© Pilz GmbH & Co. KG, 20172017-08

Chapter 3 Standards, directives and laws

3.4 Standards
3.4.3.7 EN 61511 Safety instrumented systems for the process industry sector
Standard

Harmonised

Title

EN 61511
Parts 1-3:2004

No

Functional safety –Safety instrumented systems for the process industry sector

recognises a low demand mode. The key
characteristic for this mode is that a safety function
is demanded (operated) less than once per year.
As a result, EN 61511 introduced a PFD (Probabilityof failure on low demand) alongside the PFH(Probability of failure on high demand) and SILcl(maximum achievable Safety Integrity Level).
It is particularly worth noting that the SILcl for
low demand mode may vary from the SILcl forhigh demand mode.

3 Standards, directives and laws

The EN 61511 series of standards covers
safety issues concerning plants and systems
in the process industry. As a sector standard of
EN 61508, the EN 61511 series is a sister standard
of EN 62061. This is reflected in the similar observations and mathematical principles contained in thethree standards. However, an important difference
for most end users, as well as component manufacturers, is the differentiation between the demandmodes. High demand modes have always been
assumed in engineering, but EN 61511 also

3.4.3.8 EN 62061
Standard

Harmonised

Title

EN 62061:2016

Yes

Safety of machinery
Functional safety of safety-related electrical, electronic
and programmable electronic control systems

Contents

Scope

EN 62061 addresses the issue of risk assessment
using a risk graph, which in this case is in theform of a table. It also deals with the validation ofsafety functions based on structural and statisticalmethods. As with EN ISO 13849-1, the objective isto establish the suitability of safety measures toreduce risks.

EN IEC 62061 is one of the generic standards forfunctional safety. It has been adopted at IEC level
and in the EU is harmonised as a standard within
the Machinery Directive. It therefore provides
presumption of conformity within the EU. The
scope is given as the electrical, electronic andprogrammable electronic safety of machinery.
It is not intended for mechanical, pneumaticor hydraulic energy sources. The application of
EN ISO 13849-1 is advisable in these cases.

As with EN 13849-1, there is considerable
work involved in making the calculations
required under this standard. This can be
reduced considerably if appropriate software isused, such as the Safety Calculator PAScal.
https://www.pilz.com/de-INT/eshop/
00105002187038/PAScal-Safety-Calculator,
webcode: web150431

2017-08© Pilz GmbH & Co. KG, 2017

3-29

Chapter 3 Standards, directives and laws

3.4 Standards
Risk assessment/risk analysis

Determination of the required SIL

Risks are assessed in IEC 62061 using tables
and risk graphs. The evaluations made for eachindividual risk include the severity of potential
injuries, the frequency and duration of exposure,the possibility of avoidance of a risk and theprobability of occurrence of the risk. The outcomeof the assessment is the required safety integrity
level (SIL) for the individual risks.

According to EN IEC 62061 there are four
different parameters to assess. Each parameter isawarded points in accordance with the scores in
the following tables.
SIL classification, based on the above entries, ismade using the table below, in which the consequences are compared with the Class Cl. Class Cl
is the sum total of the scores for frequency,
duration, probability and avoidance. Areas marked
with OM indicate that the standard recommends
the use of other measures in this case.

3 Standards, directives and laws

In subsequent stages of the risk assessment,
the levels determined using the risk graph arealigned with the selected risk reduction measures.
For each classified risk, one or more measures
must be applied to prevent the risk from occurringor to sufficiently reduce the risk. The SIL for thatmeasure must at least correspond to the required
SIL, determined on the basis of the risk.

Frequency andFrFr

Probability ofPrduration of exposure < 10 min ≤ 10 min

occurrence≤ 1 hour5

Very high5

5

Avoidance

Av

5> 1 hour – ≤ 1 day

5

4

Likely4> 1 day – ≤ 2 weeks

4

3

Possible3

Impossible> 2 weeks – ≤ 1 year3

2

Rarely2

Rarely3> 1 year2

1

Negligible

1

Probable

1

Consequences
Death, losing an eye or arm
Permanent, losing fingers

Class Cl = Fr+Pr+Av
S

3-4

5-7

8-10

11-13

4

SIL 2

SIL 2

SIL 2

SIL 3

SIL 3

OM

SIL 1

SIL 2

SIL 3

OM

SIL 1

SIL 2

OM

SIL 1

3

Reversible, medical attention

2

Reversible, first aid

1

14-15

OM = other measures recommended

Risk graph in accordance with EN IEC 62061

3-30© Pilz GmbH & Co. KG, 20172017-08

Chapter 3 Standards, directives and laws

Assessing the implementation/examining
the system

Determination of common cause failure –CCF factor

The principle assumption is that there is no suchthing as a safe device. Devices only become
suitable through an appropriate design for use inapplications with increased requirements. As partof an assessment each device is given a SIL, which
describes its suitability. Simple components canalso be described via their MTTFd or B10d value.

The CCF factor is determined through a
combination of several individual assessments.
One of the first key parameters to examine is thesystem architecture. Systematic effects in particularneed to be assessed, such as the failure of several
components due to a common cause. The competence and experience of the developer are also
evaluated, along with the analysis procedures.
An evaluation scale is used, on which there are
100 points to be assigned.

The following considerations examine how the
failure of devices or their components affect thesafety of the system, how likely these failures areto occur and how to calculate the SIL.

Requirement

PointsPhysical separation of safety circuits
and other circuits

25

Diversity(use of different technologies)

38

Design/application/experience

2

Assessment/analysis

18

Competence/training

4

Environmental influences(EMC, temperature, ...)

18

3 Standards, directives and laws

3.4 Standards

The next step is to determine the β factor (Beta),
based on the points achieved using the following
table.
β factor – common cause factor

2017-08© Pilz GmbH & Co. KG, 2017< 35

10 % (0.1)

35-65

5 % (0.05)

66-85

2 % (0.02)

86-1001 % (0.01)

3-31

Chapter 3 Standards, directives and laws

3.4 Standards

3 Standards, directives and laws

SIL assessment
In EN 62061, the maximum achievable SIL is
determined via the dependency between the
hardware fault tolerance and the safe failure fraction(SFF). The SFF is calculated by assessing all possible
types of component failures and establishing whether
each of these failures results in a safe or unsafe
condition. The result provides the system’s SFF.

The structural analysis also indicates whether there
is any fault tolerance. If the fault tolerance is N, theoccurrence of N+1 faults can lead to the loss ofthe safety function. The following table shows the
maximum potential SIL, based on the fault tolerance
and SFF.

Safe failure fraction(SFF)

Hardwarefault tolerance 1

Hardwarefault tolerance 0

Hardwarefault tolerance 2< 60 %

Not permitted

SIL 1

SIL 2

60 %–< 90 %

SIL 1

SIL 2

SIL 3

90 %–< 99 %

SIL 2

SIL 3

SIL 3

99 %

SIL 2

SIL 3

SIL 3

The failure rates λ of the individual components
and their λD fraction (dangerous failures) can be
determined via PFHD formulas, which are dependent
on architecture. These formulas can be extremelycomplex, but always have the format:

The combined consideration of hardware, fault
tolerance, category, DC, PFHD and SFF provides
the following SIL assignment. All conditions must
always be met. If one single condition is not met,
the SIL has not been achieved.

PFHD = f (λ Di , β, T1 , T2 , DC i )where
T2 Diagnostic test interval
T1 Minimum test interval and mission time
PFHD

Cat.

SFF

≥ 10-6≥2≥ 60 %≥ 2x10-7

≥3

≥ 0%

-7

≥ 2x10≥3≥ 60 %≥ 3x10-8≥4≥ 60 %≥ 3x10≥4> 90 %-8

Hardwarefault tolerance

DC

SIL

≥0

≥ 60 %

1≥1≥ 60 %

1≥1≥ 60 %

2≥2≥ 60 %

3≥1> 90 %

3

The final step is to compare the required SIL fromthe risk assessment with the achieved SIL. If theachieved SIL is greater than or equal to the required
SIL, the requirement for the implementation isconsidered to have been met.

3-32

© Pilz GmbH & Co. KG, 2017

2008-11

Chapter 3 Standards, directives and laws

3.4 Standards
3.4.3.9 EN 60204-1
Standard

Harmonised

Title

EN 60204-1:2010

Yes

Safety of machinery
Electrical equipment of machines – Part 1:
General requirements

The harmonised standard EN 60204-1 considers
the electrical safety of non-hand-guided machinerywith voltages up to 1000 VDC and 1500 VAC.

Its scope is therefore such that there are very few
industrial machines that it does not affect.

Standard

Harmonised

Title

EN 61508-1:2010
EN 61508-2:2010
EN 61508-3:2010
EN 61508-4:2010
EN 61508-5:2010
EN 61508-6:2010
EN 61508-7:2010

No

Functional safety of safety-related electrical, electronic andprogrammable electronic control systems

EN 61508 is the key standard dealing with thefunctional safety of control systems. It has sevenparts in total and all together contains around1000 pages of text. The whole EN 61508 standards’
package was completely revised in 2010 and
Edition 2 is now available.
A key component of EN 61508 is the examinationof the complete lifecycle from a safety perspective(in Part 1), with detailed requirements of theprocedure and the content of the individual steps;
it’s essential to both machine builders and safety
component manufacturers alike.

3 Standards, directives and laws

3.4.3.10 EN 61508

This standard is also focused on the design ofelectrical systems and their corresponding software.
However, the standard is to be expanded in practiceand will frequently apply for other systems as well(mechanics, pneumatics, hydraulics). Manufacturersof safety components such as safety relays,
programmable safety systems and safety sensor/
actuator technology are likely to derive the mostbenefit from this standard.
Overall, when it comes to defining safety levels,
end users or system integrators are better
advised to use the much less complex EN 62061
or EN ISO 13849-1, rather than EN 61508.
Another sector standard of EN 61508 is EN 61511,
which is applicable for the process industry sector.

2017-08© Pilz GmbH & Co. KG, 2017

3-33

Chapter 3 Standards, directives and laws

3.4 Standards
Other requirements

Technical requirements
PART 1PART 4Development of theoverall safety requirements(concept, scope, definition,
hazard and risk analysis)
7.1 to 7.5

Definitions andabbreviations

PART 1PART 5
Examples ofmethods for thedetermination ofsafety integrity
levels

3 Standards, directives and laws

Allocation of the safety
requirements to the
E/E/PE safety-related systems
7.6

PART 1Documentation
Clause 5 andAnnex APART 1
Managementof functionalsafetyClause 6

PART 1
Specification of the safety
requirements forsafety-related E/E/PE systems
7.10

PART 6
Guidelines on
the application ofParts 2 and 3

PART 2

PART 3

Realisation phase
for E/E/PE
safety-related
systems

Realisation
phase forsafety-related
softwarePART 1
Functionalsafetyassessment
Clause 8

PART 7
PART 1

Overview oftechniques andmeasures

Installation, commissioning
and safety validationof E/E/PE safety-related systems
7.13 and 7.14

PART 1
Operation and maintenance,
modification and retrofit,
decommissioning or disposalof E/E/PE safety-related systems
7.15 to 7.17

Extract from DIN EN 61508-1, overall framework of the safety assessment in accordance with EN 61508.
Overall framework of the IEC 61508 series of standards

3-34© Pilz GmbH & Co. KG, 2017

2008-11

Chapter 3 Standards, directives and laws

3.4 Standards
1
Concept2Overall scope
definition

3
Hazard andrisk analysis

3 Standards, directives and laws

4
Overall safety
requirements

5Overall safety
requirements allocation

9
E/E/PE systemsafety requirements
specification

10

11

E/E/PE
safety-related systems

Other risk reduction
measures

Realisation(see E/E/PE systemsafety lifecycle)

Specification and realisation

Overall planning
8

12Overall installation andcommissioning planning

Overall installationand commissioning

7

13

Overall safetyvalidation planning

Overall safetyvalidation

Back toappropriate overall
safety lifecycle phase

6

14

15

Overall operation andmaintenance planning

Overall operation,
maintenance and repair

Overall modification
and retrofit

16
Decommissioningor disposal

Overall safety lifecycle in accordance with EN 61508-1

2008-11© Pilz GmbH & Co. KG, 2017

3-35

Chapter 3 Standards, directives and laws

3.4 Standards
3.4.3.12 EN 61326-3
Standard

Harmonised

Title

EN 61326-3 Part 1
and 2:2008

No

Electrical equipment for measurement, control and laboratory use –EMC requirements

3 Standards, directives and laws

With the release of EN 61326-3-1 and EN 61326-3-2,
since 2008 there have been two standards providing
information on immunity requirements in respect of
the EMC level on safety devices. Both parts havebeen specified with different immunity requirements.
Part EN 61326-3-1 is the general section with more
stringent requirements. This part was drawn up witha particular view towards mechanical engineering.
In contrast, part EN 61326-3-2 was written with aview towards the process industry and the immunity
requirements are significantly lower. In engineering,
therefore, it should always be ensured that the test

requirements in accordance with EN 61326-3-1
are met as a minimum. As the origin of boththese standards is still very recent and there are no
forerunners to refer back to, it will still be some time
before they are reflected in the relevant device
certificates. In general, it is to be noted that productor sector standards also contain EMC requirements,
but that these are usually below the requirements
specified in EN 61326-3-1.

3.4.4 Product standards
3.4.4.1 EN ISO 14119
Standard

Harmonised

Title

EN ISO 14119:2013

Yes

Safety of machinery
Interlocking devices associated with guards.
Principles for design and selection

ISO/TR 24119

No

Safety of machinery
Evaluation of fault masking in conjunction
with interlocking devices with potential-free contacts

The previous standards EN 1088 and ISO 14119
were combined with the publication of
EN ISO 14119:2013. The standard deals withguards, i.e. gates, covers or flaps, plus sensor
technology that detects the position of suchdevices. The standard also covers guard
locking devices.
The purpose of the standard is also to specify
exact requirements to improve provisions for
reducing the ability of the machine operator todefeat safety equipment. Investigations have shownthat operators often attempt to defeat the safetyfunction of an interlocking guard by defeating the

3-36interlock. The ability to defeat safety equipment
can mainly be attributed to deficiencies in themachine design. ISO/TR 24119 will be published at
the same time as EN ISO 14119; this is a spin-off
from EN ISO 14119. ISO/TR 24119 deals with only
one subject: evaluation of interlinked safety gate
switches. The context is the recurring accumulationof faults in conjunction with applications of thistype, which can lead to the loss of the safetyfunction for the plant.

© Pilz GmbH & Co. KG, 20172017-08

Chapter 3 Standards, directives and laws

3.4 Standards
Standard

Harmonised

Title

IEC/TS 62046:2008

No

Safety of machinery
Application of protective equipment
to detect the presence of persons

EN 61496-1:2012

Yes

Safety of machinery
Electrosensitive protective equipment – Part 1:
General requirements and tests

IEC 61496-2:2013

No

Safety of machinery
Electrosensitive protective equipment – Part 2:
Particular requirements for equipment using active optoelectronic
protective devices (AOPDs)

CLC/TS 61496-3:2008

No

Safety of machinery
Electrosensitive protective equipment – Part 3:
Particular requirements for active optoelectronic protective
devices responsive to diffuse reflection (AOPDDR)

While the 61496 series describes product-specificrequirements of electrosensitive protective
equipment, IEC/TS 62046 focuses on the selection
and measurement of electrosensitive protective
equipment such as light beam devices, light grids
or scanners. As such, it is one of the key standards
for machine builders when it comes to designingmachine access areas and safeguarding material
channels.

2017-08© Pilz GmbH & Co. KG, 2017

3 Standards, directives and laws

3.4.4.2 EN 61496 and IEC/TS 62046

The EN 61496 series of standards considers
electrosensitive protective equipment.
This includes devices such as light grids, laser
scanners, light beam devices, safe camera systems
and other sensors, which can all be used for
non-contact protection. As EN 61496 is a productstandard for safety components, it is only relevant
for the typical user if the safety components he has
used are intended to conform to these standards.

3-37

Chapter 3 Standards, directives and laws

3.4 Standards
3.4.4.3 EN 61800-5-2Standard

Harmonised

Title

EN 61800-5-2:2007

Yes

Adjustable speed electrical power drive systems Part 5-2:
Safety requirements – Functional

3 Standards, directives and laws

The EN 61800-5-2 is aimed at both drive
manufacturers and users. It deals with the issueof drive-based safety, but without specifying any
requirements regarding safety-related suitability.
No safety level is established, nor is there any
definite hazard or risk evaluation. Instead, thestandard describes mechanisms and safetyfunctions of drives in an application environment,
and how these are verified and planned within thedrive’s lifecycle. Technologically, the standard isbased on EN 61508, even though proximity withEN ISO 13849-1 might have been anticipated, given
the ever-present mechanical aspect of the drives.

Manufacturers of safe drives focus on EN 61800-5-2.

3-38© Pilz GmbH & Co. KG, 20172017-08

Chapter 3 Standards, directives and laws

3.4 Standards
3.4.5 Application standards
3.4.5.1 EN ISO 11161 Integrated manufacturing systems
Standard

Harmonised

Title

EN ISO 11161:2010

Yes

Safety of machinery
Integrated manufacturing systems – Basic requirements

The standard is of particular interest to operatorsand system integrators who operate or design
machine pools and plants incorporating machinesand components. This standard should be appliedin close co-operation with EN ISO 12100.

3 Standards, directives and laws

This standard deals with the safety aspects
when assembling machines and components intoa manufacturing system (IMS). It does not deal withthe requirements of the individual components
and machines.

3.4.5.2 NFPA 79
Standard

Harmonised

Title

NFPA 79:2015

No

Electrical standard for industrial machinery

This standard is mainly important for the US market,
though it is also applied in Asia. It is very similar to
the European standard EN 60204-1.

2017-08© Pilz GmbH & Co. KG, 2017

The standard is concerned with the safe
electrical design, the operation and the inspectionof industrial machinery.

3-39Chapter 3 Standards, directives and laws

3.5 International comparison of standards,
directives and laws

3 Standards, directives and laws

The highly comprehensive system for the EU directives established in Europe with the corresponding
harmonised standards in combination with the
CE conformity assessment procedure andCE marking procedure for safety components,
plant and machinery, is not automatically acceptedaround the world. In certain countries, other legallybinding laws, directives and standards apply which
are then to be observed and implemented forsmooth export. Safe plant and machinery also
contribute to increasing occupational safety inthese countries on principle, even though theclassification of the country-specific requirement
and implementation level varies widely andgenerally the high level of safety in Europe willassuredly not be reached. This safety compendium
is mainly concerned with European standards,
directives and laws. However, the following section
provides a brief overview of the situation outsideof Europe and in other parts of the world.
3.5.1 Directives and laws in America
3.5.1.1 North America (USA + Canada)

USA
Other laws, directives and standards generally
apply in the USA compared to Europe with regard
to safety requirements for plant and machinery.
CE mark and CE declaration of conformity haveno legal acceptance. An export solely based on
CE conformity is definitely illegal and to be
categorised as very critical with regard to
product liability.
In general, plant and machinery cannot becommissioned in the USA without approval byspecial officials from the states, counties ormunicipalities, the so-called authorities having
jurisdiction (AHJ). These inspectors are responsible
for the approval of electrical building and machinesafety (electrical building/field inspector), explosion
protection (hazardous location inspector) or thesafety of pressure equipment (pressure and vessels
code inspector), for example. Without theirapproval, there is generally no commissioning.
When safety deviations are determined, shutdown
until the defect is rectified is usually possible using
a red tag. This results in complex and expensive
retrofitting and conversion measures on-site in the
USA by the manufacturer and, where applicable, any
contractually agreed penalties for non-performance
incurred due to delayed commissioning.
The Occupational Safety and Health Administration(OSHA), a sub-agency of the US Department ofLabor, is responsible for defining and monitoringbasic health and safety measures in the USA.
They specify minimum requirements in the OSHA
standards; these can be found in the Code ofFederal Regulations (CFR) under 29 CFR 1910.
These are primarily directed at machine and plant
operators.
The situation is somewhat more complicatedin terms of plant and machine safety from the
manufacturer’s point of view.

3-40© Pilz GmbH & Co. KG, 20172017-08

Chapter 3 Standards, directives and laws

First of all, there is no uniform standards systemin the USA with one issuer of standards as is
the case in Europe with CEN/CENELEC and the
EN standards. There are a number of accredited
drafters that can develop and publish standards.
These are usually manufacturers’ associations.
The most prominent and most well-known inEurope are:Comprehensive product standards as found inEurope for the electrical and mechanical safetyof plant and machinery therefore do not exist in
the USA. There is only the series of standards
ANSI B11 for plant and machinery for metalworking,such as machine tools or forming machines, which
also contains clear mechanical safety requirements
in addition to the electrical requirements.

• ANSI American National Standards Institute• NEMA National Electrical Manufacturers
Association• NFPA National Fire Protection Association• UL Underwriters Laboratories

With regard to mechanical plant and machine safety
in the USA, the general position can be taken thata consistent implementation of mechanical safety
requirements based on the harmonised A, B and C
standards in accordance with the European
Machinery Directive provides a significant basis
for satisfying the safety requirements that apply in
the USA.

However, in most cases there is no legal application
requirement for these type of norms in the plantand machinery sector. According to the critical USA
product liability law, however, a manufacturer must
always use a search of standards to ascertain
which standards are applicable for his plant andmachinery. If there is product-specific applicability,
the normative requirements should also becompletely and correctly implemented in the plantand machinery. This prevents unnecessary productliability risks.

3 Standards, directives and laws

3.5 International comparison of standards,
directives and laws

Please contact Pilz with any concrete questions
about special national considerations for machineand plant safety. The Pilz subsidiary in the USA
together with the internationally established Pilz
services for automation, plant and machine safety
are available to provide targeted support for any
country-specific questions on this topic.

Examples of standards always to be observed
and applied include:• NFPA 70 – National Electrical Code (NEC)• NFPA 79 – Electrical Standard for Industrial
Machinery• UL 508A – Industrial Control Panels
This list makes it clear that the electrical safety ofplant and machinery is of particular significance.
Mechanical safety is less important comparedto the harmonised European standards and is also
not of significance during the approval by the above
inspectors.

2017-08© Pilz GmbH & Co. KG, 2017

3-41

Chapter 3 Standards, directives and laws

3.5 International comparison of standards,
directives and laws
CanadaOther laws, directives and standards generally
apply in Canada compared to Europe with regard
to safety requirements for plant and machinery.
CE mark and CE declaration of conformity haveno legal acceptance. An export solely based on
CE conformity is definitely illegal and not encouraged for reasons relating to product liability.
3 Standards, directives and laws

In general, no machine or plant is commissioned in
Canada without approval by special officials fromthe provinces, the so-called safety authority officers(SAO). The term authorities having jurisdiction (AHJ)
is also used in Canada, however. These safety
inspectors are responsible for the approval ofelectrical building and machine safety (electricalbuilding/field inspector), explosion protection(hazardous location inspector) or the safety ofpressure equipment (pressure and vessels code
inspector), for example. Without their approval,
there is generally no approval of commissioning.
When safety deviations are determined, shutdown
until the defect is rectified is possible.

The situation in Canada is somewhat simpler interms of plant and machine safety from the
manufacturer’s point of view compared to the USA.
Unlike in the USA, there is a uniform standards
system in Canada with one issuer of standards,
the Canadian Standards Association (CSA), as isalso the case in Europe with CEN/CENELEC andthe EN standards. There is therefore only one
type of standard in Canada, the CSA standards.
However, in most cases there is no legal application
requirement for these type of norms in the plant andmachinery sector. Despite the less strict Canadianproduct liability law, a manufacturer should stillalways use a search of standards to ascertain
which standards are applicable for his plant andmachinery. If there is product-specific applicability,
the normative requirements should also be completely and correctly implemented in the plant andmachinery. This prevents unnecessary productliability risks.
Examples of Canadian standards always
to be observed and applied include:

This results in complex and expensive retrofitting
and conversion measures on-site in Canada by
the manufacturer and, where applicable any,
contractually agreed penalties for non-performance
incurred due to delayed commissioning.

• CSA 22.1 – Canadian Electrical Code (CEC)• CSA 22.2 No.286 – Industrial Control Panels
and Assemblies• SPE 1000 Model Code for the Field Evaluationof Electrical Equipment

The Canadian Centre for Occupational Health and
Safety (CCOHS) is responsible for defining andmonitoring basic health and safety measures in
Canada. This Canadian office is comparable with
OSHA in the USA (see 3.5.1.1/USA) and also
defines the minimum requirements for health andsafety for plant and machinery that primarily apply
for the plant and machine operator.

This list makes it clear that the electrical safety ofplant and machinery is of particular significance.
Mechanical safety is less important comparedto the harmonised European standards and is also
not of significance during the approval by the above
inspectors.
Comprehensive product standards as found inEurope for the electrical and mechanical safetyof plant and machinery therefore do not exist
in Canada.

3-42© Pilz GmbH & Co. KG, 20172017-08

Chapter 3 Standards, directives and laws

3.5 International comparison of standards,
directives and laws
There is an important Canadian standard thatmust be observed, however, that handles machinesafeguards:

European directives and their harmonised standards
enjoy a certain importance in South America withregard to safety, you must not automatically assume
a general acceptance.

• Z432 – Safeguarding of Machinery
Brazil

3 Standards, directives and laws

This standard contains both basic electrical andmechanical requirements of such safeguards,
irrespective of the type of plant or machine, andis comparable with the status of a European A
standard or at most a B standard.
With regard to mechanical plant and machine safety
in Canada, the general position can be taken thata consistent implementation of mechanical safety
requirements based on the harmonised A, B and C
standards in accordance with the European
Machinery Directive provides a significant basis
for satisfying the safety requirements that apply in
Canada.
Please contact Pilz with any concrete questions
about special national considerations for machineand plant safety. The Pilz subsidiary in Canada
together with the internationally established Pilz
services for automation, plant and machine safety
are available to provide targeted support for any
country-specific questions on this topic.
3.5.1.2 South America
With the exception of Brazil, there are currently
no product-specific safety requirements for plantand machinery that are concrete and applicablefor South American countries. There are national
standards organisations that develop national
standards and convert ISO or IEC standards inparticular to national standards. At the moment
the focus here is almost exclusively on standards
for consumer products, however. A case-specificcheck of the safety requirements that must be met
is therefore recommended for the export of plantand machinery to South America, for example
by means of concrete inquiry in written form tothe client/purchaser and/or operator. Even if the

2017-08© Pilz GmbH & Co. KG, 2017

As of 2010, there is a national law in Brazil that
stipulates minimum safety requirements
for machines and (machine) equipment:• Norma Regulamentadora 12 (NR-12) –MÁQUINAS E EQUIPAMENTO
The law has been in place since 1978, without reallyhaving been consistently implemented and enforcedby the authorities. With the last – essentially complete – revision in 2010, measures for monitoringby the authorities were implemented thus rendering
NR-12 essentially binding.

3-43Chapter 3 Standards, directives and laws

3.5 International comparison of standards,
directives and laws
During the revision, it was adapted to theEuropean Machinery Directive 2006/42/EC to agreat extent. The safety requirements from Annex Iof the Machinery Directive including individual
special requirements for certain machine types wereactually adopted wherever possible. In Europe, thislaw is therefore also referred to as the “Brazilian
Machinery Directive”.

3 Standards, directives and laws

NR-12 primarily targets the machine operator andapplies for old, used and new machines in contrast
to the European Machinery Directive.
A declaration of conformity as confirmation of
the implemented safety requirements in accordancewith NR-12, as stipulated in Europe, is currently
not required from the operator or the manufacturer.
In this case, the operator must verify that theplant or machinery satisfies the requirements inaccordance with NR-12. The reverse conclusion
here is that when exporting machines to Brazil,
a company is generally confronted with an operator
with corresponding demands. The authorities
namely impose corresponding compulsory
measures on the operator to ensure implementationin the event of non-compliance with NR-12.
One of the demands that is simple but still not
to be underestimated is the provision of operating,installation and maintenance manuals in Brazilian
Portuguese. This is not identical to the language
version for the EU country Portugal.

In terms of standardisation, the Brazilian standards
organisation Associação Brasileira de Normas
Técnicas (ABNT) develops the country-specificnational standards NBR (Norma Brasileira Regulamentadora), but also increasingly converts ISO andIEC standards to national standards. The currently
valid versions of ISO and IEC standards are often
not adopted, however; instead older versions areused. The standardisation system is therefore to beconsidered comprehensive but in most cases not tothe current status of international or European
standardisation.
A valid reverse conclusion is that plant andmachinery built in accordance with current
European directives and harmonised standards
with CE conformity generally have excellent
preconditions for problem-free commissioningin Brazil. A case-specific check of the safety
requirements that must be met is still recommended
for the export of plant and machinery to Brazil, forexample by means of concrete inquiry in written
form to the client/purchaser and/or operator.
Please contact Pilz with any concrete questions
about special national considerations formachine and plant safety. The Pilz subsidiary inBrazil together with the internationally established
Pilz services for automation, plant and machinesafety are available to provide targeted support for
any country-specific questions on this topic.

A harmonised standardisation to NR-12 currently
does not exist but initial consideration and discussion
on the national level is currently underway with regard
to gradually supplementing NR-12 with harmonised
standards, building on the European harmonisation
system. In this context, the possibility of certification,e.g. for safety components, is being considered.
Practical implementation is currently by no means
foreseeable, however.

3-44© Pilz GmbH & Co. KG, 20172017-08

Chapter 3 Standards, directives and laws

3.5 International comparison of standards,
directives and laws
3.5.2.1 Russia/Russian Federation

Until 2011, plant and machinery were required to
produce a GOST-R certificate under certain
preconditions to be eligible for import in the RussianFederation. The (international) customs tariff number(HS code – Harmonized Commodity Description
and Coding System) helped to form the basis asa criterion for determining products requiringcertification.
In September 2009 a decree by the RussianFederation came into effect that stipulates basic
minimum requirements for safety for machines
and equipment as well as a mandatory conformity
assessment procedure combined with a certification
procedure:• N 753 Decree of the Government of theRussian Federation – Technical Regulation (TR)on safety of machines and equipment
The basis is a contractual harmonisation process
between the EU and the Russian Federation toalign the different safety-related regulation andconformity assessment procedures for machineryin the Russian Federation. The decree includes
two annexes, one a list of the machines requiringcertification and one with machines for which a
Russian declaration of conformity is sufficient.

2017-08© Pilz GmbH & Co. KG, 2017

Obligation for certification
With an obligation for certification, the machinemust be checked by a locally accredited test
laboratory and a TR certificate must be issued. The
procedure is comparable to a type examination inaccordance with the Machinery Directive.
Declaration of conformity
If a declaration of conformity is sufficient, thismust still be additionally checked, approved andregistered by a nationally accredited certification
body. This type of declaration of conformity is NOT
a self-certification by the machine manufacturer aspermissible and common in Europe in accordance
to the Machinery Directive and the corresponding
harmonised standards.

3 Standards, directives and laws

3.5.2 Directives and laws in Asia

The customs tariff number still plays a certain role
here as there is a comprehensive list containing all
products, meaning not only machines, that requirecertification or conformity.
The basis for ensuring machine safety is formedby the Russian standards GOST (Gossudarstwenny
Standart). There are currently a large number ofmachine-specific safety standards. In addition to
the national Russian GOST-R standards, ISO andIEC standards are increasingly being converted into
GOST R ISO, GOST ISO, GOST R IEC or GOST IEC,
either with deviations or even with as little modification as possible. Furthermore, EN standards fromthe harmonised section of the European Machinery
Directive have been and continue to be adopted as
Russian GOST EN standards if no comparable
machine-related ISO and IEC standards exist.
Since July 2010, a customs union (CU) between
the three Eurasian countries of Russia, Belarus
and Azerbaijan has come into effect. This was
expanded in 2015 to include the countries ofArmenia and Kyrgyzstan. In the medium and longterm, this customs union is to incorporate
additional post-Soviet states.

3-45

Chapter 3 Standards, directives and laws

3.5 International comparison of standards,
directives and laws
The TR for machinery is valid in all countries in thecustoms union and the relevant Russian GOST
standards are recognised as the basis for conformity.

3.5.2.2 Japan

3 Standards, directives and laws

The EAC (EurAsian Conformity) is anindependent Eurasian conformity mark that exists
as an externally visible mark:Please contact Pilz with any concrete questions
about special national considerations for machineand plant safety. The Pilz subsidiary in Russia
together with the internationally established Pilz
services for automation, plant and machine safety
are available to provide targeted support for any
country-specific questions on this topic.

The Japanese Industrial Safety and Health Law
places demands on design issues relating to certain
machinery (cranes, lifts etc.). The law also statesthat the machine operator is responsible for carryingout risk analyses. He also has to ensure safety inthe workplace. It is assumed that the machine
operator will ask the machine manufacturer to issue
a risk analysis report at the time of purchase andthat the machine is designed safely. The law
also contains requirements for pressure vessels,
packaging machines for the food industry andmobile machines.
Japan generally adopts the IEC and ISO standards
as national JIS standards (Japanese Industrial
Standards); however, the Industrial Safety and
Health Law does not directly refer to each of thesestandards. There is therefore no legal obligation toactually apply and implement these JIS standards.
There are currently no concrete obligations for
acceptance or approval for plant and machinery.

3-46© Pilz GmbH & Co. KG, 20172017-08

Chapter 3 Standards, directives and laws

3.5 International comparison of standards,
directives and laws
3.5.2.3 China

There is currently an obligation for certificationfor 23 product categories with 132 productgroups from the consumer, electronic and industrial
product branches.

3 Standards, directives and laws

Plant and machinery are not subject to this. Theinternationally harmonised customs tariff number,called the HS code (Harmonized Commodity
Description and Coding System), is an importantsearch criterion for an existing obligation forcertification in the Chinese customs manual. An
additional search criterion is checking whether the
Chinese standard valid for a product is marked as
mandatory.
China has an independent national standards
system; the Standardization Administration of China(SAC) is responsible for developing this. This
standards organisation issues the national GB or
GB/T standards.

In China the State Administration of Work Safety is
responsible for defining and monitoring health andsafety measures. Monitoring is guaranteed by local
health and safety inspectors. Chinese machinesafety standards are used for plant and machinery.
Furthermore, since May 2002 China has had its own
Chinese certification system – Chinese Compulsory
Certificate (CCC). The CCC mark is used to markcertified products:• GB = Guobiao, meaning national standard• GB/T = Guobiao/Tujiàn, meaning
recommended national standard. Becomesmandatory if referenced in GB standards
In the area of machine safety, the SAC generally
adopts international ISO and IEC standards, inmany cases only with national deviations and notbased on the most current international versionsof the standard.
If there are no international standards, in somecases European EN standards harmonised for the
Machinery Directive are converted in the samemanner into national Chinese standards. An
application problem stems from the publicationin Chinese language, English language official
standard versions are, however, currently only
available in exceptional cases.
Please contact Pilz with any concrete questions
about special national considerations for machineand plant safety. The Pilz subsidiary in China
together with the internationally established Pilz
services for automation, plant and machine safety
are available to provide targeted support for any
country-specific questions on this topic.

2017-08© Pilz GmbH & Co. KG, 2017

3-47

Chapter 3 Standards, directives and laws

3.5 International comparison of standards,
directives and laws

3 Standards, directives and laws

3.5.2.4 South Korea

In South Korea, the Korea Occupational Safety &Health Agency (KOSHA) is the governmental
agency responsible for developing, implementing
and monitoring health and safety measures. The
Korean Occupational Safety & Health Act forms
the basis for KOSHA’s work. An important elementof the monitoring performed by KOSHA is theapproval procedure for various safety components,
machines and plants. The system of 13 existingcertifications with legal obligation that existed until
December 2008 was converted into a new uniform
certification system; this was bindingly implemented
with a transition period beginning in June 2011. Thisis signalled on plant and machinery using the KCs
mark (Korean Certification Safety Mark)and documented by means of a certificate. The
following nationally accredited testing institutes
are responsible for the certification:• ERI – EMC Research Institute• KETI – Korea Electronics Technology Institute• KTL – Korea Testing Laboratory

3-48

There are two different certification or approval
procedures that are to be requested by the machineand plant manufacturer as the importer before
export; these must be performed with a positive
test result:
Mandatory certification
for hazardous machinery
For hazardous machinery, a complete machine
test must be performed by an independent locallyaccredited test laboratory. This test procedure islegally prescribed for cranes, pressure vessels,
lifts, mobile lifting platforms, certain inclined lifts,
presses, press brakes, rolling machines, injection
moulding machines and hand-held chain saws.
In terms of content, this test procedure is roughly
comparable to a type examination in accordancewith Annex IV of the Machinery Directive.
Self-certification by the machine manufacturer
Here, the machine manufacturer must use
comprehensive documentation to verify to a
locally accredited test laboratory that the safety
requirements/standards relevant in South Korea
for the respective machine type have been applied,
implemented, checked, documented and thus
satisfied. This procedure can be applied for thefollowing stationary machine types: industrial
robots, grinding machines, machine tools,
woodworking machines, printing presses,
mixing and shredding machines, food preparation
machines, conveyors and vehicle lifts. The
documents to be provided are comparable with the
document creation for a complete EU conformity
assessment procedure in terms of content.
Please contact Pilz with any concrete questions
about special national considerations for machineand plant safety. The Pilz subsidiary in South Korea
together with the internationally established
Pilz services for automation, plant and machinesafety are available to provide targeted support for
any country-specific questions on this topic.

© Pilz GmbH & Co. KG, 20172017-08

Chapter 3 Standards, directives and laws

3.5 International comparison of standards,
directives and laws
3.5.3 Directives and laws in Oceania
3.5.3.1 Australia

As a member of the British Commonwealth, Australia
traditionally follows Great Britain’s administrative
procedures. This is also noticeable in the health andsafety measures thanks to commonalities – importantfor machine and plant manufacturers – with theEuropean Machinery Directive and the associatedharmonised standardisation.

Since 2013, a broadly uniform law for necessary
health and safety measures to be implemented
has applied in four of the continent’s six statesand its two territories. The national office Safe Work
Australia is responsible for developing and defining
the legal framework conditions and for monitoring.
The national law Work Health and Safety Act (WHS)
forms the basis for health and safety.
Only the states Victoria and West Australia havedeveloped and implemented their own health andsafety requirements as Occupational Health and
Safety Acts.
The defined health and safety measures are
generally legally binding and must therefore beobserved. There are various application andimplementation guidelines, called the Model Codesof Practice. These primarily directly target the local
operator and not the manufacturer of plant andmachinery. Nevertheless, a manufacturer must
deal with this in order to avoid potential problems
during the commissioning in Australia.
The monitoring is performed by inspectors
in the respective states and territories.

2017-08© Pilz GmbH & Co. KG, 2017

3 Standards, directives and laws

Australia has its own standards system;
Standards Australia is responsible for developing
this. This standards organisation issues theAustralian Standards (AS) national standards.
The following AS standards apply for the machinesafety sector:• Standard series AS 4024.xxxx –Safety of machinery• AS 60204.1 – Electrical equipment of machines,
general requirements• Standard series AS IEC 61511.x –Functional safety in process industry• AS 62061 Safety of machinery –Functional safety electrical, electronic andprogrammable electronic control systems
These standards are always to be observed, even
if there are currently no concrete requirements forlegally binding implementation from Australian
health and safety legislation. The Australian machinesafety standard is based primarily – but not completely – on the acceptance of ISO or IEC standards
and also standards harmonised for the European
Machinery Directive. The current version of aninternational or European standard has not always
been adopted, however.
Please contact Pilz with any concrete questions
about special national considerations for machineand plant safety. The Pilz subsidiary in Australia
together with the internationally established Pilz
services for automation, plant and machine safety
are available to provide targeted support for any
country-specific questions on this topic.

3-49

Chapter 3 Standards, directives and laws

3.5 International comparison of standards,
directives and laws

3 Standards, directives and laws

3.5.3.2 Directives and laws in New Zealand

As a member of the British Commonwealth,
New Zealand traditionally follows Great Britain’s
administrative procedures. This is also noticeable
in the health and safety measures thanks tocommonalities – important for machine andplant manufacturers – with the European Machinery
Directive and the associated harmonised standardisation. New Zealand has its own standards system;
Standards New Zealand is responsible for developing this. This standards organisation issues the
New Zealand Standards (NZS) national standards.
The corresponding Australian AS standards are
generally adopted as AS/NZS standards for themachine safety sector:

Since 2015, the Health and Safety Work Act (HSW)
has applied in New Zealand for necessary
health and safety measures to be implemented.
The national office WorkSafe New Zealand is
responsible for developing and defining the legal
framework conditions and for monitoring.
The defined health and safety measures are
generally legally binding and must therefore beobserved. There are various application andimplementation guidelines, which primarily
directly target the local operator and not the
manufacturer of plant and machinery. Nevertheless,a manufacturer must deal with this in order toavoid potential problems during thecommissioning in New Zealand.
The monitoring is also performed by local
inspectors in New Zealand.

3-50• Standard series AS/NZS 4024.xxxx –Safety of machinery
These standards are always to be observed, even
if there are currently no concrete requirements forlegally binding implementation from New Zealandhealth and safety legislation.
Like the AS standards, the New Zealand machinesafety standard is also based on the acceptanceof ISO or IEC standards and also standards
harmonised for the European Machinery Directive.
The current version of an international or European
standard has not always been adopted, however.
Please contact Pilz with any concrete questions
about special national considerations for machineand plant safety. The Pilz subsidiary in New Zealand
together with the internationally established Pilz
services for automation, plant and machine safety
are available to provide targeted support for any
country-specific questions on this topic.

© Pilz GmbH & Co. KG, 20172017-08

Chapter 3 Standards, directives and laws

3.5 International comparison of standards,
directives and laws
The brief – and certainly incomplete – comparisonof European and global requirements for machineand plant safety is solely intended to highlight theat times extremely varied and above all highlyinconsistent situation with regard to safety requirements for plant and machinery outside of Europe.
The machine and plant manufacturer must
therefore deal with the special country-specificlaws, directives and standards relevant for his
product and familiarise himself with these in goodtime. This is the basic requirement for what isthen highly problem-free export of plant andmachinery outside of Europe.
In general, however, it can be said that compliancewith and actual implementation of the EU directives
and harmonised standards relevant for the respective plant and machinery is a major precondition
for being able to export plant and machinery
globally while keeping the time and cost relatively
manageable.

2017-08© Pilz GmbH & Co. KG, 2017

This also shows the general significance of theEuropean directive concept with the highly detailed
harmonised standards system in particular, evenin the international sector. There is currently nocountry in the world outside of the EU that has thistype of comprehensive safety concept for plant andmachinery that covers practically all safety-related
sectors and still remains uniform. Machine and plant
manufacturers can depend on this, even though
the CE mark and CE declaration of conformity do
not enjoy any real legal acceptance globally. The
idea – that many machine and plant manufacturers
still entertain – that CE conformity practicallytranslates into a free pass for global export is plain
wrong. In the end, this is essentially “only” a selfcertification by the manufacturer that claims that
he observed, applied and actually implemented all
directives and harmonised standards that apply tohis product. And various countries outside ofEurope only trust this to a limited extent.

3 Standards, directives and laws

3.5.4 Summary

3-51

Chapter 3 Standards, directives and laws

3.6 Industrial robot,
human-robot collaboration (HRC)

3 Standards, directives and laws

ationa

l Com

plic
atio
n
Risk Antio tda emen 4il
Va asur typeSa
Co fetync an
ep d A
t
u

st

em

Im

ple

men

to
m

ati

on

tationAnalysis of the application
Documentation of the main peripheral devices ofthe planned robot application. The process andsafety-related requirements, such as cycle time,
repetition accuracy, workplace, hazardous areas,etc., are integrated into the rough plans for thesystem. Technical and economic evaluation
then take place.
Risk assessment
Review of the robot application in accordancewith the applicable standards and directives andassessment of the existing hazards.
Safety concept
Development of a detailed technical solution for thesafety of the robot application through mechanical,
electronic and organisational measures.
Safety design
By detailed elaboration of the necessary protective
measures, the danger zones of the application are
reduced or eliminated.

3-52

Ap

e

e
m RC
H
ce
for for
.
l
inc

Sy

ment

ssess

pliancEngineering

InternAnndg a rtoinin
Tra Supp
cal
hni
Tec

aly
sis

Lifecycle

System implementation
The results of the risk assessment and safetyconcept are implemented to suit the particularrequirements through selected safety measures.
Validation
Examination and mirroring of the risk assessment
and safety concept as well as performance ofthe collision measurement in accordance with
ISO/TS 15066 limit values.
International compliance
Ensuring that the machinery conforms to theregulatory requirements, be it CE marking in Europe
for example or OSHA in the US, NR-12 in Brazil,
KOSHA in Korea, GOST in Russia or CCC in China.
Training and technical support
Dissemination of expertise relating to thesafe application of robots.

© Pilz GmbH & Co. KG, 20172017-08

Chapter 3 Standards, directives and laws

3.6 Industrial robot,
human-robot collaboration (HRC)
As per Machinery Directive 2006/42/EC,
a robot system is partly completed machinery.
This means that robot systems are initially to beclassified as not safe and require CE marking.
This is due to the fact that taken by itself, a robot
does not have any specified purpose. Its intended
use is only defined by the integrator, who creates
the robot application and equips the robot witha tool.
The integrator is the person placing the machineon the market (robot cell). He must perform theconformity assessment procedure, which concludes
with the EC Declaration of Conformity.

A standards are the highest level
and are concerned with essential
health and safety requirements
for machines

B1 standards are concernedwith safety aspects
B2 standards are concernedwith safeguards
C standards areconcerned witha specific machinetype or machinegroup© Pilz GmbH & Co. KG, 2017

EN ISO 10218-1 is solely concerned with theactual robot system.
In contrast to this, EN ISO 10218-2 expands
the perspective to the entire robot application.
Both standards are type C standards. Thismeans these are product-specific standards
that are arranged above the type A and type B
standards in the hierarchy.

EN ISO 12100 Safety of machineryA
B1, B2C

In practice, however, the standards have proved to
be insufficient when it comes to safely implementing
an actual collaboration between man and machine
in which the respective work areas can overlap interms of time and space. The standards contained
a loophole, which has been closed with the
publication of ISO/TS 15066.

2017-08

For detailed safety requirements, the two standards
ISO 10218 “Safety of Industrial Robots” Part 1:“Robots” and Part 2: “Robot systems andintegration” were previously available.
The English versions of both parts are published
as EN ISO 10218-1:2011 and EN ISO 10218-2:2011
and are listed under the Machinery Directive
2006/42/EC.

3 Standards, directives and laws

3.6.1 Normative specifications
for the use of industrial robots

EN ISO 13849-1
Safety-related parts
EN 574 Two-hand control devices
EN 13850 Emergency stop devices
EN ISO 23125 Turning machines
EN 422 Blow moulding machines
EN 692 Mechanical presses

HRC requires protective measures to ensure thathuman safety is guaranteed at all times during
collaborative operation. ISO/TS15066 describes
in detail four types of collaboration as protection
principles. In addition, the maximum permissible
biomechanical limit values for a collision between
humans and robots are defined here.

3-53

Chapter 3 Standards, directives and laws

3.6 Industrial robot,
human-robot collaboration (HRC)
3.6.2 Robot applications from the perspectiveof EN ISO 10218-2
As mentioned above, EN ISO 10218-2 hasa broader focus. It examines the entire robot
application.

Four types of collaboration are described in
TS 15066 as protection principles. These four
methods can be applied individually to safeguard
HRC applications. Each individually – or as a
combination.
Method 1: Safety-rated monitored stop

A robot cell can be comprised of the following
components:
3 Standards, directives and laws

• Industrial robots• End effector (robot tool)• Workpiece• Machine equipment
In contrast to rotative drive technology, thesafety functions are not clearly named andspecified in standards for robotics.

The human only has access to the robot once
stopped (“safety-rated monitored stop”). Aspectsof sensor technology are not discussed here.
The robot system must not start up again
automatically and unexpectedly. This could
occur due to faults in the safety-related parts ofthe control systems, for example.

Safety functions of the industrial robot system
may include:• Safe stop
• Safely reduced speed• Safe axis limitation• Safe workspace monitoring• Etc.
The detailed specification is always specificto the manufacturer, however, and can vary. For
this reason, it is very important to inspect thecertificates of the respective manufacturers to
be able to classify the performance level of thesafety functions.

Method 2: Hand guiding
The human also only has access to a stationary
robot here. The hand guiding of the robot system
can only be enabled by manually operating an
enabling device.

The performance level of safety-related partsin control systems is described in Chapter 5.2 of
EN ISO 10218-2. Under 5.2.2 a dual-channel
control structure is specified, PL d, Cat. 3 as per
EN ISO 13849-1.

01
03.6.3 Human-robot collaboration
and ISO/TS 15066
EN ISO 10218-2 only touches on the topic of
human-robot collaboration. For this reason, thetechnical specification ISO/TS 15066 was created.
This has been available since February 2016 anddiscusses the topic of HRC in detail.

3-54© Pilz GmbH & Co. KG, 20172017-08

Chapter 3 Standards, directives and laws

3.6 Industrial robot,
human-robot collaboration (HRC)
Method 3: Speed and separation monitoring

Method 4: Power and force limiting

With this method, the distance between humanand robot is permanently monitored by a sensor.
The robot system moves with correspondingly
safely reduced speed.

In contrast to methods 1 to 3, with method 4
contact between human and robot is possible“under certain circumstances”. The manufacturerof the application must guarantee, however, thatthe collision between human and robot is nothazardous to the human.
The manufacturer of the application confirms thiswith a signature on the declaration of conformity.

3 Standards, directives and laws

The closer the human gets to the robot, theslower the robot becomes. If the distance is too
short, a safety stop is triggered.

A safe HRC application requires robot systems
that are specifically designed for the respective
collaboration type. The risk reduction can be
implemented either through application of thetypes of collaboration or by means of an inherently
safe design of the robot and the workspace.
Inherent in this case means that the robot systemcannot generate a hazardous collision due to its
design properties.
There is currently no sensor technology on
the market that can completely map method 3 ina safety-related manner.
In a static variant, this is currently possible withscanners or SafetyEYE.
Safety is guaranteed in the first three methods
by maintaining the distance between human andmachine. A collision between human and robot is
not permissible here. When implementing one ofthese three methods, no special HRC robots arenecessary. Standard industrial robots can beused that are equipped with corresponding safety
packages for speed monitoring or workspacemonitoring by the manufacturer.

2017-08© Pilz GmbH & Co. KG, 2017

3-55

Chapter 3 Standards, directives and laws

3.6 Industrial robot,
human-robot collaboration (HRC)
Reduced force/power robot

3 Standards, directives and laws

A robot system that “feels” the collision due toits sensor technology and then stops its movement.
This collision detection is implemented using partsof the robot control system. With regard to therequirements that are valid for safety-relatedparts of control systems, TS 15066 refers backto the previously discussed Chapter 5.2 of
EN ISO 10218-2 (PL d, Cat. 3).
Collisions can thus be mitigated in a number ofways: through design measures such as roundededges and corners, padding, or the largest possible
contact surfaces so as to distribute the force
over the surface. Technical protective measures
may also be used (e.g. reducing the dynamics ofthe robot movements and adapting the robot’s
trajectory to avoid collisions with particularly
sensitive body regions). Staff training can also help
to reduce the risk of injury.
Finally however, it is absolutely essential that ameasuring procedure is used to calculate whether
the potential collisions are harmless from thepoint of view of safety. Annex A of the Technical
Specification ISO/TS 15066 provides a bodymodel with 29 specific body areas, divided into
twelve body regions.
The body area model provides details of therespective pain threshold for each part of the body(e.g. on the head, hand, arm or leg) with a view toforce and pressure. The limit values designate when
the pain begins.

3-56

These limit values define the maximum force towhich the corresponding body region can be
exposed during a collision. The most sensitive
area is the head. It should be possible to rule out
a collision with the head during the intended use
to the greatest possible extent. If the application
remains within these limits during contact between
human and robot, it conforms to the standard.
The ISO also clearly differentiates between thetype of collision. There are two different types ofcollision:• The transient contact between human androbot. This corresponds to an impact from therobot. The human is hit by the robot but has
the chance to retreat. He is not trapped.
This type of collision is considered by TS 15066
to be less dangerous than the quasi-static
contact. For this reason, the TS allows double
the limit values for a collision in which the humanis not crushed. The head is an exception. The limit
values are not allowed to be doubled here.
• The quasi-static contact between human andmachine. This contact corresponds to crushing of
the human. There is a counter surface (applicationor building structures) in the immediate vicinityof the human. Avoidance is not possible, thecorresponding body region is crushed andthe person is possibly trapped and cannot freehimself. The TS only allows double the limit values
for the first 0.5 s of the collision. This is not valid
for body regions that affect the head, however.

© Pilz GmbH & Co. KG, 20172017-08

Chapter 3 Standards, directives and laws

3.6.4 Validation

Level 3: Overrun measurement

Validation means checking the real application.
All risk-reducing measures from the risk assessment
are again checked for implementation and completeness.

If optical safeguards were installed in the system,a check must be performed as to whether they were
installed in conformity with EN ISO 13855. This iscarried out with a calibrated and certified overrun
measurement device and, if the test is passed,
confirmed with a quality seal on the optical safeguard. The time for the next inspection should also
be clearly legible on the quality seal.

The application should be completely set up andready for delivery.
The validation phase of a robot cell comprises
the following levels:
Level 1: Calculating the performance level
The necessary PLr was already determined during
the design phase. Now for every safety function,a check is performed to determine whether therequired PL is actually achieved with the selectedcomponents.
This can be performed with supporting tools suchas the Safety Calculator PAScal, for example.

3 Standards, directives and laws

3.6 Industrial robot,
human-robot collaboration (HRC)

Level 4: Examination of the collision
HRC applications that already follow method 4 – asmentioned earlier – with which a collision between
humans and robots is possible, must maintain thebiomechanical limit values from ISO/TS 15066.

Compliance with the biomechanical limit values
is absolutely necessary, irrespective of whether it
is an inherently safe robot system or a robot
system with reduced force/power.

Level 2: Safety-related check
All components are checked for proper implementation on the complete robot cell. The goal is
uncovering any faults during the installation,
programming and commissioning. The checkof robot systems in particular is a real challenge
due to their high degrees of freedom. Not only
must the robots be validated, but also every otherperiphery device in the application.

2017-08© Pilz GmbH & Co. KG, 2017

ISO/TS 15066 gives instructions on the mathematicaldesign of a collaborative robot system. This is only
a theoretical approach, however. This approach
only considers the transient contact. There is nomathematical solution for the quasi-static contact.
A practical verification of the collision values that
actually occur is thus absolutely necessary.
During the examination of the collision, all possible
collision scenarios are checked in real-life situations.
Every body area is simulated here using the information available in ISO/TS 15066. With a collision
measurement device developed specially for this,the characteristic values of the collision are recorded.

3-57

Chapter 3 Standards, directives and laws

3.6 Industrial robot,
human-robot collaboration (HRC)
3.6.5 Purpose of the measurement
In principle, all robot movements can be hazardous!
The human must therefore be protected against the
robot. To protect the worker, the practice waspreviously strict segregation of man and machine.
The robot remained enclosed in a cell while itperformed its tasks.

In robot systems with reduced force/power, limit
values are to be entered in the safety-related part ofthe control system; these are intended to make thecollision safe. These values are not be consideredabsolute, however.
What happens in reality?
1

If the collision occurs, the robot first “feels”
resistance. The force of the robot is initiallybelow the specified force limit. The robot now
attempts to maintain its path and will increase
the power of the drives.

2

The counterforce increases and the robot
reaches the set force limit for the collision.

3

It is only at this point that the robot begins
to stop its movement. The stopping distanceoccurs after the collision, therefore inside thehuman body.

3 Standards, directives and laws

Thanks to a new generation of robots andtechnologies, these days a safety fence may
no longer be necessary if the collision is no longer
hazardous.
In a robot application in which man and machine
share the workspace and there is no safety fence
to ensure safety, the person responsible for the
CE marking process is responsible for compliancewith the limit values.
The robot system cannot do this itself!
It does not take into account dynamics.

Robot excludes dynamic
Limit when robot stops

Fail-safe limit robot reached

Collision

0.5 s
Pay attention to HRC method 4

3-58© Pilz GmbH & Co. KG, 20172017-08

Chapter 3 Standards, directives and laws

3 Standards, directives and laws

3.6 Industrial robot,
human-robot collaboration (HRC)

HRC collision measurement set for standard-compliant human-robot collaboration

The topics of overrun and reaction times must be
taken into account, even with lightweight robots.
In reality, multiples of the set collision values areoften reached.
A reduction of the robot’s dynamics is often the
only remedy.
Checking the collision values using technicalmeasurement is essential in order to still be able tosubmit the declaration of conformity in good faith.
It is important that such measurement types,
and any other measurement techniques, areunderstandable, transparent and reproducible.
That’s why Pilz developed the collision measuring
device PROBmdf for this specific force and pressure
measurement. Equipped with springs and corresponding sensors, the device measures the forces
exerted on the human body precisely and compares
them with the limit values. The measuring device
is installed at the positions determined in the risk
assessment, between the robot arm and a rigid,

2017-08© Pilz GmbH & Co. KG, 2017

inflexible surface. This simulates a quasi-static
contact, e.g. the worker being crushed between
the robot and plant. Measurement is started via
software and the data is then processed anddocumented.
It is advisable to carry out the test up to ten times,
depending on the measuring point. The highest
value, i.e. the “worst case”, is used for the validation. If the limit values are exceeded, additionalsafety measures must be installed, such as a light
grid or guard.
The collision measuring device forms part of thecomplete Pilz set for validation in accordance with
ISO/TS 15066. In addition to the measuring device
with films and scanners, the set also contains
various springs, which can be used to simulate thevarious body areas. Pilz provides the set, including
training, maintenance, calibration and regular
updates, on a rental basis.

3-59

Chapter 3 Standards, directives and laws

3 Standards, directives and laws

3.7 Safe programmingin accordance with EN ISO 13849-1
The installed hardware is perfect for taking on
the majority of the safety technology and therequirements placed on this.

What are typical software errors? Beloware examples of software errors, also called
programming errors or bugs:

Users proceed here in accordance withEN ISO 13849-1 and use the B10D values
specified by the manufacturers, the MTTFD values
or the PFHD values to determine the performancelevel of the safety function. (Note: the architecture,
diagnostic coverage etc. are also required.) The
fact that increasingly more programmable systems(control systems) are being used for the implementation of safety functions is often overlooked here.
As the application programs (SRASW) for thesecontrol systems now also influence the quality ofthe safety function, corresponding methods andprocedures must now also be defined and applied
for the software engineering; engineering because
there is more to do than just the actual programming (coding).

• Syntax error: violation of grammatical rules• Semantic errors: e.g. mixing up
the command code
• Runtime error: e.g. continuous loop
• Logical errors: e.g. incorrect method of resolution• Design error: e.g. error in the requirements
definition• Operating error: e.g. confusing operating concept.

There is a common saying: “There is no suchthing as bug-free software!” No matter how
carefully and painstakingly you program, errors
in the programming code cannot be avoided.
On average, 1,000 lines of code is expected tocontain two errors.
A deadly example of a software error is “Therac-25”.
A software error in that case resulted in a device
for providing radiation therapy for cancerous
tumours giving overdoses of radiation,
leading to three casualties in three years(https://en.wikipedia.org/wiki/Therac-25).

3.7.1 Safety-related software
Safety controllers – e.g. the PSS 4000 – containtwo types of software, referred to as safety-related
software. There is a differentiation between whether
the software is developed by the manufacturer for
the function of the safety controller or whether it isa user-developed software. Software developedby the manufacturer is also called firmware or theoperating system. In the normative parlance fromEN ISO 13849-1, this is called safety-related
embedded software, or SRESW. Softwaredeveloped by the user of the safety controller,
also referred to as an application program,is referred to as safety-related application
software (SRASW).
Furthermore, there is a differentiation between
two types of programming languages for thecreation of this application software (SRASW) in
EN ISO 13849-1.
Programming languages with unlimited or full
language scope are called FVL (Full Variability
Language). Typical examples of these FVL languages
are C or C++. The area of application for theselanguages also includes the creation of SRESW,
for example.

3-60© Pilz GmbH & Co. KG, 20172017-08

Chapter 3 Standards, directives and laws

3.7 Safe programmingin accordance with EN ISO 13849-1

LVL
Limited variability
language

LD

Standards

Software typeISO 13849-1
Safety application

IEC 62061

FBD
ISO

SRASW

Users

Software languages(Machine)

-1
849

13

3

08-

15
C6

SRESW
ISO 13849-1(Firmware, tool)

IEC 61508-3

Hardware

Programming languages with a limited language
or function scope, on the other hand, are called LVL(Limited Variability Language). These languages
are mainly used in the creation of SRASW. These
languages are characterised by the ability to
combine previously developed library elementswith new application code and thus comply with therequired specification for the safety function. Classic
examples of LVL are PLC languages such as Ladder
Diagram or Function Block. With the automation
system PSS 4000, it is also possible to use theprogramming language Structured Text as an LVL.
Increasingly more controller manufacturers limit
the function of high-level languages like C or C++
to such an extent that these could also be
considered LVL.

3.7.2 Software in relation to
the risk assessment

C++

Asm

The creation of safety-related embedded software
is not discussed in further detail. The use of FVL
during the development of SRASW is also
discouraged, as the probability of a systematic
programming error increases with the use of these
programming languages.

2017-08© Pilz GmbH & Co. KG, 2017

Manufacturer

Embedded software

FVL
Full variability
language

3 Standards, directives and laws

IE

If a safety-related protective measure has been
defined as part of the risk assessment based on
EN ISO 12100, there is an increase in use of safetycontrollers or automation systems with integrated
safety functions. As already discussed, not only
the classification of the safety controller as a
hardware component in a performance level iscrucial here, but rather the engineering of thesafety-related application software also affects
the quality of the safety function. Based on therequired performance level in accordance withEN ISO 13849-1, the safety-related application
software must also conform to the performancelevel.
If for example the safety function requires aperformance level of PL d, the SRASW must atleast correspond to the measures for achieving theperformance level PL d. In the reverse case, it ispossible that despite development of an SRASW in
accordance with the requirements of performancelevel PL e, the entire safety controller ultimately
only achieves performance level PL c when using
hardware with PL c.

3-61Chapter 3 Standards, directives and laws

3.7 Safe programmingin accordance with EN ISO 13849-1
3.7.3 Basic requirements
for software development
In Section 4.6.3 of EN ISO 1384-1, the requirements
placed on the creation of an SRASW are exploredin more detail. Requirements are placed on thedevelopment tools and the development process
here in addition to the requirements for the software
to be developed.
3 Standards, directives and laws

General requirements for the SRASW that is used ina safety function with a performance level from a toe include:• Development lifecycle with verification andvalidation• Documentation of specification and design• Modular and structured programming• Functional tests• Suitable development activities after
modifications
The development lifecycle of safety-related software
can also be described using the simplified V model.
The left branch of the V model describes thedesign-related development stages for the creationof the software. Here each development stage
is verified (checked) compared to the result of
the previous work stage. The right branch of the
V model describes the activities when performing

the check, also called verification and validation.
The model also explains that each design-related
development stage is accompanied by a verification
or validation stage, while the test plan required
for the test should already develop parallel to andindependently of the development stage.
The consistent application of the V model – using
error-preventing measures should result in theengineering/development of software with as few
errors as possible. Software that is categorised byproperties such as readable, understandable, testable and serviceable – overriding requirements forsafety-relevant software according to EN ISO 13849-1.
Modular, structured program creation should
naturally also be guaranteed as a result. A good
option for the programming of SRASW is referring
back to software modules/blocks already certified
by the manufacturer.
In reality, changes frequently interrupt thedevelopment, which is natural. These must routinely
be taken into account during development andtheir effects must be evaluated (impact analysis).
All of these activities should also be performedin accordance with the V model and recorded using
a change history. It is of course mandatory to
document all activities in the development process
in any case.

Specificationsof the safety functions

Safety-related
software specification

Validated software

Validation
Validation

Integration tests

System design

Module tests

Module design

Coding

3-62© Pilz GmbH & Co. KG, 20172017-08

Chapter 3 Standards, directives and laws

3.7 Safe programmingin accordance with EN ISO 13849-1
As already described, basic measures arenecessary for achieving a performance level PL ato e. As the performance level increases from PL cto e, additional fault-prevention measures must
additionally be introduced. The specifications of the
SRASW must be checked and the people involvedin the lifecycle must be provided with precise
information on the safety functions, the performance
criteria and the control architecture as well as thedetection and handling of external failures.
Furthermore, particular attention must be paid toselection of tools.
3.7.5 Programming tools, languages andlibraries
Tools in this sense are understood as the selectionof programming tools, libraries and languages.
Programming tools should have the ability to avoid
systematic errors, such as:• Incompatibility of data type
• Incomplete calling of interfaces• Recursions• …
The check should already be performed duringcompilation and not wait until the runtime ofthe software.
Furthermore, the programming tools should besuitable for the application of a modular programming procedure and also use a recognised subsetof the IEC-61131-3 languages. Graphical languages
such as Ladder Diagram or Function Block are often
more easily readable and more understandable thanpurely text-based languages. This is why the use ofgraphical programming languages is recommended.

2017-08© Pilz GmbH & Co. KG, 2017

The programming tool PAS4000, which is part of
the automation system PSS 4000, not only offers
textual programming languages such as Instruction
List and Structured Text, but also the graphicalprogramming languages Ladder Diagram and Pilz’s
own graphical programming language PASmulti.
PNOZmulti graphical programming is partof the PNOZmulti range.
Validated function block libraries should be referred
to whenever possible. The manufacturers of safetysystems offer a number of already validated andcertified function blocks in the libraries of theirprogramming tools. Another option is referring
back to application-specific function block libraries
that have been developed and documented during
projects and are based on the requirements
for SRASW development in accordancewith EN ISO 13849-1.

3 Standards, directives and laws

3.7.4 Additional fault-prevention measures
for increasing performance level

3.7.6 Structuring and modularity ofthe software
Clean structuring and modularly designed
software form the basis for fault prevention
and for handling changes. Attention must be
paid to this as early as the specification and designphases of the software and this procedure is tobe supported through the use of already validated
library function blocks. For independently developed blocks, semi-formal procedures (graphicalmethods) should also be applied to describe thedata or the control flow. Methods such as status
diagrams and program flow charts are particularly
suitable for this. The function blocks to be developed should also be programmed with a minimised
code length and this should then be carried out
with entry and exit.

3-63Chapter 3 Standards, directives and laws

3.7 Safe programmingin accordance with EN ISO 13849-1
Architecture in three levels has really proven itself:

InputsProcessing

Outputs

3 Standards, directives and laws

• Inputs: recording information and signals of
the safety sensors through safety inputs• Processing: processing of the information
to implement the safety function that leads toa safe condition• Outputs: actuation of the operator elements
through safety outputs
With the actuation of safety outputs, it is essentialthat these are only used in one program section.
Non-compliance with these normative requirements
here in particular can lead to hazardous conditionsat plant and machinery level. In general, theprogrammer of SRASW should employ a defensive
programming style. Defensive programming aims tocreate software that detects abnormal processes,
data and values (within the program) during runtime
and reacts to these in a pre-determined way.
This can be achieved, for example, through:• Range checking of variables• The plausibility test of values• Avoidance of set and reset commands• Grouping and structuring of the software

3-64

3.7.7 SRASW and non-SRASW in
a component
Modern automation systems such as the PSS 4000
combine safety-related programming with nonsafety-related programming. With this type ofcontrollers in particular, or during the creation of
the software for this type of automation systems,
these software components must be implemented
in different function blocks and with a definedinterface. It is of particular importance that nological link between safety-related and non-safetyrelated data is created that results in a reductionof the integrity of the safety-related signals,
e.g. through an OR link of these signals.
3.7.8 Software implementation and coding
The requirement from EN ISO 13849-1 is thatthe code must be readable, understandable andtestable. It is therefore important to define clear
programming guidelines in the organisation. Every
programmer should be able to understand andapply these guidelines. Programming guidelines(coding rules) may contain, for example, the syntax
of variables, as one of the normative requirements
states that the use of hardware addresses(e.g. E1.0) is to be avoided and instead a symbolic
variable (e.g. Input_EStop_Channel 1) is to be used.
If possible, the created code (application program)should be verified using a simulation as well asa control and data flow analysis (for PL d and e).

© Pilz GmbH & Co. KG, 20172017-08

Chapter 3 Standards, directives and laws

3.7 Safe programmingin accordance with EN ISO 13849-1
A time-intensive test phase often follows thecoding of the software. As already discussed,
errors may occur when creating the SRASW despite
all measures to prevent errors. These errors should
be discovered during the test phases wherever
possible. To be able to adequately perform thistest phase, detailed test planning should alreadybe started at the same time as the specification
phases. All test cases with completion conditions
and the tools used for the test should be listed
in this.

The black-box test of the functional behaviour
and the performance criteria make up an adequate
validation method. The black-box test refers to amethod with which the test criteria are developed
and then performed without knowledge of theinner workings of the test object. For PL d and PL esoftware, a test case run based on limit value
analyses is recommended in which the system isdeliberately tested beyond its intended application.
As an example, a parameter could be exposed toa higher value than its specified limit value. Before
starting the black-box testing, however, an I/O test
should be used to ensure that the safety-related
signals used are also used correctly in the SRASW.

PL/Category

Check measures in accordance with EN ISO 13849-2

all PLr

Black-box test of the functional behaviour and the performance,
e.g. time characteristic

recommended for PLr d or e

Additionally expanded test cases based on limit value analyses

all PLr

I/O tests to ensure that the safety-related input and output signals
are used correctly

PLr and categories
with fault detection

Test cases that simulate faults that are determined analytically beforehand,
together with the expected reaction in order to assess the suitabilityof the software-based measures for fault control

2017-08© Pilz GmbH & Co. KG, 2017

3 Standards, directives and laws

3.7.9 Testing

3-65

Chapter 3 Standards, directives and laws

3 Standards, directives and laws

3.7 Safe programmingin accordance with EN ISO 13849-1
3.7.10 Documentation

3.7.13 Changes

In addition to the result of an executable code,
all activities must be documented during thedevelopment lifecycle. If changes to the SRASW
are subsequently performed, these must also be
documented. The principle that this must becomplete, available, readable and understandable
also applies to the documentation. Function blocks
must be documented within the code as well inaccordance with these requirements. There is also
the demand that every function block contains amodule head, which must contain information suchas function description, I/O description, version
and specification of a legal person. Furthermore,
sufficient commenting on the code and thedeclaration lines is to be provided.

With every change to the SRASW, a check mustbe performed to determine to what extent thischange impacts the safety and the requirementsfrom EN ISO 13849-1 for the creation of software.
This means that even with a change to an SRASW,
the V model as well as the normative specifications
and methods must be applied. Furthermore,
the change must be clearly and adequately
documented.

3.7.11 Verification
The verification often employs a code review
method known as the “four eyes” principle. The foureyes principle means that the person who createdthe documents or the code does not check these,
but rather that this is performed by anothercompetent person.

3.7.14 Summary
All design engineers, developers, programmers forsafety-related software should follow a systematic
approach to the development of SRASW and notjust limit themselves to the selection of the appropriate components (hardware). Software and theerrors it possibly contains play an important partin safety quality and should therefore be given thesame weight as the correct selection of hardware
components.
There must also be the awareness that themeasures described here cannot be developed
and applied without effort.

3.7.12 Configuration management
Configuration management is recommended
for companies that create SRASW. This means that
all relevant documents, software modules, test
results and tool configurations that were createdwith respect to the creation of the SRASW must be
identified and archived.

3-66© Pilz GmbH & Co. KG, 20172017-08

Chapter 3 Standards, directives and laws

3.8 Validation

In mechanical engineering, a validation process
must provide evidence that the plant or machinemeets the requirements of its specific intended
use. The process of verification also examines thefunctionality of the technical equipment and thesafety-related parts of control systems, thereby
confirming that they fulfil their functions safely, in
accordance with the specification. Documentationof the results and solutions from the verification andvalidation process ensures that the intended target
has actually been achieved.

The harmonised standard EN ISO 12100 – withits basic terminology, general design principles,
procedures for assessing the risks (analysis
and estimation) as well as the principles for risk
assessment and risk reduction – defines key
procedures for safety-related systems or safetyrelated parts of machine and plant control systems.
Other harmonised standards use this essential
standard as a basis for describing the design,
structure and integration of safety-related parts ofcontrol systems and safeguards: standards suchas EN ISO 13849-1/-2 and EN 61508 with its
sector standard EN 62061 (the origin of validation).
In contrast to EN 62061, EN ISO 13849-1/-2 is not
restricted to electrical systems but can also be
applied to mechanical, pneumatic and hydraulicsystems. Both standards (EN ISO 13849-1/-2 andEN 62061) specify essential requirements for thedesign and implementation of safety-related
control systems on machinery and are successors
to EN 954-1, which is no longer valid. In theapplication of EN ISO 13849-1 or EN 62061,
there are a number of differences in the design andimplementation of safety-related parts of control
systems and their subsequent assessment within
the validation process.

3 Standards, directives and laws

Validation (from lat. validus: strong, powerful,healthy) describes the testing of a plan or solution
approach with regard to the task it is intended tofulfil and the associated solution to a problem.
Verification describes the procedure for testinga plan or solution approach with regard to acorresponding specification. Together, bothprocesses are used to demonstrate the suitabilityof a specific solution approach.

EN ISO 13849-1/-2
Mechanical,
hydraulic,pneumatic
systems

EN 62061
Electrical,
electronic,
programmablesystems

EN 61508
Userprogrammablesystems
Safety components andsystem programming

Structure and overlap of generic and sector standards

2011-11© Pilz GmbH & Co. KG, 2017

3-67

Chapter 3 Standards, directives and laws

3.8 Validation
3.8.1 Verification of safety functionsin accordance with EN ISO 13849-1/2

3 Standards, directives and laws

Required characteristic data: PL, (control) category,
MTTFd, DC, CCF, B10d

The verification of safety-related parts of control
systems must demonstrate that the requirements
and specifications have been met in accordancewith the applied standard and the safety-related
specification. These requirements refer specifically to

The stipulated requirements form the basis forthe design for implementation of the safety function(selection of components and architecture). The
planned components are grouped into subsystems
and the achievable performance level (PL) is
defined. Verification of the planned safety function:achieved PL ≥ PLr. The validation process confirms
the conformity of the configuration and function of
the safety-related parts of control systems within
the overall specification and on the plant andmachinery. Note: guidance on how to implement avalidation process and validation tools for various
technical systems can be found in EN ISO 13849-2.

• the properties of a safety function, as definedin accordance with the risk assessment andsafety concept/design,• the standard-compliant architecture of thecategory defined for the safety function.

3.8.2 Verification of safety functionsin accordance with EN 62061

The way in which the analysis and tests are carriedout will depend on the size and complexity of thecontrol system and the way it is integrated within
the plant or machine. It makes sense, therefore, tocarry out certain analyses and tests only once thecontrol system has been developed to a certain
level. An independent person or body should becommissioned to ensure that the analysis is independent. To carry out the validation, a validation
plan must first be produced to establish the scopeof the analysis and tests. The exact scope andbalance between the two processes always
depends on the technology that is used and its
complexity. The diagram overleaf provides aschematic overview of the validation process.

Required characteristic data: PFH, SIL, MTTFd, DC,
CCF, B10d. The implementation of safety functions isdesigned on the basis of the formulated requirements. This involves the selection of appropriatecomponents and the development of a coherent
architecture. The planned components are grouped
into subsystems and are the basis for determining
the safety integrity level (SIL). Verification of theplanned safety function: achieved SIL ≥ required SIL.
PL (EN ISO 13849-1)

SIL (EN 62061)

a

-

b

1

c

1

d

2

e

3

-

4

Verification of the safety-related parts of control
systems consists of a thorough analysis and, if
necessary, the carrying out of additional (function)
tests and fault simulations. It is advisable to start
the analysis right at the beginning of the design
process so that any faults and/or problems can be
identified early and dealt with accordingly.

Comparison chart performance level (PL)and safety integrity level (SIL)

3-68© Pilz GmbH & Co. KG, 20172017-08

Chapter 3 Standards, directives and laws

3.8 Validation
Design in accordancewith EN 954-1 (4)Validation plan
(3.4)

Validation principles(3.1)

Documents(3.5)

Analysis(4)NO

Fault exclusion(Annexes A-D)

Is the analysis
sufficient?

NO

Testing(5)

Is testing
complete?

YES
Safety functions
Performance Level:
Category
MTTFd
DC
CCF
Systematic failures
SoftwareCombination/
integration

3 Standards, directives and laws

Fault lists(3.2, 3.3)

Start

Test SF under fault
conditions (3.6)

YES

Validation report

All parts
tested successfully?

Modification

NO

End

Validation plan in accordance with EN ISO 13849-2

3.8.3 General information about
the validation plan
The validation plan must describe all the requirements for carrying out the validation of the specified
safety functions and their categories. The validation
plan must also provide information about themeans to be employed to carry out the validation.
Depending on the complexity of the control systemor machine that is to be tested, the validation plan
must provide information about:

2011-11© Pilz GmbH & Co. KG, 2017

• the requirements for carrying out thevalidation plan
• the operational and environmental conditions• the basic and well-tried safety principles• the well-tried components• the fault assumptions and fault exclusions• the analyses and tests to be applied
The validation plan also contains all of thevalidation documents.

3-69Chapter 3 Standards, directives and laws

3.8 Validation
3.8.4 Validation by analysis
The validation of safety-related parts of control
systems is primarily carried out by analysis.
Evidence must be provided to show that all theproperties required by a safety function (SRCF) are
actually present. The following factors are includedin the analysis:

3 Standards, directives and laws

• the hazards identified in association withthe machine• the reliability• the system structure• the non-quantifiable, qualitative aspects which
affect system behaviour• deterministic arguments such as empirical values,
quality features and failure rates“Top-down”/“Bottom-up” analysis techniques
There are two different techniques to choose fromwhen selecting the analysis technique: the deductive“top-down” technique and the inductive “bottom-up”
technique. The deductive “top-down” technique canbe applied in the form of a fault tree analysis or event
tree analysis. Examples of the inductive “bottom-up”
technique are the failure modes and effects analysis(FMEA) and failure modes, effects and criticality
analyses (FMECA).
3.8.5 Validation by testing
When validation by analysis is not sufficient, further
tests will be needed to complete the validation.
As many control systems and their requirements
are extremely complex, further tests need to be
carried out in the majority of cases.

The test results must be documented in a waythat is traceable; the test record must include thefollowing as a minimum:• the name of the person and/or body undertaking
the test• the environmental conditions at the timeof the test
• the test procedures and equipment used
To demonstrate that the target and defined safety
objective has actually been achieved, the test
results are then compared with the specifications
from the test plan.
3.8.6 Verification of safety functions
An important part of validation is verification thatthe safety functions comply with the intended
specifications, functions, categories and architectures. It is important to validate the specified safetyfunctions in all of the plant/machine’s operating
modes. Alongside the basic validation of eachsafety function, the validation of the PL and/or SIL
value within the safety function also has a key roleto play. The following steps are required whenverifying the safety function that a PL has achieved:• Validation of the category• Validation of the MTTFd values• Validation of the DC values• Validation of the measures against
common cause failures/CCF• Validation of the measures against
systematic faults

In practice the test requires a test plan, which must
include the following:• the test specifications• the expected results• the chronology of the individual tests

3-70© Pilz GmbH & Co. KG, 20172017-08

Chapter 3 Standards, directives and laws

3.8 Validation
PL calculation inaccordance with the result
from the risk assessment

Is thePL ≥ PL(required)?

Recalculate
PL

Determine
which SF requiredNO

YES
Have therequirements
been met?

NO
3 Standards, directives and laws

For eachsafety function

YES
Have allSF been fully
analysed?
If necessary,functional checkof safety function
on the machine

NO

YES

Verification and validation flowchart (source: Pilz training materials)

The validation of safety functions is a reallycomplex process and so it is advisable in this caseto use a software tool (e.g. PAScal), which can help
you to calculate the planned and/or implemented
safety functions. Based on the safety-relatedcharacteristic values of the planned or employedcomponents, these calculation tools validate thevalues that have been achieved, including therequired or demanded default values PLr or SIL.
The advantage of software-based tools is thatthey guide you step-by-step through the individual
stages involved in validating safety functions. The
option within the tool for graphic modelling of safetyfunctions gives the tester additional security in his
calculations and helps to make the results more
traceable.

2013-11© Pilz GmbH & Co. KG, 2017

3-71

Chapter 3 Standards, directives and laws

3.8 Validation
3.8.7 Validation of software

3 Standards, directives and laws

The provisions in the standards EN 62061 and
EN ISO 13849-1/-2 allow the development ofsafety-related software in the machine sector for
all performance levels and safety integrity levels.
As a result, software assumes a high level of
responsibility and largely determines the quality ofthe safety function to be implemented. It is thereforeof the utmost importance that the software createdis clear, legible and can be tested and maintained.
To guarantee the quality of the software, it is also
subjected to a validation process during development. The basic principles are:

• Working to a V model (development lifecycleincl. verification and validation)• Documentation of specification and design• Modular and structured programming• Functional testing• Appropriate development activities after
modifications or adjustments
A corresponding report is also produced in thiscase, to confirm that the software conforms to thesafety requirement specification; this report forms
part of the validation report for the plant or machine.
As with the validation of the safety functions, thesoftware should not be validated by the programmer
himself but by an independent person.

Product

Customer enquiry

Product definition

Certification, approvals

Requirement manual and/or customer requirements

Production release

Functional system tests
System specification
System architecture

Safety check

Implementation manual
Safety requirements

System integration test
Visual inspection of software

Design specification
Integration test

Hardware andsoftware specification

Module test specification

HW/SW module tests
Evidence of functionality
Verification(Have we developed the right system?)Evidence of safety and availability

Realisation
Design documents(wiring diagram, parts list,...)
Source code

Environmental tests

Validation(Have we developed the right system?)Evidence of compliance with productrequirements
Compliance with the required standards

Pilz GmbH & Co. KG’s V model for engineering projects

3-72© Pilz GmbH & Co. KG, 20172011-11

Chapter 3 Standards, directives and laws

3.8 Validation
Today there are some very good certified softwaretools available to develop and program safety-related
software for the relevant safety control system. The
use of software tools simplifies the whole validation
process, as the blocks contained within the softwareare essentially pre-certified and at the same time
validated. The more these software blocks are usedwithin an application, the less validation work will beneeded. The same is true when using parametrisableuser software; this also contains pre-validated
blocks. The subsequent series of function tests must
demonstrate whether the safety functions operate inaccordance with their specification. This includes
simulation of anticipated faults.

3.8.9 Production of validation report

3.8.8 Validation of resistance toenvironmental requirements

Maintenance and repair/periodic tests

2017-08© Pilz GmbH & Co. KG, 2017

3.8.10 Conclusion

3 Standards, directives and laws

When determining the performance of safety-relatedparts of control systems, environmental conditions
such as the environmental site and the way in which
the control system will subsequently be used play
an important role in respect of the system. Relevant
key words include waterproofing and vibration
protection. The system must therefore be validated
by analysis. In specific terms, the analysis mustshow that the control system or system has themechanical durability to withstand the wide rangeof stresses from environmental influences such as
shock, vibration and ingress of contaminants.
Safety-related parts of control systems must
maintain a safe condition under all circumstances.
The analysis should also consider factors such astemperature, humidity and electromagnetic
compatibility.

Finally, after all the verification and validation
steps have been carried out, the validation report is
produced. This contains all the information about
the analyses and tests that have been carried out intraceable form, for both the hardware and software.
Cross-references to other documents are permitted
provided these are traceable and identifiable. Any
safety-related parts of control systems which havefailed the validation process should be named,along with the factors that led to their exclusion.

Naturally, the ravages of time also gnaw away at
the performance of safety-related control systems.
Wear and tear, corrosion and sustained (mechanical)
stresses lead to a reduction in safety; in an extreme
case they can even lead to dangerous failures ofcontrol components, even the whole control system.
For this reason, it is necessary to maintain the safetyrelated parts of control systems at regular intervals
and to carry out periodic tests to check functionalsafety. A maintenance and repair plan should beavailable in written form along with records from theperiodic tests. The function tests must be carried out
by a competent person. Based on the hazard
assessment in accordance with §3 of the Ordinanceon Industrial Safety, the machine or plant operator
should define the type, scope and frequency of theperiodic tests. Details of the Ordinance on Industrial
Safety and more information on our services can befound at www.pilz.com.

3-73

Chapter 3 Standards, directives and laws

3.8 Validation
3.8.11 Appendix
The topic therefore centres around basic, well-tried
safety principles and safety components, as well as
fault exclusions. The following lists correspond to
the specifications of EN ISO 13849-1 and
EN ISO 13849-2 and provide a brief overview
of the safety-related considerations.
Basic safety principles in accordancewith EN ISO 13849-1/EN ISO 13849-2

3 Standards, directives and laws

Features of basic safety principles may be:• Use of suitable materials and manufacturingmethods, taking into account strength,
durability, elasticity and wear
• Correct dimensioning and shaping,taking into account stresses and strains• Pressure limiting measures such as pressure
control valves and chokes• Speed limiting measures
Annexes A–D of EN ISO 13849-2 contain a list of
the basic safety principles affecting mechanical,
hydraulic, pneumatic and electrical/electronicsystems.
Well-tried safety principles in accordancewith EN ISO 13849-1/EN ISO 13849-2
Features of well-tried safety principles are,for example:• Avoiding faults, e.g. through the safe positionof moving parts of components• Reducing the probability of error,e.g. by over-dimensioning components• Defining the failure mode, e.g. through positiveelectrical separation/positive opening contacts• Reducing the effect of failures,
e.g. by multiplying parts

3-74

Annexes A–D of EN ISO 13849-2 contain a listof the well-tried safety principles for mechanical,
hydraulic, pneumatic and electrical/electronicsystems.
Well-tried components in accordancewith EN ISO 13849-1/EN ISO 13849-2
A component can be regarded as well-tried
when it has been
• used in the past with successful results
in a number of applications,• made using principles which document
the suitability and reliability of the component.
A list of the well-tried components for mechanicalsystems, such as screws, springs and cams,
as well as components for electrical systems,
such as contactors and relays can be foundIn Annexes A–D of EN ISO 13849-2.
There are currently no well-tried components
listed for pneumatic and hydraulic systems.
Fault exclusions in accordancewith EN ISO 13849-2
The requirements for applying a fault exclusionmust be indicated in the validation plan. It is
important that each fault exclusion can be justified
with a reasonable, traceable explanation. Annexes
A-D of EN ISO 13849-2 provide an overview ofpossible fault exclusions based on their fault
assumptions. For example, these may be:• Fracture due to over-dimensioning on
mechanical systems• Spontaneous change due to safety device
on pneumatic systems• Change of switching times due topositive action on hydraulic systems• Short circuits between adjacent contacts
insulated from each other on electrical/electronicsystems© Pilz GmbH & Co. KG, 20172017-08

Chapter 3 Standards, directives and laws

3.8 Validation
What can Pilz do for you?

How you benefit from validation by Pilz

Pilz GmbH & Co. KG offers a wide range of services,
including validation within the lifecycle of the plantand machinery. By mirroring the risk assessment
and the safety concept, the developed solutions are
adapted to suit the actual requirements in the system
integration. Validation by Pilz follows an objective
and systematic review of the implemented measures,
evaluation of the technical safeguards and finallyfunction tests. Compliance with all applicable safety
standards and directives is assured. With a wealth ofexperience in validating machinery, Pilz engineers
have developed structured methods for inspecting
safety-critical elements of plant and machinery.
The calculation tool PAScal helps to verify
the performance level that has been achieved forthe respective safety function.

• Qualified methods during conformity
assessment procedure• Consideration of all relevant aspects ofvalidation and CE marking• Support by the safety experts at Pilz

• Mirroring of the requirements fromthe risk assessment and safety concept• Verification of the achieved performance levelin accordance with EN ISO 13849-1/
EN IEC 62061, based on the calculation
tool PAScal, Sistema etc.
• Verification of the operating manual• Function testing and fault simulation(safety check)• Testing of the safety-related software andhardware functions• Testing of the sensor/actuator technology andits wiring• Measurements (earth conductor, sound level etc.)• Production of a test report with detailed
information about the results• Acceptance of responsibility as the“authorised representative” by signing theEC declaration of conformity

To complete your machine’s safety lifecycle, Pilz
can offer CE marking as a final service. In this case,Pilz undertakes the whole conformity assessment
process, assuming responsibility for the wholeprocedure. By signing as the authorised representative on the EC declaration of conformity, Pilz
confirms that the requirements of the directives
have been met. As a result you obtain the “passport”
your machine needs throughout the European
internal market.

3 Standards, directives and laws

Validation by Pilz includes:

Complete your overall safety processwith CE marking

Regular inspections and up-to-date knowledge ofstandards, directives and product developments are
essential to anyone wishing to operate their plant or
machine safely on a long term basis. In accordancewith the Ordinance on Industrial Safety, it isessential that electrosensitive protective equipment(for example: light grids, light beam devices,scanners etc.) is properly configured and installed
and undergoes regular inspection. Responsibility
for this lies fully in the hands of the operator.
Regular inspections keep youon the safe side
An independent inspection body, accredited by
DAkkS (German Accreditation Body) in accordancewith DIN EN ISO 17020, guarantees objectivity,
high availability for your plant and machine, plus
the highest possible safety for your staff.
At the end of the process Pilz will submit theinspection report and discuss all the results withyou. If the inspection is passed, the plant is given
a Pilz quality seal.

2017-08© Pilz GmbH & Co. KG, 2017

3-75

Chapter 3 Standards, directives and laws

3.9 Certification and accreditation

3 Standards, directives and laws

Customers are increasingly regarding certificates,or service providers with third-party certification,
as a guarantee of quality. In principle, however,certificates are not legally binding and can beissued by practically anyone. They are merely anindication that a third-party has checked that certain
work practices are carried out in accordance withthe relevant specifications. The certificates actually
say nothing about the quality of this third-party
inspection. That’s why it is important to haveaccurate knowledge about the competence ofthe certifying company or to make enquiries ifnecessary.
The situation is different with accredited companies:
accreditations are legally binding and can only be
issued by national bodies. With accreditation, thepublic accreditation body confirms that a company
or institution possesses the competence to perform
certain conformity assessment tasks. Conformity
assessment is a procedure which checks whether
certain specifications have been met, by definition
or objective. If an accredited company or institution
issues a certificate, the customer can assume thatit has the necessary competence to do so.
3.9.1 Accreditation: Quality seal for customers
Accredited conformity assessment bodies,accredited bodies for short, are generally institutions
such as test or calibration laboratories, inspection or
certification bodies. They provide services such as
tests, inspections, certifications, e.g. of management
systems, persons and products, in order to assess
the conformity of products, plants or management
systems. The assessment is usually part of atest procedure that has to demonstrate that certain
requirements, such as those listed in the standards,
have been met.

3-76

In Europe, accreditation is uniformly regulated
through the Accreditation Directive 765/2008/EC.
Since 01.01.2010, all member states have been
obliged to operate a single national accreditation
body. This will accredit the conformity assessment
bodies and evaluate them at regular intervals
through audits, to guarantee continued compliancewith the requirements. Among other things, theaccreditation process checks the independence ofthe organisation, quality management, training ofstaff, management of calibrated measuring devices,
work instructions and handling of records and test
reports, to ensure they conform to the relevant
EN/ISO standard. The national accreditation
bodies will also examine and evaluate the practicalimplementation of the on-site certification tasks.
Accreditation is beneficial to both the accredited
institution and its customers in equal measure:it shows the customer that the institution is carryingout its work correctly and in accordance with thestandards. At the same time, the customer obtains
an assessment benchmark for the competence ofthe organisation performing the check.
Organisations generally work in isolation and rarely,
if ever, receive an independent technical assessment of their performance. A regular assessment
by an accreditation body examines all aspects ofa facility’s operations with regard to the continuous
production of accurate and reliable data. The
accreditation body identifies and discusses areas
for improvement; at the end of the assessment,
a detailed report is available. If required, theaccreditation body can monitor subsequent
activities. So the company can be sure that it
has introduced appropriate corrective actions.

© Pilz GmbH & Co. KG, 20172011-11

Chapter 3 Standards, directives and laws

3 Standards, directives and laws

3.9 Certification and accreditation

Some examples of accreditation bodies in Europe

2011-11© Pilz GmbH & Co. KG, 2017

3-77

Chapter 3 Standards, directives and laws

3.9 Certification and accreditation* For Austria: bmwfi,
for Switzerland: Swiss Accreditation Service(Schweizerische Akkreditierungsstelle [SAS])

3 Standards, directives and laws

In Germany the German Accreditation Body
(Deutsche Akkreditierungsstelle GmbH* [DAkkS]),
founded by the Federal Ministry of Economics
and Industry, is responsible for this. All previous
accreditation bodies (DACH, DAP, TGA/DATECH
and DKD) were merged within DAkkS early in 2010.

Merging the German accreditation bodies into DAkkS

Accreditation continues to enjoy worldwide
recognition due to agreements between DAkkS
and the International Laboratory Accreditation
Cooperation (ILAC), the International Accreditation
Forum (IAF) and the European co-operation
for Accreditation (EA).

MRA

MLA

International recognition of DAkkS
MRA = Mutual Recognition Agreement
MLA = Multilateral Recognition Arrangement

3-78© Pilz GmbH & Co. KG, 20172017-08

Chapter 3 Standards, directives and laws

3.9 Certification and accreditation

Unlike certification to ISO 9001, for example,
accreditation uses criteria and procedures
specifically developed to determine technicalcompetence, thus assuring customers that the
test, calibration or measurement data supplied by
the laboratory or inspection service is accurate andreliable. Accredited bodies can be recognised by
the symbol of the relevant accreditation body, which
is usually found on test or calibration reports. A listof the accredited bodies in Germany is available atwww.dakks.de.

Example of the DAkkS logo for the Pilz inspection body

3.9.2 Accreditation or certification
Accreditation uses criteria and procedures
specifically developed to determine technicalcompetence. Specialist technical assessors
conduct a thorough evaluation of all factors inan organisation that affect the production of test
or calibration data. The criteria are based oninternational standards such as ISO/IEC 17020,
ISO/IEC 17025 or ISO 15189, which are usedworldwide to evaluate accredited organisations.
Accredited bodies use this standard specificallyto assess factors relevant to technical competence,such as:2017-08© Pilz GmbH & Co. KG, 2017

• Technical competence of staff• Validity and appropriateness of test methods• Traceability of measurements and calibrations
to national standards• Suitability, calibration and maintenanceof test equipment• Testing environment• Sampling, handling and transportationof test items• Quality assurance of test and calibration data
By this process, accreditation assures organisations
and their customers that test and calibration data
produced by their accredited body is accurate andreliable.

3 Standards, directives and laws

These agreements ensure that all accredited bodies
worldwide have a standard level of competence
and that the services that are carried out satisfy thevery highest quality requirements. Both nationallyand internationally, accreditation is highly regarded
as an indicator of technical competence. Many
industry sectors routinely specify accreditation for
suppliers of testing services.

Certification, to the standard ISO 9001 for example,
is widely used by manufacturing and service
organisations. It demonstrates that products,
services and procedures meet the required quality
standards. The aim in certifying an organisation’squality management system to ISO 9001, forexample, is to confirm that the management system
conforms to this standard. Although laboratories
and inspection bodies can be certified to ISO 9001,
unlike accreditation, such certification makes noclaim regarding technical competence.

3-79Chapter 3 Standards, directives and laws

3.9 Certification and accreditation
3.9.3 Tests in accordance with the Ordinanceon Industrial Safety and accreditation
All European employers are legally obliged toprovide employees with safe work equipment. In
Germany, this has been regulated since October
2002 at the latest by the industrial safety regulations* (BetrSichV). This regulation is the mandatory
implementation of the Work Equipment Directive
2009/104/EC, which was adopted by the EU backin 1989 and has since been revised.

3 Standards, directives and laws

* In Austria: Ordinance on Working Equipment;
in Switzerland: Federal Act on Accident
Insurance (AIA))The employer is obliged to guarantee thisrequirement the first time the work equipment
is put into use and through subsequent regulartesting. He must determine the test intervals
himself, taking account of statutory specifications.
He must also ensure that these tests are only
carried out by “competent persons”.
Technical Rule for Occupational Safety 1203 defines
the requirements placed on a “competent person”.
Essentially the person must have professional
training, a certain amount of professional
experience, recent professional activity and regular
relevant continuing training in the field to beinspected. The employer is free to decide which
staff member will be named the “competentperson”. He must merely be convinced of hiscompetence and be able to prove this in court.

Alternatively a company can also outsource thesetests to an external provider. However, this does
not absolve it of the responsibility of checking thecompetence of the company that will conduct the
tests. Unlike certified companies, accredited bodies
prove particularly helpful in this regard, because
only accreditation makes a legally binding statement
about the competence of such bodies, thereby
satisfying the burden of proof.
Pilz GmbH & Co. KG operates an accredited
inspection body, which companies can appoint toundertake the testing of safeguards on plant andmachinery. Due to accreditation, the services arerecognised worldwide. The inspection body has
access to qualified inspectors in Germany as wellas other EU member states. As a result, Pilz canoffer its services not only within the EU but worldwide. In 2015, the German Accreditation Body
(DAkkS) renewed the accreditation. This showsthat Pilz meets all the requirements of EN ISO/IEC 17020:2012 for a Type C inspection body inthe mechanical engineering sector and is competentto carry out the predefined conformity assessment
tasks. Pilz can even carry out very complex
examinations. The inspection body offers thefollowing services:

Example of implementation of the EU Work Equipment Directive

3-80© Pilz GmbH & Co. KG, 20172017-08

Chapter 3 Standards, directives and laws

3.9 Certification and accreditation

If the customer selects an accredited inspection
body that meets his testing or measurement needs,
he can be sure that the inspection body can provide
accurate and reliable results.
The technical competence of an inspection bodydepends on factors such as:

3.9.4 Conclusion
Essentially, every company is free to have its work
equipment inspected by its own staff or to appointan external company to do the work. However, inevery case, the person conducting the inspection
must be competent to do the job. If a staff member
is selected, the employer can normally assess hiscompetence. If he opts for an external provider, hewill have to rely on written evidence. Certificates are
generally not sufficiently compelling; in the event ofa legal dispute, they do not usually meet the formal
requirements. In contrast, accreditations for the
relevant services provide reliable, legal security.

3 Standards, directives and laws

• Inspection of electrosensitive protective
equipment ESPE (light curtains, scanners,
safe camera systems)• Measurement of stopping performance
to confirm the specified safety distances• Inspection of additional safeguards(E-STOP, safety gates, 2-hand)• Verification of compliance with theminimum specifications of the Ordinanceon Industrial Safety• Verification of compliance with the minimum
requirements of the Machinery Directive (CE)

Informative links:• DAkkS: http://www.dakks.de• EA: http://www.european-accreditation.org• ILAC: http://www.ilac.org• Qualifications, training, experience of staff• The right equipment, correctly calibrated
and maintained• Appropriate quality assurance procedures• Adequate test procedures• Validated test methods• Inspections based on national standards• Precise recording procedure andreport production• Suitable test facilities
All these factors help to ensure that an accredited
inspection body is technically competent and able
to carry out the tests it offers.

2011-11© Pilz GmbH & Co. KG, 2017

3-81

4
Safeguards

Chapter 4 Safeguards

4 Safeguards
4-3
4-7
4-7
4-7
4-8
4-8
4-9
4-11
4-16
4-16
4-18
4-19
4-22
4-22
4-24
4-26
4-27
4-29

4 Safeguards

4
Safeguards
4.1	European Union standards, directives and laws relating to safeguards 
4.1.1
Standards for guards 
4.1.2
Standards for dimensioning of guards 
4.1.3	Standards for the design of protective devices or electrosensitive protective equipment 
4.2
Guards 
4.2.1
Fixed guards 
4.2.2
Movable guards 
4.2.3
Further aspects on the design of safeguards 
4.3
Protective devices 
4.3.1
Active optoelectronic protective devices 
4.3.2	Further important aspects in connection with electrosensitive protective equipment 
4.3.3
Other sensor-based protective equipment 
4.4
Manipulation of safeguards 
4.4.1
Legal position 
Conduct contrary to safety – What does that mean? 
4.4.2
4.4.3
What can designers do? User-friendly guards 
4.4.4
4.4.5
Conclusion 

2017-08© Pilz GmbH & Co. KG, 20174-1

Chapter 4 Safeguards

4.1 European Union standards,
directives and laws relating to safeguards
Safeguards are necessary to provide operatorswith as much protection as possible from hazards
that may arise during machine operation. They
are primarily fences or barriers, which makephysical access to the machine difficult. However,sometimes it’s neither possible nor sensible toselect a fixed guard of this type. In this case, thedecision will fall in favour of a control technology
solution which shuts down part or all of the machine,
should anyone approach a source of danger,
or brings the machine to a safe status by anothermeans. Should this type of hazard protection also
prove unsuitable, or if potential hazards remain
despite the application of these measures, thenindicative safety technology is the final option:in this case, the residual dangers are indicated in
the operating manual or on the machine itself.

4 Safeguards

Guard barriers and safety devices
protect against dangers

2017-08© Pilz GmbH & Co. KG, 2017

4-3

Chapter 4 Safeguards

4.1 European Union standards,
directives and laws relating to safeguards
There are a vast number of regulations that deal with safeguards on machinery.
First of all, we’ll consider the statutory regulations of European Directive 2006/42/EC.

Machinery Directive (2006/42/EC)

1.4.2. Special requirements for guards

1.4. Required characteristics of guards andprotection devices

1.4.2.1 Fixed guards

1.4.1. General requirements
Guards and protective devices must:

4 Safeguards• be of robust construction• be securely held in place• not give rise to any additional hazard• not be easy to by-pass or render
non-operational• be located at an adequate distance fromthe danger zone
• cause minimum obstruction to the view ofthe production process, and• enable essential work to be carried out on the
installation and/or replacement of tools and formaintenance purposes by restricting accessexclusively to the area where the work has tobe done, if possible without the guard having
to be removed or the protective device having
to be disabled.
• Guards must, where possible, protect
against the ejection or falling of materials
or objects and against emissions generated
by the machinery.

4-4

Fixed guards must be fixed using systems
that can be opened or removed only with tools.
Their fixing systems must remain attached to
the guards or to the machinery when the guards
are removed. Where possible, guards must
be incapable of remaining in place without their
fixings.
1.4.2.2 Interlocking movable guards
Interlocking movable guards must:• as far as possible remain attachedto the machinery when open
• be designed and constructed in sucha way that they can be adjusted only
by means of an intentional action© Pilz GmbH & Co. KG, 20172010-11

Chapter 4 Safeguards

4.1 European Union standards,
directives and laws relating to safeguards• prevents the start of hazardous machinery
functions until they are closed and gives
a stop command whenever they are nolonger closed
Where it is possible for an operator to reachthe danger zone before the risk due tothe hazardous machinery functions has ceased,
movable guards must be associated witha guard locking device in addition to
an interlocking device that:• prevents the start of hazardous machinery
functions until the guard is closed and locked,
and• keeps the guard closed and locked until
the risk of injury from the hazardous machinery
functions has ceased
Interlocking movable guards must be
designed in such a way that the absenceor failure of one of their components prevents
starting or stops the hazardous machinery
functions.

2010-11© Pilz GmbH & Co. KG, 2017

1.4.2.3 Adjustable guards restricting access
Adjustable guards restricting accessto those areas of the moving parts strictly
necessary for the work must be:• adjustable manually or automatically,
depending on the type of work involved, and• readily adjustable without the use of tools
1.4.3. Special requirements for protective
devicesProtective devices must be designed
and incorporated into the control systemin such a way that:• moving parts cannot start up while they
are within the operator's reach• persons cannot reach moving parts
while the parts are moving, and• the absence or failure of one of theircomponents prevents starting or stops
the moving parts. They must be adjustable
only by means of intentional action.

4 Safeguards

Interlocking movable guards
must be associated withan interlocking device that:

4-5

Chapter 4 Safeguards

4.1 European Union standards,
directives and laws relating to safeguards
A number of points in the above requirements
are considered separately here:
Guards must, where possible, protect against
the ejection or falling of materials or objects andagainst emissions generated by the machinery.
The active direction of the protection is described
here: it is not only necessary to consider hazards
during the approach of people towards the danger
zone; some hazards arise from the machinery
itself, have an outward effect and therefore require
protection.
Safeguards must cause minimum opportunities for
obstruction to the view of the production process.
A further requirement for a fixed guard is that its
fixing systems remain attached to the machinery or
to the guard itself once the guard is removed. So in
future, screws on protective covers for example willneed to be fixed in such a way that they cannot belost once the guard is removed.

The commentary entitled “Guide to application of
the Machinery Directive 2006/42/EC – 2nd Edition –June 2010” issued by the European Commission
provides an interpretation: the requirement is for
fixed guards to be used where it is expected thatthe machine operator will remove them. A practicalexample would be opening up the guard for amonthly clean. In contrast, this does not need toapply to guards which are removed solely for general
overhaul or for more major repairs. It is therefore
advisable for machine manufacturers to classify theirequipment accordingly.
Protective devices must be adjustable only
by means of intentional action. This requirement
makes particular sense in relation to light beam
devices or light curtains. These devices are adjusted
as the machine is put into service, after which point
they should not be adjustable without good reason,otherwise the necessary safety distance may
no longer be guaranteed.

4 Safeguards

This very strict requirement throws up a numberof questions in respect of feasibility. For example,
does this apply to all the screws on a safety fence?
In an extreme case, even the floor fixings of thesafety fence would be subject to this requirement.

4-6© Pilz GmbH & Co. KG, 20172017-08

Chapter 4 Safeguards

4.1 European Union standards,
directives and laws relating to safeguards
4.1.1 Standards for guards
In addition to the statutory regulations of the Machinery Directive, the following European standards
currently exist relating to safeguards:
Standard

Title

EN ISO 14120:2015

Safety of machinery
Guards – General requirements for the design and construction of fixed
and movable guards

EN ISO 14119:2013

Safety of machinery – Interlocking devices
associated with guards – Principles for design and selection

4.1.2 Standards for dimensioning of guards
Standard

Title

EN ISO 13857:2008

Machinery safety
Safety distances to prevent hazard zones being reached by upper andlower limbs (ISO 13857:2008)

EN 349:1993+A1:2008

Machinery safety
Minimum gaps to avoid crushing of parts of the human bodyStandard

Title

EN 61496-1:2013

Safety of machinery
Electrosensitive protective equipment – Part 1:
General requirements and tests

EN 61496-2:2013

Safety of machinery
Electrosensitive protective equipment – Part 2:
Particular requirements for equipment using active optoelectronic
protective devices (AOPDs)

CLC/TS 61496-3:2008

Safety of machinery
Electrosensitive protective equipment – Part 3:
Particular requirements for active optoelectronic protective devices
responsive to diffuse reflection (AOPDDR)EN ISO 13855:2010

Safety of machinery
Positioning of safeguards with respect to the approach speedsof parts of the human body2017-08© Pilz GmbH & Co. KG, 2017

4 Safeguards

4.1.3 Standards for the design of protective devices or electrosensitive protective equipment

4-7Chapter 4 Safeguards

4.2 Guards
A guard is part of a machine which is specificallyrequired as a form of physical barrier to protect
persons from the hazards of machinery. In somecases the same safeguards can simultaneously

protect the machine from persons, for example,
if time-critical processes may not be interrupted
by persons approaching at random. The study
below considers the first scenario only.

Examples of guards

4 Safeguards

A “guard” forms a physical barrier between
the machine operator and the hazard, in contrast
to “protective devices” or “electrosensitive
protective equipment” such as light curtains
and light beam devices, which are covered later.
Safeguards of this type do not prevent access toa hazard, but detect a person or part of a person’s
body when a hazard is approached. In this case,the hazard is shut down via a downstream
controller so that the danger is removed before
the hazard zone is reached. Depending on its
design, a guard may be implemented as housing,casing, shield, door, cover or some other format.
Guards are available in a wide range of types andformats, therefore.

4-8

4.2.1 Fixed guards
Fixed guards are permanently attached to themachine. This type of safeguard is suitable when it
is unnecessary to remove the guard under normal
operating conditions or when access is not required
during the work process. Examples would be chain
covers or grilles in front of motor fans.

© Pilz GmbH & Co. KG, 20172017-08

Chapter 4 Safeguards

4.2 Guards
4.2.2 Movable guards
If access is required to the danger zone, a movableguard can be used, e.g. a safety gate.
The frequency with which access is required will
determine whether the guard needs to be fixed or
movable. The standards can help you make thisdecision.

EN 14120
Where access is required only for machine setting,process correction or maintenance, the following
types of guard should be used:a) Movable guard if the foreseeable frequencyof access is high (e.g. more than once a week),
or if removal or replacement of a fixed guard would
be difficult. Movable guards shall be associatedwith an interlock or an interlock with guard locking(see ISO 14119).
b) Fixed guards only if the frequency of access islow, their replacement is easy and the removal andreplacement can also be performed within a safe
work system.

4 Safeguards

Note: in this case, the term “interlock” means
the electrical connection between the positionof the safeguard and the drives to be shut down.
In safety technology, the commonly understoodmechanical “interlock”, meaning a lock, is calleda “guard locking device”.

Monitoring several safety gates with one evaluation
device thanks to individual diagnostics.

2017-08© Pilz GmbH & Co. KG, 2017

4-9

Chapter 4 Safeguards

4.2 Guards
Selection guide for guard type

Are there
hazards?

No

No guards
requiredYes

Is access required
during operation?

No
Fixed guards

Yes

Is access necessary
for machine setting,process correction
or maintenance?

No

Automaticallyclosing guards
or adjustable guards

4 Safeguards

Yes

Is accessonly required for machinesetting, process correction
or maintenance?

Yes

No
Fixed guard

Yes

No

Yes
Is access required
during a working cycle?

Is access required >once a week or is the removal
and replacement of a
fixed guard difficult?

Is any hazard
that arises from opening
the guard averted before
access is possible?

No

Movable guardwith interlocking device(with guard locking)Yes

Interlocking
movable guards
or control guards

In accordance with EN 14120

4-10© Pilz GmbH & Co. KG, 20172017-08

Chapter 4 Safeguards

4.2 Guards

Fixed guards for maintenance or repair work

2017-08© Pilz GmbH & Co. KG, 2017

4.2.3 Further aspects on the designof safeguards
Once the decision has been made to use a movableguard, the next step is to determine the safety levelof the corresponding interlock (safety integrity level
SIL or performance level PL) in accordance with
EN 62061 or EN ISO 13849-1. The corresponding
control system is then designed and validated.
These control systems will include sensors in
the form of switches, which detect the position of
the guard. Via this detection feature, hazardous
movements can be stopped as a result of the guard
being opened. An additional safety function can
prevent drives starting up unexpectedly when asafety gate is opened. The stopping time of hazardous movements will need to be considered: whena safety gate is opened, if it can be assumed thata drive with a long stopping time will generatea hazardous movement, this gate will requirea guard locking device. The guard locking device
must be unlocked by actively operating a release.
This is the only way to guarantee that the safety
gate is not released unintentionally as the result ofa power failure, for example. In this case, it’s also
important to note that a person who is in the danger
zone at the time of the power failure and has shutthe safety gate behind him cannot be released byan unlock command on the machine control system.
Such a case may be rare, but it is conceivable;
for this reason guard locking device variants exist
that have a mechanical release function. However,operating staff must be sure to have the appropriate
actuation tool available or to be aware of how to
operate the emergency release.

4 Safeguards

Summary
Guards which need to be opened during production
mode are generally designed as movable guards.
These are in complete contrast to fixed guards,
which are only operated rarely, for example, when
they are opened to carry out maintenance or repair.
This classification also needs to be well-foundedbecause different costs will be associated with thetype or selection of guard.

4-11

Chapter 4 Safeguards

4.2 Guards
Connection in series for safety gate switches

4 Safeguards

When selecting sensors to scan movable guards,
the question arises as to whether such sensors
can be connected in series to an evaluation device,

and if so, how many? The answer to this question
depends on the faults to be assumed or on themasking of these faults’ detectability. The following
example of safety gate sensors connected in series
is intended to illustrate this point:

1

2

3

4

Example of safety gates connected in series

1

The example shows three safety gatesconnected in series to an evaluation device.
Initially all the safety gates are closed andthe relay’s outputs are “on”, i.e. the machine
can be operated.

2

On the left-hand safety gate, a short circuit
occurs in the line to the switch with the
N/C contact: at first the fault is not detected
and the machine can continue operating.

3

4-12

The left-hand safety gate is then opened, an
event which the left switch signals to the relay.
During a feasibility comparison of the two
switches, the relay discovers an inconsistency
and switches to a fault condition, i.e. once thesafety gate is closed the machine cannot berestarted.

4

Now the right-hand safety gate is also opened.
Via these signals the relay once again detects
a normal condition. The fault condition is reset,
the safety gates can once again be closed
from left to right and the machine is ready tostart up again.

This example illustrates an undetected fault inthe safety circuit. An additional fault could cause
the whole safety gate guard to fail to danger. Theseand similar faults are described by the term fault
masking. In the current standards, the maximum
diagnostic coverage (DC) that the switch canachieve is restricted, depending on the masking
probability.

© Pilz GmbH & Co. KG, 20172017-08

Chapter 4 Safeguards

4.2 Guards

Safety switches with integrated fault detection

In practice, a single pair of switches assessed via
a safety relay can achieve a DC = 99 %. Based on
this premise, in ISO/TR 24119 the maximum DC fora group of interlinked switches is stated based on
the number of switches connected in series andtheir frequency of operation.

Mechanical switches
In this context, the question also arises as to theneed for mechanical redundancy and the numberof independent switches on a safety gate. Wheninstalled correctly, magnetically operated andRFID proximity switches are often designed sothat a single mechanical fault does not lead tothe loss of the safety function; however, on
mechanically operated switches (reed or roller
switches), particular attention needs to be paid
to the single-channel mechanical actuator. The
documentation for the switch should always bechecked carefully to establish whether the switch
itself has any assured properties and if so, which.
This is particularly important when a dual-channel
electrical switching element is present.
Fault exclusions for the mechanical part of theseswitches are to be justified by the user if not
explicitly confirmed by the switch manufacturer
as part of the intended use. This is often very
difficult if not impossible to achieve, as it is difficult
to estimate the effects of wear, vibration, corrosion
or inappropriate mechanical stress, for example.
In cases such as these, to achieve PL d or PL e you
must either use two mechanical gate switches pergate, one dual-channel magnetic switch or one
RFID switch with OSSD output.

4 Safeguards

The occurrence of this type of fault masking should
be taken into account on mechanical switches andmagnetic proximity switches alike. Only switcheswith internal diagnostics and an OSSD output,
as commonly found on RFID based switches,
are unaffected by this.

As you can see in the table on the next page,
masking restricts the achievable DC and, asa direct result, the achievable PL. If a group ofinterlinked switches is required to meet PL e,a technical solution is available using switcheswith integrated fault detection. As masking
cannot occur in this case, it is possible tohave interlinked switches without restricting
the DC or PL.

2017-08© Pilz GmbH & Co. KG, 2017

4-13

Chapter 4 Safeguards

4.2 Guards
Number of frequently
used movable guards 1) 2)
0

Number of additional
movable guards 3)

Maximum achievablediagnostic coverage (DC) 4)

2 to 4

Medium+5 to 30

Low

> 30

None

1

Medium1+

2 to 4

Low

≥5

None

>1

+

≥0

None

If the frequency is greater than once an hour.
If the number of operators that can open the separate safeguards is greater than 1,
the number of frequently used movable guards is increased by 1.
3)
The number of additional movable guards can be decreased by 1
if one of the following conditions is met:
- If the minimum distance between the safeguards is greater than 5 m, or- If none of the additional movable guards can be reached directly.
4)
If you can predict that fault masking will definitely occur (e.g. several movable guards are open
at the same time as part of the normal operation or service), the diagnostic coverage is restricted to None.
1)
2)

Maximum achievable diagnostic coverage (DC) (simplified)

4 Safeguards

When additional parameters such as wiring type,
test pulses and switch type are taken into account,more complex considerations can be provided
beyond the values shown in the table. These canlead to better results in individual cases, but arealways restricted to a maximum DC = medium.

4-14

There is also the question of how to proceed witha series connection of sensors with their own PL.
In this case the diagnostics are an integral part ofthe sensor and are not influenced or reduced bya series connection. Nevertheless, the switch signalof the first sensor in the chain must be guided
through all the other sensors before it can beprocessed by an evaluation device. A safety-related
failure of another sensor in the chain could prevent
it being forwarded. That’s why in this case it’snecessary to add up the failure probabilities of
all the sensors in the chain – even if only the first
sensor belongs to the safety function that is under
examination.

© Pilz GmbH & Co. KG, 20172017-08

Chapter 4 Safeguards

4.2 Guards
One problem has proved to be critical when using
magnetically operated gate switches (with reed
contacts). If pairs of switches and safety relays areused and their mutual suitability has not been testedby the manufacturer, the machine builder mustensure that peak currents within the switch do notcause premature wear. This mainly affects pairs ofreed switches with relay-based safety units.
For the assessment it is necessary to determine themaximum occurring peak current IS (see Formula 1)
and to compare this with the permitted peak currentof the switch ISmax. All switches in series connections
must be considered, which is why the lowest of all
the permitted peak currents must be greater thanor equal to the maximum switching current(see Formula 2).
RSmin(i)Minimum internal resistance of switch i

ISmax(i)Maximum permitted peak current of switch i

UPmax

Maximum voltage

RPmin

Minimum internal resistance of safety relay

IS

Maximum switching current

IS =

Umax
RPmin + ∑ RSmin (i)iFormula 1

There is another new factor to consider fromISO 13855 relating to the consideration of switches
on movable guards. This involves a potential hazard
which might arise when a gate in a safety fence
can be opened to such an extent that a person
can access the danger zone through the opening
without the corresponding gate switch receiving
a signal change. This is more of a theoretical hazard
but it can be averted by increasing the safety
distance proportionate to the size of the undetectedgate opening. In practice, the problem should neverarise in the first place with the installation of a gate
switch that has been selected and fitted to meet therequirements of the situation.
In this respect, the actual safety distance between
the gate and site of the hazard is of greater practicalrelevance. Here, the question arises as to what
happens when the safety gate in a safety fence is
opened and a person enters the danger zone but
the machine is still running down or braking. In thiscase, the relevant danger zones can still be reached
if the person approaches at sufficient speed and themachine has a correspondingly long braking time.
According to the standard, the calculation for theuse of light curtains can be used in this case. Safety
distance S is calculated as S=(K x T). K is thewalking speed of the person of 1,600 mm/s and T
is the time from the triggering of the gate switch tothe machine stopping (i.e. safe status is achieved).
The time that it takes to open the gate may be
deducted. This can be identified either by considering
how long this may take in theory or by timing it inpractice, as no standard values are provided.

4 Safeguards

Assessment of magnetic switchesIS ≤ MIN (ISmax (i))
iFormula 2

The problem of premature wear does not normallyoccur on mechanically operated switches andswitches with OSSD output because wear on theseswitches is primarily determined via the average
current and the thermal behaviour.

2013-11© Pilz GmbH & Co. KG, 2017

4-15

Chapter 4 Safeguards

4.3 Protective devices
4.3.1 Active optoelectronic
protective devices

Monitoring production areasin which active intervention is requiredProtective devices (electrosensitive protective equipment, abbreviated to ESPE below) are always used
when access to the corresponding hazard zone isintended to be particularly easy to achieve and there
are no hazardous repercussions to be anticipatedfrom the machine itself (example: welding or grinding
processes). To ensure that a potential hazard canbe shut down quickly enough, the protective device
must be installed at an appropriate distance.
This distance or safety distance (S) is defined in
EN ISO 13855 and depends in particular on thefollowing factors:• t1 = Response time of the protective device itself.
• t2 = Response time of the machine, i.e. themachine’s stopping performance in responseto the signal from the protective device• C = Potential approach towards a danger zone
undetected by the protective device, e.g. reaching
through two beams of a light curtain undetected,
depending on the distance of these beams• K = Anticipated approach speed of the humanbody or parts of the human body. This factor
is defined in EN ISO 13855 as 1,600 mm/s forwalking speed and 2,000 mm/s for hand speed

4 Safeguards

The distance to be implemented is therefore
S = K x (t1 + t2) + C

Safe camera system forthree-dimensional zone monitoring

4-16© Pilz GmbH & Co. KG, 20172017-08

Chapter 4 Safeguards

4.3 Protective devices
EN ISO 13855 defines the following preferential distances:
Resolution

Calculation formula(Distance S [mm])Notesd ≤ 40 mm

S = 2000 x T + 8 (d-14)

If the result is < 100 mm, a distance ofat least 100 mm must be maintained.

If the result is > 500 mm, you can use

In this case, S may not be < 500 mm.

S = 1600 x T + 8 (d-14)
as the calculation
40 < d ≤ 70 mm

S = 1600 x T + 850

Height of the lowest beam ≤ 300 mm
Height of the highest beam ≥ 900 mm

Multiple single beams

No. ofbeams

Beam heights in mm

Multibeam

4300, 600, 900, 1200

3300, 700, 1100

2400, 900

1

750

S = 1600 x T + 850

Single beam

S = 1600 x T + 1200

If the risk assessment permits a single beam arrangement• Even when a guard has been carefully designed,
any means of defeating it must be taken into
account. Any possibility of reaching over or
around a detection field needs to be excluded.
As it is not always possible to cover any gaps
alongside the detection field and an adjacentsafety fence, safety distances between the person
and the danger zones need to be observed here
as well. The calculation of these distances is very
similar to those for safety distances that apply
to access to danger zones via a detection field.
Particular attention needs to be paid to thisimportant difference. In practice, it could forexample be the case that access to a danger
zone is protected by a vertically installed light
grid. However, this light grid is often not ashigh as a person might be able to reach and depending on a railing, for example - may be
2017-08© Pilz GmbH & Co. KG, 2017

only 1,100 mm high. In this case, a person would
be able to stand just in front of the light gridwithout interrupting the detection field. Furthermore, in this case the person can still lean forward
and with an outstretched arm access the area
behind the light grid with their hand. In order toavert hazards in this situation, minimum distances
between the danger zone and light curtain are
defined. These minimum distances are comprisedof two components: walking speed and hand
speed multiplied by the system’s response timeplus an additional value which depends on theheight of the danger zone and the height of thesafeguard. This additional value may be up to
1,200 mm. Where space is limited, it is worth
looking at covering all possible means ofpermanently defeating the system.
• Information on positioning and sizing ofpressure-sensitive mats can be found in chapter 7
of EN ISO 13855. Here as well, the familiar
formula of S = (K x T) + C is used. In this case K
equals 1,600 mm/s, derived from normal walking
speed. A minimum distance of C = 1,200 mm
is required to protect an outstretched arm or
hand that will not be detected by the pressuresensitive mat.
• The design of the safety distance S for thearrangement of two-hand control devices isbased on the formula S = (K x T) + C. In this case,
C is 250 mm and K is 1,600 mm/s.

4 Safeguards

If the ESPEs form horizontal or inclined protected
fields above an accessible area which requires
safeguarding, the fields must be positioned at
a minimum height, as pre-determined by theapplication and ESPE. Here too, the safety distance
between the outer edge of the protected field andthe danger point to be safeguarded should besuch that the possibility of injuries resulting fromthe hazardous movement in the danger zone is
excluded, bearing in mind the machine’s stopping
performance.

4-17

Chapter 4 Safeguards

4.3 Protective devices
4.3.2 Further important aspects
in connection with electrosensitive
protective equipment
4.3.2.1 RestartOnce a safeguard has been triggered, a machine
may not be restarted automatically after theprotected field has been cleared. This should only
be possible via a reset on a control device outside
the danger zone, with visual contact.
4.3.2.2 Encroachment from behind

4 Safeguards

As well as the obvious protection for the danger
zone it’s also necessary to consider the possibilityof reaching over, under or around the device,
as well as encroaching from behind. A purely
mechanical safeguard or another light curtain canbe used to provide protection against encroachment from behind. If there is any possibility of
defeating the safeguards, additional measures
must be taken to protect them.

4.3.2.3 Muting
Muting is the temporary, automatic suspensionof electrosensitive protective equipment so thatmaterial can be transported into and out of a danger
zone, for example. Special sensors are used toensure the muting controller only starts the muting
cycle when the material is being transported
through the protected field. The sensors must
be positioned in such a way that persons cannot
activate the muting sensors. If anyone should
access the protected area, the potentially
dangerous movement is shut down immediately.
The industry has developed special safety relays
with muting function specifically for this case. Somelight curtains also provide the option to mute theprotected field only partially (blanking). In thisprocess for example, the precise section throughwhich the item is being transported is renderedpassive. However, under no circumstances
should anyone be able to reach the danger zone
undetected via this deactivated section of theprotected field. A design measure (e.g. a cover forthe remaining free space) should be used to ensurethat nobody can reach the danger zone from theside, in between the item and the protective device.

Muting with four muting sensors

4-18© Pilz GmbH & Co. KG, 20172017-08

Chapter 4 Safeguards

4.3 Protective devices
4.3.3.1 Laser scanners
A second ESPE installed horizontally or at an angle
is often used to protect against encroachment of
the ESPE from behind. Often this can only covera small area. With larger zones to be safeguarded,a scanner can be used for additional opticalmonitoring of encroachment from behind. A laser
beam scans the area to be monitored. If the beamis reflected by a foreign body, this will be detected
and the hazardous movement will be safely shutdown.

4.3.3.2 Safe camera systems
The latest developments on the market are safe
camera systems for monitoring freely configurable
zones. In contrast to simple sensors, they are able
to record and analyse detailed information about
the whole monitored zone. This way potentiallyhazardous work processes are safely monitored,
protecting man and machine.
4.3.3.3 Pressure-sensitive mats
Many pressure-sensitive mats operate inaccordance with the normally open principle:
they require the use of special evaluation devices,which account for this actuation principle andguarantee appropriate fault detection. Pressuresensitive mats that operate to the normally closed
principle are also available, however; where a low
safety level is required and the electrical loads
are low, these can be used to activate contactors
directly.

4 Safeguards

4.3.3 Other sensor-based
protective equipment

SafetyEYE

PSENscanSafeguarding of danger zones with safety laser scanner and safe camera system

2017-08© Pilz GmbH & Co. KG, 2017

4-19

Chapter 4 Safeguards

4.3 Protective devices
4.3.3.4 Two-hand control devices
Two-hand control devices are used on a workstation
to keep both of the operator’s hands committed
locally; while the devices are operated, the hands are
kept away from the danger zone. Various types of

two-hand circuits are defined and can be applied tosuit the necessary level of protection: requirementlevels for two-hand control devices:

Requirements

Types
EN 574
Para.

I

II

III
A

B

C

Use of both hands

5.1

◆

◆

◆

◆

◆

Release of either actuator initiates the cessation of the output signal

5.2

◆

◆

◆

◆

◆

Prevention of accidental operation

5.4

◆

◆

◆

◆

◆

Protective effect shall not be easily defeated

5.5

◆

◆

◆

◆

◆

Re-initiation of output signal only when both actuators are released

5.6

◆

◆

◆

◆

◆

Output signal only after synchronous actuation within max. 500 ms

5.7

◆

◆

◆

Use of category 1 in accordance with EN 954-1

6.2

Use of category 3 in accordance with EN 954-1

6.3

Use of category 4 in accordance with EN 954-1

6.4

◆

◆
◆

◆
◆

4 Safeguards

The current edition of EN 574 still refers to thewithdrawn standard EN 954-1. That’s one of thereasons why EN 574 is currently under revision.

P2HZ X4P
Evaluation of two-hand control circuits

4-20© Pilz GmbH & Co. KG, 20172017-08

Chapter 4 Safeguards

4.3 Protective devices
4.3.3.5 Functional safeguards
Avoidance of unexpected start-up in accordancewith EN 1037 or soon DIN EN ISO 14118.

In cases such as these the machine designer
has two options: if isolation from the energy supply
is possible without device defects and without
initiating other hazardous movements, standstillmonitoring can be used. Although the convertercontrolled drive is stationary it is still active, so it ismonitored to check that it does not move. Should
any movement occur on account of an error, thesupply to the whole branch is shut down via acontactor. This solution assumes that the slightdrive movement which occurs in the event of anerror does not cause a hazard. The movement itself
consists of two parts: the part which activatesthe sensor technology for monitoring and the partoccurring before the protection circuit has reacted
and a contactor has switched. These influencesmust be examined in a risk assessment.

2017-08© Pilz GmbH & Co. KG, 2017

External drive monitoring through the
PNOZmulti safety system with speed monitoring

If an unintended movement such as this is
unacceptable, safe drive technology must be used,which will prevent such faulty behaviour from thestart (see also Chapter 7: Safe motion control).

4 Safeguards

When an operation is in progress, the samequestion always arises: when a machine is brought
to a halt via an operational stop command, howsafely is the machine prevented from unintentionallyrestarting: what happens in this situation shoulda fault occur in the controller and a drive is started
up unexpectedly? This is an issue which is just as
important as the consideration of functional safety
associated with “more obvious” safeguards. A key
point to consider is the issue of converter-controlled
drives. These drives are often stopped by signals
such as “Zero Speed” or “Controller Inhibit”.
The desire is often to avoid shutting down so as
not to lose any data about the current drive status.
In some cases, spontaneous shutdown of theconnection between the mains and the converter
or even between the converter and the drive islinked to device defects and so cannot be
considered.

Examples of drive-integrated safety

4-21

Chapter 4 Safeguards

4.4 Manipulation of safeguards
Dealing with safeguards and their manipulation is
an issue in which the true causes have long been
largely taboo. It’s a situation that’s difficult to understand, for without negative feedback, where canyou start to make positive changes in the design ofplant and machinery?
This situation has now changed: the confederationof commercial trade associations has publisheda study showing that safety equipment had been
manipulated on almost 37% of the metal processing
machinery examined. To put it plainly: in a good
third of cases, manipulations have been detected
and examined, although it’s safe to assume that theunreported number may be somewhat higher.
One fact that hasn’t changed, unfortunately,is the number of accidents recurring on machineryon which the safeguards are manipulated, as the
BG bulletins regularly show.

4.4.1 Legal position
The legal position is clear: European anddomestic law (e.g. EC Machinery Directive andProduct Safety Act (ProdSG)) stipulate that it is the
responsibility of machine manufacturers to only
place products on the market that have an adequatelevel of safety. Manufacturers must establish all
the potential hazards on all their machines inadvance and assess the associated risks. They
are responsible for developing a safety concept for
the respective products, implementing that concept
and providing the relevant documentation, based on
the results of the risk analysis and risk assessment.
Potential hazards must not be allowed to impact
negatively on subsequent users, third parties or theenvironment. Any reasonably foreseeable misusemust also be included. Operating manuals should
also clearly define the products’ intended use andprohibit any known improper uses.

4 Safeguards

Design engineers should never underestimate
the technical intelligence and creativity of machineusers, as revealed by some dubious practices
for defeating safeguards: it begins with crude but
effective access to the mechanical structure of thesignal flow chain and extends to skilfully filed keys
for Type 2 safety switches. It includes loosened,
positive-locking shaft/hub connections on switch
cams, which are difficult to detect, as well as
sophisticated short and cross circuits anddisguised, carefully hidden but rapidly accessible
override switches in N/C / N/O combinations,in the connection lead between the controller andthe safety switch. This is only a small sample ofthe manipulations that are detected; it is by nomeans all.

4-22

© Pilz GmbH & Co. KG, 20172017-08

Chapter 4 Safeguards

4.4 Manipulation of safeguards

The task of taking into account potential
manipulations in advance is therefore contradictory:
design engineers are supposed to simulate theimagination and drive of the machine operators,
who may frequently work under pressure but
still have enough time and energy to work out
alternative solutions. They are supposed toincorporate their expertise into their designs and,
under today’s usual time constraints, convert this
into safety measures which are manipulation-proof.
A task that’s not always easy to resolve.

4 Safeguards

Design engineers should also consider thatmachine operators generally have a fair level oftechnical understanding and manual dexterity andalso have considerably more time to becomeannoyed at ill-conceived operating and safetyconcepts and to consider effective “improvements”
than the design engineers had for their development
and implementation. Quite often they will have beenreliant purely on the normative specifications,
without being seriously aware of the realistic,
practical requirements.

The checklist contained in EN ISO 14119 forassessment of the incentives for defeatinginterlocking devices performs a valuable service
in predicting potential manipulations. It would also
be desirable, however, if design engineers in futurewould increasingly put themselves in the user’s
position and honestly and candidly ask themselves
what they would do with the available operating
and safety concept.

2017-08© Pilz GmbH & Co. KG, 2017

4-23

Chapter 4 Safeguards

4.4 Manipulation of safeguards
4.4.2 Conduct contrary to safety –What does that mean?
Definition
Defeat in a simple manner
Render inoperative manually or with readily available
objects (e.g. pencils, pieces of wire, bottle openers,
cable ties, adhesive tape, metallised film, coins,
nails, screwdrivers, penknives, door keys, pliers; but
also with tools required for the intended use of themachine), without any great intellectual effort ormanual dexterity (see also EN ISO 14119).
Manipulation
In terms of safety technology: an intentional,
unauthorised, targeted and concealed intervention
into a machine’s safety concept for one’s own
benefit,, using tools (see also EN ISO 14119).

4 Safeguards

Sabotage
Secret, intentional and malicious intervention into
a technical system, in order to harm employees
or colleagues. Word’s origin:
the wooden shoe (French: sabot) of an agricultural
worker or Luddite in the 19th century, which wasthrown into a lathe.
When designing and constructing machinery,
manufacturers specify what the machines canand should be able to achieve. At the same timethey also specify how the user should handle themachine. A successful design involves much morethan simply the machine fulfilling its technological
function in terms of the output quantity documented
in the implementation manual, and the quality andtolerances of the manufactured products. It mustalso have a coherent safety and operating concept
to enable users to implement the machine functionsin the first place. The two areas are interlinked, sothey ought to be developed and realised in a joint,
synchronous operation.

4-24

Numerous product safety standards (e.g. EN 1010
or EN 12717) are now available, offering practicalsolutions. Nonetheless, planning and design
deficiencies are still to be found, even on newmachinery. For example:• Recurring disruptions to the workflow, brought
about for example by deficiencies in the technological design or in the precision of the components (direct quote from a plant engineer:“The greatest contribution design engineers canmake to active health and safety is to design themachines to work exactly in the way which waspromised at the sale.”)• Opportunities for intervention or access,e.g. to remove the necessary random samples,are either difficult or non-existent• Lack of segmented shutdowns with material
buffers, so that subsections can be accessedsafely in the event of a fault, without having toshut down the entire plant and lose valuable time
starting it up again
Ill-conceived safety concepts are still found inpractice on a regular basis. Many errors are madewith interlocked safeguards, for example, when
• Non-hazardous or frequently operated function
elements, e.g. actuators, storage containers,
filler holes, are installed behind (interlocked)
safeguards• The interlock interrupts the hazardous situation
quickly and positively when a safeguard is
opened, but afterwards the machine or process
is unable to continue or must be restarted© Pilz GmbH & Co. KG, 20172013-11

Chapter 4 Safeguards

4.4 Manipulation of safeguards
Nobody has any doubt that designers act to thebest of their knowledge and belief when they
design and implement technological functions
as well as those functions relating to persons
or operators. One can’t really blame them forassuming that subsequent users will behave
reasonably and correctly when using the machinery.
But it’s precisely here that caution is advised:human behaviour is mainly benefit-oriented,
both in everyday and in working life. People strive
to perform the tasks they are given or have setthemselves as quickly and as well as necessary,with the least exertion possible.

People will also try to intervene actively in support
of a process if it isn’t running quite as it should. They
will make every effort to rectify troublesome faults asquickly and simply as possible. If they can’t becauseof the design (and the fault rectification procedure
set down in the operating manual), they will find away out by defeating the interlock, for example. They
will often regard the additional work as a personal
misfortune for the smooth performance of their work
function. By defeating the safety measures that havebeen provided, the fault rectification procedure
is much less complex and is therefore seen as a
success. Successful behaviour tends to be repeateduntil it is reinforced as a habit, which in this caseis unfortunately contrary to safety and indeed
dangerous.

Risk
UnprotectedInterlock“all or nothing”

leads tomanipulation!

4 Safeguards

Work under
special conditions
and accepted risksGaininsafetyResidual risk

Normal mode

Special mode

Operation

Interlocking concept for special operating modes

2017-08© Pilz GmbH & Co. KG, 2017

4-25

Chapter 4 Safeguards

4.4 Manipulation of safeguards
The more such rule breaches are tolerated atmanagement level and go unsanctioned, thegreater the probability that the rules will continue
to be breached without punishment. Incorrect
conduct becomes the new, informal rule. For overthe course of time, the awareness of the risks thatare being taken will lessen and those involved
become convinced that they have mastered thepotential hazards through vigilance. But the risk isstill there; it’s just waiting for its chance to strike.

4 Safeguards

There’s no question that the factors that trigger an
accident seem initially to rest with the conduct of
those affected. However, design errors on the machine
encourage the misconduct that’s so dangerous(even life threatening) to those involved. Suchmachines do not comply with the EC Machinery
Directive. In other words: it is the manufacturer’s
responsibility to design protective measures in sucha way that they provide a sufficient level of safety,in accordance with the determined risk, while still
guaranteeing the functionality and user friendlinessof the machine. Ultimately it is always better toaccept a calculable, acceptable residual risk witha carefully thought out safety concept, tailored tothe practical requirements, than to expose themachine operator to the full risk of insecure
processes following successful manipulation.

4.4.3 What can designers do?
Designing safety-related machinery means morethan simply complying with regulations andother legal stipulations. Consulting the relevant
regulations and standards, dismissively asking“Where does it say that?!” – to ensure that only
those safety measures that are strictly necessary
are implemented – is no substitute for deep
consideration of solutions that are not only rightfor safety and right for people but are also fit for
purpose.
Most of all, design engineers must be moresensitive to operators’ demands for operabilityof machines and safety devices, which stemfrom practical experience, and provide a serious
response to these. This does not make the safetyrelated design more difficult, but is the basis onwhich to build user-friendly, safety-related machinery.
It’s essential that the actual development anddesign is preceded by a detailed, candid analysisof the operational requirements, the results of which
are recorded in a binding requirement specification.
If not, the situation may arise in which the machine
and its incorporated safety measures may not be
accepted. What’s more, they could provoke users
into coming up with “new ideas”, most of which do
not support health and safety. These in turn could
conjure up a whole new set of hazards, which were
far from the minds of the original designers.
Nonetheless: manipulation rarely occurs voluntarily;
it usually indicates that machine and operating
concepts are not at their optimum. Conduct contrary
to safety should always be anticipated when:• Work practices demand actions which
do not have a direct, positive impact on
outcomes• Work practices enforce constant repetitionof the same work steps, or fresh approaches
are always required in order to achieve worktargets• Safeguards restrict the line of vision androom for manoeuvre required to performthe activity• Safeguards impede or even block the visual/auditory feedback required to work successfully• Troubleshooting and fault removal are
impossible when the safeguards are open

4-26

© Pilz GmbH & Co. KG, 20172017-08

Chapter 4 Safeguards

4.4 Manipulation of safeguards

The obligations of machine manufacturers
are threefold:
1. Anticipate reasons and incentives for
manipulation, remove the temptation to defeat
interlocks by creating well thought-out operating
and safety concepts for machinery.
2. Make manipulation difficult by design,
e.g. by installing safety switches in inaccessible
areas, using hinge switches, attaching safetyswitches and their actuators with non-removablescrews, etc.
3. Under the terms of the monitoring obligation
specified in the Product Safety Act (ProdSG),
systematically identify and rectify any deficiencies
through rigorous product monitoring with all
operators (reports from customer service engineers
and spare part deliveries are sometimes very
revealing in this respect!).

4.4.4 User-friendly guards
It’s important to recognise that safeguards – eveninterlocked guards – are always willingly accepted
and are not manipulated when they do not obstruct
but actually support or even simplify the workflow.
Faults in the safety concept which force operators
to manipulate safeguards are genuine design faults,
for which the machine manufacturer is liable insome circumstances. Safety-related solutions withan acceptable residual risk must be put in place,not just for fault-free normal operation, but also for
setup, testing, fault removal and troubleshooting.
Simply to make manipulation attempts moredifficult on a technical level only appears to solve
the problem (see also EN ISO 14119). For if there
is enough pressure, a “solution” will be found. It’s
more important to eliminate the reason for manipulation. What’s needed is not excessive functionality(even in terms of safety technology), but user
friendliness. If there’s any doubt as to whether
the safety concept is adequate, it’s recommended
that you seek expert advice from the relevant
employer’s liability insurance association or fromthe safety component manufacturer.
4 Safeguards

In other words: manipulations must always be
anticipated when restricted machine functions
or unacceptable difficulties tempt, or even force,the machine user to “improve” safety concepts.
Manufacturers must design protective measures
so that the functionality and user friendliness of themachine are guaranteed at a tolerable, acceptablelevel of residual risk: predict future manipulation
attempts, use design measures to counteract themand at the same time improve machine handling.

The client who places the order for a machine
can also help to counteract manipulation by talking
to the machine manufacturer and candidly listing
the requirements in an implementation manual,binding to both parties, and by talking openly about
the faults and deficiencies within the process,then documenting this information.

2013-11© Pilz GmbH & Co. KG, 2017

4-27

Chapter 4 Safeguards

4.4 Manipulation of safeguards
Guards use physical barriers to stop people andhazardous situations coinciding in time and space.
Their essential design requirements are statedin EN 14120 and ISO EN 14119. Safety-related andergonomic aspects must be taken into accountalongside questions regarding the choice ofmaterials and consideration of mechanical aspects
such as stability. These factors are decisive, not justin terms of the quality of the guard function but also
in determining whether the safeguards, designed
and constructed at considerable expense, will be
used willingly by employees or be defeated andeven manipulated.

4 Safeguards

Experience shows that despite all the protestations,almost every safeguard has to be removed or
opened at some point over the course of time.
When safeguards are opened, it’s fundamentally
important that hazards are avoided where possible
and that employees are protected from danger.
The reason for opening, the frequency of opening
and the actual risk involved in carrying out activities
behind open safeguards (see the following
illustrations) will determine the procedures
used to attach and monitor safeguards.

Safeguard is opened forServicing work
Troubleshooting
work
Retrofit work

Maintenance work
Repairs(installation
processes)

without tools

with tools

Movableinterlocked
safeguard

Safeguard
fixed tothe machine

Once opened,
the machine
may only
be set in motion
under certain
conditions,e.g.:with two-handcircuit,in jog mode,at reduced
operating speed

Before opening:
Operatemain switch,
secure switch
with lock,attachwarning sign

Opening procedures on safeguards.

4-28© Pilz GmbH & Co. KG, 20172017-08

Chapter 4 Safeguards

4.4 Manipulation of safeguards
Hazardous movement is safeguarded

Safeguard
is opened

Switch to
special mode
Press

Secure4.4.5 Conclusion
Just some final words in conclusion for all designers:
designing interlocks so that absolutely no movementof the machine or subsections is possible once thesafeguard has been opened actually encourages
the type of conduct which is contrary to safety and,ultimately, leads to accidents. Nevertheless, it is
the causes you have to combat, not the people.
If a machine does not operate as intended, users
will feel they have no choice but to intervene. In allprobability, the machine will “reciprocate” some timewith an accident. Which is not actually what it was
designed to do!

4 Safeguards

Hazardous movement
is interrupted

If safeguards must be opened frequently as a conditionof operation, this must be possible without tools.
Where there are hazardous situations, use of aninterlock or guard locking device must be guaranteed.
Further protective measures must be adjusted tosuit the resulting risk and the drive/technologicalconditions, to ensure that the activities which need
to be carried out while the safeguards are open canbe performed at an acceptable level of risk.

Move on undercertain conditions

Avoid
hazards

Yes
Restriction?

Securehazards&
No

Indicatehazards

Work with open safeguards
and accepted risks

Interlocking concept for safeguards.

2017-08© Pilz GmbH & Co. KG, 2017

4-29

5
Safe
control
technology

Chapter 5 Safe control technology

5 Safe control technology
Safe control technology
Safety relays Overview of safety relays Structure and function of safety relays Relays and electronics Greater flexibility during installation 
Special features and functions Configurable safe small controllers 
Safety-related and non-safety-related communication 
Customer benefits from function and logic elements 
Safety and automation 
Overview of safety controllers 
Integration within the automation environment 
Safe decentralisation and enable principle Function blocks in safe controllers Mission time of safety functions 
Use of used components Using safety controllers to achieve safe control technology Overview 
Structures of the safe control technology Modularisation of the automation function 
Safe control technology in transition 
New requirements for safe control technology Complex yet simple – no contradiction 
From static to dynamic safety 
About Industrie 4.0 

2017-08© Pilz GmbH & Co. KG, 2017

5-4
5-4
5-4
5-6
5-7
5-10
5-11
5-13
5-16
5-21
5-21
5-22
5-24
5-25
5-26
5-26
5-27
5-27
5-28
5-29
5-30
5-30
5-32
5-37
5-38

5 Safe control technology

5
5.1
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.2
5.2.1
5.2.2
5.3
5.3.1
5.3.2
5.3.3
5.3.4
5.3.5
5.3.6
5.4
5.4.1
5.4.2
5.4.3
5.5
5.5.1
5.5.2
5.5.3
5.5.4

5-1

Chapter 5 Safe control technology

5 Safe control technology
Safety relays, therefore, are devices which
generally implement safety functions. In the eventof a hazard, the task of such a safety function is
to use appropriate measures to reduce the existingrisk to an acceptable level in the event of a hazard.
These may be safety functions such as emergency
stop, safety gate function or even standstillmonitoring on a drive. Safety relays monitor a
specific function; by connecting them to othersafety relays they guarantee total monitoring ofplant or machinery.
The first safety-related controller ultimately camefrom the desire to connect functions flexibly
through programming, similar to the way this isdone on a programmable logic controller (PLC).

5 Safe control technology

In the early days of control technology, the focus
in the controller was on the function and therefore
the process image. Relays and contactors activatedplant and machinery. Where there were shutdown
devices or devices to protect personnel, the actuator was simply separated from the supply whennecessary. However, people gradually realised that
this type of protection system could be rendered
inoperational in the event of a fault: the protectivefunction would no longer be guaranteed. As aresult, people began to consider the options for
safeguarding this type of separation function.
Special relay circuits, such as the 3 contactor
combination, were one of the initial outcomes ofthese considerations. These device combinations
ultimately led to the development of the firstsafety relay, the PNOZ.

Safety functions for all requirements

2017-08© Pilz GmbH & Co. KG, 2017

5-3

Chapter 5 Safe control technology

5.1 Safety relays
Configurable safe small controllers like PNOZmulti
are a combination of safety relay and safetycontroller. Having considered the advantages anddisadvantages of both systems, they combine thesimplicity of a relay with the flexibility of a safetycontroller. Although the primary focus for safety
relays and safety controllers is to monitor safetyfunctions, the current trend is towards intelligent
dovetailing of safety and automation functions
within one system.
5.1.1 Overview of safety relays
Safety relays perform defined safety functions.
For example, they
• Stop a movement in a controlled andtherefore safe manner• Monitor the position of movable guards• Interrupt a closing movement during access.
Safety relays are used to reduce risk: whena fault occurs or a detection zone is violated, they
initiate a safe, reliable response. Safety relays areencountered in almost every area of mechanicalengineering, mainly where the number of safetyfunctions is quite manageable. However, increasing
efforts are being made to integrate diagnostic
information into control concepts as well as overall
concepts. That’s why in future safety relays andeven safe small controllers with communications
interfaces will be more prevalent in plant andmachinery.
5 Safe control technology

Safety relays have a clear structure and aresimple to operate, which is why no special training
measures are required. To use these devices
successfully, all that’s generally needed is normal
technical knowledge of electrical engineeringand some awareness of the current standards
for machine safety. The devices have become
so widely used because of their compact design,high reliability and, importantly, the fact that thesafety relays meet all the required standards.
They have now become an integral componentof any plant or machine on which safety functions
have a role to play.

5-4

Since the first safety relays were developed –initially with the sole intention to monitor the
emergency stop function – a wide range of devices
have now become established, performing somevery specific tasks in addition to the monitoring
functions: for example, monitoring speeds orchecking that voltage is disconnected on a power
contactor. The devices are designed to work wellwith the sensors and actuators currently available
on the market. Today, a safety relay is available
for practically every requirement. With their diverse
functionality, safety relays can implement almost
any safety function, for example, monitoring
the whole safety chain from the sensor to theevaluation logic, through to activation of theactuator.
5.1.2 Structure and functionof safety relays
Today’s safety relays are distinguished primarily
by their technological design:• Classic contact-based relay technology• With electronic evaluation andcontact-based volt-free outputs• To fully electronic devices
with semiconductor outputs
Nothing has changed in the fundamental requirementthat safety relays must always be designed in such a
way that – when wired correctly – neither a fault on
the device nor an external fault caused by a sensor
or actuator may lead to the loss of the safetyfunction. Technological change has advanced thedevelopment of electronic safety relays, which offer
much greater customer benefits: electronic devices
are non-wearing, have diagnostic capabilities andare easy to incorporate into common bus systems forcontrol and diagnostic purposes.

© Pilz GmbH & Co. KG, 20172017-08

Chapter 5 Safe control technology

5.1 Safety relays
Ch. 1

Ch. 2

E-STOP
button+UB–***Safety contacts,
positive-guided
13
23
33

Feedback
loop
S11

S12

S22

Y1

Y2

Auxiliary N/C contact
not permitted
for safety circuits
41

K1

K2

K2
K3

K1

K3

K1

K2

K1

K2

K3

S33

C1

K3

S34

14

24

34

42

ON button

Ch. 1

Ch. 2

UB

–

Feedback
loop
S11

S12

S22

Y1

***Safety contacts,
positive-guided
13
33
23

Y2

Auxiliary N/C contact
not permitted
for safety circuits
41

5 Safe control technology

E-STOP
button+Short circuitin output contact

Short circuit in
E-STOP pushbutton

K1

K2

K2
K3

K1

K1

K3

K2

K1

K2

S33

K3

S34

C1

K3

14

24

34

42

ON button

Structure and function of a safety relay

2013-11© Pilz GmbH & Co. KG, 2017

5-5

Chapter 5 Safe control technology

5.1 Safety relays
The typical design of a first generation safety relay inrelay technology is based on the classic 3 contactor
combination. The redundant design ensures thatwiring errors do not lead to the loss of the safetyfunction. Two relays (K1, K2) with positive-guided
contacts provide the safe switch contacts. The two
input circuits CH1 and CH2 each activate one of thetwo internal relays. The circuit is started via the start
relay K3. There is another monitoring circuit between
the connection points Y1 and Y2 (feedback loop).
This connection is used to check and monitor the
position of actuators, which can be activated or shut
down via the safety contacts. The device is designed
in such a way that any faults in the input circuit aredetected, e.g. contact welding on an emergency stop
pushbutton or on one of the safety contacts on the
output relay. The safety device stops the device
switching back on and thereby stops the activationof relays K1 and K2.

functions to be implemented in the same effective
area. Adjustable start-up test and optional reset
for restarting allow for flexible application of thedevices. As a single device type can implement
several different safety functions at once, savings
can be made in terms of stockholding, configuration, design and also when commissioning plantand machinery. Not only does this reduce theengineering effort in every lifecycle phase, it also
simplifies any additions or adjustments that are
required.

5.1.3 Relays and electronics

5 Safe control technology

The latest generation of safety relays operates
using microprocessor technology. This technology
is used in the PNOZsigma product group, forexample, and offers further additional benefits
over conventional relays. There is less wear andtear thanks to the use of electronic evaluation
procedures and the diagnostic capability, plus thesafety relays also reduce the number of unit types:
one device can now be used for a variety of safetyfunctions and sensors, e.g. for contact-based
sensors such as emergency stop pushbuttons
or mechanical safety gate switches, but also forsensors with semiconductor outputs such as
non-contact safety gate switches, light curtains
and two-hand control devices. As electronic safety
relays have a more compact design, they take upmuch less space. The reduced size enables more

5-6

Electronic safety relays and small controllers
can be expanded in the simplest way possible.
Whether you use additional contact blocks orfunction modules: adapting to the specificrequirements of the respective plant or machineis a simple, straightforward process, with contacts
expanded via connectors. With just a single baseunit, plus additional expansion units if required,users can fully implement all the classic functions.

© Pilz GmbH & Co. KG, 20172017-08

Chapter 5 Safe control technology

5.1 Safety relays
5.1.4 Greater flexibility during installation
For many years, wiring of the individual functions
on safety relays was a complex, problematic
procedure which had a negative impact on the
installation process. Imagine the following situation
on a machine: a safety gate is intended to prevent
random, thoughtless access to a danger zone.
Access is only possible once the hazardous
movement has been stopped and the machine isin a safe condition, at least within the danger zone.
However, the intention is for various drives to be
operable at reduced speed, even when the gate isopen, for installation and maintenance purposes
for example. An enable switch has therefore been
installed, which must be operated simultaneously.

&

1

1

1

≥1
1

1

1

&
1

0

5 Safe control technology

1

If these requirements are to be implemented inpractice, so that the operator is protected frompotential hazards, a substantial amount of wiring will
be needed to connect the individual safety devices.
As well as the actual protection for the safety gate,
safety relays will also be required for the enableswitch, to monitor "Setup" mode, and for the
master emergency stop function. Reduced purely
to the logic relationships, the connections could
look as follows:1

Wiring example

2013-11© Pilz GmbH & Co. KG, 2017

5-7

Chapter 5 Safe control technology

5.1 Safety relays
If this application is implemented using classic
contact-based devices, the design will correspond
approximately to the diagram below:

Wiring example using contact-based safety relays

5 Safe control technology

The diagram shows that implementation via
contact-based devices produces a result which
is not entirely comprehensible; it is also very cost
intensive due to the vast amount of wiring involved.
In recognition of this fact, consideration almost
inevitably turned to a simpler form of implementation,using logic connections between the safety relays.
Thus started the development of a new type ofdevice with integrated connection logic.

&

Input

Output

Input

Input

OutputLess wiring due to linkable outputs

5-8© Pilz GmbH & Co. KG, 20172017-08

Chapter 5 Safe control technology

5.1 Safety relays
devices contain a logic block with special inputs,
enabling logic AND/OR connections between thedevices. An output block with auxiliary outputs andsafety outputs completes the safety relay.
The following application example shows how
the above example is implemented using electronic
safety relays from the stated product group.
Compared with a design using contact-based
technology, the diagram is much clearer andthe amount of wiring is drastically reduced.

5 Safe control technology

Microprocessor technology opened up a whole
new range of possibilities, as expressed by the
predominantly electronic devices in the PNOZelog
product group, for example. It laid the foundations
for previously unimagined flexibility: one device
can now be set for different application areas,
another device for different safety functions.
Unlike conventional safety relays, these relays haveelectronic safety outputs and auxiliary outputs thatuse semiconductor technology. As a result they are
low-maintenance and non-wearing and are therefore
suitable for applications with frequent operations or
cyclical functions. In addition to the actual basic
function, such as monitoring a safety gate or an
emergency stop function for example, theseWiring example using electronic safety relays

2013-11© Pilz GmbH & Co. KG, 2017

5-9

Chapter 5 Safe control technology

5.1 Safety relays
5.1.5 Special features and functions

5.1.5.2 Safety relays for the Ex area

A key benefit of safety relays is their ability to
specialise. They have a clear, self-contained task tofulfil, so specific customer requirements have led
to a wide range of safety relays with particularfunctions and features: these include devices
with muting function, with safe monitoring of speed,
standstill and monitored disconnection, as well as
safety relays with special properties for the Ex area.
The examples below illustrate some of thesefunctions.

Some of the most hazardous plant andmachines are those that manufacture, transport,
store or process dust, flammable gases or liquids.
Explosive compounds may be produced during
these processes, which could present a danger
beyond the immediate environment. Potentiallyexplosive atmospheres like these require special
devices, on which electrical sparking on contacts
and impermissibly high temperatures must be
prevented. Such safety relays must provide
an intrinsically safe output circuit and volt-freecontacts for potentially explosive areas. Dependingon the area of application, different versions ofsafety relays are available that are approved foruse in potentially explosive areas.

5.1.5.1 Muting function
The muting function is used to automatically andtemporarily suspend a safety function implemented
via a light curtain or laser scanner for a particularpurpose. A muting function is frequently used totransport material into or out of a danger zone.

5 Safe control technology

Certified safety relay for the Ex area

5-10

© Pilz GmbH & Co. KG, 20172017-08

Chapter 5 Safe control technology

5.2 Configurable safe small controllers
With this generation of devices, the safetyfunctions and their logic connections are configured
exclusively via the software tool. The manufacturer
provides the safety functions as function elements;
specified bodies such as BG or TÜV will havealready tested them for safety. With the help ofsafe function elements and the logic connection
between the elements, plant or machine builders
create the safety-related application they require,
an application which they would previously have
implemented by wiring contactors and relays ina laborious, time-consuming process. Contacts andwires are replaced by lines between the ready-madeelements. An electrical circuit diagram showing the
logic functions is no longer required.

5 Safe control technology

Similar to progress in the automation technology
sector, safe control technology has graduallydeveloped from hard-wired contactor technology
to contact-based safety relays and devices withintegrated logic function and beyond to flexible,
configurable small controllers. The idea was tomake safe control technology more transparent
and manageable for the user. This was the major
driving force behind development of the devices
and ultimately led also to the development of new
types of configuration tools, which graphicallydisplay function and logic and then forward theconfigured setting to the base unit via chip card
or USB stick. The result is a high degree of flexibility
for the responsible electrical design engineer;
their plans only have to consider the number ofdigital and analogue inputs/outputs required. They
can incorporate the functions at some later date
and adapt them to suit the changed situation if
necessary. At the same time, any work involved
in wiring the logic functions also disappears.

Logic connections between the elements for simple configuration

2017-08© Pilz GmbH & Co. KG, 2017

5-11

Chapter 5 Safe control technology

5.2 Configurable safe small controllers
Not only is it easy to connect the function elements
to each other, a simple click of the mouse is all ittakes to adapt them fully to the requirements of
the relevant application. Adjustable properties define
the behaviour of the individual elements within
the application: whether single or multi-channel,

with or without automatic restart, e.g. whena safety gate is closed. Parameters that determine
how an element will behave can be easily set
in accordance with the application’s safety
requirement.

Configure function elements

5 Safe control technology

The parameters available in the “Configure
Function Element” window (see figure) essentially
mirror the familiar functions from the safety relays.
They no longer have to be set laboriously on
the device or be selected via jumpers; with theparameter tool everything operates in the simplest
way possible. Users will find all the useful, provenelements from the world of the classic safety relays,
just represented in a different format. This new
configuration method has another quite simple,
safety-related benefit: once the configuration has
been selected, it cannot easily be modified byunauthorised persons via screwdriver or device
selector switch.

5-12

Simple configuration of the required input andoutput elements plus special elements for speed
or analogue processing enable users to createa safety controller that suits their own individual
needs. Functions can be added or adapted laterwith relative ease. Users simply select theseelements from a list and then create the necessary
logic functions.

© Pilz GmbH & Co. KG, 20172017-08

Chapter 5 Safe control technology

5.2 Configurable safe small controllers
5.2.1 Safety-related and non-safety-related
communication

Configurable small controllers offer a whole new
set of options here: they can be connected toalmost any fieldbus via fieldbus modules. This
enables a simple, two-way exchange of signals andinformation. This produces closer dovetailing of
automation and safety and therefore of the wholeautomation structure. In this case, the fieldbus
modules of the configurable small controllers behave
just like any other fieldbus subscriber in the fieldbus
system. These connections can be used to transfer
diagnostic data to any automation system, leading
to a significant reduction of plant and machine
downtimes.

5.2.1.1 Non-safety-related communicationof standard signals and diagnostic data
Communication on classic contact-based safety
relays is very limited. Simply displaying fault conditions can sometimes prove difficult. Switching toelectronic versions already makes communication
somewhat easier: LEDs flash, sometimes withvarying frequencies, to distinguish between specificmalfunctions. LCD displays indicate errors and/or
operating states in plain text.

Integrated, user-friendly diagnostic concepts
enable targeted fault detection and remedial action.
Using Active-X elements, data can be displayed
directly on operator terminals via the Pilz OPC or
OPC UA server.

I2
I6

I3
I7

I0
I4

I1
I5

I2
I6

PNOZ m EF 16DI

Power
Run
Diag
Fault
I Fault

Power
Run
Diag
Fault
I Fault

I3
I7

I0
13

I1
14

I2
23

I3
24

PNOZ m EF 4DI4DOR

I0
13

I1
14

I2
23

5 Safe control technology

I1
I5

X1 X3

I0
I4

PNOZ m EF 16DI

X1 X3

PNOZ
m ES
Profibus

X1 X3

Power
OnlineOffline
Fault

X1 X3

An OPC UA server connection can also be used
to link PNOZmulti with the web-based visualisation
software PASvisu. All variable from the safe small
controller are adopted here. It is therefore possible
to generate a comprehensive and convenient
overview of plant and machinery, both locallyand remotely.

I3
24

PNOZ m EF 4DI4DOR

X10
Address

Power
Run
Diag
Fault
I Fault
O Fault

772143772140I8 I9 I10 I11
I12 I13 I14 I15772143000007 0.1

000007 0.1

X4 X2

X4 X2

I8 I9 I10 I11
I12 I13 I14 I1533

34 43 44000007 0.1

X2772140000007 0.1

X4

Power
Run
Diag
Fault
I Fault
O Fault

X2

X1772132
100002
1.0

Profibus

X1

33

34 43 44

24V 0V

max. 12+1

PNOZmulti 2 – for large-scale automation projects in conjunction with the diagnostic solution PVIS,
the operator terminals PMI, safe sensor technology PSEN and decentralised periphery PDP67

2017-08© Pilz GmbH & Co. KG, 2017

5-13

Chapter 5 Safe control technology

5.2 Configurable safe small controllers
5.2.1.2 Safety-related communication
with configurable small controllers
Previously, this could only be achieved byexchanging hardware signals. This is a laborious
process and is extremely inefficient due to thehigh cost for each piece of information transmitted.
If link modules are used to replace the previous
hard-wired solution, the amount of wiring is
reduced along with the cost, while the amountof information data is increased.

5 Safe control technology

Progressive networking has forced its way up to
the level of configurable small controllers. Theseuse special link modules or protocols to exchange
safety-related data up to performance level e of
EN ISO 13849-1. Safe data transfer using thistechnology opens up new horizons in the field ofconfigurable small controllers. If several machines
are working together in a close network, forexample, safety requirements will demand thatsafety signals are exchanged between thecontrollers.

Connection of configurable safe small controllers

5-14© Pilz GmbH & Co. KG, 20172017-08

Chapter 5 Safe control technology

5.2 Configurable safe small controllers
In addition to these special link modules, more
and more Ethernet-based safety protocols are now
being used, even in the field of safety controllers.
The black channel principle enables the Ethernet
network to be used in parallel with automation andsafety protocols.

A function and logic element has been developed
to transfer safety information; this makes it easy forusers to exchange data with the automation system
PSS 4000 in complex networks.

Address

Transferring this safe communication into softwarebased elements or special hardware is probably themost efficient solution that is currently available innetworking.

FS_LightCurtain
SAFEUSINT

SwitchType

EnableSAFEBOOLSAFEBOOLAutoStart

DiagOperated

SAFEBOOLSAFEBOOL

AutoReset

DiagReadyForReset

SAFEBOOLSAFEBOOL

MonitoredReset

DiagReadyForTest

SAFEBOOLSAFEBOOLStartupTest

DiagSwitchError

SAFEBOOL

DiagInputNotValid

SAFEBOOLTIME

SimultaneityTime

TIME

DelayTimeSAFEBOOL

InputNC1

SAFEBOOL

InputNC2

BOOL

Reset

Safe Ethernet Connection

The safe Ethernet connection enables a point-to-point connection between a PNOZmulti base unit
and a PSS 4000 device. Up to 48 safe virtual inputs and outputs can be transmitted via this connection.

Communications partner 1
Point-to-pointconnection 1

Block/element
Safe Ethernet connection
Local address

30

Remote address

31

5 Safe control technology

Communications partner 2
Block/element
Safe Ethernet connection
31

Local address

30

Remote address

Communications partner 3

Block/element
Safe Ethernet connection
Local address

40

Remote address

41

Point-to-pointconnection 2

Block/element
Safe Ethernet connection
41

Local address

40

Remote address

Connection addresses with two point-to-point connections

2017-08© Pilz GmbH & Co. KG, 2017

5-15

Chapter 5 Safe control technology

5.2 Configurable safe small controllers
5.2.2 Customer benefits
from function and logic elements

Example: Sequential muting
Muting phase 1:

Configurable safe small controllers offer a wide
range of predefined function elements. Theseelements form the basis for implementing the safety
technology requirements of plant and machinery.
The availability of elements for the widest possible
range of applications and functions enables users
to implement their requirements quickly andeffectively.

• Material in front of the danger zone
• Light curtain active• Muting lamp off

5.2.2.1 Function elements for muting function
The “muting function” is one of those laborious
functions which previously required the applicationof special relays, but which can now be implemented
easily using configurable small controllers. The function is used to automatically and temporarily suspend
a safety function, such as a light curtain or laser
scanner. It is often applied, for example, to transportmaterial into or out of a danger zone. A distinction ismade between sequential and cross muting. Typicalapplication areas include the automotive industry,on palletising of drink dispensing machines, or in the
manufacture of stone products (concrete blocks,
tiles etc.). Additional sensor technology is used to
distinguish between persons and objects.

Muting phase 2:

5 Safe control technology• Muting sensors 1 and 2 operated• Light curtain suspended• Muting lamp on

5-16© Pilz GmbH & Co. KG, 20172017-08

Chapter 5 Safe control technology

5.2 Configurable safe small controllers
Muting phase 3:• Muting sensors 3 and 4 operated• Light curtain suspended• Muting lamp on

Muting phase 4:

5 Safe control technology• Muting process ended• Light curtain active again• Muting lamp off

2017-08© Pilz GmbH & Co. KG, 2017

5-17

Chapter 5 Safe control technology

5 Safe control technology

5.2 Configurable safe small controllers
5.2.2.2 Logic elements for press applications

5.2.2.3 Logic elements for burner applications

In addition to logic elements for individual functions,complete application packages are also available
for specific self-contained applications such asmechanical and hydraulic presses, for example. Suchpackages are designed to perform control functions
as well as meeting safety-related requirements. The
package contains all the basic functions that a press
needs: e.g. elements for setup, single-stroke andautomatic operating modes; monitoring a mechanicalrotary cam arrangement; run monitoring to monitor
the mechanical transmission for shearpin breakage;
monitoring of electrosensitive protective equipment
in detection and/or cycle mode; monitoring andcontrol of the press safety valve plus cycle initiation
via a two-hand control device.

Another self-contained application package isavailable for burner applications. The burner logic
element is designed to control and monitor burners(automatic burner control system) in accordancewith the standards that are mostly needed in thiscase, such as EN 50156-1, EN 298 or EN 676,
for example.
The element monitors safety chains, combustion
air pressure, ignition, flame, external compoundcontroller or tightness control. Functions such as
safety valves, ignition valves, ignition or also external compound controllers can continue to becontrolled. By setting the parameters for the logic
element, these control and monitoring functions
can be adapted flexibly for the specific burner type.
The burner cycle has several phases, in which
various steps are run through, based on the burnertype. If the input signals for that particular step arecorrect, the next step in the cycle is carried out.
If not, a safety shutdown or fault lockout is carriedout, depending on the configuration.

Safe control and monitoring of presses

5-18© Pilz GmbH & Co. KG, 20172017-08

Chapter 5 Safe control technology

5.2 Configurable safe small controllers
Encoder

18Mini-IOPNOZ m EF 1MM“Listening function” of a standard encoder through the safety controller

In addition to general safety functions such as
monitoring of safety gates, emergency stop function
or light curtain evaluation, configurable small controllers also offer special expansion modules andspecific logic elements for advanced options suchas the safe detection of movement and standstillon drives. With the speed monitor modules of the
PNOZmulti devices, up to two axes are possible per
expansion module, each with eight limit values for
speed and standstill monitoring and detection ofclockwise and anti-clockwise rotation. In this way,
motion information can be integrated directly
into the safe small controller, irrespective of thedrive system you are using.

2017-08© Pilz GmbH & Co. KG, 2017

Monitoring is possible up to performance level dof EN ISO 13849-1 with regular standard rotary
encoders. No expensive safe encoders are required.
Laborious wiring is no longer necessary thanks to thesimple “listening function” of the encoder signals –“tapping” the encoder cable via a T-junction. The
direct signal tap on the motor encoder minimises
the work involved in the mechanical and electricaldesign through appropriate adapter cable forthe widest range of drives. Speed and standstilldetection, including evaluation via customised logic
elements, is easily available via plug and play.

5 Safe control technology

5.2.2.4 Logic elements for the drive environment

5-19Chapter 5 Safe control technology

5.2 Configurable safe small controllers
5.2.2.5 Logic elements
for safe analogue processing

Example: Range monitoring
4 … 20 mA current loop

In the past, processing analogue signals safely using
safe small controllers was as good as impossible.
Only the integration of special expansion modules
and the availability of customised logic elements
has made safe analogue processing possible. In asimilar procedure to that of the drive environment,
configurable small controllers can be used toevaluate sensor information from the analogue
process environment. This may relate to process
conditions such as fill level, position, temperatureor pressure for example; there’s practically no limit
to the extended application options. For analogue
signals it is also possible to define limit values,
threshold values or value ranges within which ameasured value may move; this is done throughconfiguration of the module or by setting parametersin the logic element. Reliable monitoring therefore
becomes a reality; all values can be evaluatedand further processed.

With range monitoring, the first step is to define
the permitted value range. Depending on theselected condition (“greater than” or “less than”),
the output for threshold value monitoring is set
to “0” if the recorded value exceeds or drops below
a range limit.
Two range limits are to be defined in this example:• I < 3 mA monitors for open circuit and• I > 21 mA monitors for encoder error
Error if

Comment

Condition

Value

R1

<

3 mA

Open circuit

R2

>

21 mA

Encoder error

2

4

6

8 10 12 14 16 18 20 22 24

0 mA

25,59 mA

Example: Monitoring the position ofa control valve via range monitoring
5 Safe control technology

Control valves in process technology, e.g. to control
flow rates, are generally controlled in analogue;
feedback on the valve position is also analogue.
Without safe analogue processing, until now,
only special switches have been able to evaluate
the position signals from valves. PNOZmulti allows
you to set as many valve positions as you likeand to monitor compliance, safely and reliably.

5-20© Pilz GmbH & Co. KG, 20172017-08

Chapter 5 Safe control technology

5.3 Safety and automation
5.3.1 Overview of safety controllers
Safety controllers essentially came about because of
the desire to integrate safety through programming,in a similar way to that of a PLC control system. It’sno surprise then, that safety controllers are following
the example of the PLC world. Centralised systems
came first, followed by decentralised systems inconjunction with safe bus systems. The programming followed the same pattern, except that the
instruction set was drastically reduced from thevery start. Additionally, simple languages suchas IL (Instruction List) or LD (Ladder Logic/Ladder
Diagram) were used. These measures were taken
for reasons of safety, for the opinion was that limiting
the programming options would minimise the errors
made in generating the program. Initial systems
clearly focused on processing safety functions.
Although even at the start it was possible to program
the safety controller for standard automation,in practice this application found very limited use.
In the meantime, however, a growing number oflimited high-level languages such as Structured Text
are being used in programming.

PII

Safety-related features aside, there is little todistinguish safety controllers from standard
automation control systems in terms of their actual
function. Essentially a safety controller consists of
two PLC controllers, which process the application
program in parallel, use the same I/O process image
and continuously synchronise themselves. It sounds
so simple, but the detail is quite complex: crosscomparisons, testing of the input/output level,
establishing a common, valid result, etc. are allmulti-layer processes, which illustrate the internal
complexity of such systems. Ultimately, of course,
the user is largely unaware of this; with the exceptionof some specific features, such as the use of test
pulse signals to detect shorts across the contacts,
modern systems behave in the same way as other
PLC controllers.
Structure of a safe control system:• Two separate channels• Diverse structure using different hardware• Inputs and outputs are constantly tested• User data is constantly compared• Voltage and time monitoring functions• Safe shutdown in the event of error/danger

PII

DPR
A

Crosscheck

ChannelFlag

5 Safe control technology

ChannelB

Counter
PIO

PIO

&

Elementary structure of a safe control system

2017-08© Pilz GmbH & Co. KG, 2017

5-21

Chapter 5 Safe control technology

5.3 Safety and automation
5.3.2 Integration within the automation
environment
Cycle times are becoming ever shorter, while
productivity and the demands on plant andmachinery control systems are increasing. In
addition to the technical control requirements,
the need for information regarding process andmachine data is constantly growing. As a result,communication technologies from the office world
have made their mark on control technology.
One consequence of this trend, for example,
is the prevalence of Ethernet-based bus systems
in automation technology, right down to fieldand process level.

The division of duties also has a number of
positive aspects: on the one hand, it increases
overall performance, because each unit simply
concentrates on the matters for which it has been
designed and configured. Productivity increases do
not just impact positively on the output of the plantor machine: they can also be beneficial in termsof handling, if faster reaction times enable safety
distances to be minimised, for example. On theother hand, separation can also be used to transfer
responsibility for the individual systems to different
individuals. That helps both sides, because
everyone can concentrate on the task in hand.

5 Safe control technology

Previously safety technology was characterised
more or less as a monitoring function and wasincorporated as such into the automation chain.
The process controller dominated and thereby
defined the actual process stages. As a “monitoring
instrument”, the safety controller either agreed or
disagreed with the decisions of the processcontroller. The figure overleaf illustrates theprinciple.

Monitoring is limited to safety-relevant control
functions, as is the enable. Process outputs withouta safety requirement are unaffected. A distinct
benefit of such a procedure is the fact that thetasks, and therefore the responsibilities, are clearly
separated. A separate system is responsible for thedesign and monitoring of the safety technology;
another separate controller manages the machine
and the process. This way it is possible to guarantee
the absence of feedback: changes made primarily
in the standard control system will not affectthe safety controller. This is an essential safety
requirement of a safety system.

5-22© Pilz GmbH & Co. KG, 20172017-08

Chapter 5 Safe control technology

5 Safe control technology

5.3 Safety and automation

Enable operating principle, with safety relay or safety controller

2017-08© Pilz GmbH & Co. KG, 2017

5-23

Chapter 5 Safe control technology

5.3 Safety and automation
Complete PII/PIO+ diagnostic data

Failsafe (FS)Standard (ST)

Switch commands
for PSS enable

ST outputs

FS outputs
FS inputs

ST inputs

PLC cycle
ST busPSS cycle
SafetyNET p
Outputs
Classic: “&” on control system

5 Safe control technology

Circuit diagram for the enable principle

5.3.3 Safe decentralisationand enable principle
As explained already, in many cases safety
technology follows the developments made instandard control technology. The benefits fromtransferring the input/output level to the field via
decentralisation have resulted in the same process
being applied to safety-related inputs and outputs.
This was followed by the development of a safety
bus system, which not only allows field inputs
and outputs but also a safety-related connection
between safety controllers.

5-24

The diagram above illustrates a typical application inwhich the enable principle has been implemented.
The safety controller switches the safety-related
outputs, and the standard PLC transfers the switch
command for the corresponding output to the safetycontroller via fieldbus. This retrieves the switch
command from there and inserts it into the output’s
control program as an AND function. Modern
controllers combine the safety function and thestandard function in one device. The data is thustransferred within the overall controller between thesafety section and the standard section. The time
for running the data over the fieldbus is no longer
required, thereby considerably shortening thereaction times. The fieldbus now transfers safetyrelated and non-safety-related data to decentralised
modules in one medium.
© Pilz GmbH & Co. KG, 20172017-08

Chapter 5 Safe control technology

5.3 Safety and automation
5.3.4 Function blocks in safe controllers
Function blocks for safety-related functions are
the key to the success of safety controllers.
Although initially they were more or less an imageof the functions and properties found on safety
relays, gradually the range has been developed
to include elements for special uses such aspress applications or burner management. Today,
function elements are available for almost every
conceivable safety-related application. All of thesehave been tested by notified bodies and offer
users optimum safety for everyday use.

The concept of function elements was originallyintended for the safety controller, but was thendeveloped to form configurable logic elements forconfigurable small controllers as described, making
applications even more customer-friendly. The
principle of using configurable logic elements is
also part of a continually developing programming
environment for the safety controllers. The user
can choose between classic programming, e.g. in
IEC 61131, and a configuration similar to that of
the configurable small controllers.

5 Safe control technology

Software platform
PAS4000

A	Project tree with folder structure:
clear and expressive
B	Property field:
edit parameters,
easily make changes
C	Programming window:
for software editors
D	Block library:ready-made safety andnon-safety-related blocks

Modular software for controlling, programming and monitoring using software platform PAS4000 as an example

2017-08© Pilz GmbH & Co. KG, 2017

5-25

Chapter 5 Safe control technology

5.3 Safety and automation
5.3.5 Mission time with safety functions
What happens with components in safety functions(designed in accordance with EN ISO 13849-1 or
IEC 62061) at the end of the mission time (Tm)?
The duration of use of the relevant modules has been
an issue since the application of EN ISO 13849-1
for design and validation of safety-related control
functions. The standard specifies a period of 20 years
as the default value for safety-related components.
However, it is also possible to use components
with a shorter mission time, provided the machine’s
accompanying documentation clearly refers to thiscomponent and the need to exchange it.

5 Safe control technology

Even if the issue is largely excluded at the
moment: on long-lasting machines, the time will
come in which the configured mission time has
elapsed, but the machine is to continue in use. In
this case, safety-related integrity can only continue
to be guaranteed if the relevant components areexchanged. By this time the original machine
manufacturer will probably have no more obligations
regarding the machine, so responsibility passes tothe operator. The relevant components must be
identified and replaced. The new components musthave similar or better safety-related characteristic
data (PL, SIL, B10d, MTTFd, etc.). This process canbe made easier if the original machine manufacturer
provides this data from the outset (e.g. by verifying
the design using a calculation program such as
PAScal). In this situation it is conceivable thatcomponents will be exchanged that appear perfectfrom the outside and continue to perform theircontrol function without difficulty. Nonetheless theyneed to be exchanged because the probability ofa dangerous failure has risen to beyond an
acceptable level.

5-26

In theory it is possible to have the manufacturer
inspect the used component, for example, andmaybe repair it in such a way that a new mission
time (Tm) begins. However, this approach is rarely
cost effective and only ever on very valuable
components.
Even IEC 62061 recognises a similar parameter,
namely the “proof test interval”. At the end of thisinterval, the component must undergo a proof test
to examine its further usability. The situation is comparable to that in accordance with EN ISO 13849-1,
only the mission time is not fixed at 20 years but
rather specified individually by the manufacturer,
thus making it more difficult to trace.
5.3.6 Use of used components
In general, the use of used components is also to beconsidered. This is only reasonable for high-quality
components that still have a considerable residual
value that justifies the additional work. If used components are to be used in new safety functions, it’s
important to estimate the proportion of mission time(Tm) that has already elapsed and how much remains.
Other characteristic data, particularly the B10d value
on components that wear due to operation, can bepartially utilised. Such components can only be
used if their previous application has been traced
and documented. These (reduced) values must thenbe used in the calculations when validating the newsafety function.

© Pilz GmbH & Co. KG, 20172017-08

Chapter 5 Safe control technology

5.4 Using safety controllers to achieve safe
control technology
5.4.1 Overview
In which direction is safety technology developing?
Which control systems provide the highest user
benefits? How will the various disciplines of safety,
control, motion, CNC and visualisation work together
in future? Will it be possible to implement economicalsolutions despite the increasing complexity? Even in
future there will be a number of different approaches
to take to resolve requirements. One potential
approach is to modularise plant and machinery intofunctional units. This is already happening today,
albeit primarily for the mechanical part of plant andmachinery. This approach has only partially beenused in control technology as yet.

The graphic below illustrates the compromise thathas previously been reached between minimum
costs, maximum quality and rapid implementation:
Performance/quality

Maximum

Adequate

Minimum
Effort/costs

Earliest
Duration

However, excellent support during the engineering
phase, through an appropriate programming model,
a user-friendly programming environment and an
extensive library, can lead to higher quality inshorter time and at a lower overall cost.

5 Safe control technology

Whether the issue is safety-related or automation
functions: the demands on plant and machinery
continue to grow, so there’s an increasing need fortechniques that will allow applications to be wellstructured and therefore manageable. The requirement for minimum effort and associated cost
reductions is increasingly the focus. The aim is to
reduce engineering times still further.

2008-11© Pilz GmbH & Co. KG, 2017

5-27

Chapter 5 Safe control technology

5.4 Using safety controllers to achieve safe
control technology
5.4.2 Structures of safe control technology

This does not mean that safety and automation
functions have to be combined inside one device.
What’s important is that they work together toprocess tasks as a system, without impeding eachother. Each device, each controller, should do what
it does best. The system’s backbone is an extremely
powerful bus system, which manages data traffic
in the background. The result of this technologicaldevelopment is a system which uses the intrinsic
benefits of technology controllers. For example,
it makes no sense for a safety controller to have tocarry out motion functions when that’s a specifictask of the motion technology controller.

5 Safe control technology

The model of safety technology as a pure“monitoring function” is changing drastically:safety technology may have been almost
exclusively associated with emergency stop,
safety gate, light curtains and interlocks fora long time, but it would now be unthinkable notto regard the issue of safety on drives, for example.
Other areas will include safe pneumatics andhydraulics. Applications will emerge from areas
which are not yet the focus of our attention, but
one thing is clear: safety is an integral part ofthe overall plant and machine function, so it
must be considered appropriately, right fromthe start. In simple language, safe control
technology means: make the control function
safe! Safe control technology becomes reality

when safety enjoys the same mechanisms,
the same handling and the same flexibility
as the standard section, at all levels of automation
technology.

Module nModule 3
PAS4000

Module 2

Module 1

Safety and automation control functions combined in one system

5-28© Pilz GmbH & Co. KG, 20172017-08

Chapter 5 Safe control technology

5.4 Using safety controllers to achieve safe
control technology

Module A

Module B

Module Type A

Module Type B

5.4.3 Modularisationof the automation function
Modularisation as an approach to solving thecontrol technology requirement of the future
ultimately involves division of the control
technology into corresponding units or modules,and decomposition right down to the technology
functions.

Module C

Module Type C

Module Type C

Module A

Module Type A
5 Safe control technology

Ultimately however, this means that all thecontrollers have to be able to share access tothe same data, without the user being required toorganise it this way. The system must perform thistask automatically in the background. In future, eventhe tools must have the same look and feel, plus
standardised handling. Whether it’s motion, control
or visualisation: handling of the various functions
and tasks must be seamless.

Modularisation of a machine and distribution of tasks across various control systems

Whatever can be decomposed mechanically canalso be decomposed into single parts or components with regard to automation. A componentsbased approach must not be limited to individual
stations (such as modules A to C in the figure,for example), but must extend right down to theindividual function units (known as mechatronic
units). Future applications will be implemented
much more effectively if comprehensive libraries
can provide these units as reusable component
blocks.

2017-08© Pilz GmbH & Co. KG, 2017

Even when division into modules and mechatronic
units makes sense, it’s important not to lose sightof the overall picture: programming models thatkeep the units together and represent them as awhole are a much greater benefit to customers
than those that merely provide components withinterfaces and ultimately expect the user to lookafter these interfaces.

5-29Chapter 5 Safe control technology

5.5 Safe control technology in transition
Sometimes safety technology appears complex
and confusing, but behind it is the ongoing quest
for simple “formulas”: safety must be simple, clear,
traceable and verifiable. As a result, safe control
technology leaves little room for an unconventional
approach to solutions; it is almost by definition
a conservative part of control and automation
technology. Innovative trends or flows are mostly
introduced after somewhat of a time lag. This
mindset is also manifested in the current perception
that, if a fault occurs or safety is called upon(for example if the E-STOP function is operated),safety technology must always shut down safely,
by electromechanical means wherever possible
and without using any additional electronic
components.
What is this perception based on? Safe control
technology is intended to protect man from all
hazards emanating from plant and machinery.
As such, it is informed by norms and standards
like almost no other sector. Last but not least,
if regulations and specifications are presented ina way that is transparent, making it simpler tounderstand how they are implemented, this also
helps to achieve safety.

5 Safe control technology

The usual formulas and perspectives may still apply
and essentially still make sense, but safety controllers are also undergoing a massive transition in thecourse of general technological progress. Even in
the past, safe control technology has continuously
adapted to control-related circumstances: how else
would we have today’s safety solutions, which would
have been totally unthinkable in the eighties andwould not have conformed to the standards at thattime because only electromechanical solutions werepermitted? Electronic safety solutions only came into
use gradually following extensive test procedures
carried out by notified bodies (TÜV, BG, etc.).
Modern manufacturing techniques require newtechnical approaches; process and manufacturing
cycles are constantly changing. Clearly, safe control

5-30

technology must keep pace with developmentsin the automation technology sector. Customers
expect innovative products and solutions withintegrated safety concepts that increase productivity,
support efficient work processes and create
additional benefits.
5.5.1 New safe control technology requirements
What are the challenges facing safe control
technology today? Current requirements for greater
flexibility in configuration and programming or forincreased communication, for example, are alreadybeing taken into account. There are other requirements, however, which cannot yet be identified
explicitly, nor do they have a name. Henry Ford
once said “If I’d listened to my customers I wouldn’t
have built cars, I’d have bred stronger horses”. Thisillustrates the point that successful developments
should not be geared solely at superficial needs
but must always deal with the core requirement.
Far-sighted vision is required if innovative products
and solutions, in the true sense of the word, are to
be the end product. If you transfer this insight tosafe control technology it is clear that the formulascommonly used today cannot solve the tasks of the
future; companies need to offer new solutions.
Even today, in many companies safety operates
by removing power to every drive, even the wholeplant, once a protected area has been accessed.
With increasing productivity requirements, however,it must be possible to access defined detection
zones in a plant without having to halt the entire
production process. At the same time the safety ofthe operator must be guaranteed. That’s why thedemand is for intelligent, dynamic safety solutions.
In future, to react to a safety-related event with a
total shutdown can only be regarded as a last resort.

© Pilz GmbH & Co. KG, 20172017-08

Chapter 5 Safe control technology

5.5 Safe control technology in transition
With some justification, a whole new generation ofsafety controllers is expected from safe control technology manufacturers in future. Compare it with yourcar, where assistance functions are increasingly used
to help drivers and offer additional safety (features
such as distance monitoring and automatic speed
reduction); in the same way, useful, extra safetyenhancing features will increasingly make their markin mechanical engineering. An example from forming
technology, where servo presses are becoming increasingly important, clearly illustrates the changed
requirements: on conventional presses a mechanicalrotary cam arrangement was enough to control
the safety of the stroke movement, but the motion
sequence on servo presses is fundamentally different.
A press stroke is no longer the 360° rotation ofan eccentric cam but a pendulum movement
between variable angle settings. Previously well-tried
procedures can no longer guarantee safety on suchapplications; the demands on the evaluation device
are much more complex than before.

The graphic examples are intended to show thatin future, safe control technology will need to makewide-ranging calculations in order to meet the
specified requirements. Safety controllers must
be able to record, process and output complex
measured variables. The necessary means to do
this are significantly different to anything currently
available. It involves not only the sensors andactuators, but above all the processing logic
functions, for which simple instruction sets are nolonger sufficient due to the increased requirements.
To summarise, plant and machinery processes are
becoming more complex and dynamic due to thedemands that are placed on them. Safe control
technology of the future must take these changed
requirements into account.

Stroke (mm)max.

Slide stroke
without
servo mode
Slide strokewith servo
pendulum mode

Safety function in accordance with EN 13849-1
with sensor, logic and actuator

Cycle time
reducedTime (s)5 Safe control technology

0

Slide stroke with and without servo mode

2017-08© Pilz GmbH & Co. KG, 2017

5-31

Chapter 5 Safe control technology

5.5 Safe control technology in transition
5.5.2 Complex yet simple –no contradiction
The classic, widespread view of safety technology
today revolves mainly around safety functions suchas those illustrated below. Common functions
are those such as emergency stop, safety gates,
two-hand control, operating mode selection, valve
control, monitoring the direction of rotation or rotary
cam arrangement; these cover the majority of therequired safety functions – basic functions thatare required in this or a similar form in almost
all machines.

Where safety on plant and machinery is limited
to basic functions, there will still be a requirementin future for simple safety controllers, on whicha manageable number of safety functions can be
implemented simply. That is one of the strengths ofconfigurable small controllers such as PNOZmulti:
programming could not be simpler, using graphic
symbols and drag and drop. This has now become
the state of the art; indeed it has practically
been the market standard since the turn of themillennium. To date, PNOZmulti has been bothrole model and technological forerunner within thisdevice class.
5.5.2.1 Configurable safe
small controllers continue to develop
Because the software tool and hardware wereso easy to handle, applications that were originallythe reserve of “genuine” high-performance safetycontrollers have gradually been migrating to theconfigurable small controllers. In principle, that does
not present a problem, provided the devices meetthe requirements. However, the user is increasingly
confronted with the fact that the small controller isreaching the limit of its capabilities. That’s because
wide-ranging configurations can be developed tosuch an extent that even the programmer is at
risk of losing oversight. At this point a contradiction
can quickly arise: the more you add to the functionalities reproduced in the configurable small controllers, the more you lose oversight and the benefitof simple usability. But the latter is exactly what
the user values.

5 Safe control technology

Safety functions on an eccentric press

5-32© Pilz GmbH & Co. KG, 20172017-08

Chapter 5 Safe control technology

5.5 Safe control technology in transition
5.5.2.2 Latest generation
configurable safety controllers
What distinguishes the configurable controller
PSSuniversal multi, part of the automation system
PSS 4000, from established devices such as the
PNOZmulti? The control systems PSSuniversal multi
are significantly more powerful than the configurable
safe small controllers and constitute a whole newdevice class of “configurable safety controllers”.
PSSuniversal multi differs from its predecessors
in two key areas: the ability for expansion withadditional data types is a fundamental feature. The
devices can not only handle Boolean variables but
can also process any form of data type, just like“fully fledged” controllers. The graphic options havealso been extended so that complex composite
data structures can be displayed graphically on
individual lines in the Editor. This promotes clarity,
without losing important information.

PNOZmulti

PASmulti

SAFEBOOLSAFEBOOL

Another fundamental change concerns the program
structure. From the perspective of a PLC controller it
is customary for programs to have a hierarchicalstructure. Programs contain function blocks, which
in turn call up functions or elements. A feature ofconfigurable small controllers is that the program isdisplayed on a single plane. To date it has not beenpossible to reproduce the hierarchical structures
familiar from PLC controllers. It is a sensible solution
for simple applications, indeed it has contributed tothe success of this device class. However, this typeof programming soon becomes confusing whenapplications are more complex.
Now this feature has been added to the configurable
controller PSSuniversal multi: program sections canbe combined into one block, making the program
clearer, without losing any of the information contained in the program section. If a function is createdin the customary “flat” format, it can be selected andmerged into a new block. The new element “inherits”
all open interfaces as its external interface and canbe opened, expanded or modified by double-clicking
on it. As a result it is possible to view the element’s
internal structure at any time.

SAFEBYTESAFEWORD
SAFEDWORDSAFESINT
SAFEINTSAFEDINT
5 Safe control technology

SAFEUSINTSAFEUINT
SAFEUDINT

Comparison between PNOZmulti and
PSSuniversal multi data types

2017-08© Pilz GmbH & Co. KG, 2017

5-33

Chapter 5 Safe control technology

5.5 Safe control technology in transition
Layer 4Layer 3Layer 3Layer 25 Safe control technology

Layer 1

Hierarchical structuring of the controller PSSuniversal multi from the automation system PSS 4000

5-34

© Pilz GmbH & Co. KG, 20172011-11

Chapter 5 Safe control technology

5.5 Safe control technology in transition
5.5.2.3 Integration of automationand safety technology
increasingly dynamic, there is a greater need forcontrolled access to the process and productivity
requirements are higher, so safe control technology
is gradually changing as a result. In the future, theprevious strategy of shutting down safely when
the safety function is called upon or when an error
occurs will no longer be acceptable. Safe control
technology must open up to innovative processes,
as currently illustrated by examples of safe drive
functions.

Safe stop 1 (SS1)

Safe speed
range (SSR)

Safe stop 2 (SS2)

Safe
direction (SDI)

Safe operating stop (SOS)

Safe brake control (SBC)

Safely limited
speed (SLS)

Safe brake test (SBT)

5 Safe control technology

Previous safety controllers are characterised
primarily by the ability to program them freely, ina similar way to a standard PLC. However, there
are some restrictions. To ensure that programs
remain clear and understandable, on most systems
the instruction set and/or number of available editors
is restricted. This hasn’t been a problem, and indeed
isn’t a problem, provided plant and machinery only
require simple safety measures. However, a structuraltransition is currently taking place regarding safety
technology requirements: processes are becoming

Drive-integrated safety with PMCprotego DS

2017-08© Pilz GmbH & Co. KG, 2017

5-35

Chapter 5 Safe control technology

5.5 Safe control technology in transition
But that’s just the beginning! Step by step, safe
control technology needs to become a permanentfeature of automation technology, as is already thecase with drive technology with dynamic speed or
standstill monitoring. Future safety concepts willneed to be much more dynamic, including functions
such as torque monitoring, based on the positionof one or more axes. The available safety controllers
will only partly satisfy these new requirements.
Instruction sets will be required that can meet theneed for dynamisation of safety functions. And
yet programming will still need to be built on simple,
manageable base elements that enable a safe
programming procedure, as required by theIEC 61508 standards, for example.

5 Safe control technology

Ultimately, modern safety controllers offer a sensiblecombination of the programming procedure froma PLC and the configuration benefits from the“configurable small controllers” device class. Specifically this means that today’s safety controller needs
to have a large number of editors. The “instrument”
that the user is handed shouldn’t span only one
octave, but if possible should cover the whole“audible” range. Care should be taken to ensurethat the editors also meet the needs of the various
industries and target groups. Complex safetyfunctions should be capable of being created andtested in a high level language. After the test phase
it must be possible to convert to a graphic display.

5-36© Pilz GmbH & Co. KG, 20172017-08

Chapter 5 Safe control technology

5.5 Safe control technology in transition
Dovetailing function/safety

PSS 4000
Complexity

PMCprotego S

PNOZmulti
PNOZ

Static safety

Dynamic safety

Static and dynamic safety

Changes are happening at system level as well as
device level. The signs are beginning to emerge inthe safe drive technology sector. Previously, thesafety function was connected to the controller but
now it is distributed, i.e. the function migrates to the
local function controller, for example the drive. At
the same time, separation of the safety and control
functions is becoming increasingly fuzzy; the control
function could ultimately be safety-related. Looking
at today’s plant and machinery it is clear that not
only have safe automation requirements changed,
both in the number of safety functions and the way
in which they are linked, but that the desire for more
flexible solutions continues to grow. Why is this?
The main factor behind what have sometimes beenmajor changes in mechanical engineering over the
past few years has been the trend of replacing
mechanics with electronics. In addition to economic
considerations, this has also brought new degrees
of technical freedom, which are now reflected in thesafe control technology requirements.

2017-08© Pilz GmbH & Co. KG, 2017

In the past, safety was primarily influenced bystatic events such as the operation of an emergency
stop device, the opening of a safety gate or theinterruption of a light curtain, but the focus today
is on requirements that enable the safety function
to react in a way that’s tailored to the machine’s
dynamic processes. Reactions are no longer
triggered only by simple logic connections, but bycomplex states or results of intricate calculations towhich the safety function must react appropriately.
How does this affect developments in safe control
technology? Dynamic safety needs the control
function to dovetail closely with safety. That’s why
it’s necessary to think more in terms of systems.
If subfunctions are to fit seamlessly together,functions cannot simply be superimposed, theymust be an integral part of the overall system.
Developments in the control technology sector havealready seen functions executed across device
boundaries; similar developments will also become
established in safe automation. Ultimately, thechallenge lies in integrating the functions into theoverall system. With highly complex dynamic tasks,
insular solutions will generate no added value.

5 Safe control technology

5.5.3 From static to dynamic safety

5-37Chapter 5 Safe control technology

5.5 Safe control technology in transition
5.5.4 About Industrie 4.0

Modular machine and decentralisation

Industrie 4.0 is more than a vision of the future.
Intelligent networking is a huge opportunity forindustry. Flexible production can help to optimise
the use of industrial plants. Customised products
can be made on mass production terms, increasing
the productivity of the plant. Nevertheless, many
companies are still hesitant to embrace Industrie 4.0
for their own production operations. According to
the McKinsey Institute study “Industry 4.0 – How tonavigate digitization of the manufacturing sector” 1),
only six out of ten companies in Germany feel they
are ready for Industrie 4.0, even though 91 percent
perceive the digitisation of industrial production as
an opportunity. We would like to change all that,and offer solutions and products for Industrie 4.0
to companies worldwide. Because the topic of
Industrie 4.0 is increasingly coming sharply into
focus in the international arena, too: the continuing
process of globalisation in particular renders it
necessary to prepare the way for integration
through the digitisation of production processes
along the entire value chain.

For several years now, modular mechanical andplant engineering has been seen as the key togreater flexibility in production. A complete plantcomprises multiple autonomous machine modules.
A module maps one or more standardised
production steps and can be combined with othermodules to form a complete process. This involves
connecting all modules to a backbone that supplies
each of them with energy (400 VAC three-phasecurrent, compressed air, ...) as well as with process
and control data. Each product/workpiece also hasaccess to all relevant information on the respective
production process. Should the production processchange or productivity increase, one or more
modules may be exchanged or identical modules
can be added.

1)https://www.mckinsey.de/sites/mck_files/files/
mck_industry_40_report.pdf

Modularisation and decentralisation are consequently two of the key success factors en routeto the future of automation. A prerequisite for thisis automation systems that are able to control the
distributed intelligence in the machine modules ina user-friendly way. All plant and machinery can thenbe broken down into manageable, independently
functioning units.

5 Safe control technology

The modular structure of plants and machinery
follows the mechatronic approach. The philosophy
here is to universally merge all the disciplines
involved in a machine’s development process:mechanics, electrics and automation technology.
The interaction between diverse, individual,
automation technology components and associatedsoftware tools to form an automation solution isuniversally defined. This universality extends
across the four levels of the automation pyramid(management level, operational level, control leveland field level). The mechatronic approach requires
even control functionalities to be able to “migrate”
into individual mechatronic modules.

Plants can be broken down into manageable,
independently functioning units.

5-38© Pilz GmbH & Co. KG, 20172017-08

Chapter 5 Safe control technology

5.5 Safe control technology in transition

Plants can be broken down into manageable, independently functioning units.

2017-08© Pilz GmbH & Co. KG, 2017

Decentralised systems make commissioning
modules a straightforward affair. The configuringtask, too, is very user friendly because identicalcontrol programs and subfunctions can also be
used for various modules.

5 Safe control technology

This is where systems so far meet their limits.
Although function modules can be created, whenthese are to be executed by powerful, central controllers, the commissioning of individual modules
rapidly becomes a laborious process because of its
complexity. Changes to the configuration and theprogramming of the individual function modules,
which are subsequently needed, likewise increase
the workload.

So the automation of the future demands solutions
that are able to both distribute control intelligenceand guarantee that the necessary networking ofseveral controllers remains easy for the user tohandle. Such a solution is available from Pilz withthe automation system PSS 4000.

5-39

Chapter 5 Safe control technology

5.5 Safe control technology in transition
Safety and security
InjuryThe ongoing development of the automation
landscape with Industrie 4.0 means that companies
are faced with new safety and security challenges.
The world of automation is merging with the
IT world. Specific perspectives on the issue ofsafety/security differ significantly: the internationallyused terms are “Safety” for machinery safety and“Security” for IT and data security; this helps withthe basic differentiation.
Safety demands that residual risks arising froma plant or machine do not exceed acceptable values. This includes hazards to the plant environment(e.g. environmental damage) as well as hazards
within the plant (e.g. people inside the plant).
Security concerns the protection of a plant or
machine from unauthorised access from outside
as well as the protection of sensitive data from
corruption, loss and unauthorised access fromwithin. This includes explicit attacks as well as
unintentional security incidents.

Production
loss

SafetySecurity

Loss ofexpertiseand data

DamageProtecting life and limb:
safetySafety for man
and machineProtecting against threats:
security
Security for plants,
data and expertise
against unauthorised
access and misuse

Interaction between safety and security

Comprehensive protection of production andsafety-relevant control data during transfer,processing and storage must address the following
areas of security:

5 Safe control technology• Physical security and availability of the IT systems• Network security• Software application security• Data security• Operational security

5-40© Pilz GmbH & Co. KG, 20172017-08

Chapter 5 Safe control technology

5.5 Safe control technology in transition
Action areas of Industrie 4.0
One of the principles for sustained market
acceptance is to create standardised mechanisms
in communication between machines and within
the machine. Practical solutions that are acceptable
to users will only take shape if the requirements ofboth worlds (automation and IT) are considered.
In summary, this means that Pilz is committed
to modern control architectures in an Industrie 4.0
environment.
Our focus is on the following issues:
Modular approach:Our modern control functions are designed for
distribution and object orientation – sensors andactors have intelligence. We hereby replicate
the trend towards mechatronic control objects(automation components) in our products and thecorresponding engineering tools.
Safety and security:
Both have clear parallels in terms of standardisationand procedure in the engineering process. We
want to utilise the experience we have gained inmachinery safety and automation to drive thisimportant work forward.

2017-08© Pilz GmbH & Co. KG, 2017

5 Safe control technology

All the devices and automation components
necessary for the control function receive direct
Internet access to exchange process data andparameter data for diagnostics and (remote)maintenance. As a result, the demands for all theautomation devices involved increase in terms of
security and a standardised diagnostic interface
and display.

5-41

6
Safe
communication

Chapter 6 Safe communication

6 Safe communication
Safe communication
Basic principles of safety-related communication 
Principle of decentralised safety technology Handling communication errors 
Principle of redundancy Safe Ethernet communication with SafetyNET p 
Why Ethernet in automation technology? System description SafetyNET p 
UDP/IP-based communication with RTFN 
Hard real-time communication with RTFL 
Application layer 
Safe communication via SafetyNET p 
Safe telegram structure 
Industries, applications 
Application example of a modular machine design 

2017-08© Pilz GmbH & Co. KG, 2017

6-3
6-3
6-3
6-5
6-6
6-6
6-7
6-9
6-10
6-11
6-11
6-12
6-12
6-14

6 Safe communication

6
6.1
6.1.1
6.1.2
6.1.3
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2.5
6.2.6
6.2.7
6.2.8
6.2.9

6-1

Chapter 6 Safe communication

6.1 Basic principles
of safety-related communication
Safety-related communication has already replacedparallel wiring in many of today’s mechanicalengineering applications. There are many reasonsfor this: it reduces complex wiring, simplifies
diagnostics and troubleshooting and increases theavailability of the whole application. The following
chapter explains how safe communication operates,
using SafetyNET p as an example, and also
demonstrates some applications.
6.1.1 Principle of decentralised safety technology
Depending on the desired safety level, peripherydevices such as E-STOP switches are generally
connected to a safety controller in a dual-channel
configuration. The redundancy and additional cable
tests mean that faults such as short circuits or open
circuits can be detected and managed. A bus cable
uses single-channel, serial communication, which
does not provide physical line redundancy. That’s
why additional measures in the protocol are needed
to uncover faults such as a disconnected bus cableor communication problems.

Principle of decentralised safety technology

6.1.2 Handling communication errors
The sections below describe typical errors
and measures which may occur when safetyrelated data is communicated via an industrial
communication system, and ways in which thesecan be handled.
6.1.2.1 Message repetition

6 Safe communication

Malfunctions within the bus subscriber or a
network component can lead to telegram repetition.
Each message is given a sequential number so that
repeated messages are detected. The receiver is“expecting” the sequential number, so it will detect
repeated telegrams and initiate appropriate
measures.

2017-08© Pilz GmbH & Co. KG, 2017

6-3

Chapter 6 Safe communication

6.1 Basic principles
of safety-related communication
6.1.2.2 Message loss

6.1.2.5 Message corruption

Messages can be deleted or it can no longer bepossible for telegrams to make it to the receiver due
to a malfunction on a bus subscriber or a network
component. The receiver uses a sequential number
to detect the loss of data packets. A timeout on thereceiver also monitors the latest time by which a
new message must arrive. Once this timeout has
elapsed, the receiver is able to bring the application
to a safe condition.

Malfunctions on a bus subscriber or a network
component or faults on the communication medium,e.g. due to EMC, can corrupt messages: a data
security mechanism (check sum) applied to thesafety-related telegram content will recognise thisand detect the corrupted message.

6.1.2.3 Message insertion
Additional messages may creep in as the resultof a malfunction on a bus subscriber or a network
component. As with message repetition, thesequential number can be used to detect andmanage this situation.
6.1.2.4 Incorrect message sequence
Errors on a bus subscriber or network componentsthat store telegrams, such as Ethernet switches
and routers, can corrupt the telegram sequence.
However, this will be detected through thesequential numbers.

6.1.2.6 Message delay
A malfunction on the bus subscriber or an
incalculable data volume in the network can leadto delays: a timeout on the receiver will detect thedelays and initiate appropriate measures.
6.1.2.7 Combining safety-related andnon-safety-related communication functions
In mixed systems containing safety-related andnon-safety-related subscribers, receivers will
sometimes interpret a telegram from a standard
subscriber as a safety-related telegram. Suchmistakes on the part of the receiver can be avoidedusing measures such as unique IDs across the
network and varied data security features forsafety-related and non-safety-related messages.

Measures per message
Fault

Sequential
numberRepetition

◆

Loss

◆

Insertion◆

Incorrect sequence◆

Timeout

ID fortransmitterand receiver

6 Safe communication

Combining safetyrelated and non-safetyrelated messages

Varied data security
for safety-related andnon-safety-related messages◆◆

Message corruption
Delay

Data security

◆
◆
◆

◆

Errors and measures, using SafetyNET p as an example, taken from BIA GS-ET 26

6-4© Pilz GmbH & Co. KG, 20172017-08

Chapter 6 Safe communication

6.1 Basic principles
of safety-related communication
6.1.3 Principle of redundancy

6 Safe communication

In order to control potential errors when recording
and processing safe signals in bus subscribers,
each function is processed by at least two different
components or methods, which monitor each other.
When an error is detected, these components or
methods are used to bring about a safe condition.
On the safe bus system SafetyNET p, for example,
the application software is processed by redundantmicroprocessors, which compare their respective
results before transferring them to the redundant
controller. This then generates the actual safetyrelated message.

2017-08© Pilz GmbH & Co. KG, 2017

6-5

Chapter 6 Safe communication

6.2 Safe Ethernet communication
with SafetyNET p®

e

c
Offi

ll 1

ce

u

od

Pr

on
cti

The function and application of a safe Ethernetbased bus system is explained below, using the
popular safety-related bus system SafetyNET p
as an example.
6.2.1 Why Ethernet in automation technology?

6 Safe communication

Automation technology is currently developing
away from a centralised control system withsimple binary sensors and actuators into complex,
intelligent systems. The proportion of control andprocess capacity within the sensors and actuators
is constantly growing. This trend changes thecommunication requirements dramatically: insteadof the usual master/slave system that we see today,
in future, more and more data will be exchanged
directly between the subscribers. Today’s individual,
largely simple subscribers will increasingly assume
the function of subscribers with their own
computing capacity.

6-6

Modern IT technology – as seen in officecommunication with personal computers andnetwork components – currently offers a wide
range of system components at favourable prices.
There is huge potential for innovation. That’s
why users are increasingly keen to modify
this technology to make it usable for industrial
automation technology. Ethernet plays a prominentrole here; it has been the established standard in
office communication for years.
The requirements of the individual elementsof a production plant also continue to growalongside this trend. This affects scan times,
precision/frequency of measurements, dataamounts and processor power, to name but a few.
As far as the automation system is concerned, theperformance of the controllers and communication
systems must satisfy these growing requirements.
As a modern, Ethernet-based fieldbus system,
SafetyNET p meets these requirements. At thesame time, SafetyNET p is as simple to install
and as reliable as fieldbus systems.

© Pilz GmbH & Co. KG, 20172017-08

Chapter 6 Safe communication

6.2 Safe Ethernet communication
with SafetyNET p®
6.2.2 System description SafetyNET p
SafetyNET p is a bus system in which all devices
on a network have the same authorisations.
The bus scan time of SafetyNET p can be adapted
to suit the application requirements. Data is
exchanged here in accordance with the publisher/
subscriber principle. As a publisher, each device
can provide data to the other devices (subscribers)
via SafetyNET p. In turn, these subscribers can readthe published data from individual subscribers or
all subscribers. This way it is possible to exchange
data efficiently between all the subscribers.
6.2.2.1 Security
The protocol includes a safe data channel,
which is certified for data transfer in accordancewith SIL 3 of IEC 61508. Both safety-related andnon-safety-related data is transferred via the same
Ethernet cable. Non-safety-related subscribers havedirect access to safety-related data and can use it
for further non-safety-related processing tasks.
Communication media
A wide range of communication media isavailable to SafetyNET p, enabling it to satisfy
the varied application requirements. In this way,
copper cables, radio links and fibre-optic cables
can be used.
Fibre-optic communication

Safe wireless communication
SafetyNET p data can be transmitted wirelessly
using access points. From the safety controller’s
perspective, the access points are transparent,
i.e. they are not visible as subscribers in the
network. Wireless transmission does not affectthe safety level of SafetyNET p.
Safe wireless communication is used when it is toocomplex and therefore cost inefficient to lay cables.
Another application is subscribers on movablefacilities. These may be rotating or linear-moved
plant sections, such as those found on cranesystems or automated guided vehicles. When safe
wireless technology is employed, high demands
are placed above all on the quality of the wirelessconnection, as this affects the number of telegrams
that are lost as well as incorrect sequence anddelays and can cause safety-related shutdownsof the application. This in turn will impact on theapplication’s availability.
To guarantee the quality of the wireless connection,
particular attention should be paid to selecting
wireless and antenna technology and redundancy
concepts that are appropriate for the application;these should be verified through field trials where
necessary.

6 Safe communication

With fibre-optic (FO) communication, fibre-optic
cables, transmitters and receivers are used insteadof copper cables. SafetyNET p has a number ofdifferent devices for creating fibre-optic paths. Thistask is typically performed by Ethernet switches
that offer fibre-optic converters for fibre-optic cable
paths of up to 40 kilometres, depending on theapplication.

FO communication is found in a wide range ofapplications. It’s important where a high EMC load
would disrupt communication, as would be the casewith welding robots in the automotive industry,for example. Fibre-optic paths are also frequently
used for safety-related communication between themountain and valley stations on cable cars, where
it’s necessary to span long distances outdoors.

2017-08© Pilz GmbH & Co. KG, 2017

6-7

Chapter 6 Safe communication

6.2 Safe Ethernet communication
with SafetyNET p®
6.2.2.3 Application layer

6.2.2.2 Flexible topology andscan time selection
SafetyNET p is extremely flexible, not just whenit comes to selecting a suitable communication
media, but also on the issue of the appropriate
topology: the system supports linear, star, tree
and ring topologies. The RTFL communication
principle (Real Time Frame Line) is suitable for
intra-cell communication, as it allows the fastest
scan times. Jobs and events can be recorded
and executed with high precision across theentire network. Absolutely essential for real-time
applications: a jitter of around 100 ns must be
achievable in real-time control loops. As a result,it’s even possible to use SafetyNET p in a converter
control loop between a rotary encoder and a speed
regulator. Other highly dynamic applications arealso possible, of course. RTFN mode (Real Time
Frame Network) is usually used at higher levels,
as it offers maximum coexistence capability withexisting services.

The interface with the application is based on
the widely-used CANopen technology.
6.2.2.4 Standard Ethernet technology
SafetyNET p uses the widely-used UDP/IP
communication for cell-to-cell communication orcommunication in general networks. Conventionalcommercially available network components areused for setting up the network infrastructure.
This includes connectors, cables, switches,routers and gateways, in particular.

Corporate network
TCP/IP
PC

ServerPC

Machine network
RTFN
Machine 2

Machine 1

HMI

Machine 3

Machine communications
RTFL/RTFN

Motion control
PLC

I/O

PLC

I/O

PLC

I/O

PLC

PLC
Drive

Motion control bus

6 Safe communication

RTFL

RTFL real-time

RTFN

RTFN

RTFL real-time

RTFL

SafetyNET p in the communications hierarchy

6-8© Pilz GmbH & Co. KG, 20172017-08

Chapter 6 Safe communication

6.2 Safe Ethernet communication
with SafetyNET p®
6.2.3 UDP/IP-based communication with RTFN

Application

6

Presentation

5

Session4

Transport

3

Network

2

Data link

MAC

1

Physical

PHY

TCP

RTFL

DNS

UDP

IP

6 Safe communication

HTTP

File

7

RTFN

PTP

Layer

SystemPrecision Time

SMTP

OSI

Domain Name

E-Mail

FTP

ProtocolDownloadInternet

The RTFN transport layer of SafetyNET p can beused at process control and manufacturing celllevel, where standard Ethernet protocols are in
demand and the real-time requirements are lower.
RTFN is used to network the RTFL real-time cells
and to connect subscribers, such as visualisation
devices or service PCs. The RTFN level typicallyhas a tree topology as used in the office world.
Ethernet switches are used to connect the network
subscribers in individual point-to-point connections.

SafetyNET p in the ISO/OSI reference model

2017-08© Pilz GmbH & Co. KG, 2017

6-9

Chapter 6 Safe communication

6.2 Safe Ethernet communication
with SafetyNET p®
6.2.4 Hard real-time communication with RTFL
The RTFL transport layer of SafetyNET p is
optimised for the fastest real-time applications.
Typically the devices are connected in a linear
structure, as with traditional fieldbus systems. Datais exchanged in accordance with the publisher/
subscriber principle. As a publisher, each device
can provide data to the other devices (subscribers)
via SafetyNET p. In turn, these subscribers can readthe published data from individual subscribers or
all subscribers. This way it is possible to exchange
data efficiently between all the subscribers.
RTFL uses a very fast, cyclical data transmission

as the communication mechanism. Communication
is initiated by a Root Device (RD). The Ethernet
frame generated within the Root Device is thentransferred to the other devices (OD – Ordinary
Device). The ODs fill the Ethernet frame with data
to be published and extract from the Ethernet
frame the data to be read. Each RTFL segment
requires just one Root Device. RTFL devices have
two Ethernet interfaces, which enables use of
the familiar daisy chain wiring often foundon fieldbuses.

Publish

RJ45

RD

PublishSubscribe
RJ45

OD

OD

OD

PublishSubscribe

PublishSubscribe

PublishSubscribe

RJ45

RJ45

RJ45

RJ45

RJ45

RJ45

Subscribe

6 Safe communication

SafetyNET p RTFL communication

6-10© Pilz GmbH & Co. KG, 20172017-08

Chapter 6 Safe communication

6.2 Safe Ethernet communication
with SafetyNET p®
6.2.5 Application layer

6.2.6 Safe communication via SafetyNET p

The application layer of SafetyNET p adapts
the mechanisms of CANopen to the conditionsof SafetyNET p. CANopen is an open, manufacturer-independent fieldbus standard specified/standardised by CiA (CAN in Automation).
SafetyNET p therefore has a standardised
application layer for industrial applications.

SafetyNET p can also communicate safety-related
data through an integrated safe communication
layer. The security mechanisms are designed tomeet up to SIL 3 of IEC 61508. The safety-related
data is sent encapsulated within SafetyNET p
telegrams. As a result, all other network
components such as switches or cable may be
standard Ethernet components, which have no
impact on safety. Even non-safety related network
subscribers such as PCs or standard control
systems, for example, have no impact on safetyrelated communication. As a result it is possible
to mix the operation of safety and non-safetyrelated devices within a network.

The SafetyNET p application layer is largely
based on the CANopen standard. The changes
that have been made are mainly in the communications area and in the way safe application datais handled. The key element in CANopen is theobject directory, which acts as the interface
between the application and the communication
subsystem. Essentially it is a grouping of objects
and functions, which can then be stored and called
up as application objects.

6 Safe communication

Generally, there are two possibilities forcommunication between devices: application
data can be merged into process data objects/
PDOs (mapping) and then published via thecommunication system. This is achieved
via the cyclical data channel in SafetyNET p.
The second possibility is the SDO (service data
object), which is used for acyclic data and isapplied when setting controller parameters,for example.

2017-08© Pilz GmbH & Co. KG, 2017

6-11

Chapter 6 Safe communication

6.2 Safe Ethernet communication
with SafetyNET p®
6.2.7 Safe telegram structure
Cyclical data in SafetyNET p is communicatedas safe PDOs (SPDOs) and has the following
format:• PID (Packet Identifier):used with the SID for unique data packet
identification• Length: complete length of packet in Bytes• Process data: safe process data
• SID (Safe ID): 16 bit unique network-wide ID,
through which both the sender and the SPDO
are uniquely identifiable• Counter No.: 8 bit cyclical counter
for life sign monitoring on subscribers• CRC: 32 bit check sum covering the wholesafe data packet

PID

LengthProcess data

SID

Counter No.

CRC

Packetidentifier

Packet length

Process data

SPDO
identifier

Cyclical“life sign”
counterCheck sum

Safe PDO message

6.2.8 Industries, applications
SafetyNET p is used worldwide in a wide range
of industries and applications.
The list below represents only a selection.
6.2.8.1 Airports

6 Safe communication

Airports contain baggage handling and conveying
technology applications in which long distances
have to be covered. Safety-related equipment
such as E-STOP pushbuttons and grab wires are
distributed across the whole route. SafetyNET p
collects the safety-related signals and makes themavailable to the safety controllers, which stop or
shut down the drives safely if necessary.

6-12© Pilz GmbH & Co. KG, 20172017-08

Chapter 6 Safe communication

6.2 Safe Ethernet communication
with SafetyNET p®
6.2.8.2 Passenger transportation

6.2.8.4 Automated guided vehicles (AGV)

SafetyNET p is also used for communication
on cable cars: safety-related signals are exchanged
between the mountain and valley stations andsignals are collected en route. Fibre-optic cables
are often used as the communication medium forcovering long distances.

The real-time Ethernet SafetyNET p is also used
for automated guided vehicle systems. Data for
automation tasks such as loading and unloading
as well as for safety-related control tasks such as
speed and direction of an individual transport unit
is transmitted.

6.2.8.3 Crane applications

6 Safe communication

Modern control concepts based on powerful
Ethernet technology. As a result, all information
is available everywhere. The real-time Ethernet
SafetyNET p is used in extensive crane systems,
for example, for the reliable exchange and thesynchronisation of control data, failsafe dataand states.

2017-08© Pilz GmbH & Co. KG, 2017

6-13

Chapter 6 Safe communication

6.2 Safe Ethernet communication
with SafetyNET p®
6.2.9 Application example
of a modular machine design

6 Safe communication

Plant and machinery are becoming increasingly
modular. This means that they are being segregatedinto mechatronic units with separate functions.
In a concept such as this, the electrical engineering
follows the mechanical structure of the machine,bringing wide-ranging benefits. Once the machinemodules have been developed they can be reusedin various machines, which ultimately reduces
the development effort. Modules can also be
manufactured separately and joined together only
during final assembly. What’s more, modules canbe developed in isolation from each other, sotasks can be run in parallel, saving time during
development.

This type of engineering follows the building-block
principle and enables customised solutions to be
implemented at lower cost. Fieldbus systems
prevent this modular approach, as they are mainly
based on a centralised master/slave approach. In
safety technology in particular, one central instanceis usually available: the master. The publisher/
subscriber communication principle applied
universally on SafetyNET p does not use a central
instance, thereby enabling a modular machine
design.

Modular machine design

6-14© Pilz GmbH & Co. KG, 20172017-08

7
Safe motion

Chapter 7 Safe motion

7 Safe motion
Safe motion
Definition of safe motion 
Basic principle Safe separation of the power-generating energy supply 
Safe motion monitoring 
Safe limit value specification Standard EN 61800-5-2 
Safety functions Stop functions and their standard reference 
Safety functions in accordance with EN 61800-5-2 
System examination 
Drive electronics Motor Safe logic 
Safe braking 
Motion monitoring 
Motion control 
Implementation examples 
Examples of safe motion 
Performance level of safety functions 
Reaction times of safety functions 

2017-08© Pilz GmbH & Co. KG, 2017

7-3
7-4
7-4
7-6
7-9
7-10
7-12
7-12
7-12
7-22
7-23
7-24
7-24
7-25
7-25
7-26
7-26
7-28
7-28
7-42

7 Safe motion

7
7.1
7.2
7.2.1
7.2.2
7.2.3
7.3
7.4
7.4.1
7.4.2
7.5
7.5.1
7.5.2
7.5.3
7.5.4
7.5.5
7.5.6
7.5.7
7.6
7.6.1
7.6.2

7-1

Chapter 7 Safe motion

7.1 Definition of safe motion

When you examine the application of the failsafe
principle within classic safety functions, initiationof the safety function causes the outputs to shut
down, and this is called a “safe condition”. If safe
drive functions are used, an application may look
like this: when a safety gate is opened, the motor
is braked safely with a defined ramp and thenremains at standstill under active control. The
motor will then move in jog mode at safely
reduced speed. In other words if static detection
zone monitoring has been violated, production
can continue at a reduced number of cycles andwith safely monitored movements.
What this simple example illustrates is thetransition from static to dynamic safety. Dynamicmeans something different in the various disciplines.
In safety technology, dynamic is understood tobe the ability to adapt the safety functions to thechanging detection zones. The functional safety

requirements for variable speed drives specified
in EN/IEC 61800-5-2 open up new horizons on
this issue.
The main requirements of safe drive systems interms of dynamic safety are:• Safe monitoring of kinematic variables suchas acceleration, speed, distance, for example• Short reaction times to reduce stopping distances• Variable limit values, which can be adapted to suit
the runtime

7 Safe motion

Safe drive functions have recently made theirmark on standards, products and applications
and today can be considered as state of the art.
They are part of the functional safety of plantand machinery and, as measures that boost
productivity, are increasingly gaining ground in
the market. The protection of machinery andequipment is also increasing in importancealongside personal protection.

Drive-integrated safety technology, fast, safe
drive buses, high-performance programmablesafety systems and safe camera systems are all
products suitable for high-end safety solutions.
The term “safe motion” is interpreted differently,
depending on your perspective. Drive manufacturers generally understand safe motion to be
drive-integrated safety, whereas controller
manufacturers associate it with external solutions.
Looking at the issue independently we can establishthat the term “safe motion” only refers in thefirst instance to the implementation of a safe
movement.

Comparison of static and dynamic safety

2017-08© Pilz GmbH & Co. KG, 2017

7-3

Chapter 7 Safe motion

7.2 Basic principle

7 Safe motion

The objective of safety technology has always
been to prevent potentially hazardous movements.
Nothing, then, is more obvious than to dovetailsafety technology with motion generation.
For technical and economic reasons, the drive
electronics – servo amplifiers and frequency
converters – have remained non-safety-related
components within automation. So safety is
guaranteed through additional safe components,
which bring the motor to a zero-power, safe
condition in the event of a fault, or safely monitor
the movement of the connected motor. The current
market trend is to integrate these safe components
into the drive.
In accordance with the current state of the art,a safe motion controller is a combination of safe
motion monitoring, safe isolation of the motor
from the power-generating energy supply andnon-safety-related motion generation.

Non-safety-related
motiongeneration

Safe
separation

Safe
monitoringSafemotioncontrol

Motor

Components used in safe motion control

The following details refer to three-phasedrive systems, as currently used in an industrial
environment. Applying these to other actuatorsystems (e.g. DC drives, servo valves, …) is
only possible under certain conditions and needs
to be examined separately.

7.2.1 Safe separation of thepower-generating energy supply
Before explaining the different shutdown paths
on a converter it is necessary to understand thefundamental mode of operation.

Converter
SupplyRectifierIntermediate circuit

Inverted rectifier

Power element

Motor

Control element

Control system

Reference variables

Control loops

Pulse pattern

Optocouplers

Converter’s fundamental mode of operation

7-4© Pilz GmbH & Co. KG, 20172017-08

Chapter 7 Safe motion

7.2 Basic principle
circuit. The intermediate circuit is also used toabsorb the braking energy. The inverted rectifier
then generates an output voltage with sinusoidal
fundamental wave through cyclical switching of
positive and negative intermediate circuit voltages.
The converter’s control element uses reference
variables to generate pulse patterns, which areused to drive the power semiconductors on the
inverted rectifier module. There are several possible
ways of isolating the motor from the powergenerating energy supply:

Shutdown path

Principle or device

Technology

1 Mains isolation

Mains contactor

Isolation of supply voltage to the converter

2 Motor isolation

Motor contactor

Isolation of the motor terminal voltage

3 Drive-integrated isolation

Safe pulse disabler

Isolation of the control signals to the power
semiconductors

4 Isolation of reference variable

Setpoint setting
to zeroController does not generate control variables(processor-based)

5 Isolation of control variable

Controller enable

No control signals are generated for the power
semiconductors.

7 Safe motion

Internally a converter is divided into a control
element and a power element. Both elements
are galvanically isolated from each other via optocouplers. The power element is where the power
fed in from the mains is prepared. A terminal voltage
with variable amplitude and frequency is generated
from the mains voltage and its constant amplitudeand frequency. First of all, the sinusoidal mains
voltage in the rectifier is converted into a pulsating
DC voltage. This is smoothed through a downstream capacitor – also known as an intermediate

Supply

1
4

5

2

Motor

Setpoint
specification

Control loops

Outputstage enable
Output stage

3

Converter’s shutdown paths

2017-08© Pilz GmbH & Co. KG, 2017

7-5

Chapter 7 Safe motion

7.2 Basic principle

7 Safe motion

If the power-generating energy supply is isolated
via the mains or motor, the mains or motor
contactor must have positive-guided contacts.
If the N/C contact is linked to the start signal on theconverter, a fault on the contactor contact will be
detected. The highest category can be achieved if
two contactors are connected in series and eachis fed back to the N/C contacts. The disadvantage
of mains isolation is that the intermediate circuit
capacitor on the power element is discharged eachtime power is isolated and must be recharged whenrestarting. This has a negative impact on restart
time and machine availability and also reduces theservice life of the intermediate circuit capacitors,
because the charge/discharge processes accelerateageing of the capacitors.
If the motor was isolated, the intermediate circuit
would stay charged, but disconnecting the motor
cable for wiring the contactor is a very complex
process, so it is only rarely used in practice. Also,
the use of motor contactors is not permitted on allconverters. Potential overvoltages when isolating
the contacts may damage the inverted rectifier.
If there is a frequent demand to separate the powergenerating energy supply as a safety function, there
will also be increased wear on the positive-guided
contacts on the mains or motor contactor. Isolationof the reference variable (setpoint specification)or control variable (output stage enable) can be
combined with the above shutdown paths. As the
setpoint specification and output stage enable are
frequently processor-based functions, they may not
be used in combination, so that common cause
failures are excluded.

7-6

The drive-integrated solution is based on theprinciple that the pulse patterns generated by
the processor are safely isolated from the power
semiconductors. On the drive systems examined inthis case, motor movement results from an in-phase
supply to the winding strands. This must occur insuch a way that the overlap of the three resulting
magnetic fields produces a rotating field. Theinteraction with the moving motor components
creates a force action, which drives the motor.
Without the pulse patterns, no rotating field iscreated and so there is no movement on the
motor. The optocouplers, which are used forgalvanic isolation between the control and power
element within a converter, are ideally suited asa shutdown path. For example, if the anode voltageof the optocoupler is interrupted and combinedwith the isolation of the control variable (control
enable) mentioned previously, motor movement
is prevented through two channels. In practice,
testing of the shutdown paths is undesirable
because stopping the motor interrupts production.
7.2.2 Safe motion monitoring
Motion is described through the kinematic
variables acceleration, speed and distance. As far
as potential hazards are concerned, torques andforces also play a key role. The above variables
are covered by the safety functions listed in thestandard EN/IEC 61800-5-2. The implementationof safety-related monitoring is heavily dependent
on the sensor technology used within the system.
The sensor technology used within the drive
technology is generally not safety-related andmust be monitored for faults. For example, a criticalstatus would occur if the encoder was unable
to supply a signal due to a defect, while power
is applied to the motor and it is accelerating.

© Pilz GmbH & Co. KG, 20172017-08

Chapter 7 Safe motion

7.2 Basic principle

Encoders generally have several signal tracks,
enabling them to detect direction or defined positions
within a revolution, for example. These signals
can also be consulted for feasibility tests, so thata second encoder system is not required. However,this is not a universal dual-channel structure as
the movement is recorded from a shaft or lens.
Dual encoder systems are also now available on
the market. Such systems are suitable for functions
such as safe absolute position. With a strict,diverse, dual-channel design it is even possible
to achieve SIL 3 in accordance with EN/IEC 61508.
In addition to an optical system, a magnetic sensing
system may also be used, for example.

Encoder signal

Multi-turn encoders offer a more economicalsolution; they set their separate multi-turn andsingle-turn tracks in proportion and can therefore
detect faults. In this case, safety-related preprocessing takes place within the encoder systemitself. Another option is to use motor signals: byrecording voltages and/or currents, calculations canbe used to indicate the mechanical movement of
the motor. A comparison with the encoder signals
will uncover any dangerous failures. The productstandard for electrical drive systems with integrated
safety functions EN 61800-5-2 contains a list offault assumptions for various motion and position
sensors (Annex D, Table D.16).

7 Safe motion

Moved axes in safety-related applications needredundant positional information in order to carryout relevant safety functions. There are various
ways to obtain independent position values: one
possibility is to detect the defect through a second
encoder. In this case, a safe component would
have to monitor both encoders and guarantee thatthe plant is switched to a safe condition if an error
occurs. Sometimes the advantage of this solution isthat the two encoder systems detect the movement
at different points on the machine and so can detect
defective mechanical transmission elements.

The combination of encoder system and safe
evaluation must guarantee that dangerous failures
are prevented by means of fault exclusions or
fault-detecting measures.

Description
Initiator signal: generated by scanning a cam or cogwheel,
analogue signal with 24V level
Two analogue signals, 90° out of phase,
either square or sinusoidal (level: TTL, 24 V, 1 Vss)
Digital interface, which transmits coded positional information (SSI, fieldbus)
Digital motor feedback interface with additional analogue signals(EnDat, Hiperface, BiSS)

Safe digital interface, which transmits coded positional information(SafetyNET p, CANopen Safe, PROFIBUS and PROFINET with PROFIsafe, ...)
Standard encoder interfaces

2017-08© Pilz GmbH & Co. KG, 2017

7-7

Chapter 7 Safe motion

7.2 Basic principle
Encoder system

Description

Safety integrity

Standard encoder

Evaluation of two signal tracks
on a common lens

Low

Two totally separate channels, expensive

Very highTwo totally separate channels, expensive, imprecise

Average

Two independent encoder systems in
one housing, without safe pre-processing

High

Safe encoder

Two independent encoder systems in one housing,with safe pre-processing

High

Safe encoder

Dual-channel diverse structure in one encoder housing,with safe pre-processing

High

Standard encoderand motor signals

Two totally separate and diverse channels

Very highTwo encoders
7 Safe motionoror

One encoder and initiator
orSafe encoderoror

Encoder systems for safety-related applications

7-8© Pilz GmbH & Co. KG, 2017

2008-11

Chapter 7 Safe motion

7.2 Basic principle
7.2.3 Safe limit value specification
Safe motion monitoring requires not just safe
motion detection but also the opportunity to specify
limit values safely. The way in which this is achieved
depends on the level of dynamics and the flexibility
within the machine.
Limit values

Description

Constant

Fixed during commissioning
and cannot be amended
during operation.

-

Selectable

Possible to select/change
the appropriate value froma fixed set of limit values
during operation.

oLimit values arecalculated and adjusted
during operation.

+

Dynamic

Dynamics

7 Safe motion

It must be examined on a case-by-case basis
whether an encoder system in combination witha drive-integrated solution or an external monitoring
device achieves the safety integrity required by
the application. Safe encoder systems often makedemands of the evaluation device (e.g. diagnostic
tests) or indicate faults that are not controlled by
the encoder itself. These must then be checkedagainst the fault-detecting measures of the special
evaluation device. There are often also gradations in
the maximum achievable safety integrity.

Dynamic and static limit values

Relay-like systems often use constant limit values.
For example, a fixed limit value can be defined by
setting jumpers or via other setting options on thedevice. On safe controllers, multiple limit values canbe defined via configuration or programming userinterfaces. Selection can be made during operation
via a safe I/O interconnection, through evaluationof sensor signals or through specification via a safe
fieldbus, for example. Dynamic limit values canonly be used in conjunction with a powerful,safe controller or a safe bus system with real-time
capabilities. When combined with optical monitoringof the protected field in robot applications, forexample, safe speed can be reduced based on
the distance of the operator from the danger zone:
the closer the operator comes to the danger zone,
the slower the motors move.

2017-08© Pilz GmbH & Co. KG, 2017

7-9

Chapter 7 Safe motion

7.3 Standard EN 61800-5-2

7 Safe motion

Adjustable speed electrical power drive systems –Part 5-2: Safety requirements – Functional: Part 5-2of the standard series EN 61800 is a productstandard for electrical drive systems with integrated
safety functions. It defines the functional safety
requirements for developing safe drives in accordancewith the standard EN 61508. It applies to adjustablespeed electrical power drive systems, as well as
servo and frequency converters in general, which

are dealt with in other parts of the standard series
EN 61800.
EN 61800 Part 2: General requirements - Rating
specifications for low voltage adjustable frequency
a.c. power drive systems, lists a series of newterms, which are explained in greater detail below:

PDS
CDM
BDM
SupplyMains filter

Transformer

Inverted rectifier

Motor

Input device

Control loops

Definition of a power drive system (PDS)Power drive system (PDS)
System comprising power equipment (power
converter module, AC motor, feed module ...)and control equipment. The hardware configuration consists of a complete drive module (CDM)
plus a motor or motors with sensors, which
are mechanically connected to the motor shaft(the driven equipment is not included).
PDS/Safety-related (SR)AC power drive system for safety-related
applications

7-10

Complete drive module (CDM)
Drive system without motor and without a sensor
connected mechanically to the motor shaft;it comprises, but is not limited to, the BDM andexpansions such as the feed module and auxiliary
equipment.
Basic drive module (BDM)
Drive module consisting of a power converter
module, control equipment for speed, torque,current, frequency or voltage and a control system
for the power semiconductor components, etc.

© Pilz GmbH & Co. KG, 20172013-11

Chapter 7 Safe motion

7.3 Standard EN 61800-5-2

7 Safe motion

Manufacturers and suppliers of safe drives candemonstrate the safety integrity of their products
by implementing the normative provisions of thispart of EN 61800. This enables a safe drive to beinstalled into a safety-related control system byapplying the principles of EN/IEC 61508, its sector
standards (e.g. IEC 61511, IEC 61513, IEC 62061)
or EN ISO 13849.
This part of EN 61800 does NOT define any
requirements for:
• The hazard and risk analysis
for a specific application• The specification of safety functions
for this application• The assignment of SILs to thesesafety functions• The drive system, with the exceptionof the interfaces• Secondary hazards (e.g. through failures
within a production process)• Electrical, thermal and energy safety
considerations covered in EN 61800-5-1• The manufacturing processof the PDS/Safety-related (SR)• The validity of signals and commands
for the PDS/Safety-related (SR)2008-11© Pilz GmbH & Co. KG, 2017

7-11

Chapter 7 Safe motion

7.4 Safety functions
7.4.1 Stop functions and their standard reference
Stop functions are found on almost all machines.
EN 60204-1 defines three categories of stopfunction for the various functional requirements:

7 Safe motion• Stop category 0• Stop category 1• Stop category 2
A category 0 stop leads to an immediate interruption of the power-generating energy supply to themachine actuators. Activation of the mains isolating
device automatically triggers a category 0 stop,
as power is no longer available to generate themovement. With a category 1 stop, the powergenerating energy supply to the actuators is maintained to enable a controlled stop. Stop category 2
is used if power is required even in a stop condition,
as power is maintained after the controlled stop.
These stop categories should not be confused withthe categories in accordance with EN ISO 13849-1,
which categorise structures with a specific behaviour in the event of a fault. For speed-controlled
drive systems, EN 61800-5-2 assigns stop functions
to the stop categories listed in EN 60204-1.

7-12

EN 60204-1

EN 61800-5-2

Stop category 0

Safe torque off (STO)

Stop category 1

Safe stop 1 (SS1)

Stop category 2

Safe stop 2 (SS2)

7.4.2 Safety functions in accordancewith EN 61800-5-2
Today’s state-of-the-art technology enables stopfunctions to have a drive-integrated solution.
This solution reduces the space requirement in
the control cabinet and also the amount of wiring
necessary, as additional external components
required in the past, such as contactors, are now
superfluous. Even additional components to monitor
standstill or speed are now surplus to requirements.
Servo amplifiers with integrated safety functions inaccordance with EN 61800-5-2 are now available,
providing much simpler solutions, even for complex
safety requirements. The standard EN 61800-5-2
divides safety functions into stop functions andmiscellaneous safety functions. The description is
only rudimentary and allows a great deal of freedom
in how it is implemented and interpreted. This isparticularly evident with the stop functions, which
are among the most complex of safety functions.
The implementation method can vary greatly,
but so too can the external behaviour of thesafety functions.
When the safety functions are operated in practice,subsequent effects can often be attributed to thepoor quality of the sensor signals or to the actual
behaviour of an electrical drive in general. Poorly
tuned control loops and EMC are frequently thecause of restricted availability of safe drive axes.
One example of this is the definition of standstill:on a closed loop system, zero speed is more ofa theoretical value. Depending on the quality of thecontrol loops, some motor jitter may be observed
around the zero position; if the limit value was set
to zero, this would immediately trigger a reaction on
account of a limit value violation. The safety function
would shut the drive down safely – at the expenseof system availability. In this case, it helps to definea standstill threshold > 0, where the permitted
speed is still non-hazardous. An alternative is todefine a position window, from which the motor
may not deviate. In this case, even the slightest
movements would not lead to a limit value violation.

© Pilz GmbH & Co. KG, 20172017-08

Chapter 7 Safe motion

7.4 Safety functions
whole safety chain when calculating the required
safety integrity.

To guarantee the security of the manufacturing and production process as well as thesafety of personnel, safety functions may also
be permanently active, without the requirementof the plant remaining in a special operating
mode. Several components and their respective
interfaces must be considered in order toimplement the safety functions, as well as the

7 Safe motion

It is not mandatory for the safety functions listed
in EN 61800-5-2 to be implemented using driveintegrated safety. An external solution may also
be used.

Safe sensor
technology

Drivecontroller

Safemonitoring

Safety gater

Drivecontroller

Safe
logic

Safe
removalof powerSafemonitoringPowerelement

Motor

Encoder

0

1

2

Brake

Power
element

E-STOP

Operatingmode
selectorswitchMotor

Encoder
MotionSafety chain

2017-08© Pilz GmbH & Co. KG, 2017

7-13

Chapter 7 Safe motion

7 Safe motion

7.4 Safety functions
7.4.2.1 Reaction functions

Safe torque off (STO)

If faults or limit value violations are identified by
the safety functions, defined reaction functions
must be initiated. EN 61800-5-2 frequently talks ofthe limiting of speeds or positions. This is achievedby initiating a stop of the motor as a reaction
function in the event of a violation of limit values.
However there are also applications where direct
shutdown after a limit value violation is undesirable.
For multi-axis applications, for example, it may
make sense for a limit value violation merely to bereported by the individual axis and for a higher-levelsafety controller to take care of coordinated brakingof the entire system of axes. External monitoring
relays can equally merely report limit value violations.
In combination with a safe shutdown path, therequirements of the normative safety functions
can then be satisfied.

The power-generating energy supply to the motor
is safely removed, so that no further movement ispossible. It is not necessary to monitor standstill.
If an external force effect is to be anticipated,additional measures should be provided to safely
prevent any potential movement (e.g. mechanicalbrakes). Classic examples are vertical axes orapplications with high inertia. This safety function
corresponds to a category 0 stop (uncontrolledstop) in accordance with IEC 60204-1. If thefunction is triggered during operation, the motor
will run down in an uncontrolled manner, which is
not desirable in practice. That is why this function
is generally used as a safe restart interlock or in
conjunction with the safety function SS1.

7.4.2.2 Safe stop functions

Modern servo amplifiers include an integrated
safe shutdown path, so safe devices are now
available that prevent unexpected start-up andshut down safely in the case of danger.

When considering safety on axes, the main factors
are to prevent the axes from starting up unexpectedly
and to shut down moving axes safely in the case of
danger. The corresponding functions are summarised
here under the heading of “Safe stop functions”.

Safe torque off

Safe stop functions

7-14© Pilz GmbH & Co. KG, 20172017-08

Chapter 7 Safe motion

7.4 Safety functions
Safe stop 1 (SS1)technology and drive technology. This safetyfunction corresponds to a category 1 stop(controlled stop) in accordance with IEC 60204-1.

Implementation

Description

Monitored time delay

Triggering of the safety function starts an application-specific,
safe time delay, after which the power is safely removed from the motor.
Motor braking is a function of the non-safety-related drive technology.
Should the motor accelerate during this time delay, it will not be detected.

Automatic standstill detection
with monitored time delay

The monitored time delay is combined with standstill detection. If the
motor reaches standstill before the time delay has elapsed, the STO function
will be triggered. Here too, motor acceleration during the time delay will
not be detected.

Monitoring of the braking ramp

A monitored braking ramp provides the highest quality in terms offunctional safety. During the braking process, values are continuously
compared with a limit value or a permitted drag error.
If the limit value is violated, the STO function is triggered.

In many applications, drives cannot simply be shut
down as they would then run down slowly, which
could cause a hazard. Also, an uncontrolled run
down of this type often takes considerably longer
than controlled axis braking. The safe stop 1
function (SS1) monitors controlled braking of theaxis directly within the servo amplifier. Once theset braking ramp has run its course, the drive isshut down safely. The reaction times are reduced
compared with external monitoring solutions; asa result, in many cases the safety distances to thedanger points can also be reduced. This provides anumber of benefits, such as improved ergonomics
for the plant operator, space savings due to the
reduced distance between the guards and thedanger points and, last but not least, cost savings.

2013-11© Pilz GmbH & Co. KG, 2017

7 Safe motion

With safe stop 1 (SS1), defined motor braking ispart of the safety function. When the motor is atstandstill, the STO function is triggered. There arevarious options for implementing these requirements; the key factor is the dovetailing of safety

Safe stop 1

7-15

Chapter 7 Safe motion

7.4 Safety functions
Safe stop 2 (SS2)

7 Safe motion

With safe stop 2 (SS2), defined motor braking isagain part of the safety function. When the motor
is at standstill, a safe operating stop (SOS) is
triggered. Unlike safe stop 1 (SS1), the motor atstandstill is in closed loop operation. This meansthat the standstill position is held precisely, due to

Implementation

Description

Monitored time delay

Triggering the safety function starts an application-specific,
safe time delay, after which a safe operating stop is triggered.
Motor braking is a function of the non-safety-related drive technology.
Should the motor accelerate during this time delay, it will not be detected.

Automatic standstill detection with
monitored time delay

The monitored time delay is combined with standstill detection. If the
motor reaches standstill before the time delay has elapsed, the safe operatingstop will be triggered. Here too, motor acceleration during the time delay will
not be detected.

Monitoring of the braking ramp

A monitored braking ramp provides the highest quality in terms offunctional safety. During the braking process, values are continuously
compared with a limit value or a permitted drag error.
If the limit value is violated, the STO function is triggered, otherwisea safe operating stop will follow.

So what are the benefits of the safe stop 2 (SS2)function? If the axes no longer need to be shut
down at standstill, they will actively hold theircurrent position, so the synchronisation between
axes and process is no longer lost. As a result,the axes can be restarted immediately at any time,
which clearly increases plant availability. Here too,
the drive-integrated function leads to shorter
reaction times, thereby minimising the risks. The
monitoring functions’ response times have a direct
influence on the potential channels available untila safety shutdown occurs. As the reaction times
are used in the calculation of the safety distances,the benefits listed for the safe stop 1 function will
also apply here.

7-16

the active control loop. Again, there are several
options for implementing these requirements. Thissafety function corresponds to a category 2 stop(controlled stop) in accordance with IEC 60204-1.

Safe stop 2© Pilz GmbH & Co. KG, 20172013-11

Chapter 7 Safe motion

7.4 Safety functions
Modern drive solutions not only examine howaxes are switched on and off, but also look at thepotential risks that may arise during operation of theaxes. The functions employed to avoid/reduce theserisks are summarised here under the heading of“Safe motion functions”.

Application of the safe operating stop (SOS) function is generally intended for the standstill phasesof a process. A typical situation would be accessto a danger point during process intervention. An
operator stops production using a command suchas “Stop at end of cycle”, for example. Once theplant has stopped, the safe operating stop (SOS)
function is activated, after which the guard locking
device on the access gate is unlocked. The plant
can now be accessed without risk.

7 Safe motion

7.4.2.3 Safe motion functions

Safe motion functions

Safe operating stop (SOS)

Safe operating stop

The safe operating stop (SOS) has already been
described with the safe stop 2 (SS2) safety function.
It monitors the standstill position while the motor
is in a controlled loop status. Once the safety function has been lifted, the production or machining
process can be continued with no loss of precision.
This function is generally used in combination witha safe stop 2 (SS2) function, as standstill monitoring
usually involves a braking process. As describedabove, the limit value can be specified as both aspeed threshold and a position window.

Safely limited acceleration (SLA)and Safe acceleration range (SAR)

2017-08© Pilz GmbH & Co. KG, 2017

Safety functions relating to acceleration monitoring
are not widely used in state-of-the-art technology.
In servo drive technology, Ferraris sensors are used
to detect acceleration only in special applicationsof machine tools or printing machinery. Standard
drives cannot process these signals in their control
loops; monitoring of these acceleration signals
is very complex in practice. Another option is todifferentiate safe speed and position changes
according to time, and to compare the momentary
acceleration calculated from these with limit values.
Such methods are used successfully for stationary
braking and acceleration ramps. In the case of lessstable motion paths, even small fluctuations inspeed lead to high acceleration values because of
the time derivative, and therefore lead to shutdownof the drive.

7-17

Chapter 7 Safe motion

7 Safe motion

7.4 Safety functions
Safely limited speed (SLS)

Safe speed range (SSR)

Safely limited speed (SLS) is probably the best
known safety function. In practice, this safetyfunction is often applied as safely reduced speed.
As a result, a defined transition from the operating
speed in automatic mode to the reduced speed in
setup mode must be guaranteed. If the monitoring
function detects that the limit value has been
violated, the drive must be shut down safely. The
manner in which the shutdown is achieved depends
on the application; it is best to aim for definedbraking using the SS1 function, followed by removalof the power-generating energy.

The safe speed range (SSR) can be used tomonitor a safe minimum speed, for example. Again,
the reaction that occurs when a value falls below
the stated limit value depends heavily on theapplication. Drive axes may be coupled, in whichcase an appropriate reaction must be triggered
when shutting down the drive (e.g. selective
shutdown).

Without drive-integrated safety functions,the implementation of this function involved highmaterial costs or functional restrictions. Where axes
are moved in jog mode during setup, the potential
axis speed in the event of a fault is a key aspect ofany risk analysis. Operators must be protected fromany hazard that would lead to an uncontrolled axis
start-up in the event of a fault. When the safely
limited speed (SLS) function is used for thesejog functions, the solution provides the shortest
possible reaction time in the event of a fault.
This reduces the risks to the operator significantly,
as any uncontrolled axis start-up would be detected
at the onset and would result in a safe shutdown.

Safe speed range (SSR) can generally be used
for permanent process monitoring. Risks cannot
always be eliminated just by limiting the capacity forspeeds to suddenly increase. Speeds that reducesuddenly as the result of a fault can also present
a risk. If axes are operating at a defined distance,
a speed that drops abruptly on just one of the twoaxes may create a risk of crushing. These are thecases for which the safe speed range (SSR) function
have been defined and developed. This function
would be used to shut down the relevant axes,
thereby eliminating any hazard to the machine
operator.

Safe speed range

Safely limited speed

7-18© Pilz GmbH & Co. KG, 20172017-08

Chapter 7 Safe motion

7.4 Safety functions
Like acceleration monitoring, the problem withtorque or force monitoring is the lack of suitable orestablished sensor technology. Torque measuringsystems are not widely used on standard drives,
but servo drive technology provides the option forindirect measurement via the motor current. The
motor current is proportional to the motor’s force
or torque, so the hazard resulting from a hazardous
movement is limited. Non-hazardous values asregards the effect of forces can be found in thelimit value list 2015, in the BIA Report.

Safe direction (SDI)
This prevents the motor from moving in an invalid
direction. This safety function is frequently used in
combination with safely limited speed (SLS) in
setup mode. Here too, the drive-integrated solution
enables the fastest possible shutdown.
7 Safe motion

Safely limited torque (SLT)and safe torque range (STR)

Safely limited position (SLP)
Safe position monitoring ensures that the motor
does not exceed a preset position limit value. If
a limit value is violated, the motor is braked usinga safe stop. The stopping performance achievablefrom a technical point of view must be taken into
account. Below the limit value there are no restrictions in terms of acceleration or speed of the motor.
Absolute position detection is required for thissafety function. Absolute encoders may be usedor relative measuring systems may be combinedwith a safe reference run.

Safe direction

Safe cam (SCA)
A safe output signal indicates whether the motor
is positioned inside a specified range. These ranges
are absolute position windows within a motor rotation.
The basic function involves safe monitoring ofabsolute positions, which is why appropriate sensor
systems must be used.

Safely limited increment (SLI)

Safe speed monitoring (SSM)

The motor is allowed to travel a permitted distancefollowing a start command. A safe stop function
must be triggered once the limit value is reached.
If the permitted distance is exceeded, this must be
detected and the drive must be safely brought toa standstill. Encoder systems with relative measurement are sufficient for this safety function.

The safe speed monitoring safety function (SSM)
is very closely related to safely limited speed (SLS).
However, if a limit value is violated there is nofunctional reaction from the components that aremonitored, merely a safe message which can beevaluated and processed by a higher level safetycontroller. On one side the controller can perform
more complex reaction functions, while on theother, the safety function can be used for processmonitoring.

2017-08© Pilz GmbH & Co. KG, 2017

7-19

Chapter 7 Safe motion

7.4 Safety functions
Safe brake test (SBT)

Functions related to holding brakes and service
brakes have been summarised under the headingof safe brake functions.

Mechanical brakes are often used as standard
components in safety functions. In that case, theuser must carry out a safety assessment and obtainconfirmation that the brakes satisfy all requirements
relating to a higher-level safety function.

7 Safe motion

7.4.2.4 Safe brake functions

Safe brake functions

Safe brake control (SBC)
Safe brake control (SBC) supplies a safe output
signal to drive an external mechanical brake.
The brakes used must be “safety brakes”, in whicha quiescent current operates against a spring.
If the current flow is interrupted, the brake will
engage. Control modules frequently include a
power reduction feature when the brake is released
to reduce energy consumption or brake heating.
A safe brake test may be required to detect faults
during operation, depending on the risk analysis.
Holding brakes or service brakes are often used onaxes with suspended loads. Alongside the brake,
the brake drive is another key component in termsof the safety function. The safe brake control (SBC)
function is normally initiated in conjunction with the
STO safety function. Safe brake control influences
the entire brake management of the drive axis andshould be coordinated with the purely functional
requirements.

Using the safe brake test (SBT) function significantly
increases safety. In many cases, simply controlling aholding brake safely is not enough to make a verticalaxis safe. If the wearing, mechanical part of the brakeis not maintained regularly, it cannot be guaranteedthat the holding brake will apply the designatedbraking action in the event of danger. The safe braketest (SBT) function provides an automatic test
which replaces previous measures that could only
be implemented through organisational and manual
operations; if the result is negative, it can bring theplant to a standstill and signal a fault. This reduces
maintenance work considerably.

Safe brake test

Safe brake control

7-20© Pilz GmbH & Co. KG, 20172017-08

Chapter 7 Safe motion

7.4 Safety functions
Maintenance
Safe brake test
(SBT)

MutingSafe direction(SDI)

7 Safe motion

Setup
Safely limited
speed
(SLS)

Operator intervention
Safe stop 2(SS2)

Safety functions using the example of a packaging machine

2017-08© Pilz GmbH & Co. KG, 2017

7-21

Chapter 7 Safe motion

7.5 System examination

7 Safe motion

Safe drive technology merges two issues,
which individually already involve a high level ofcomplexity. The challenge is to provide the user withtransparent, comprehensible logic in the lifecycleof a safe motion application. The difficulty inconfiguring and selecting safe drive components
is in translating the various influencing factors to

Principles/specifications

Parameters/criteria

No. of axes

the product requirements. Or to put it another way:
in selecting products for an optimum, safe drive
solution, which parameters are to be derived fromwhich specifications?

Concept/solution

Components
Drive-integrated/
external
monitoring

Type of movement
Encoder systems
Machine design/functionality

Drive technology

Ability
to modify
limit values
Safe
drive
functions
Risk assessment
B standards
C standards

Interfaces/
communication

Safe logic/
control technology

Safetyintegrity
MechanicalbrakesConfiguration

Reaction times

Generalrequirements

Retrofitor
new development

Driveelectronics

Procedure for configuring and selecting a safe drive solution

7-22© Pilz GmbH & Co. KG, 2017

2008-11

Chapter 7 Safe motion

7.5 System examination• How many drive axes?
• Does the system use servo amplifiers or
frequency converters?
• Are the drives decentralised – i.e. outside
the control cabinet?
• Which safe drive functions are required andhow are the parameters to be set?
• Does the movement to be monitored involve
an elliptical curve, synchronous drive axes or,in the simplest case, a single movement?
Specifications from the B and C standards and risk
analyses will provide the safety integrity requirement(SIL and PL). These, of course, will also influence
the required safety functions. The reaction timesof the safe drive components are part of the overallmachine design and must be fine-tuned as part ofan iterative process. Factors such as stopping
performance, safety distances, inertia of the moved
mass or the reaction capability of the machine
controller play a key role.
General requirements may be whether or not themachine is to be retrofitted with safe drive functions,for example. In some circumstances, existing
components must continue to be used, a situation
which will often favour an external safety solution.
These criteria and parameters must be converted
into a concept. The result is a safe drive solution,
made up of standard market components.

2008-11© Pilz GmbH & Co. KG, 2017

7.5.1 Drive electronics
These days, modern frequency converters or
servo amplifiers have an integrated safe shutdown
path, through which the STO safety function canbe performed. This shutdown path is generally
accessible externally via a terminal pair and must beconnected to 24 VDC. If the safety function is not inuse, 24 VDC will be available permanently at theterminals. If the shutdown path is used as an STO
or safe restart interlock, the terminals must beconnected to a safe output on a safety controller
or safety relay. In this case, it is important to ensurethat the test pulse on the safe output does notinitiate the safety function. A countermeasure is
to use an input filter with an appropriate time delay.
Depending on the version, a feedback path isavailable for fault detection, to achieve greater
safety integrity.

7 Safe motion

The machine design and the functionality demandedby the end customer are essentially the factorsthat determine which drive technology will be usedand how the machine will be operated in control
technology terms. The resulting parameters are:

The benefits of a drive-integrated shutdown
lie mainly in the• Reduced wiring requirement,• Rapid restart, as the intermediate
circuit remains charged,• Short reaction time (measured from thefalling edge at the input to the shutdown of
the optocoupler, the reaction time is in the
millisecond range).

7-23Chapter 7 Safe motion

7.5 System examination
7.5.2 Motor

7.5.3 Safe logic

The relevant properties for the motor in termsof its use in safety-related systems are

Safety relays or safety controllers can perform thefollowing tasks in systems with safe drive functions,depending on the application:

7 Safe motion• Type of movement (rotating, linear),• Acceleration capability (inert asynchronous
motor or air-borne linear drive),• Integrated motor encoder,• Integrated holding brake incorporated
into the safety concept.
The motor’s acceleration capability influences
the system’s maximum permitted overall reaction
time. Highly dynamic linear motors have extremely
low electrical time constants on the winding anda high overload capability, so that a multiple of the
rated power is present in just a few milliseconds.
Resolvers are widely used as motor encoders inservo drive technology. They are used in rotating
motors and are both robust and economical. The
measuring system provides an absolute position
within a motor rotation, but has limited resolution
due to the function principle. Only rarely canresolver signals be evaluated by safe monitoring
components. For this reason, motor encoder
systems with sine/cosine analogue tracks are
preferable in safety-related applications withmotion monitoring. Motor encoder systems withan all-digital interface can only be monitored using
special manufacturer-specific safety components.
Third party products cannot be connected.

7-24• Evaluation of sensors on safeguards• Activation of safety functions,• Drive shutdown• Evaluation of the status of safely monitored
drive axes in a multi-axis system• Establishing the plant’s overall safety• Specifying new limit values during operation• Interface between the drive controller andthe safety functions
The safe logic can be implemented either as separate, external components or as drive-integrated
components. Safe logic is the interface between
the sensors on the safeguards and the safemonitoring unit. Drive-integrated solutions enablesimple functions in single axis systems to be
implemented economically. Sensors are connected
directly on the drive and are evaluated. The limited
number of safe interfaces makes cross-communication
between the drives as well as complex logic links
impossible. The cycle time of the safety controller
must always be included in the assessmentof the overall reaction time if pre-processing insafe logic is required in order to activate a safetyfunction. Depending on the size of the user
program, this will range between 50 and 200 ms
and therefore dominates over the delay in the
shutdown path. It is also necessary to consider
a delay time on safe, digital inputs; this arises
due to the input filters.

© Pilz GmbH & Co. KG, 20172011-11

Chapter 7 Safe motion

7.5.4 Safe braking

7.5.5 Motion monitoring

Mechanical brakes must be used if the output
shafts on motors or gearboxes are affected byforces that would trigger movement when the
motor was shut down. Example applications arevertical axes or motors with high inertia. The
operation of vertical axes is a special case as far
as safety technology is concerned. The failsafe
principle – the removal of power to the drives inthe event of a fault – is generally applied in safety
technology, but in this case it would not lead toa safe condition because falling loads present
a hazard. Mechanical brakes are incorporated torectify this; their functionality must be constantly
verified using special proof tests. As with theencoder systems, various versions are available tofit the specific safety requirements. Dual channel
capability can be implemented either through two
independent brakes or through a brake with two
separate brake circuits. The advantage of two
separate brakes is that faults can be covered
within the mechanical transmission elements
between the drive and the process. The brake
configuration depends largely on the machine
design and the overall safety concept.

Motion monitoring has two main tasks: it must detectany violation of the limit values and then trigger anappropriate reaction function. It must also detect any
potential faults on the encoder system and likewise
trigger an appropriate error reaction function. Bothfunctions are heavily linked to the availability of thedrive system. Noisy signals or poorly tuned control
loops can cause sensitive monitoring mechanisms
to trigger reaction functions and therefore reduce
plant availability. Proper shielding of the motor andencoder cables is absolutely essential. The algorithms
for the monitoring functions can be applied via
hysteresis or filter settings. The reaction times
for these components are in the millisecond range.
Motion monitoring is available as both an external
and a drive-integrated solution. An integrated solution
has clear advantages over an external device in termsof wiring effort and convenience. Disadvantages
are higher retrofitting costs for existing plants anddependence on the converter that is used. Thismeans that the technical properties of the drive,
as well as the interfaces and the performance of thesafety functions, have to fit the application. With an
external monitoring unit, safety functions can be
implemented as standard on frequency converters
and servo amplifiers of a different performance classor manufacturer.

2011-11© Pilz GmbH & Co. KG, 2017

7 Safe motion

7.5 System examination

7-25

Chapter 7 Safe motion

7.5 System examination
7.5.6 Motion control

7 Safe motion

With the current state-of-the-art technology, motion
control is a non-safety-related drive component.
Depending on the task, the functions are either
drive-integrated or are performed by an external

controller via fieldbus or drive bus. The classic
allocation between the controllers depends on
the required movement.

Movement

Controller

Safe motion monitoring

Positioning of a single axis

Positioning controller

Drive-integrated or external monitoringof single axis

Electronic cam disk
(synchronous motion)

Motion controller

Limit value and monitoring must be examinedfor each drive axis. The status conditions of
the individual axes are evaluated in central,safe logic.

Elliptical curve(resulting motion)

NC or RC controller

Safe, central calculation of the current position
from the position of the individual axes

7.5.7 Implementation examples
Servo converters with drive-integrated
motion monitoring and safe pulse disabler
for shutdown
Sensor evaluation is undertaken, for example,
by a small, safety-related controller, which
activates the safety functions in the drive via asafe I/O interconnection. The servo motor has
an integrated sine/cosine motor encoder for motor
control and positioning. The reaction time before
the safety function is activated is around 60 ms,
the reaction time when limit values are violatedis <10 ms.

Implementation example with servo amplifier

7-26© Pilz GmbH & Co. KG, 20172017-08

Chapter 7 Safe motion

7.5 System examination
Safely monitored drive withfrequency converter and asynchronous motor

7 Safe motion

An incremental encoder is used to detect motion.
A safety relay or a small, safety-related controller
with motion monitoring evaluates the sensor signals
and triggers an STO function in the event of a fault.

Implementation example with frequency converter

2017-08© Pilz GmbH & Co. KG, 2017

7-27

Chapter 7 Safe motion

7.6 Examples of safe motion
7.6.1 Performance levelof safety functions
7.6.1.1 Normative basis

7 Safe motion

Several standards (generic safety standards
and technical safety standards; type A and type B
standards) are available for determining thesafety level achieved by the safety-related part ofa controller. EN ISO 13849-1 is generally appliedin the engineering sector. For many machines,
the safety level to be achieved can be takenfrom the respective machinery safety standards(type C standards); (e.g. presses ➔ EN 692, EN 693;
robots ➔ EN ISO 10218-1, packaging machinery➔ EN 415). If there are no C standards for a
product, the requirements can be taken fromthe A and B standards.

7.6.1.2 Safe stop function
The safety function “E-STOP when light curtain
is interrupted” is addressed here by the example
below; it illustrates a safe stop function for a motordriven axis. The methodology described below isbased on EN ISO 13849-1 and as such can only
be applied if all the safety function subcomponents
have their own performance level. Using the terminology of the standard, it is a series connection ofsafety-related parts of a controller (SRP/CS).
This example uses a light curtain, a configurable
safety controller and a servo amplifier withintegrated safety functions. A servo motorwith feedback system is connected to the servo
amplifier.
The risk analysis permits a stop category 1 forthe axis.

Structure of the safety function

7-28© Pilz GmbH & Co. KG, 20172017-08

Chapter 7 Safe motion

7.6 Examples of safe motion

7 Safe motion

PLlow = PL e
The block diagram shows the logical structure of the safety function,
comprising the series connection of the safety-related subcircuits.

Determination of the performance level for the overall circuit
EN ISO 13849-1: Table 11 – Calculation of PL for series connection of SRP/CS
PLlow
a
b
c
d
e

Nlow

➔

PL

>3

➔

None, not allowed

≤3

➔

a

>2

➔

a

≤2

➔

b

>2

➔

b

≤2

➔

c

>3

➔

c

≤3

➔

d

>3

➔

d

≤3

➔

e

Note: the values calculated for this look-up table
are based on reliability values at the mid-point foreach PL.
In the example of the safe stop function, all threecomponents involved have performance level e.
As a result, the lowest performance level of asafety-related subcircuit (SRP/CS) is also PL e.
Using the standard’s terminology, therefore,
we have:

2017-08© Pilz GmbH & Co. KG, 2017

• 3 x SRP/CS each with PL e
• The lowest performance level ofthe 3 subcircuits (SRP/CS) is PL e andis assigned the parameter PLlow.
• The lowest performance level occurs
in 3 subcircuits and so theparameter Nlow = 3.
If you apply this information to Table 11 of
the standard, the result for the example is an
overall classification of PL e.

7-29

Chapter 7 Safe motion

7.6 Examples of safe motion
7.6.1.3 Safe stop function on vertical axes

7 Safe motion

If you examine the potential risks on servo axes
you’ll see that a vertical axis is also a good example
for increasing awareness of the mechatronic view.
Removal of power is not enough to bring an axis
to a safe condition. In many cases, the load’s own
weight is enough for it to fall. Mass and friction will
determine the speed that occurs in the process.
As part of the risk analysis, potential hazards areanalysed in the various machine operating modes
and as operators carry out their work. The required
measures will then be derived from this analysis.
With vertical axes, the measures that need tobe taken will essentially depend on whether thefull body of the operator can pass below thevertical axis or whether just his arms and hands are
positioned below the vertical axis. Another aspect isthe frequency and duration of his stay in the danger
zone. All these factors are added up to give the“performance level” that the safety functions mustachieve.
Building on the “Safe stop function” example,
a brake is added to the structure. Holding brakes
and service brakes are both common.

Structure of the safety function

7-30© Pilz GmbH & Co. KG, 20172017-08

Chapter 7 Safe motion

7.6 Examples of safe motion

7 Safe motion

PLlow = PL e
The block diagram shows the logical structure of the safety function,
comprising the series connection of the safety-related subcircuits.

Determination of the performance level
for the holding brake

The following assumptions are made, based on
the application of the component:

Here the user of EN ISO 13849-1 is confronted
with one of the positive approaches of this standard.
The standard not only enables examination of theelectrical part of the safety function, but also of themechanical, hydraulic and pneumatic section.

• hop is the mean operating time in hours per day.
• dop is the mean operating time in days per year.
• tcycle is the mean time between the startof two consecutive cycles of the component(e.g. switching a valve) in seconds per cycle.

However, the holding brake used in this example
does not have a performance level, as this is
only available for intelligent components. Brake
manufacturers can only provide a B10d value, as
they do not know how exactly their components will
be used in the application and so can only makea statement regarding the number of operations
before a component failure. The design engineer
constructing the safety-related part of the controller
must now calculate the time to a dangerous failureof the component. The B10d value is not the only
consideration in this calculation; the mean time
between two consecutive cycles is also a key factor
which influences the MTTFd value.

Assuming that the calculation of the MTTFd forthe holding brake results in a value of > 100 years,
this gives an MTTFd classification of “HIGH”.
EN ISO 13849-1 provides a graph to make it easier
to determine the performance level. To decipher
the performance level from this graph the diagnostic
coverage DC is required. To determine the levelof diagnostic coverage it is important to knowwhether every conceivable fault can be detected
through tests. Based on this consideration, a highclassification will be possible if a safe converter
is used to drive the motor and the holding brakeis tested automatically before the danger zone isaccessed. To do this, a torque is established witha factor of 1.3 to the brake’s rated holding torque,
before waiting for at least one second. If the axis
holds its position during the whole test, it canbe assumed that the holding brake is in goodworking order. On this basis, it is possible to define
the diagnostic coverage at 99%.

MTTFd =

nop =2017-08B10d
0,1 x nop

d op x h op x 3 600 s/ht Zyklus© Pilz GmbH & Co. KG, 2017

7-31

Chapter 7 Safe motion

7.6 Examples of safe motion
10-4
a
10-5
b
3x10-6
c
10-6
d
10-7
e
10-8

PFH/h-1
Performance level3 years
10 years
30 years
MTTFoc = low,

7 Safe motion

Cat. BDCavg= none

MTTFoc = medium,Cat. 1DCavg= noneCat. 2DCavg= low

MTTFoc = highCat. 2DCavg= med.

Cat. 3
DCavg
= low

100
years
Cat. 3DCavg= med.

Cat. 4DCavg= highGraph to determine the PL in accordancewith EN ISO 13849-1

If this information is applied to Table 11 of
EN ISO 13849-1 for a simplified calculation, theresult for the example is an overall classification of
PL d. Unlike the example for the safe stop function(without brake), a reduction factor now applies: inaccordance with EN/ISO 13849-1, the achieved
performance level is reduced by one level if theoverall circuit contains more than three subcircuitswith PLlow. However, in this case a detailed calculation using the achieved PFHD values can certainly
result in PL e. This is where software tools such as
the PAScal Safety Calculator come into their own.

So we now have the following data:• Category = 4• MTTFd = high• DC = highIf this data is applied to the graphic, PL e can be
determined.
Determination of the performance level
for the overall circuit

PAScal Safety Calculator

In the illustrated example of the safe stop function
on a servo axis with holding brake, all four components involved have performance level e. As aresult the lowest performance level of a subcircuit(SRP/CS) is also PL e. Using the standard’s
terminology, therefore, we have:• 4 x SRP/CS each with PL e
• The lowest performance level ofthe 4 subcircuits (SRP/CS) = PL e and isassigned the parameter PLlow.
• The lowest performance level occurs
in 4 subcircuits and so the parameter Nlow = 4.

7-32

© Pilz GmbH & Co. KG, 20172017-08

Chapter 7 Safe motion

7.6 Examples of safe motion
7.6.1.4 Jog function withsafely limited speed (SLS)

7 Safe motion

These days, jog functions can generally be carriedout while guards are open thanks to the safely
limited speed (SLS) function. The respective
application will determine the type of incrementthat can be classified as non-hazardous. It may be
helpful to consult EN 349 and EN ISO 13855.

Structure of the safety function

PLlow = PL e
The block diagram shows the logical structure of the safety function,
comprising the series connection of the safety-related subcircuits.

2017-08© Pilz GmbH & Co. KG, 2017

7-33

Chapter 7 Safe motion

7.6 Examples of safe motion
Determination of the performance level
for the overall circuit

7 Safe motion

In terms of structure, the jog function withsafely limited speed (SLS) is similar to the safe
stop function described in section 7.6.1.2. The key
difference lies in the pushbuttons used for the jog
function and the impact this has on the calculationof the performance level. In EN ISO 13849-1,
pushbuttons (enabling switches) are given a B10d of
100,000. The time between two operations (cycles)is the key factor in calculating the MTTFd.
Calculation formula for MTTFd

MTTFd =

nop =

B10d
0,1 x nop

d op x h op x 3 600 s/ht Zyklus

The following assumptions are made, based on
the application of the component:• hop is the mean operating time in hours per day.
• dop is the mean operating time in days per year.
• tcycle is the mean time between the start oftwo consecutive cycles of the component(e.g. switching a valve) in seconds per cycle.

7-34

Assumptions:• B10d = 100,000• hop = 16 h/day• dop = 220 d/year
Calculation MTTFd:• tCycle = 5 s➔ MTTFd = 0.395 years• tCycle = 3,600 s ➔ MTTFd = 284.1 years
As shown in the example with cyclical operationin 5 s intervals, even in the best case it is only
possible to achieve PL c with a B10d value of
100,000. This demonstrates very clearly that theapplication range for wearing components has
a direct influence on the calculation of the performance level and therefore affects the achievablesafety level. The design engineer must therefore
look very closely at the application range of his
components in the respective application. Even
if EN ISO 13849-1 states 100,000 cycles for B10d,
there may well be special components with a higher
B10d value. If an application uses a pushbutton as
an E-STOP command device, it will certainly not
be operated constantly at 5 second intervals. The
situation is completely different if a pushbutton isused as a command device for cyclic initiation ofa machine cycle and has to trigger a safe stop once
released. The values stated in the example may
cause a problem if a higher performance level isrequired.

© Pilz GmbH & Co. KG, 2017

2008-11

Chapter 7 Safe motion

7.6 Examples of safe motion

7 Safe motion

7.6.1.5 Muting with safe direction (SDI)

Structure of the safety function

PLlow = PL e
The block diagram shows the logical structure of the safety function,
consisting of the series connection of the safety-related subcircuits (SRP/CS).

In conjunction with light curtains and a muting
circuit, the safe direction function (SDI) has apositive effect on safety because the respective
direction of the drive axis is monitored during
the muting phase and a safe shutdown occurs in
the event of a fault.

2017-08© Pilz GmbH & Co. KG, 2017

Determination of the performance level
for the overall circuit
The performance level corresponds to the result
from the example of the safe stop function.

7-35

Chapter 7 Safe motion

7.6 Examples of safe motion
7.6.1.6 Motion monitoring withexternal devices

7 Safe motion

Drive-integrated motion monitoring is accompaniedby external monitoring. In the simplest case, thedrive has no safety function. A drive can be shut
down in order to implement a safety function via
conventional means, using contactors for example.
However, today’s drives often already have an
STO function and can therefore implement a “safestop”. So an upstream safety relay can ensure thatthe hazardous movement is shut down simply andsafely. Actual safety-related motion monitoringtakes place in the external monitoring component,
however.
The task of the external devices is to detect motion.
The safety characteristic data of the employedsensors, e.g. encoders or proximity switches, issignificant in determining the safety level that canbe achieved. Different solutions to suit the various
requirements are available to monitor movementswith external monitoring devices. At the highest
level it is necessary to distinguish between so-called
standard encoders and “safe” encoders. Whenstandard encoders are used, it is important todetermine whether one or two encoders are
required.

7-36

The following safety functions may be realised, forexample, depending on the monitoring functions
implemented in the external monitoring devices:• Safely limited speed (SLS)• Safe direction (SDI)• Safe operating stop (SOS)• Safe speed range (SSR)• Safely limited acceleration (SLA)• Safe acceleration range (SAR)
The following examples illustrate potential typesof motion monitoring using external devices. For thesake of clarity, the examples only illustrate thosemotion monitoring components with the task ofmonitoring motion sensors such as encoders or
proximity switches. The basic calculation method
corresponds to the one illustrated in the previous
examples.

© Pilz GmbH & Co. KG, 20172017-08

Chapter 7 Safe motion

7 Safe motion

7.6 Examples of safe motion

A, A
B, B

Motion monitoring with one standard encoder

7.6.1.7 External motion monitoringwith one standard encoder
In this example, one standard encoder as sensor
is responsible for motion detection. Various
combinations are possible in conjunction withthe drive controller. The hazardous function is shut
down via an STO function available within the drive.
If it is only the monitoring device that evaluates theencoder signals for the safety function, i.e. the drive
controller does not use an encoder or only uses a
separate encoder, a maximum of performance level
PL c can be achieved. This requires an encoderwith MTTFd = high and classification as a “well-triedcomponent” or Category 1, or alternatively directclassification as PL c.

If the monitoring device evaluates the encoder
signals while the drive controller for position
control uses the same signals simultaneously,
a performance level of up to PL d can be achieved.
This requires an encoder with MTTFd = medium/high. The drive controller acts as an additional
diagnostic instance for the safety function throughthe appropriate parameterisation and activationof drag error detection (incl. shutdown). A pure
frequency converter (FC) without control function
cannot be used in this case. The following
safety functions are possible with the illustrated
configuration:• Safely limited speed (SLS)• Safe direction (SDI)• Safe operating stop (SOS)• Safe speed range (SSR)• Safely limited acceleration (SLA)• Safe acceleration range (SAR)
Note: the safety functions that can be realised
depend on the monitoring functions implemented
in the external monitoring device.

2017-08© Pilz GmbH & Co. KG, 2017

7-37

Chapter 7 Safe motion

7 Safe motion

7.6 Examples of safe motion

A, A
B, B

Motion monitoring with redundant standard sensors

7.6.1.8 External motion monitoringwith standard encoder and proximity switch
Generally speaking, two separate sensors formotion detection are required in order to achieve
the highest safety level (PL e) with standard
sensors. Depending on the external monitoring
device, these may be two encoders or, as shownin this example, one encoder and an additional
proximity switch. The corresponding values for
MTTFd are required for the sensors. This enables
the performance level to be calculated for thesensor subsystem, which consists of the encoder
and proximity switch; this can then be used to
calculate the performance level for the overall safetyfunction. The hazardous function is shut down via
an STO function available within the drive.

7-38

The encoder signals evaluated by the monitoring
device for the safety function can also be used by
the drive controller for speed and position control.
However, this is not absolutely essential for thesafety function. The following safety functions are
possible with the illustrated configuration:• Safely limited speed (SLS)• Safe direction (SDI)• Safe operating stop (SOS)• Safe speed range (SSR)• Safely limited acceleration (SLA)• Safe acceleration range (SAR)
Note: the safety functions that can be realised
depend on the monitoring functions implemented
in the external monitoring device.

© Pilz GmbH & Co. KG, 20172017-08

Chapter 7 Safe motion

7 Safe motion

7.6 Examples of safe motion

Motion monitoring with proximity switches

7.6.1.9 External motion monitoringwith two standard proximity switches

The following safety function is possible with
the illustrated configuration:

Without an encoder, safety-related motion
monitoring can still be implemented using standard
sensors in the form of proximity switches, even up
to the highest safety level (PL e). As in the previous
example, two separate proximity switches are
required for motion detection. If common cause
failures (CCF), due to EMC for example, cannot be
excluded or managed on both proximity switches,
the use of diverse components from different manufacturers or of different types is recommended. The
corresponding values for MTTFd are required for theproximity switches. This enables the performancelevel to be calculated for the sensor subsystem,
which consists of the two proximity switches;
this can then be used to calculate the performancelevel for the overall safety function. The hazardous
function is shut down via an STO function available
within the drive.

• Safely limited speed (SLS)• Safe speed range (SSR)

2017-08© Pilz GmbH & Co. KG, 2017

Note: the safety functions that can be realised
depend on the monitoring functions implemented
in the external monitoring device.

7-39

Chapter 7 Safe motion

7 Safe motion

7.6 Examples of safe motion

A, A
B, B
Z, Z

Motion monitoring with safe encoder

7.6.1.10 External motion monitoringwith safe encoder
Manufacturers are increasingly offering “safe”
encoders for motion monitoring tasks. These
devices are designed specifically for use in safetyfunctions and are certified accordingly. As a result,a performance level of PL d or PL e can beachieved, depending on the construction type.
This is usually possible with just one encoder,i.e. there is no need for two devices, as is the casewhen standard components are used. However,safe encoders are not actually “safe” until they
are combined with a safe monitoring device,because there are no diagnostic or feasibility tests
implemented within the encoder. The use of safe
encoders therefore requires detailed knowledgeof the requirements for use in safety-related
applications, as described by the manufacturer
in the operating manual. The monitoring device
must be able to meet these requirements exactly
by performing the monitoring functions demandedby the device manufacturer.

One test that is often demanded, for example,
is the absolute value check for sin/cos encoders:sin²+cos²=1. If this check is not implemented withina monitoring device, the device cannot be used in
combination with a safe encoder that requires sucha check. To date there is still no uniform or evenstandardised interface for safe encoders, so theencoder manufacturers’ requirements for theirproducts vary enormously. That’s why it is absolutely essential that the safe encoder and safemonitoring device are totally compatible. In thisexample, the hazardous movement is shut down
via the STO function available within the drive.
The following safety functions can be implemented
with the illustrated configuration:• Safely limited speed (SLS)• Safe direction (SDI)• Safe operating stop (SOS)• Safe speed range (SSR)• Safely limited acceleration (SLA)• Safe acceleration range (SAR)
Note: details of the safety functions that canbe realised depend on the monitoring functions
implemented in the external monitoring device.

7-40© Pilz GmbH & Co. KG, 20172017-08

Chapter 7 Safe motion

7.6 Examples of safe motion
7.6.1.11 Safeguarding detection zones
with a safe camera-based solution

7 Safe motion

Until now, interaction between man and robot
has largely been characterised by fixed safeguards.
A modern camera-based solution offers a whole
range of new options in this case. The detection
zone covers all three dimensions; one single device

meets every requirement when accessing a danger
zone and also provides protection against climbingover and crawling under the detection zone. The
detection zones can be individually configured
and can also enable the speed of the active axesin the monitored zone to be reduced if anyone
approaches.

Sensing device

FOC

Control unit

Structure of the safety function

2017-08© Pilz GmbH & Co. KG, 2017

7-41

Chapter 7 Safe motion

7.6 Examples of safe motion

7 Safe motion

PLlow = PL dBlock diagram of the safety functions

Determination of the performance level
for the overall circuit
The result is performance level d.

7.6.2 Reaction times of safety functions

PLlow = PL e
Block diagram of the safety functions

Several boundary conditions are used in calculatinga safety distance.
Determination of the reaction timein the case of external commands
If an E-STOP pushbutton acts upon an evaluation
device, its reaction time is added to the reaction
time of the drive-integrated safety function. It will
also be necessary to add the time needed to bringan accelerated axis to standstill:• treac = tmulti + tPMC + tramp• tmulti = Reaction time of the evaluation device
is approx. 20 ms

7-42• tPMC = Reaction time of the drive-integrated
safety functions to external signals is 6 ms
• tramp = Ramp time to standstill depends
on the moved mass, speed and otherapplication-dependent data
Determination of the reaction time
when limit values are violated
If a monitoring circuit on a drive-integrated safetyfunction is activated, it will be necessary to add
the time needed to bring the accelerated axis to
standstill.
• treac = tPMC + tramp© Pilz GmbH & Co. KG, 20172013-11

8
Mechanical,
pneumatic
and hydraulicdesignChapter 8 Mechanical, pneumatic and hydraulic design

8 Mechanical, pneumaticand hydraulic design
Mechanical, pneumatic and hydraulic design
Introduction to mechanical, pneumatic and hydraulic design 
Mechanical design 
Introduction 
Danger, hazard, risk 
Definition and implementation of safety measures 
Pneumatic design 
Relevant units Introduction 
Well-tried principles and protective measures 
Circuit-based solutions 
Stopping and braking 
Circuit diagram and operating manual Hydraulic design 
Basic physical knowledge Advantages of hydrostatic power transmission 
Disadvantages of hydrostatic power transmission 
Definitions 
General hydraulic relationships Structure of a hydraulic system 
Simple hydraulic circuit, upward movement 
Simple hydraulic circuit, downward movement 
Simple hydraulic circuit, speed 
Circuit diagram for a simple hydraulic circuit 
Two-cylinder controllers with electric valves 
Two-cylinder controllers with sequence valves Series circuit 
Parallel circuit 
Differential circuit 
Speed controllers 
Drive pumps, fixed pumps Drive pumps, screw pumps Drive pumps, vane pumps Safety requirements on hydraulic circuits 
Safety requirements in general 
Concept and design 
Additional safety requirements 
Establishing compliance with the safety requirements 
Safety-related parts of hydraulic controllers Controllers in accordance with Category B, Performance Level a as per EN/ISO 13849-1 Controllers in accordance with Category 1, Performance Level b Controllers in accordance with Category 2, Performance Level b Controllers in accordance with Category 3, Performance Level d Controllers in accordance with Category 4, Performance Level e 
Further example for controllers in accordance with Category 4 

2017-08© Pilz GmbH & Co. KG, 2017

8-3
8-4
8-4
8-5
8-9
8-21
8-21
8-23
8-23
8-27
8-33
8-35
8-37
8-37
8-37
8-37
8-37
8-38
8-44
8-44
8-45
8-45
8-46
8-47
8-48
8-49
8-49
8-50
8-51
8-52
8-53
8-54
8-55
8-55
8-55
8-55
8-56
8-57
8-58
8-59
8-60
8-61
8-62
8-63

8 Mechanical, pneumatic and hydraulic design

8
8.1
8.2
8.2.1
8.2.2
8.2.3
8.3
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.4
8.4.1
8.4.2
8.4.3
8.4.4
8.4.5
8.4.6
8.4.7
8.4.8
8.4.9
8.4.108.4.11
8.4.128.4.138.4.148.4.158.4.168.4.178.4.188.4.19
8.5
8.5.1
8.5.2
8.5.3
8.5.4
8.5.5
8.5.6
8.5.7
8.5.8
8.5.9
8.5.108.5.118-1Chapter 8 Mechanical, pneumatic and hydraulic design

8.1 Introduction to mechanical,
pneumatic and hydraulic design

8 Mechanical, pneumatic and hydraulic design

Safety technology is consistently gaining inimportance in the design of plant and machinery.
Although machinery may have already been
fitted with a high level of safety measures, withrising demands on efficiency and productivity,
safety technology continues to develop on an
ongoing basis. The Machinery Directive plays
a significant role in this. The following threechapters deal with mechanics, pneumatics andhydraulics. However, all three drive technologies
should also always be considered in combination
with the electrical design.

2011-11© Pilz GmbH & Co. KG, 20178-3

Chapter 8 Mechanical, pneumatic and hydraulic design

8.2 Mechanical design
8.2.1 Introduction
Engineers and designers have always done agood job. How else could you explain theremarkable level of safety on today’s plant andmachinery? The considerable maelstromsurrounding the EC Machinery Directive (MD)
has not actually been based on (safety) technology.
It has been much more concerned with the factthat a member of the company’s management
team must now use his good name to guaranteethat the supplied machine actually has the necessarylevel of safety demanded and, what’s more,that this can be proved legally (key words are
documentation and operating manual). However,it’s important to get one thing straight:

Our machines are still not always perfect, but they
are continuously getting better. Evolution in safety
technology does not mean the implementationof wholly new solutions; quite the opposite:
Deficiencies provide the impetus for improvement
and errors the premise for correction!
Regarding terminology: In general parlance, thedistinction between reliability and safety is notalways clear. That is because both terms have somethings in common: They refer to future events anddeal with probability. From the perspective of worksafety and the associated safety-related design, adistinction should be made between the two terms,
using exclusive definitions: If a component (or even a
module, machine or plant) does not fulfil its intended

Safe
development and design

8 Mechanical, pneumatic and hydraulic design

Safetyfor manand environment

Successful productFulfils
the technicalfunction

Economical
to manufacture
and in use

Clear
development and design

Simpledevelopment and design

Ground rules for the design of successful products

8-4© Pilz GmbH & Co. KG, 20172013-11

Chapter 8 Mechanical, pneumatic and hydraulic design

8.2 Mechanical design

8.2.2 Danger, hazard, risk
Annex I of the EC Machinery Directive defines
five obligatory steps as the basis for designingsafety-related machinery:
1. Determine the limits of the machine
including of its proper use and of reasonably
foreseeable misuse
2. Systematically identify potential dangers
in the design and hazardous situations
resulting from these
3. Estimate the hazardous situations whenworking with or on the machine (risk analysis)
4. Assess the risks associated with the hazards
and whether a risk reduction is necessary
5. Implement and document all the safetymeasures necessary to manage the risk
Regarding terminology: Viewed objectively,
dangers can be regarded as an energetic ormaterial potential that exceeds human limits andcan spontaneously lead to health impairments or
injuries of varying degrees of severity.
Hazards arise as soon as there is the possibilityof humans coinciding with dangers in time andspace, enabling an unwanted situation to arise.
The effects of what happens as the hazard unfolds
are subject to the relentless laws of nature.

The consequences may have various degrees
of severity. The level of risk is still determinedby whether technical or organisational countermeasures can or cannot be implemented.
Statements of risk are calculated prognosesof potential future events, in other words, theresult of human considerations and not therefore
the laws of nature playing out.
For design engineers it is important to know thatthe causes of danger lie in the effective parametersof material, energy and information. In other words,
parameters they apply during the design process
and which they can use to achieve a safe condition,
via the same methods employed to design functional
technical systems.
The hazard from materials may not only arise
from their chemical or biological properties. They
can also adversely affect humans on account of
their property as space-filling matter (geometry)in the earth’s gravitational field: Wherever thegeometric layout of the machine results in forced
postures or when heavy loads have to be carriedor transported by hand (strain on the spine).
8 Mechanical, pneumatic and hydraulic design

function in compliance with pre-defined boundary
conditions, it is deemed to be unreliable. If a
component (or even a module, machine or plant)
causes an accident involving bodily harm, it is/was
unsafe. The meaning of “reliable” and “safe” can bederived from the reverse implication. The logicalconsequence from an accident is that you can only
sensibly speak of safety (or lack of safety) if all the
relevant considerations of the technical systems
and their design treat humans as an inextricable
component of the work system, realistically, withall their deficiencies.

Energy: Every machine needs energy to perform
its technological function. Any energy used to fulfil
a work function can be hazardous to humans assoon as its impact is uncontrolled and exceeds
certain energy densities.
Information: A poorly designed information
flow between man and machine, including theboundary conditions, can trigger behaviours which
can endanger the machine user and others. In thiscontext, the basic information parameter implies
that human safety in work systems depends on thenatural laws of information processing and humanbehaviour. As the basic parameters of material,
energy and information are used in machinery,
dangers can only emanate from these parameters.

The term risk requires a new mindset. It represents
the consequences for man and the environmentof hazards that occur with varying frequency.

2017-08© Pilz GmbH & Co. KG, 2017

8-5

Chapter 8 Mechanical, pneumatic and hydraulic design

8.2 Mechanical design
Risk evaluation
DangerHazardMan

Level of thelatent or actualenergy-related/material
damage potential

Possibility of man coinciding withdanger in time and space

Limit values

Frequency of coincidencein time and space

Frequency of occurrence
Deterministic

Dangers

Constant

Frequently during
normal operation
Operating time
Seldom and briefDangers

Stochastic

8 Mechanical, pneumatic and hydraulic design

Practically neverOperating time

Risk
F

R=S×F

Minor

Serious

Bodily harm

S

Protective options

Reducing harm
Technical

Personal

Context of risk assessment

8-6© Pilz GmbH & Co. KG, 20172011-11

Chapter 8 Mechanical, pneumatic and hydraulic design

8.2 Mechanical design

Material

EnergyExamples2

No.

Spatialdisposition

1

Forced postures,
unreachable function elements

Physicalstresses2

Handling of loads,
high operating forces, high cycle counts

Physicalinfluences

3

Air temperature, draught,
air humidity, high or low pressure

Biologicalinfluences

4

Fungal cultures, bacteria in inhaled air,contaminated germ-infested air filter

Chemicalinfluences

5

Corrosive, poisonous,
harmful, irritant substances

Thermalinfluences

6

High and low ambientand contact temperatures, fire

Explosions

7

Chemical explosions(solid substances, vapours, gases), physical explosions

Mechanicalinfluences

8

Places where you can fall, danger sources,
danger zones, collisions, impact points

Noise,
vibration

9Sound emissions,hand vibration, whole body vibration

Electricalinfluences

10

Electrostatic charges,
body through-flow, arcing

Electromagnetic
fields11

Electromagnetic fields,
magnetic fields

Radiation

12

Electromagnetic waves, IR/UV radiation,laser, ionising radiation

Presentationof information

13

Inadequate layout of notices,
control elements; incompatibility

Light
conditions

14

Luminosity, glare,
luminous colour, luminance distribution

Psychomental
stress15

Unclear operating and work instructions,software ergonomics

Organisational
failings

16

Poorly thought-out,
uncoordinated sequence of operations

Hectic pace,stress, shock

17

Incorrect operation,
panic reactions, mistakes

1

3

4

8 Mechanical, pneumatic and hydraulic design

Effective parameter EffectInformation

Dangers when dealing with machinery

2011-11© Pilz GmbH & Co. KG, 2017

8-7

Chapter 8 Mechanical, pneumatic and hydraulic design

8.2 Mechanical design
8.2.2.1 Mechanical dangers

machine accidents because their destructive impact
is underestimated, both by design engineers andby those affected. Unlike stochastic dangers, withpractice, danger points are visible to the naked
eye of anyone with any sort of technical interest,
whether in drawings, CAD designs or on finishedmachinery. It is really a benefit that today’s design
engineers can counteract these dangers using
relatively simple means.

The essential distinguishing feature concerns thetype of mechanical energy (kinetic, potential) andthe question as to the basis of the energy (object
or human) and which movements would precedea possible accident (kinematically based or freemovements).
Hazards: Hazards occur when potential dangers
and humans coincide in time and space. There are
two types: stochastic (random) and deterministic(predetermined) hazards.

8 Mechanical, pneumatic and hydraulic design

Deterministic hazards: These are rooted in thefunctional design of the machine, e.g. danger
points which are a technical necessity, such as
those on tools with set movements. Such hazards
are latent throughout the whole of the machine’s
lifetime and have a consistently high level of probability. An accident at a danger point is therefore
only a matter of time, unless design measures areused to counteract it. Deterministic, mechanicaldanger points are still the main focus for all

Stochastic hazards occur with a time-based
probability during a machine’s lifetime. They arenormally visualised with the bathtub curve, althoughstrictly speaking this only applies to a few modules
or components. It is rare for these hazards andtheir causes to be directly identifiable and, as
is unfortunately almost always the case with
spectacular accidents, they can hardly ever be
reliably predicted.

Dangers

Deterministic

Dangers

Stochastic

Dangers

Operating time

Personal injury

Operating time

Material damage/personal injury

Deterministic and stochastic dangers

8-8© Pilz GmbH & Co. KG, 20172011-11

Chapter 8 Mechanical, pneumatic and hydraulic design

8.2 Mechanical design
Today there are more than 80 risk assessment
procedures on the market and in academia, andthe number is expected to rise. However,none of them is (legally) binding. Though the
Machinery Directive refers to some harmonised
standards for machine safety (EN ISO 13 849,
EN ISO 12 100, IEC 61508 or EN 62 061), theimplementation of these continues to be highly
problematic in practice. And it’s not all the fault ofdesign engineers: With no relevant training, they
are supposed to derive binding measures frommultiple statements of probability for more
events than are likely to occur. The following
definition of technical risk is currently generally
accepted:
Risk is not a law of nature, but a statement ofprobability (prognosis) regarding the impact ofhazards on man and/or the environment under adefined set of circumstances. Risks are calculated
from the frequency and severity of potential injury,
damage to health or material damage, combinedwith the possibility or otherwise of technical,
organisational or personal measures to avert orprotect against the hazard. The result of the risk
assessment ultimately determines the reliability
requirements of the safety functions to be fulfilledby the safety-related parts of the controller. This
also refers to the reliable performance of the guard
function.
8.2.3 Definition and implementationof safety measures
Machine manufacturers are obliged only to supply
safe products on the internal European market.
For this reason, they must calculate all the hazards
associated with the machine in advance andassess the resulting risks. With the knowledge
gained from the risk analysis and the risk assessment, manufacturers must design their machines
in such a way that cannot be harmful either tousers, other persons or the environment. In otherwords the machines must be safe.

2017-08© Pilz GmbH & Co. KG, 2017

Many people like to use the term “safe”; after all,the feeling of safety is one of the most important
basic human needs. Advertising and insurance
industries, along with politicians, really understandhow to address this basic need and exploit it for
their own interests. In technology, “safe” is often
taken to mean the fulfilment of a machine function
over a fixed period. That really addresses reliability,
however, so we need to be precise: In its true
sense, safety is understood to be the absenceof potential and real danger for man and theenvironment. Safety and reliability have many
common features: Both describe a futuremachine behaviour and are therefore statements
of probability.
The first commandment for safety-related design:
All hazard types must be tackled within the design!
The necessary design measures must counteract
both unforeseeable stochastic and deterministic
hazards. The different modes of operation of both
hazard types also require different design methods.
Note the following when selecting thedesign methods:
8 Mechanical, pneumatic and hydraulic design

8.2.2.2 Risk assessment

1. Design measures should always be used toreduce existing risks to such an extent thatthe achieved residual risk is tolerable to theindividual and society (i.e. it may occur andmust then be accepted).
2. As stochastic and deterministic hazards
vary substantially, it is only logical thatthe measures taken to counteract them mustalso differ.
Key:• Stochastic: Hazards influenced by chance
for which the danger potential cannot be
predicted exactly, i.e. is expressed asa probability• Deterministic: Hazards with a constantdanger potential that is the same at all times

8-9Chapter 8 Mechanical, pneumatic and hydraulic design

8.2 Mechanical designType ofenergyEnergybearer1

2

Movement
3

Potential
energyGraphic
No.

Hazarddue to451Danger points
on controlled
moving parts:
Danger is confined
to a specific location.

Movement
along fixedchannels2
Kinetic
energyObjects3
Danger sources
due to uncontrolled
moving parts:
Danger emanates froma specific location.
4

8 Mechanical, pneumatic and hydraulic design

Potential
energyFree
movement
Places where
you can fall
5

People,parts of the body
6

Impact points
Kinetic
energy7
Movement
along fixedchannels

Inertia forces
8

Basic mechanical dangers

8-10© Pilz GmbH & Co. KG, 20172011-11

Chapter 8 Mechanical, pneumatic and hydraulic design

8.2 Mechanical design
Dangers

Deterministic

Stochastic

Dangers

Dangers

Operating time

Operating time

Objective:
Eliminate faults
that lead to danger

Objective:
Manage faults
that lead to danger

Deterministic methods:

Stochastic methods:

Avoid
dangers

SecureagainstdangersWarnof dangers

8 Mechanical, pneumatic and hydraulic design

Design measures

Safe life
principle

Failsafe
principle

Redundancy
principle

Important design measures for avoiding danger

2011-11© Pilz GmbH & Co. KG, 2017

8-11

Chapter 8 Mechanical, pneumatic and hydraulic design

8.2 Mechanical design
8.2.3.1 Design measuresagainst stochastic hazards
Stochastic hazards can be mainly attributed tocomponent failures or software errors. Although
they affect machine reliability, they may notnecessarily have an adverse effect on human safety.
The aim of targeted design measures is to increase
the time-based probability that machines will fulfil
their intended function within an agreed operatingtime and remain immune to random component
failures. That way they can harm neither man nor
the environment. The most well known design
measures are:• Safe life principle• Failsafe principle• Redundancy principle

8 Mechanical, pneumatic and hydraulic design

Idea

1

Measures relating to the safe life principle
start from the assumption that the machine isadequately dimensioned and designed according to
its function, and as such will operate as intended
during its warranted lifetime: without faults, failures
or danger. This design principle is particularly
significant on safety devices such as rupture discs,
for example. The model shown below used theextremely reliable buckling bar principle.
Application of this principle assumes that:
1. All the stresses that act on the machine
are known,
2. The applied calculation methods andaccepted material performance match reality,
3. No influences other than those consideredin the calculation will occur during themachine’s lifetime.

Development22

Product

1

2
2

1

1

3
Pressurising medium

Pressurising medium

Item A
1Key:
1 Rupture disc2 Buckling pin
3 Sealing membrane
4 Joint

2

A

2

4

Non-fragmenting rupture disc (reverse buckling disc)8-12© Pilz GmbH & Co. KG, 20172011-11

Chapter 8 Mechanical, pneumatic and hydraulic design

8.2 Mechanical design
In real life, none of these assumptions can be
guaranteed. For this reason, it is advisable to takea different route. The failsafe principle knowingly
permits errors. However, the systems are designed
and constructed so that a safety-related crash does
not lead into the abyss but stops at an agreed level.
The systems react to faults in such a way that they
“fail” to safety - although this only applies to known,
identifiable and foreseeable faults. This assumes
that energy for this function may be supplied within
the system not just in case of emergency, but thatsufficient energy is always stored in advance. This
will be dissipated in the case of danger and thesystem transferred to a low-energy and therefore
stable condition. Implementation of this principle
often makes use of ever-present effects such as
gravitational or frictional forces and the self-locking
that can be achieved through these means.

In redundant systems, more components areprovided to fulfil a function than are actuallynecessary. The assumption is as follows: If oneof these components should malfunction or fail,the other will completely take over its function.
The principle is to achieve the greatest possible
reliability with a minimum of redundancy. As reasonable as this principle may be, it does have one
important weakness: Experience shows that
there are always situations, and always will besituations, in which all redundant components failsimultaneously due to a common cause failure.
These situations are very difficult to predict andcontrol through the design. Consistent but expensive
diversity, particularly in terms of physical diversity,
produces the best results.

Unfavourable

Favourable

8 Mechanical, pneumatic and hydraulic design

Check
valve

Crush point
Check
valve

When the hose assembly fails, themedium leaks before the check valve.
Tool drops in an uncontrolled manner.

When the hose assembly fails, the controlled
check valve prevents the liquid column frombreaking.
Tool remains above.

Hose assembly with check valves

2011-11© Pilz GmbH & Co. KG, 2017

8-13

Chapter 8 Mechanical, pneumatic and hydraulic design

8.2 Mechanical design
Redundancy
1

Homogeneous

8 Mechanical, pneumatic and hydraulic design

Diverse(components)

Example2

No.

3

Safety valve

Safety valve

Duplication only
increases safety when
no systematic errors canoccur, e.g. corrosion,material mix-up, which canrender both safety devices
ineffective simultaneously.

Safety valve

Rupture disc

Diversity in the action
principle of the safety device:1

Switching the action
principle makes it unlikelythat the independent safety
devices, which operate todifferent principles andare made by different
manufacturers, would failsimultaneously.

2

Actuator

Diverse(process variables)

Explanation

Diversity in thephysical principle:

Actuator

Each of the diverse,
controlled valves is
activated by the control
systems CS1/CS2, which
react if a limit value on
two process variables
connected by a physical law(e.g. general equation ofstate) are exceeded.

3

×Pressure sensor

××
Temperature sensor

Homogeneous and diverse redundancy

8-14© Pilz GmbH & Co. KG, 20172011-11

Chapter 8 Mechanical, pneumatic and hydraulic design

8.2 Mechanical design
8.2.3.2 Design measuresagainst deterministic hazards
Deterministic hazards can be attributed to thefunctional design of the machinery, as required bytechnical necessity, and the employed procedures.
Targeted design measures are intended to stop the
possibility of latent dangers impacting on people.
Three methods have been developed in the courseof technical progress:

In contrast to the measures taken against stochastic
hazards, which are fundamentally regarded as beingof equal value, the EC Machinery Directive bindingly
specifies the sequence and priority in which therespective measures against deterministic hazards
should be applied
1. Direct
2. Indirect
3. Informative

1. Direct safety technology
2. Indirect safety technology
3. Informative safety technology

Safety technology methods
Safety technology

Indirect

DirectInformative

Action principle

Avoid dangers

Secure against dangers

Warn against dangers

DiagramMachining

8 Mechanical, pneumatic and hydraulic design

ObserveAct
STOP!

EC Machinery
Directive,
EN ISO 12100

Eliminate orminimise dangers

Take the necessary protective
measures when dangers cannot
be eliminatedInstruct the user
about the residual risks

Safety technology methods

2011-11© Pilz GmbH & Co. KG, 2017

8-15

Chapter 8 Mechanical, pneumatic and hydraulic design

8.2 Mechanical design
Unfavourable

Favourable

1

x

2

Shearing hazard avoided by design

8 Mechanical, pneumatic and hydraulic design

8.2.3.2.1 Direct safety technology
Methods using direct safety technology attempt toconfigure components, machines and processes insuch a way that they present no risk, or only a low,
accepted risk to people. Geometric and energetic
measures are available:
Geometric measures attempt to avoid thehazardous effect of danger points on moving
machine parts by complying with standardised
minimum distances to ensure that dangerous
proximity does not even arise, or by making suchdanger points inaccessible by complying withsafety distances.
Energetic measures attempt to stop the hazard’s
underlying energy having a harmful effect on
people by:

8-16• Limiting the effective energy• Interrupting the flow of energy to people• Targeted deformation of machine partsrather than the human body
The first measure attempts to limit the energies andforces that occur at a danger point, so that theirimpact remains below acceptable physiologicalvalues. Technically, however, such an energy levelis generally only of limited use. The second measure
prevents harmful impact on people by interrupting
the flow of energy or forces towards the humanbody before the pain threshold is reached. The third
measure reduces the rigidity of machine parts tosuch an extent that, if a danger point is accessed,
machine rather than body parts are deformed.
Caution is required, however: Direct safety
technology is often portrayed as a “silver bullet”,
but it cannot be applied on danger points withtechnological functions. Safeguards against these
dangers should be provided via special measures
such as protective devices, for example.

© Pilz GmbH & Co. KG, 20172011-11

Chapter 8 Mechanical, pneumatic and hydraulic design

8 Mechanical, pneumatic and hydraulic design

8.2 Mechanical design

Elastic closing edges on protective devices

8.2.3.2.2 Indirect safety technology
Components used in indirect safety technology
safeguard against dangers that are necessary to themachine function and therefore cannot be avoided.
Protective devices are arranged between operator
and danger, preventing the two coinciding in timeand space. Guards or protective devices are used.
Guards, e.g. enclosures or covers, form impenetrable
physical barriers and as such protect against entry
or access to hazardous situations. They can also
prevent operators being hit by objects ejected fromthe protected areas.

2017-08© Pilz GmbH & Co. KG, 2017

Although protective devices such as two-handcircuits or light beam devices do not prevent entry
or access to hazardous situations, they do renderthem safe by influencing the process via themachine controller as soon as they are activated.
Ergonomic aspects decide on the manageability
and therefore the acceptance of the protective
devices. The most important ergonomic requirement is that the operators are not obstructed any
more than necessary during day-to-day handlingof the protective device.

8-17

Chapter 8 Mechanical, pneumatic and hydraulic design

8.2 Mechanical design
Protection
againstBreaking thecause and effectrelationshipEffect
via

1

2

3

DiagramNo.

Description

Space

6

7
Safeguards hold backthe uncontrolled moving
parts, absorb theirkinetic energy andstop them reachingpeople.

Covers,enclosures,
guardsWhen in position,
safeguards provide
a physical barrier
between the danger
points and the work/
traffic area. People areunable to reach danger
points.

Impeding
deviceFingerimpeder,
hand
impeder

Safeguards are
kinematicallyconnected tohazardous movements.
They positively keeppeople away fromdanger zones.

Interlocked
or locked
movableguard

Covers,enclosuresmonitoredby position
switches

Opening the safeguardinterrupts the hazardous
movement and lifts thephysical barrier between
the danger point andperson. Its safety
depends on the reliable
function of the safetyrelated parts of thecontrol system.

Safeguardthat binds
you toa location

Enabling
switch,hold-to-run
control
device,two-handcircuits

During the hazardous
movement, safeguards
bind people to a safe
location, from which
they cannot reach thedanger points. If aperson should leave
the safe location, thehazardous movement
is stopped.

Safeguard
withpresence
sensing

Optoelectronic
capacitive
sensors,
safe edges,
pressuresensitive
mats,light grids,
scanners

Safeguards prevent
hazards by interrupting
hazardous movements
as soon as anyone
exceeds the safe limits
and approaches thedanger point.

1

Trapping

y

Fixed
guard

x

z

2

y
x

8 Mechanical, pneumatic and hydraulic designzDanger points

Mobilephysicalbarriers

3

Space
and
time
Mobilephysicalbarriers

4

5
Time

Reliable
controlmeasures

6

Explanation

Trap covers,
protection
structureson earthmovingmachinery(ROPS,FOPS)

5

4

Danger sources
Staticphysicalbarriers

ExamplesBasic types of protective device

8-18© Pilz GmbH & Co. KG, 20172011-11

Chapter 8 Mechanical, pneumatic and hydraulic design

8.2 Mechanical design
8.2.3.2.3 Informative safety technology
As the final option in combating deterministic
hazards, informative safety technology attempts
to ensure that at-risk personnel observe safe
work practices through targeted messages andinformation, using methods such as: Safety signs,
safety guidelines in operating manuals, internal
company instruction organised by the machineuser etc. The effectiveness of this method varies
from country to country. It can certainly enjoy
considerable success in other cultures, but itshould not necessarily be relied upon in European
countries. Due to different mentalities among the
population, priority must be given to technicalprotective measures that are activated automaticallyand prevent or safeguard against dangers.

8 Mechanical, pneumatic and hydraulic design

It would be practically impossible to build a machinewith an acceptable level of risk using only one ofthe design measures listed here. The various
methods used in these measures must instead beco-ordinated to ensure they complement each otherand are effective both functionally and overall.1)

Source: Neudörfer A.: Konstruieren sicherheitsgerichteter Produkte [Design of safety-related products], 5th edition,
Heidelberg, Berlin, New York et al., Springer, 20131)	2013-11© Pilz GmbH & Co. KG, 2017

8-19

Chapter 8 Mechanical, pneumatic and hydraulic design

8.2 Mechanical design
Information parameters
ExampleChannelProcess

Means

1

2

3

4

No.

Text

Operating instructions
1

Welding
harmful to eyes

2

StaticGraphic symbol

Stop, halting a movement
3

Rapid stop
ISO 7000

Safety mark4

VisualMarking

8 Mechanical, pneumatic and hydraulic design

5

Colour combination:
Yellow-black (permanent danger)
Red-white (temporary danger)

Light signals
6

Activediagrams

1
3

7

2

3
6
4

Dynamic

Aural

Processvisualisation,
simulation

2

5

1

4
5
6

Main motor
Infeed table open
Cover open
No compressed air
Film broken
Magazine empty

8

Acoustic
signals9

TactileMovingobjects

Evasive safeguard
10D

Means of informative safety technology

8-20© Pilz GmbH & Co. KG, 20172011-11

Chapter 8 Mechanical, pneumatic and hydraulic design

8.3 Pneumatic design
Variable

Unit

SymbolRelationship

Lengths

Micrometreμm

1 μm = 0.001 mm

Millimetremm

1 mm = 0.1 cm = 0.01 dm = 0.001 m

Areas

VolumeCentimetrecm

1 cm = 10 mm = 10,000 μm

Decimetredm

1 dm = 10 cm = 100 mm = 100,000 μm

Metre

m

1 m = 10 dm = 100 cm = 1,000 mm = 1,000,000 μm

Kilometrekm

1 km = 1,000 m = 100,000 cm = 1,000,000 mm

Square centimetre

cm²

1 cm² = 100 mm²

Square decimetredm²

1 dm² = 100 cm² = 10,000 mm²

Square metrem²

1 mm² = 100 dm² = 10,000 cm² = 1,000,000 mm²Area

1 a = 100 m²

Hectareha

1 ha = 100 a = 10,000 m²

Square kilometrekm²

1 km² = 100 ha = 10,000 a = 1,000,000 m²

Cubic centimetrecm³

1 cm³ = 1,000 mm³ = 1 ml = 0.001 l

Cubic decimetredm³

1 dm³ = 1,000 cm³ = 1,000,000 mm³

Cubic metrem³

1 m³ = 1,000 dm³ = 1,000,000 cm³

Millilitreml

1 ml = 0.001 l = 1 cm³

Litre

l

1 l = 1,000 ml = 1 dm³

Hectolitrehl

1 hl = 100 l = 100 dm³

DensityGram/
cubic centimetre

Force/
weight force

NewtonN

TorqueNewton metre

NmPressure

Pascal

Pa

Bar

bar

8 Mechanical, pneumatic and hydraulic design

8.3.1 Relevant units

1 daN = 10 N

Mass

2017-08

1 Nm = 1 JPsi

1 psi = 0.06895 bar

Milligrammg

1 mg = 0.001 g

Gram

g

1 g = 1,000 mg

Kilogramkg

1 kg = 1,000 g = 1,000,000 mg

Tonne

t

1 t = 1,000 kg = 1,000,000 g

Megagram

Mg

1 Mg = 1 t© Pilz GmbH & Co. KG, 2017

8-21

Chapter 8 Mechanical, pneumatic and hydraulic design

8.3 Pneumatic design
Variable

Unit

Acceleration

Metre/ squaresecondAngular speed

One/second

SymbolRelationship

1 G = 9.81 m/s²ω=2×π×nn in 1/s

Radian/second
Output8 Mechanical, pneumatic and hydraulic design

Work/energy,
heat

Watts

W

Newton metre/secondNm/sJoule/second

J/s

Watt second

Ws

Newton metre

Nm

Joule

J

Kilowatt hourkWhKilojoulekJ

Megajoule

MJ

MechanicalstressNewton/ square
millimetre

Plane angle

Second"1" = 1’/60

Minute’1’ = 60"

Degree°RadiantradOne/second

1/s

One/minute

1/min

Unit

SymbolSpeed

Variable
Density
Pressure loss
coefficientlζ, zetaδ, delta

η, etaDynamic
viscosity

Normal nominal
flow rate

Relationshipτ, tauStatic viscosity

Flow rate

1 rad = 1 m/m = 57.2957°
1 rad = 180°/π

ρ, rhoFriction shear
stress8-22

1 kWh = 1,000 Wh = 1,000 × 3,600 Ws = 3.6 × 106 Ws = 3.6 × 103
kJ = 3,600 kJ = 3.6 MJ

η=ν×ρ

ν, nu
l/min

Q

l/min

qnN

With T = 293.15 K (20 °C), p1= 6 bar, p2 = 5 bar, ρair = 1.292 kg/m³© Pilz GmbH & Co. KG, 20172017-08

Chapter 8 Mechanical, pneumatic and hydraulic design

8.3 Pneumatic design
8.3.2 Introduction

8.3.3.1 Basic and well-tried principles

Pneumatics is one of the drive technologies inengineering, alongside electrics and hydraulics.
To ensure that a machine can be operated safely,
it is not enough to identify hazards and then passthis information to a controller or safety components.
The drives must be brought to a safe condition;
only then is the machine safe.

First let’s look at some basic and well-tried principlesof pneumatics. These include good compressed air
treatment: Compressed air must be filtered and must
be free of water and compressor oil. Poorly treatedcompressed air will cause elements to malfunction.
Valves no longer switch and become stuck; cylinders
may move unintentionally due to leakages. And
there’s the recurring question on whether or not
to lubricate compressed air. The maxim here is:
Lubricate once, lubricate forever. However, today’s
pneumatic components have lifetime lubrication andno longer need to be lubricated. If new components
are built into old machines on which the compressed
air is lubricated, the new parts will also be lubricated.
In this case, select a lubricant that is valve-compatible. Only use a small amount of lubricant, for“overlubrication” will also lead to malfunctions.

8.3.3 Well-tried principles and protective measures
Safe pneumatics can be divided into two basic
fields: Firstly, the basic and well-tried principles,as described in Annex B of DIN EN ISO 13 849-2,
and secondly, the protective measures relevant forpneumatic drives. These include control technology
solutions that move a cylinder in accordance witha desired behaviour.

8.3.3.2 Selection and dimension

2017-08© Pilz GmbH & Co. KG, 20178 Mechanical, pneumatic and hydraulic design

The pneumatic components should be selected
and dimensioned to withstand the expecteddemands. Environmental conditions such as temperature, oils, acids, alkaline solutions and cleaning
agents should be noted. A good safety-related
circuit is worthless if aggressive cleaning agentssoften the pneumatic hose. Pneumatic cylinders
are usually calculated so that they supply the force
required in the machine. However, the calculation
should also take account of kinetic energy. If acylinder moves too quickly – applications frequently
require high cycle counts – the energy with whicha pneumatic cylinder travels to the end position
will be correspondingly high. This will damage thecylinder in the long term.

8-23

Chapter 8 Mechanical, pneumatic and hydraulic design

8.3 Pneumatic design
8.3.3.3 Pressure limitation

8 Mechanical, pneumatic and hydraulic design

Another basic principle is pressure limitation.
A pressure relief valve is located on the air chamber
behind the compressor and protects the air chamberfrom explosion. The machine has an integrated
service unit, which regulates the operating pressure.
If the setting for the operating pressure is turned up,
the forces within the plant will increase, which canlead to an overload. Consequently, the machine
operator should not be able to change the operatingpressure without authorisation. It makes sense,
therefore, to have a pressure relief valve in theservice unit, protecting the machine from adangerous failure of the pressure regulator. If there
were any defect, the machine would face the fullmains pressure. For this reason, further pressure
limitation measures are required, which will affectthe dimensioning of the cylinder. Where pneumatic
cylinders are installed vertically, excess pressure
arises on the cylinder due to the moving mass,
the operating pressure and the surface difference.
If this cylinder is then to be stopped pneumatically,e.g. by closing off the compressed air, pressure
peaks of well over 30 bar are possible. In turn,this pressure will overload all the pneumaticcomponents used in this part of the circuit.

DNC-50-500-PPV-A
with 80 kg
external load

60 %

0 mm
500 mm
20 %
2

4
5

3

1

2
1

3

Circuit diagram, pressure values (source: Festo)

Component description

IdentifierState variable

Cylinder, double-action

DNC-50-500-PPV-A

Travelmm

Pressure gauge

Pressure up

Pressure
bar

0

1

2 3

4 5

6

7

8

9 10

500
400
300
200
100
6
4
2

Pressure gauge

Pressure down

Pressure
bar

20
15
10
5

Pressure values (source: Festo)

8-24© Pilz GmbH & Co. KG, 20172017-08

Chapter 8 Mechanical, pneumatic and hydraulic design

8.3 Pneumatic design

8.3.3.4 Positioning of safeguards
Application in conjunction with a light beam
device or two-hand circuit provides another reason
for ensuring that the design of a pneumatic circuitis thorough and correct. In accordance withDIN EN ISO 13855 “Positioning of safeguards
with respect to the approach speeds of parts of
the human body”, the stopping performance ofa hazardous drive must be measured and themeasurement used to determine the distance ofthe light beam device or two-hand circuit. The
speed of a pneumatic cylinder depends not only
on the operating pressure, mass and mounting
position, but above all on the screw joints, hoses
and valves that are used, along with their flow rates.
If the latter is not calculated, the assembler will
determine the machine’s cycle counts and thereby
the stopping performance for a light beam device,
based on a greater or lesser degree of knowledge.
If an operator then changes the hoses and screw
joints, enabling a higher flow rate, he will bechanging the stopping performance at the sametime. The distance of the light beam device may
no longer be sufficient for this drive; the risk ofa hazardous incident would increase significantly.
It is advisable, therefore, to make all the drive
calculations in full and to include the values forhoses and screw joints in the circuit diagram. An
indication that the information is “safety-related”
also makes sense. A photograph during theacceptance test, showing exactly this layout,
would also be a helpful guide in the event of any
legal dispute.

2017-08© Pilz GmbH & Co. KG, 2017

8.3.3.5 Basic principle of mechanical springsor air springs
The mechanically well-tried spring is anotherbasic principle of safety technology, in mechanics
as well as pneumatics and hydraulics. On valves
with a mechanical spring, the valve’s switchingposition is clearly defined if the control signal oreven the compressed air supply is switched off.
This is not the case on pulse valves (bistable valves
with two coils). When selecting monostable valves
it is worth paying particular attention to the return
mode, for not only are there mechanical spring
return valves but also air spring return valves.
The diagram below shows two monostable valves.
The upper valve has a mechanical spring, the lower
valve has an air spring. The return mode is shownon the right-hand side of the valve. These are
5/2 directional valves with pilot control, manual
override and electrical activation.

42

8 Mechanical, pneumatic and hydraulic design

These pressure peaks can be reduced by installinga pressure regulator between the operating valve
and the upper cylinder connection. In this case,the cylinder’s downward movement is supported
not with the normal operating pressure but witha pressure reduced to 2 bar. If the cylinder issubjected to very high pressure, no pressure isneeded for the downward movement. In this case,a silencer is screwed into the upper cylinderconnection. The cylinder can then be controlledwith a 3/2 directional valve because the pressure
is only needed for the upward movement.

51 3
4

2

51 3

Monostable valves with mechanical / air spring(source: Festo)

8-25

Chapter 8 Mechanical, pneumatic and hydraulic design

8.3 Pneumatic design
However, air-spring valves can only be reset if
sufficient pressure is available for the air spring.
The compressed air supply to the air springs cancome from pressure port 1 or from a separate
control air connection. Ultimately, this depends
on the valve series. Specialists must clarify whether
air-spring valves can be used in safety-related
circuits, and under what conditions. Very close
attention must therefore be paid to the design ofthe valve in pneumatic circuit diagrams.

Further safety principles in pneumatics concern
the reduction of force and speed. These are mainly
applied in set-up mode. Force is reduced bylowering the operating pressure for the cylinder. In
pneumatics, speed is generated via the intensity of
the flow rate. In both cases, the supply of pressure
to the operating valve is simply switched. The risk
assessment will determine whether this switchoverneeds to be single or dual channel.

4

2

5 1

3

14

5

3

14

4

14
4

14

8 Mechanical, pneumatic and hydraulic design

14

2
14

84

14

14

5 1

5 1

4

84

3

3

1

2

2

Control air Working pressure 1 Working pressure 2

Reduced force (source: Festo)

Control air

Reduced speed (source: Festo)

The circuit diagram for reduced speed only
represents the principle. As the hoses and screw
connections between the operating valve and thecylinder also affect the speed, reduced speed isgenerally achieved through valves that sit directlyon the cylinder.

8-26© Pilz GmbH & Co. KG, 20172017-08

Chapter 8 Mechanical, pneumatic and hydraulic design

8.3 Pneumatic design
Having looked at some examples for basic andwell-tried principles in pneumatics, let’s look now
at the actual protective measures. Protective
measures for safety-related pneumatics describe
circuit-based solutions. These include:• Protection against unexpected start-up• Ventilation and venting• Braking the movement• Blocking the movement• Reversing the movement• Free movement option• Balancing forces on the drive
Protection against unexpected start-up
In the first instance, a manual start-up valve on
the service unit provides effective protection against
unexpected start-up. With this manual valve, themaintenance engineer can vent the machine, usinga padlock to protect against a restart. The next
sensible measure is an electrical start-up valve,
which can be activated via a higher level control
system. This measure also includes a pressure
sensor, which monitors the operating pressure.
The control system detects any drop in pressure
and consequently switches off all the outputs plus
the soft start valve. As soon as the corresponding
operating pressure has returned, the controller
switches the compressed air back on and ventilates
the machine and its drives.

2011-11© Pilz GmbH & Co. KG, 2017

The proper selection of operating valves is anothereffective protective measure. Valves with a separate
control air supply cannot be switched without control
air. As a result, valves would be prevented fromswitching in the event of an electrical fault. What’smore, if the installed operating valves are closed intheir rest position, there will be no cylinder movement
when the machine is ventilated, as the compressed
air is still unable to reach the cylinder. If the installed
operating valves allow air to reach the cylinder when
the compressed air is switched on, a slow build-up
of pressure is generally desirable. A soft start valve
can be used in this case. This valve will initiallyventilate the machine slowly via a throttle point. The
valve will not open fully until an operating pressureof 3 bar is present, for example. Only at this point
will the entire operating pressure be available at full
flow rate. In the initial ventilation phase, this valve
can thus be used to perform slow and controlled
cylinder movements. Should a hose be installed
incorrectly, there would immediately be an audible
hissing sound, but the hose would not thrash about
forcefully, as it would if full pressure were applied.

8 Mechanical, pneumatic and hydraulic design

8.3.4 Circuit-based solutions

8-27

Chapter 8 Mechanical, pneumatic and hydraulic design

8.3 Pneumatic design
8.3.4.1 Venting

the practice of ventilating and venting is coming
under increasingly critical scrutiny for quite different
reasons: The procedure costs a lot of time andtherefore money; productivity falls.

Venting is frequently used as a protective measure.
It is employed when the cylinders are de-pressurised
and do not represent a danger. However, therespective mounting position and the mass at thecylinders must be taken into account. The conceptof this measure is similar to that of removing powerin the electrical field: The electrical voltage is simply
switched off to avoid hazards from contact withelectrical cables. The principle is exactly the same in
the pneumatic field, for without power/compressed
air, there’s no danger. However, in safety technology
it is always necessary to examine the mechanics
which will ultimately have to perform the movements.
If a vertically-installed cylinder is vented, the cylinder
piston will obey inertia and move downwards.
Additional protective measures must be considered
for this exact scenario. In industry, however,

The fact that safety is the first priority is undisputed.
A machine can certainly be ventilated and vented
at performance level PL = “e”. The soft start andexhaust valve MS6-SV is a safety component inaccordance with the MD 2006/42 EC and meets
performance level “e”. It is an intrinsically safe,
redundant, mechatronic system in accordance withthe requirements of DIN EN ISO 13849-1. The
pneumatic safety-related objective, i.e. safe venting,is guaranteed even if there is a fault in the valve(e.g. due to wear, contamination).

8 Mechanical, pneumatic and hydraulic design

24V

MS6-SV

12

11

21

22

2
1 3

12

A1

56 8 9A2

A12 S22 S34 Y4 Y5

Eingangsschaltung/Netzteil/Power unit/ Input circuit/
Alimentation Circuit d’entrée

14

&

Y32

S21

S11

Taktausgänge/
Test pulse outputs/
Sorties impulsionellesµController 1&

24µController 2&

0V GND

Schematic, safe ventilation and venting (source: Festo)

8-28© Pilz GmbH & Co. KG, 20172017-08

Chapter 8 Mechanical, pneumatic and hydraulic design

8.3 Pneumatic design
The schematic on page 8-28 shows a circuit with adual-channel design for safe ventilation and venting.
Two enable signals are sent from the electronic
safety relay to pins 1 and 2 on the MS6-SV. An
additional electronic safety relay would draw
attention to any shorts between the two devices.
As a result, performance level “e” can be achieved.
The circuit diagram does not show the potential
feedback from MS6-SV to the PNOZ. A volt-freecontact, which is incorporated into the feedback
loop, is available for this purpose. This enables
the PNOZ to detect whether the MS6-SV is readyfor operation.
Festo MS6-SV (source: Festo)

Single-channel ventilation and venting is also
possible, of course. Electropneumatic valves inthe service unit fulfil this purpose, receiving theircommands from the higher level controller or froma single-channel safety circuit. Venting can also be
implemented via the operating valve 1V1.

1A1
1V2

1V3

8.3.4.2 Normal operation

2017-08© Pilz GmbH & Co. KG, 2017

1V1

1M1

4

2

5

1 3

8 Mechanical, pneumatic and hydraulic design

In normal operation, one of the two valve coils 1M1
or 1M2 is always under voltage. The valve is thereby
switched. So the cylinder piston is either in one end
position or moves from one end position to theother. The cylinder is vented when the operating
valve is in its middle setting. This is the case whenboth coils are de-energised. The venting process on
the operating valve is faster than venting via theservice unit because the route for the compressed
air is shorter and the pressure volume to be vented
is lower. If venting is performed via the service unit,
several cylinders will be vented and at the sametime the pressure volume will be higher. There isanother advantage to venting via the operating
valve: Additional protective measures can easily
be implemented in parallel on other cylinders,such as “reversing” for example.

1M2

2
0Z1

1

3

Venting with 5/3 directional valve (source: Festo)

8-29

Chapter 8 Mechanical, pneumatic and hydraulic design

8.3 Pneumatic design
8.3.4.3 Reversing“Reversing” as a protective measure is the rightchoice when the movement of the cylinder piston
is dangerous in only one direction.
The monostable 5/2 directional valve, as shown inthe diagram with 1V1, needs an electrical control
signal at the coil 1M1 in order to switch the valve.
The cylinder’s piston rod extends in sequence. If thecoil is switched off, the control force on the left sideof the valve will be missing. The mechanical springon the right side can switch the valve back on; thepiston rod continues to retract. In the normal machine
cycle, the control system switches the valve coilon and off. A safety relay connected between thecontrol system and the valve coil can also switch off
the coil. In this case, it would be irrelevant whether
the output on the control system (a non-safetyrelated PLC for example) is still switched on. Even
if the electrical supply voltage should fail, the valve

would be switched back to its home position.
The piston rod cannot reverse until compressed
air is returned. The emergency stop function
therefore needs a stop category 1 for reversing.
The compressed air will not be switched off until thecylinder has reached its safe end position. A stop
category 0 switches off the compressed air supply
immediately and cannot be used in this casebecause reversing would no longer be possible.
All pneumatic circuit diagrams must allow for a
total failure of the compressed air supply. The
electronic control system detects the failure of thecompressed air: To ensure that the piston rod has
sufficient air available to guarantee that the piston
rod can reverse, a stored volume is arranged
upstream of the operating valve. A check valve isconnected upstream of the stored volume to ensurethat the stored air cannot discharge in the directionof the compressed air supply. As a result, thecompressed air always flows in the direction of thecylinder.
8.3.4.4 Failure mode

8 Mechanical, pneumatic and hydraulic design

When considering the failure mode of the operating
valve, the following possibilities are conceivable:
1A1

1V2

1V3

4

1M1

1V1

5

2

1

3

• The valve does not switch, so the piston rod
does not move either. There is no danger. Theremay be various causes. It may be that voltage
is not reaching the valve coil, the valve may be
defective. Sometimes the armature in the coil orthe piston in the valve may stick.
• A different type of error occurs if the valve
does not switch back. In this case, the piston
rod continues to extend or remains extended.
On the electrical side, a short may be the reason,or possibly the valve piston is hanging up. In any
case, this is a dangerous failure.

Single-channel reversing (source: Festo)

8-30© Pilz GmbH & Co. KG, 20172017-08

Chapter 8 Mechanical, pneumatic and hydraulic design

8.3 Pneumatic design
It is clear that single-channel systems will fail in theevent of a dangerous failure of one component in
the safety chain. As a result, they can only be used
when the risk is low. For greater risks, dual-channel
systems should always be selected.
On a dual-channel system, both operating valves
1V1 and 1V2 must be switched to enable the piston
rod to extend. If one valve fails to switch, the piston
rod will not extend. If both valves have switchedand one valve switches off, because the cable tothe coil is broken for example, the piston rod will
retract, even if the other valve is still switched.
If one of the two valves becomes stuck in theswitched position but the other valve can still beswitched, the piston rod will either extend or retract,
depending on how the functioning valve is switched.
This is called single fault tolerance, as a dangerous
failure does not lead to the loss of the safetyfunction.

8 Mechanical, pneumatic and hydraulic design• Another error source lies exclusively within
the valve: The valve piston remains stuck in anintermediate position. To be able to describe
this fault more specifically, you need to be familiar
with the internal design of the valve. The questionis, when the valve piston is in the intermediate
position, are all the valve’s connections blocked
off or interlinked? If all the connections areblocked off, compressed air can no longer
flow through the valve. If the cylinder piston isextended, compressed air would no longer
flow in, but neither would any air flow out of thecylinder. This would represent a dangerous
failure of the valve. If all the valve’s connections
are interlinked, the cylinder would possibly not
be completely de-pressurised, but its force
would be substantially reduced. Ultimately, thecylinder’s mounting position and the mass to be
moved would need to be considered in order toestimate the danger.

1A1

1V3

1V4

1V1

1M1

4

5

2

1

3

1V2

1M2

4

5

2

1

3

Dual-channel reversing (source: Festo)

2017-08© Pilz GmbH & Co. KG, 2017

8-31

Chapter 8 Mechanical, pneumatic and hydraulic design

8.3 Pneumatic design
to leave the end position. The piston rod may only
leave the end position once the second valve isswitched. If the piston rod were to extend even as
the first valve was switched, this would indicatethat the second valve was already switched. A fault
would therefore be present. The other operating
valve must not be switched until the next cycle; thisis the only way to detect a dangerous failure of thesecond valve. It is important to check all sensors
for a signal change, for only a signal change
confirms that the sensor and wiring are operatingcorrectly. The example below illustrates theinteraction between pneumatics and electricalengineering.

A third possibility is provided by valve diagnostics,
which make use of the sensors that are normallyinstalled on the cylinder to sense the cylinder’sswitching position. This demands some skill fromthe programmer, however. The cylinder’s piston
rod is in the rear end position; the sensor registers
this position. Initially, only one operating valve
is switched, so the piston rod is not yet permitted

A standard PLC controls the normal machine cycle.
As the cylinder is categorised as a dangerous drive,a risk analysis resulted in a dual-channel design forcontrolling the cylinder. If a dual-channel safetyswitch acts upon a dual-channel safety relay, thesafety relay will switch off the coils on both valves
1V1 and 1V2 if the safety switch is operated. The
PLC needs a signal so that it can also switch off

8 Mechanical, pneumatic and hydraulic design

How do you detect a dangerous failure ona valve? Valves with integrated switching position
sensing offer one possibility. These valves have an
integrated sensor in the body of the valve, which
senses the switching position of the valve piston.
A diagnostic coverage of 99 % can be applied
when calculating the performance level for thisvalve. Pressure sensors on either of the two valve
outputs are another possibility. When a signal
changes at the valve coil, the signal at the sensor
must change within a very short time, in which casethe valve, sensor and wiring are all in order. Thisapplies for the pressure sensor as well as thesensor integrated within the valve.

1A1

1V3

1V4

1V1

4

5
Standard
PLC

1V2

2

1

3

1M1

4

5

2

1

3

1M2

Safety
relay
1M1

1M2

Interaction between electrical engineering and pneumatics (source: Festo)

8-32© Pilz GmbH & Co. KG, 20172017-08

Chapter 8 Mechanical, pneumatic and hydraulic design

8.3 Pneumatic design

8.3.5 Stopping and braking
Another protective measure is to stop or brakea movement. The intended use and applicationmust be clarified quite specifically in advance.
The clamping cartridge is a holding brake; its sole
purpose is to clamp the piston rod once it has
already stopped. A service brake can absorb
kinetic energy, so a moving piston rod can be
decelerated using a service brake.

Clamping cartridge
A clamping cartridge is used when a verticallyinstalled cylinder is to be held at an end positionin order to stop any further downward movementof the piston rod in the event of a compressed air
failure. It is important that the clamping cartridge
does not close until the piston rod is at the end
position and has come to a stop. If a cylinder witha service brake is used instead of a clamping
cartridge, the movement can be stopped at any
time. But what happens if the piston rod is in anintermediate position between the two end positions
as the brake is opened? If the cylinder is installedvertically and is de-pressurised, the piston rod will
move downwards with its mass. This generallymeans danger. Admittedly, this danger would nolonger exist with a horizontal installation. If thecylinder still contained compressed air and thepiston rod happened to be in an intermediate
position, a hazardous movement would still occur
as the brake was opened. One side of the cylinder
is ventilated, the other side is vented. “Pre-vented”
systems generate very high acceleration values andspeeds. 3/2 directional valves provide an elegant
solution in this case.
8 Mechanical, pneumatic and hydraulic design

the outputs to the coils. The safety function
impacts upon the PLC, therefore. A performancelevel of “d” to “e” can be achieved, depending on
the diagnostics. The valves will require a diagnostic
coverage of 99 % for PL = “e”.

Cylinder with clamping cartridge (source: Festo)

1A1

0V1
12

2

14

0M1

1V1

4

2

1M1
1

3

5

1

3

E-STOP circuit

Cylinder with clamping cartridge and monostable 5/2 directional valve (source: Festo)

2017-08© Pilz GmbH & Co. KG, 2017

8-33

Chapter 8 Mechanical, pneumatic and hydraulic design

8.3 Pneumatic design
Four switch variants are possible with two 3/2 directional valves: The cylinder is de-pressurised on bothsides when both valves are switched off (as shownin the circuit diagram). If both valves are switched,
the cylinder is ventilated on both sides. Forces need
to be balanced on the valve piston to ensure thatthe piston rod remains stationary as the brake is
opened. This requires different operating pressureson the two 3/2 directional valves. The values thatare required here depend on the mounting position
and the mass at the piston rod. Once the brake isopen, one of the two valves 1V1 or 1V2 switches
off; the piston rod moves slowly in the required
direction. Two throttle check valves 1V3 and
1V4 are responsible for the slow movement. Thesevalves are incorporated as exhaust throttles in orderto restrict the compressed air flowing from thecylinder. Exhaust throttles are only effective if there
is air in the cylinder, which is another reason why itshould be ventilated before the brake is opened.
In this context, we are reminded once again of
the correct design of the pneumatic drives, as
described previously under the basic and welltried principles. Because the design is of particularimportance for the brake. It is commonly believedthat a compressed air signal achieves a higher
speed in a thin hose than it does in a thick hose.
The lower volume is generally given as the reason.
However, the flow behaviour within the hose has
a much greater significance, as the following
graphic shows.

8 Mechanical, pneumatic and hydraulic design

Cylinder with brake (source: Festo)

1A1
2

2

1V3

1V4
1

12

0V1 2

12

0M1
E-STOP circuit

1

1V1 2

3

1V2 2

12

1

1M2

1M1
1

12

12

Auxiliary control air

1

3

e.g. 400 kPa
Operating pressure3

600 kPa
Operating pressure

Cylinder with brake (source: Festo)

8-34© Pilz GmbH & Co. KG, 20172017-08

Chapter 8 Mechanical, pneumatic and hydraulic design

8.3 Pneumatic design
Hose diameter

300
ms
280

2.5 mm260
240

4.0 mm

220
200
180

5.5 mm160

9.0 mm

140
120
100

9 mm
is faster!

80
60
40
20
0

0

1

2

3

4

5

6

7

8

9

10

11 m 12Hose length

The ventilation time rises as the length of the hoseincreases; the increase is more pronounced onthin hoses than on thick ones. The behaviour whenventing is the same, so the brake’s reaction timedepends on the hose. The brake is activated laterwith a long, thin hose than with a short, fat hose.
For this reason, it is always beneficial to locate theshift valve directly on the brake. The brake closes
when the pressure drops below approx. 3.5 bar.
So when the compressed air drops below the set
operating pressure, the brake reacts more quickly.
However, care needs to be taken if the machine
operator can adjust the operating pressure on themachine himself. If the operating pressure isincreased, the venting time will also be extended.
The brake will react later, the stopping performance
will be longer. Brakes and clamping cartridges are
zero fault tolerant, in other words, they can fail. Just
like on a car, a brake is subject to constant wear.
For this reason, it must be tested at appropriate
intervals. For further details on the design and2013-11© Pilz GmbH & Co. KG, 20178 Mechanical, pneumatic and hydraulic design

Ventilation time based on hose length and diameter at 6 bar (600 kPa) (source: Festo)

testing of the brake please refer to the operating
manual or consult the manufacturer. The influenceof hose length and diameter is also important forthe cylinder speed. The shorter and thicker the
hose, the faster the cylinder, the higher the kinetic
energy and the longer the stopping distance.
This is important in connection with light beam
devices etc. and the required distance from thedanger point.
8.3.6 Circuit diagram and operating manual
To conclude, some thoughts on pneumatic circuit
diagrams: Annex 7 of the Machinery Directive calls
for an operating manual. This operating manual
should provide all persons working on the machinewith all the information necessary to perform theirwork safely. For the maintenance engineer, thismeans having circuit diagrams available that arecomplete and correct and apply for the machine.
They must be able to locate the components they

8-35

Chapter 8 Mechanical, pneumatic and hydraulic design

8.3 Pneumatic design
see on the circuit diagram on the machine, otherwise
it is impossible to work safely. Connection designations should be included in the circuit diagram;the hose connections should be made accordingly.
Components should be identified and the connections named. These markings should be identifiable
over the whole of the machine’s service life. It makes
sense for safety-related components to be identified
on the circuit diagrams. As such, the maintenanceengineer will recognise the special significance of
these components. The correct connection designations should be stated alongside the component
designations. If hoses are connected incorrectly
because the connection designations are incorrect,
the piston rod will suddenly extend rather thanretract when the valve is activated electrically.

8 Mechanical, pneumatic and hydraulic design

Under what conditions is a circuit diagram drawn
and viewed? All drives and valves are shown in theirhome position; compressed air is present, even if
the start-up valve on the service unit is shown in
the off position. The home position is the positionof the drives before automatic mode is started andis different from the position of the machine whende-pressurised. The piston rod is extended where
cylinders are installed vertically, while the piston rod
is retracted to the home position on this cylinder.
Before starting automatic mode, the control
engineer must first bring the drives to the home
position. With the exception of mechanical directly
actuated limit switches, all valves are shown in
the non-actuated condition. On monostable valvesand middle-setting valves, this switch setting isdefined by the mechanical spring.
The circuit diagram display starts at the bottom
left with the service unit or pressure source andcontinues towards the top right. However, whendrafting or planning the circuit diagram, you should
start at the top with the drives and only draw theservice unit at the end. Before the design engineer
starts to think about the control valves for thecylinders, he needs to be clear about the mounting
position, the behaviour in the event of a power
failure and subsequent restoration (pneumatics andelectrics), the necessary protective measures, plus
the control and stop category. The frequently fixed

8-36

allocation of 5/2 directional valves to doubleacting cylinders generally leads to a vain attempt
to provide individual cylinders with reasonable,
effective and above all low-priced safety circuits.
Only when all the requirements of the cylinder
have been defined can thoughts turn to the service
unit. The cylinders may require different operatingpressures, in which case several pressure regulators
will need to be used. In the event of an emergency
stop, only one part of the compressed air shouldswitch off, while in another part of the machine,
full pressure should still be available. Valve terminals
require a separate control air supply, for which
the service unit must offer an appropriate solution.
Once these aspects have been considered, aservice unit can often look quite different to the onethat was originally planned. This is a disadvantage
if the service unit has already been ordered at an
early stage: The additional parts that are needed
will have to be selected, ordered and installed
and the necessary modifications will be complex,
costing even more time and money. Information
regarding hose colours and hose cross sections,screw joints and hose numbers help to provide
clarity during assembly and when troubleshooting.
Clarity is always a plus for safety and speed;
DIN ISO 1219, DIN ISO 5599 and DIN EN 81346-1
are standards dealing with the generation of circuit
diagrams and graphic symbols.
In pneumatics, is safety technology moredifficult than electrical technology? Essentially no.
The basic principles and concepts are the sameor similar. Compressed air as a medium is different;
to many people it’s new and unfamiliar. As
with electrical drives, mechanics must also be
considered in pneumatics. An electric motor does
not operate through its shaft alone; extensive
mechanics generally follow to a greater or lesser
extent as is the case with pneumatics. The information in this chapter, with its examples, ideas andsuggestions, is simply an initial introduction to thesubject of “safety and pneumatic design” and iscertainly not sufficient to guarantee safe operationof a plant or machine.

© Pilz GmbH & Co. KG, 20172013-11

Chapter 8 Mechanical, pneumatic and hydraulic design

8.4.1 Basic physical knowledge

8.4.4 Definitions

In hydraulics the talk is of hydrodynamic energy
transfer, e.g. a pump transfers mechanical energy
to the oil and flow energy is used to drive a turbine
wheel, for example.

• Fluid power: The means whereby signals andenergy can be transmitted, controlled anddistributed using a pressurised fluid or gas as
the medium• System: Arrangement of interconnectedcomponents that transmits and controls fluid
power energy• Component: An individual unit (e.g. cylinder)
comprising one or more parts designed to bea functional part of a fluid power system• Hydraulics: Science and technology which
deals with the use of a liquid as the pressure
medium• Maximum working pressure: The highest
pressure at which a system is intended tooperate in steady-state conditions• Rated pressure: The highest pressure atwhich the component is intended to operate fora number of repetitions sufficient to assure
adequate service life
• Control device: A device that provides aninput signal to an operating device (switch)• Operating device: A device that provides an
output signal to a component (solenoid)• Piping: Any combination of fittings, couplings
or connectors with pipes, hoses or tubes, whichallows fluid flow between components

8.4.2 Advantages of hydrostatic
energy transfer
The following advantages play a rolein hydrostatic energy transfer:• Transfer of high forces and powers inthe smallest possible space• Sensitive, infinitely variable control of speeds• Smooth speed control under load, withina large setting range• Large transmission range on drives• Quiet operation, fast, smooth reversal of motion• Simple, safe overload protection• High switch-off accuracy when stopping
the operating component• Long service life and low plant maintenanceas the sliding components are automaticallylubricated by the hydraulic fluid
8.4.3 Disadvantages of hydrostatic
energy transfer

8 Mechanical, pneumatic and hydraulic design

8.4 Hydraulic design

The following disadvantages should be mentioned:• Operation accuracy changes in the event ofoil viscosity fluctuations due to temperature
variation• Sealing problems, particularly when there arehigh system pressures and temperatures• Air dissolves in hydraulic fluid. Air bubbles
are created when the pressure drops,
adversely affecting control accuracy• Hydraulic fluids are channelled in a loopwith cooler and filter

2017-08© Pilz GmbH & Co. KG, 2017

8-37

Chapter 8 Mechanical, pneumatic and hydraulic design

8.4 Hydraulic design
8.4.5 General hydraulic relationships
8.4.5.1 Pressure, absolute pressure andoverpressure
Pressure p is the force applied to area A, also calledpressure for short. The amount of pressure at any
point is irrespective of the position. The unit ofmeasurement for pressure is defined with pascal
using the base units of the International System ofUnits: kilogram, metre and second.

Absolute pressure: The absolute pressure scale
starts at pabs = 0, as absolute pressure is the zeropressure of a vacuum.
Overpressure: The difference between absolutepressure and the existing atmospheric pressure pambis called overpressure.

Piston pressure force
Graphic

P

F

Equation/equation conversion

Formula symbol/units

F = 10 × p × A

F = Piston pressure force [N]p = Hydraulic pressure [bar]A = Piston area [cm²]d = Piston diameter [cm]
η = Cylinder efficiency factor

F = p × A × η × 10
2

A=d×π
4

A

A = 4 × F × 0,1
π×p

8 Mechanical, pneumatic and hydraulic design

p = 0.1 × 4 × F 2
π×dPiston forces
GraphicdA

Equation/equation conversion

Formula symbol/units

F = Pe × A × 10

F = Piston pressure force [N]Pe = Excess pressure on
the piston [bar]A = Effective piston area [cm²]d = Piston diameter [cm]
η = Cylinder efficiency factor

F = Pe × A × η × 10

Pe

F

2

A=d×π
4
A for circular ring area:D

2

A = (D - d ) × π
4
A

F
Pe

8-38

© Pilz GmbH & Co. KG, 20172017-08

Chapter 8 Mechanical, pneumatic and hydraulic design

8.4 Hydraulic design
Piston speed
Graphic

Equation/equation conversion

A1

v1

v1 =

Q1
A1

v2 =

Q2
A2

v1,2 = Piston speed[cm/s]
Q1,2 = Volume flow rate [cm³/s]
A 1 = Effective piston area(circle) [cm²]A 2 = Effective piston area(ring) [cm²]2A1 = d × π
4

Q1

2

A2 =
A2

Formula symbol/units

2(D - d ) × π
4

v2

Q2

8.4.5.2 Pascal’s law
Pascal’s law is the basic law of hydrostatics andapplies to incompressible fluids at rest:

8.4.5.3 Gravitational pressure

8 Mechanical, pneumatic and hydraulic design

Pressure exerted anywhere in a confined fluid
is transmitted equally to the internal wall of thecontainer and to the fluid.
hThe pressure ph generated in the fluid by gravity
alone is determined by
ph = ρ × g × h• ρ: Density of the fluid• g: Gravitational constant (= 9.81 m/s2)• h: Height of the liquid column
When designing hydraulic systems it is necessary tocheck whether the gravitational pressure is of any
notable size compared with the pressures occurring
within the system. Generally the gravitationalpressure is not of any note because it is often lessthan the required system pressure.

2017-08© Pilz GmbH & Co. KG, 2017p

Gravitational pressure

8-39Chapter 8 Mechanical, pneumatic and hydraulic design

8.4 Hydraulic design
8.4.5.4 Force and path transmission
The principle of force and path transmission canbe best explained using the example of an hydraulicpress: In accordance with Pascal’s law, thepressure p generated by the force F1 is transmitted
equally to all parts of the fluid and to the area A1.
This gives:

In this way, it is possible to illustrate the principle offorce transmission: For example, if the area A2 is ten
times greater than the area A1 (A2=10*A1), the force
F1 will also be transmitted at ten times its value tothe force F2. At the same time, the path travelled S1
is transmitted as a 10th of S2.

Force and path transmission
Graphic
F2

F1

Equation/equation conversion

Formula symbol/units

F1 = F2
A1 A2

F1 = Force on the pump piston [N]F2 = Force on the working piston [N]A 1 = Area of pump piston [cm²]A 2 = Area of working piston [cm²]s1 = Travel of pump piston [cm]s2 = Travel of working piston [cm]φ = Transmission ratio

F1 × s1= F2 × s 2
S1
S2
A2

φ = F1 = A1 = s 2
F2
A2
s2

A1

8 Mechanical, pneumatic and hydraulic design

8.4.5.5 Pressure transmission
The principle of pressure transmission:
Pressure intensifier
Graphic
p2
A2

Equation/equation conversion

Formula symbol/units

p1 × A 1 = p2× A2

p 1 = Pressure in the small cylinder [bar]A1 = Piston area [cm²]p 2 = Pressure on the large cylinder [bar]A2 = Piston area [cm²]p1 A1

If, for example, the area A1 is twice the size of area
A2 ( A1=2*A2), the pressure p1 will be transmitted atdouble its value as p2.

8-40

8.4.5.6 Hydraulic work

8.4.5.7 Volumetric efficiency factor

On the hydraulic press, if piston 1 is moved
downwards along the path S1 with the area A1 andforce F1, the hydraulic work executed in the process
is W1. The hydraulic work executed at piston 2 witharea A2 during this process is W2.

This takes into account the volumetric losses
resulting from leakage flows. The hydraulicmechanical efficiency factor gauges the losses
resulting from flow losses and sliding machineparts.

© Pilz GmbH & Co. KG, 20172017-08

Chapter 8 Mechanical, pneumatic and hydraulic design

8.4 Hydraulic design
8.4.5.8 Continuity equation
Prerequisite: A fluid flows through a tube withvarious cross sectional areas. As no fluid is lost
between the various cross sectional areas, thefollowing applies for the mass flows that stream
through these areas:

Graphic

Q1

A1

A2

Q2

Equation/equation conversion

Formula symbol/units

Q1 = Q2

Q1,2 = Volume flow rates[cm³/s, dm³/s, m³/s ]A 1,2 = Cross-sectional areas[cm², dm², m²]
v 1,2 = Flow speeds[cm/s, dm/s, m/s]

Q 1 = A1 × v1
Q 2 = A2 × v2

v1

v2

A1× v1 = A 2 × v2

8.4.5.9 Bernoulli’s equation

8.4.5.10 Flow forms

Bernoulli’s equation is a special case derived
from the familiar Navier-Stokes equation from fluid
mechanics, which applies to three-dimensional
viscous flows. The equation for the energy form is:

Laminar or turbulent flow forms occur in the tubes
of hydraulic systems. With a laminar flow, the fluid
particles move in orderly, separate layers, which is
why we talk of a flow direction. The flow lines run inparallel to the tube axis. With a turbulent flow, thefluid no longer moves in orderly layers.

2
V + g x z + p = const.
2ρ

8 Mechanical, pneumatic and hydraulic design

Continuity equation

The main axial flow is now superimposed on all
points through random longitudinal and transverse
movements, that result in a disturbed flow. The flowis thereby mixed. The transition from a laminar toa turbulent flow occurs at velocity of flow vcrit instraight tubes with a circular cross section d andviscosity of the fluid v when the critical Reynolds
number Recrit = 2,300.

2017-08© Pilz GmbH & Co. KG, 2017

8-41

Chapter 8 Mechanical, pneumatic and hydraulic design

8.4 Hydraulic design
8.4.5.11 Viscosity
A surface-mounted plate with an area A is moved
at constant speed v on a fluid layer with a definedheight h. The force F is required to maintain the
movement. If the layer thickness h is not too great,a linear velocity gradient dv/dz develops between
the plate and the bottom of the fluid.

τ stands for the friction shear stress and η for the
dynamic viscosity of the fluid, which as a property
represents a measurement for the internal friction,
which makes it more difficult for the fluid particles tomove. The energy expended in moving the particles
is converted into heat. The definition of the viscosity
used in hydraulics:

The law discovered by Newton

is known as Newton’s law of friction.

Moving plate AYF

8 Mechanical, pneumatic and hydraulic design

dy
dv
Fluid

v(y)

X
Stationary plate

Newton’s law of friction

8-42© Pilz GmbH & Co. KG, 20172017-08

Chapter 8 Mechanical, pneumatic and hydraulic design

8.4 Hydraulic design
When fluid flow is friction-free, the total energy
comprising pressure energy, kinetic and potential
energy is constant. With real fluid flows (subjected
to friction), due to the influence of the viscosity,
part of the flow energy is converted into thermalenergy, which cannot be utilised technically and istherefore also referred to as flow loss. Only pressure
energy can be affected by losses due to frictional
influences. Considerable pressure losses can occur
in fittings (tube bends, tube branches, extensions,narrowings) due to frictional influences. The
calculated resistance coefficient is used for thenumeric simulation.
8.4.5.13 Cavitation
Cavitation describes the formation of bubbles(air and steam bubbles) on bottlenecks in hydrauliccomponents due to pressure drops and the sudden
breakdown of these bubbles once the bottleneck ispassed. A distinction is made between two types ofcavitation: Air bubble cavitation and steam bubble
cavitation. Both types of cavitation have similarly
negative effects on the components in hydraulicsystems.

8.4.5.15 Steam bubble cavitation
This occurs when steam bubbles are formed in theoil because the static pressure drops to or below
the steam pressure of the oil. Here too, the pressure
drops due to the increased flow rates present atbottlenecks in hydraulic components.
8.4.5.16 Hydro pumps
At the heart of any hydraulic system is the hydropump. The mechanical energy fed via its drive shaft,generally through an electric motor, is needed toincrease the energy or pressure of the oil flowing
through the pump and to cover all the losses that
occur within the pump. The energy of the flow rateleaving the pump’s pressure port, also known ashydrostatic energy, is then available to operate
hydraulic applications. Hydro systems generally
require high pressures at low flow rates; only inrare cases are these greater than 300 l/min. For
this reason, centrifugal pumps are not suitable forthis type of application. Hydro pumps operate inaccordance with the displacement principle, likeradial piston pumps for example. This system isbased on the reducing and expanding space. The
displacement volume, also known as stroke volume,is understood to be the volume of oil delivered
when a pump rotates.

8 Mechanical, pneumatic and hydraulic design

8.4.5.12 Pressure losses in tubes,
fittings and valves

8.4.5.14 Air bubble cavitation
One property of fluids is the ability to dissolve
gases. In this context, we talk of the gas dissolving
capacity of fluids. Hydraulic oils in particular contain
air in a dissolved state. As well as being present in
a dissolved state, air can also occur as air bubbles
within the oil. This happens when the oil’s staticpressure on-site drops to the dissolved gas
pressure and therefore the oil’s capacity to absorb
air is exhausted.

2017-08© Pilz GmbH & Co. KG, 2017

On hydro pumps, the distinction is made between
constant and variable pumps. On constant pumps,
the displacement volume Vi cannot be varied. On
variable pumps, the displacement volume Vi isa changeable variable and is dependent on thevolume setting. The theoretical flow rate of thepump is calculated by multiplying the displacement
volume by the pump speed.

8-43Chapter 8 Mechanical, pneumatic and hydraulic design

8.4 Hydraulic design
8.4.6 Structure of a hydraulic system
The hydraulic circuit diagram shows the structure ofa hydraulic circuit. The individual hydraulic devices
are represented by standardised symbols and areinterconnected through pipelines. The diagrams that
follow illustrate simple hydraulic circuits. In this case,the devices are not represented by standardised
symbols but are shown schematically to identify theirmode of operation. The pump sucks the hydraulic oilfrom the container and pushes it into the pipeline
system containing the built-in devices. The oil flows
from P to B through a directional valve in the hydrocylinder. The piston (with tool) creates resistancefor the oil. The pressure rises in the power section
between the pump and piston until the piston force
is sufficient to overcome the load and the piston
moves.
8.4.7 Simple hydraulic circuit, upward movement

8 Mechanical, pneumatic and hydraulic design

The directional valve is held in position by any
amount of actuation force. The piston travels to the
top end position. The displaced oil flows throughthe directional valve from A to T, back to the tank.
The directional valve therefore controls the directionof the oil flow. To ensure that the system is protected from excessive loads (pressures), a pressure
limiting valve is installed in the pressure line, after thepump. If the set pressure is exceeded, the valve will
open and the remaining oil will flow into the tank.
The pressure will not increase any further.

Load
Cylinder,doubleaction

Actuation
force

Directional valve

T
B
Pressure
limiting valve

P

A

Tank

Pump

P Pressure line
A,B Consumer connection lines
T
Tank return line

Structure of a hydraulic system

8-44© Pilz GmbH & Co. KG, 20172017-08

Chapter 8 Mechanical, pneumatic and hydraulic design

8.4 Hydraulic design
8.4.8 Simple hydraulic circuit,downward movement

8.4.9 Simple hydraulic circuit, speed

When the actuation force is removed, the directional
valve is reset via spring force. Now the oil flows fromP to A to the rod side of the piston. The piston moves
towards the bottom end position, the displaced oilflows through the directional valve from B to T, backto the tank. Switching the directional valve enables
the piston to continuously move back and forth.

If it’s necessary to control not only the directionof the piston but also the speed, the amount of oil
flowing in and out of the cylinder will need to bevaried. This can be done using a choke valve: If thevalve cross section is reduced, less oil will flow into
the cylinder over a defined unit of time. The oil flow
is less than before it was choked, so the piston
speed will also be slower, in accordance with thecontinuity equation. In other words, the piston
speed is proportional to the oil flow. So the speed
is controlled by controlling the oil flow.

Load

8 Mechanical, pneumatic and hydraulic design

Load

Choke
valve
Withoutvalve
actuation

T

T
B

P

A

Downward movement on a simple hydraulic circuit

2017-08

Actuationforce© Pilz GmbH & Co. KG, 2017

B
Pressure
limiting valve

PA

Speed control on an individual hydraulic circuit

8-45

Chapter 8 Mechanical, pneumatic and hydraulic design

8.4 Hydraulic design
8.4.10 Circuit diagram for a simple hydraulic circuit
The hydraulic process described above is illustrated
below as a hydraulic circuit diagram. The directional
valve is manually operated. When unoperated it isheld in the spring-centred middle position by springforce.

Cylinder
Choke valve

Pressure
limiting valve

Manually
operated
directional valve
in bypass position

8 Mechanical, pneumatic and hydraulic design

Check
valve
Pump

M

Tank

Drive motor

Circuit diagram for a simple hydraulic circuit

8-46© Pilz GmbH & Co. KG, 20172017-08

Chapter 8 Mechanical, pneumatic and hydraulic design

8.4 Hydraulic design
8.4.11 Two-cylinder controllers
with electric valves

1. Start: Solenoid Y1 is energised, directional
valve 1 to the left, piston on cylinder 1 to the right
2. Limit switch 2 actuated: Solenoid Y1
de-energised, solenoid Y3 energised,directional valve 2 to the left, piston on
cylinder 2 to the right
3. Limit switch 4 actuated: Solenoid Y3
de-energised, solenoid Y2 energised,directional valve 1 to the right, piston on
cylinder 1 to the left
4. Limit switch 1 actuated: Solenoid Y2
de-energised, solenoid Y4 energised,directional valve 2 to the right, piston on
cylinder 2 to the left
5. Limit switch 3 actuated: Solenoid Y4
de-energised, solenoid Y1 energised,directional valve 1 to the left, piston on
cylinder 1 to the right (continue with step 2)• Sequential circuits• Synchronous circuits• Series circuits• Parallel circuits
The diagram below shows a sequential circuit(sequential circuit with limit switches and solenoid
valves): In the version with limit switches, the limit
switches actuate the piston rods, based on the path(the electrics are not shown):

Limit switch 1

Limit switch 2

Limit switch 3

Cylinder 1

Y1
Directional valve 1

Limit switch 4

8 Mechanical, pneumatic and hydraulic design

If two or more cylinders are to be used on a hydraulicsystem, various requirements can be associated with
their use, and these can be implemented using
various circuit types:

Cylinder 2

Y2

Y3

Y4
Directional valve 2

M

Circuit diagram for two-cylinder controllers with electric valves

2017-08© Pilz GmbH & Co. KG, 2017

8-47

Chapter 8 Mechanical, pneumatic and hydraulic design

8.4 Hydraulic design
8.4.12 Two-cylinder controllers
with sequence valves
The sequence valves 1 and 2 are pressure valves
which open at a certain pressure, which can beselected. They close again when the pressure drops.
This results in the following motion sequence:
1. Left directional valve is activated: The piston sideof cylinder 1 is pressurised, the cylinder extends.
When the piston stops, the pressure rises above
the pressure set on the pressure limiting valve.
2. Sequence valve 1 opens: The fluid flows to
the piston side of cylinder 2, this cylinder also
extends.
3. Right directional valve is activated, the rod sideof cylinder 2 is pressurised, the cylinder retracts.
When the piston stops, the pressure rises above
the pressure set on the pressure limiting valve.
4. Sequence valve 2 opens: The fluid flows to therod side of cylinder 1. This piston also retracts.

Cylinder 1

Cylinder 22
Sequencevalve
1

Check valve

Directional valve

M

8 Mechanical, pneumatic and hydraulic design

Pressure
limiting valve

Circuit diagram for two-cylinder controllers withsequence valves

8-48© Pilz GmbH & Co. KG, 20172017-08

Chapter 8 Mechanical, pneumatic and hydraulic design

8.4.13 Series circuit

8.4.14 Parallel circuit

A series circuit is implemented as with valvesconnected in series. The return line is not guided
back into the tank, as with a single circuit, but tothe directional valve on the second cylinder. If bothcylinders are operated simultaneously in this typeof circuit, the piston force and piston speed will
influence each other. The result is the following
relationships: System pressure p, which acts upon
the piston area of cylinder 1, must be large enoughnot only to generate its own lifting force F1 but also
to overcome the counteracting force FG1 generated
by cylinder 2. This counteracting force comes fromthe fact the oil pressure needed to operate cylinder
2 in turn acts upon the piston ring area of cylinder 1.
The ring area of cylinder 1 displaces the oil andconveys it to cylinder 2. Its speed depends therefore on the return flow rate from cylinder 1. The
relationship between the extending speed ofcylinder 1 and the extending speed of cylinder 2 isthe same as the relationship between the pistonarea of cylinder 2 and the ring area of cylinder 1.

In contrast to a series circuit, with a parallel circuit
there is no mutual influencing when all the cylinders
operate simultaneously. Oil is supplied via a branchpipe line. The system pressure set at the pressure
limiting valve prevails as far as the directional
valves. With a parallel circuit, sufficient fluid must be
available to maintain the necessary system pressure
if the cylinders are to be extended simultaneously.
If the pump conveys too little fluid, the cylinder withthe lowest operating resistance will extend first.
If it is in the end position, the pressure continues
to rise until it is sufficient for the next cylinder.
So the extension of the cylinders depends on
the necessary operating pressure.

p

FG1

A1

A R1

V1

F1

Directional
valves

A2

A R2

V2

8 Mechanical, pneumatic and hydraulic design

8.4 Hydraulic design

F2

Return line

M
Pressure
limiting
valve

Circuit diagram for a series circuit

2017-08© Pilz GmbH & Co. KG, 2017

8-49

Chapter 8 Mechanical, pneumatic and hydraulic design

8.4 Hydraulic design
Doubleacting
cylinderSingleacting
cylinderDirectional valves(4/3 valves)

Directional
valves (3/2 valve)

T

T

T

Manometer

M

Variable pump

8 Mechanical, pneumatic and hydraulic design

Circuit diagram for a parallel circuit

8.4.15 Differential circuit
The rod chamber is constantly under pressure,the piston chamber is connected to a directional
valve. This circuit is called a differential circuit
because the force acting upon the piston rod isexpressed as a ratio of piston area to rod area. The
differential circuit is used when the piston must be
hydraulically clamped and the pump must be as
small as possible or a rapid movement of the piston
is required. If the piston extends via the directional
valve, the fluid dispersed from the ring area will
be combined with the pump flow ahead of thedirectional valve and will be fed back to the pistonside of the cylinder. With this circuit, the force
exerted by the piston rod is calculated from theproduct of pressure times rod area.

Pistonchamber
Directional valve(3/2 valve)RodchamberCurrent
regulating
valve

M

Circuit diagram for a differential circuit

8-50© Pilz GmbH & Co. KG, 20172017-08

Chapter 8 Mechanical, pneumatic and hydraulic design

8.4 Hydraulic design
Flow valves are used for speed control. Flowvalves are choke valves or flow control valves.
There are two options: primary or secondary
control.
Primary control: With primary control, theflow valve sits in the inlet between the directional
valve and the cylinder. It controls the inflowing
hydraulic fluid. The graphic symbol shows a twoway flow control valve. A check valve is connectedin parallel, which blocks the inflow but lets thereturn flow through. As a result, the fluid flows
through the flow valve only on the infeed and not on
the return. The piston is thus only controlled in one
direction. Two flow control valves must be installed
if the other direction is also to be controlled. The
disadvantage of primary control is that the piston
jumps if the operating resistance suddenly drops.
A back pressure valve can prevent this.

P

Circuit diagram for primary control

2017-08© Pilz GmbH & Co. KG, 2017

Secondary control: With secondary control, the flow
valve sits in the outlet between the directional valve
and the cylinder. As such, it controls the return flow.
The switch symbol shows a two-way flow control
valve. A check valve is connected in parallel, whichblocks the return flow but lets the inflow through.
As a result, the fluid flows through the flow valve only
on the return and not on the infeed. The piston is thus
only controlled in one direction. Two flow control
valves must be installed if the other direction is also
to be controlled. Secondary control does not havethe disadvantage that the piston can jump.

8 Mechanical, pneumatic and hydraulic design

8.4.16 Speed controllers

P
Without back pressure valve

Circuit diagram for secondary control

8-51

Chapter 8 Mechanical, pneumatic and hydraulic design

8.4 Hydraulic design

Suction chamber

Discharge chamber

Fixed axial gap

Externally toothed gear pumps

8.4.17 Drive pumps, fixed pumps

8 Mechanical, pneumatic and hydraulic design

Externally toothed gear pump: The fluid conveyedfrom the suction side to the discharge side isdisplaced alternately from the gaps through theinterlocking cogs. Advantages: Low-cost standard
pump with high efficiency factor, which can beconnected to other pumps working to the same
principle. Disadvantages: High noise level.
Application: In open circuits in industrial
applications.
Internally toothed gear pumps: A driven pinion
shaft (1) carries a gear ring (2). The tooth chambers
are filled on the suction side, the filler separates the
suction and discharge zone on the discharge side.
On the discharge side, the oil is displaced throughthe gear ring. Advantages: Low-noise standard pumpwith high efficiency factor, which can be connected
to other pumps working to the same principle, lower
noise level. Disadvantages: More expensive than the
traditional gear pump. Application: In open circuits
in industrial applications, where quiet running is an
important requirement.

8-52

2
6
3
1
4
5
7
1 Pinion shaft
2 Gear ring
3 Filler pin
4 Filler
5 Hydrostatic bearing
6 Suction port
7 Discharge port

Internally toothed gear pumps© Pilz GmbH & Co. KG, 20172017-08

Chapter 8 Mechanical, pneumatic and hydraulic design

8.4 Hydraulic design

Auxiliary spindle

Drive spindle

Suction nozzle

Discharge nozzle

Screw pump

8.4.18 Drive pumps, screw pumps

2017-08© Pilz GmbH & Co. KG, 20178 Mechanical, pneumatic and hydraulic design

Two jointly driven meshing spindles form oilchambers within the housing, which are moved fromthe suction to the pressure nozzle as the spindles
rotate. Advantages: Pulse-free flow rate, low noiselevel. Disadvantages: Relatively low efficiency factor
due to high volumetric losses, so high oil viscosity
is required. Application: In open circuits in industry;for example, on precision machines and in the lift
industry. High volume flows.

8-53

Chapter 8 Mechanical, pneumatic and hydraulic design

8.4 Hydraulic design
Transport

Suction
s

Vane
Rotor
Housings
Suction
2e+s

Transport
2e+s

Drive pump with vane cells

8.4.19 Drive pumps, vane pumps

8 Mechanical, pneumatic and hydraulic design

Moving vanes in the slots on the rotor that arepressed against the housing wall by centrifugal
force and pressure. The cell size increases in
conjunction with the suction port and reduces in
conjunction with the discharge port. Advantages:
Pulse-free flow rate, low noise level, can be flanged
to multi-flow pumps. Disadvantages: Low efficiency
factor as gear pumps, more sensitive to dirt.
Application: In open circuits in industry; forexample, on precision machines with low pressure.

8-54© Pilz GmbH & Co. KG, 20172017-08

Chapter 8 Mechanical, pneumatic and hydraulic design

8.5 Safety requirementson hydraulic circuits
8.5.1 Safety requirements in general

8.5.3 Additional safety requirements

When designing hydraulic systems for machinery,
all the intended operating states and applications
must be taken into account. To determine thehazards, a risk assessment must be carried out
in accordance with EN ISO 12100. As far as ispracticable, all identified risks should be designed
out of the system where possible. Where this is
impossible, appropriate protective measures should
be provided.

Leakages:

All safety-related system components should beselected in such a way that they guarantee safety
during operation and reliably operate within thelimits defined.
• All parts of the system must be designed
to withstand maximum operating pressure or be
secured against pressures above the permissible
limit values through other protective measures.
• Preferred safeguards against excess pressure
are one or more pressure limiting valves, which
restrict pressure in all parts of the system.
• Systems should be designed, built andconfigured to minimise pressure surges andpressure increases. A pressure surge andincreased pressure must not give rise to any
hazard.

Energy supply:• The electrical or hydraulic energy supply
must not cause a hazard. This is particularly
true for• Switching the energy supply on or off,
• Energy reduction,• Failure and/or restoration of energy.
Unexpected start-up:• The system is to be designed in such a way that,when the pressurised medium is completely
isolated, an unexpected restart is prevented.
• Option for mechanical interlock on stop valvesin the stop position, plus removal of pressure in
the control system• Isolation from the electrical supply (EN 60204-1)

8 Mechanical, pneumatic and hydraulic design

8.5.2 Concept and design• Leakages that occur in the system must not giverise to any hazard.

Mechanical movements:• These must not lead to a situation in which
persons are endangered, whether intentionallyor unintentionally.
Low-noise design:• Compliance with EN ISO 11688-1 is essential.
Operating temperatures:• The temperature of the pressure medium must
not exceed the maximum operating temperaturestated as the limit value for all the system’s
components.
Operating pressure range:• The operating pressure permissible forthe respective plant sections must becomplied with.

2017-08© Pilz GmbH & Co. KG, 2017

8-55

Chapter 8 Mechanical, pneumatic and hydraulic design

8.5 Safety requirementson hydraulic circuits
Couplings or fastenings:• Drive couplings and fastenings must be capableof withstanding the maximum torque under all
operating conditions on a sustained basis.
Speed:As a hydraulic system is generally not a complete
machine, many test procedures cannot be carriedout until the hydraulic system is incorporated intoa machine. See below, EN ISO 4413 Chap. 6:• The speed must not exceed the maximum value
stated in the manufacturer’s documentation.

Chap. 6: Establishing compliance with the safety
requirements and acceptance test

Lift stops:

The hydraulic system must undergo a combinationof inspection and testing to confirm that:• Appropriate means should be used to secure
adjustable lift stops.
Valves with defined switching position:• Any drive that must maintain its position or
adopt a specific failsafe position in the event of
a control failure must be controlled by a valve
which guarantees a defined switching position,either via a spring pre-load or an interlocking
device.

8 Mechanical, pneumatic and hydraulic design

8.5.4 Establishing compliancewith the safety requirements

Hydraulic systems with hydraulic accumulator:• Hydraulic systems with hydraulic accumulators
are used to automatically regulate the storage
fluid pressure. During maintenance work on thesystem, it is necessary to relieve the pressurein the system to safely shut off the hydraulicaccumulator. Hydraulic accumulators and theassociated pressurised components must
operate within the specified limits, temperaturesand environmental conditions.

• a) the system and its components comply
with the system description;• b) the connections of the components
in the system comply with the circuit diagram;• c) the system including all safety components
functions properly; and• d) no measurable unintentional leakage occurs
for any components excluding an amountof fluid that is not sufficient to form a drop ona cylinder rod after several cycles.
NOTE: As a hydraulic system is generally not
a complete machine, many test procedures
cannot be carried out until the hydraulic system
is incorporated into a machine. A function test
must then be performed following installation inaccordance with the agreement between theclient and the contractor.
The results of the confirmation through inspection
and testing must be documented and the reportmust contain the following information:• Type and viscosity of the hydraulic fluid used;• Temperature of the hydraulic fluid in the container
after the temperature has stabilised.
Important: Permissible leakage is defined as slightwetting insufficient to form a drop.

8-56© Pilz GmbH & Co. KG, 20172017-08

Chapter 8 Mechanical, pneumatic and hydraulic design

8.5 Safety requirementson hydraulic circuits
Drive elements

Scopeof categories(valve area)

VDB

RF

8 Mechanical, pneumatic and hydraulic design

Energyconversion
Energytransmission
M

Fluid power system

8.5.5 Safety-related partsof hydraulic controllers
On fluid power systems, any valves that control
hazardous movements or conditions should be
regarded as safety-related parts of the controller.
On hydraulic systems, measures taken to limit
pressure within the system (VDB), to filtrate thehydraulic fluid (RF), to monitor the temperature
range (T) and to check the fill level of the tank (N)should also be taken into account, although thesecomponents are not directly control components.

2017-08© Pilz GmbH & Co. KG, 2017

8-57

Chapter 8 Mechanical, pneumatic and hydraulic design

8.5 Safety requirementson hydraulic circuits
8.5.6 Controllers in accordance with Category B,
Performance Level a as per EN/ISO 13849-1
Category B is the basic category; its requirements
apply to all other categories. These requirements
also incorporate the basic safety principles.
The basic safety principles which are particularly
relevant and specific for fluid power systems are:

8 Mechanical, pneumatic and hydraulic design• Failure of a component can lead to the lossof the safety function.
• De-energisation principle(positive signal for starting)• Management of energy changes, failure
and restoration of energy• Pressure limitation within the system• Selection of an appropriate hydraulic fluid• Sufficient filtration of the pressure medium• Avoidance of contamination• Isolation of energy supply• Compliance with the basic requirements
at components (shock, temperature, pressure,viscosity etc.)• Safety-related switch position of valves
when the control signal is removed(effective springs)• Type and condition of the pressure medium

8-58© Pilz GmbH & Co. KG, 20172017-08

Chapter 8 Mechanical, pneumatic and hydraulic design

8.5 Safety requirementson hydraulic circuits
Hazardous movement

Provensafety-related valve
WV
Other consumers

DF

VDB

8 Mechanical, pneumatic and hydraulic design

RF

M

N

T

LF

Example of hydraulic circuit (Cat 1, PL b)

8.5.7 Controllers in accordance with Category 1,
Performance Level b
In addition to the requirements from Category B,
Category 1 controllers must be designed andconstructed using well-tried safety principles andwell-tried components. General well-tried principles
for hydraulics are:2017-08© Pilz GmbH & Co. KG, 2017

• Torque/force limitation (reduced pressure)• Reduced speed (reduced flow rate)• Over-dimensioning• Travel limiting jog mode
• Sufficient positive overlapping in piston valves• Positive force (positive mechanical action)• Targeted selection of materials
and material pairings• Expose safety-related springs to at least 10 %below the endurance limit based on 107 duty
cycles (see EN 13906-1)

8-59

Chapter 8 Mechanical, pneumatic and hydraulic design

8.5 Safety requirementson hydraulic circuits
Hazardous movement

WV

VDB

RF

M

8 Mechanical, pneumatic and hydraulic design

N

T

LF

Example of hydraulic circuit (Cat 2, PL b)

8.5.8 Controllers in accordance with Category 2,
Performance Level b
In addition to the requirements from Category B andthe use of well-tried safety principles, Category 2
controllers must be designed so that the test
equipment (TE) is able to check the safety functions
at suitable intervals and to react to these.
In the above example, only one directional valve
controls the hazardous movement. The electricalmachine controller tests the valve’s safety function
as part of each cycle and on each machine start-up.
The failure of the directional valve must not be able
to influence the test function. Conversely, if thetest function should fail, this must not affect the

8-60

reliability of the directional valve. During the test,
position switches detect when the valve sliding
piston returns to its safety-related middle setting.
If the machine controller detects a failure in a
directional valve, it immediately triggers a hydraulicpump shutdown.
The total time for detection of the failure andswitch to a non-hazardous condition (generally
standstill) must be shorter here than the time
until the danger point is reached (see also
EN ISO 13849-1 and EN ISO 13855).

© Pilz GmbH & Co. KG, 20172017-08

Chapter 8 Mechanical, pneumatic and hydraulic design

8.5 Safety requirementson hydraulic circuits
Hazardous movement

WV1

WV2

VDB

RF

N

T

8 Mechanical, pneumatic and hydraulic design

M

LF

Example of hydraulic circuit (Cat 3, PL d)

8.5.9 Controllers in accordance with Category 3,
Performance Level d
In addition to the requirements from Category B andthe use of well-tried safety principles, Category 3
controllers must be designed so that a single fault
does not lead to the loss of the safety function.
Whenever reasonably practicable, a single fault shallbe detected at or before the next demand upon thesafety function.

2017-08© Pilz GmbH & Co. KG, 2017

Safety-related control of the hazardous movement occurs via the directional valve WV1, whichswitches as part of each cycle, and via the pressure
valve WV2. The additional shutdown of the pumpdrive motor is not absolutely necessary. The movement of the valve sliding piston WV1 from thesafety-related middle setting is not queried inthis case; the pressure valve WV2 is switched on
redundantly. This provides single fault tolerance. If
pressure valve WV2 sticks, this is detected by theelectrical position monitoring in the control system.
If directional valve WV1 fails, detection during
operation is possible if the cylinder is stopped
outside the end positions at regular intervals.

8-61Chapter 8 Mechanical, pneumatic and hydraulic design

8.5 Safety requirementson hydraulic circuits
Hazardous movement

WV1

WV2

VDB

8 Mechanical, pneumatic and hydraulic design

RF

M

N

T

LF

Example of hydraulic circuit (Cat 4, PL e)

8.5.10 Controllers in accordance with Category 4,
Performance Level e
In addition to the requirements from Category B andthe use of well-tried safety principles, Category 4
controllers must be designed so that a single fault
does not lead to the loss of the safety function. The
objective of safety concepts is for a single fault tobe detected immediately or at the latest before thenext demand upon the safety function.

8-62

Two valves control the hazardous movement.
Each valve is able to shut down the hazardous
movement on its own, so single fault tolerance
is provided. Both valves are also equipped withelectrical position monitoring. This ensures thatall possible single faults are detected early by thecontrol system.

© Pilz GmbH & Co. KG, 20172017-08

Chapter 8 Mechanical, pneumatic and hydraulic design

8.5 Safety requirementson hydraulic circuits
8.5.11 Further example for controllers inaccordance with Category 4, Performance Level e
In this hydraulic controller, only the downward
movement is monitored in terms of safety (compare
hydraulic press). Two electrically monitored valves
WV1 and WV3 control the build-up of pressure on
the upper side of the piston; valves WV2 and WV1
are responsible for reducing the pressure. Valves

WV1, WV2, WV3 are equipped with electrical position
monitoring. Working in conjunction with the control
system, this guarantees that all faults are detected.
By monitoring the main stage of valve WV2, any
failure in the pilot valve WV4 will be detected at
the same time. The pressure limiting valve VDB isdesigned as an electrically adjustable pressure
valve with a pressure limiting function.

Hazardous
movement

WV4

SV

WV1

8 Mechanical, pneumatic and hydraulic design

WV2

WV3

VDB

RF

M

N

T

LF

Example of hydraulic circuit (Cat 4, PL e)

2017-08© Pilz GmbH & Co. KG, 2017

8-63

9
AppendixChapter 9 Appendix

9 Appendix
Appendix
Index Exclusion of liability 

2017-08© Pilz GmbH & Co. KG, 2017

9-3
9-13

9 Appendix

9
9.1
9.2

9-1

Chapter 9 Appendix

9.1 Index• A
A, B and C standards.................................3-41, 3-43
Absence of feedback.......................................... 5-22
Absolute pressure............................................... 8-38
Access....................3-7, 3-54, 4-3, 4-4, 4-5, 4-8, 4-9,
4-16, 4-18, 5-40, 7-17, 7-31, 7-41, 8-17
Accreditation Directive 765/2008/EC.................. 3-75
Active optoelectronic protective devices............ 4-16
Actuator........................ 5-3, 5-4, 5-6, 5-31, 5-41, 6-6
Adjustable guards restricting access.................... 4-5
Air bubble cavitation............................................ 8-43
Air spring....................................................8-25, 8-26
Analogue processing..................................5-12, 5-20
ANSI (American National
Standards Institute)....................................3-18, 3-41
Anthropometric data........................................... 3-28
Application area.......................3-17, 3-24, 3-29, 3-33
Application layer...........................................6-8, 6-11
Approach speed............. 3-19, 3-28, 4-7, 4-16, 8-25
Assembled machinery........................................... 3-6
Assembly instructions................................3-10, 3-14
Assembly of machines.......................................... 3-6
Assessment............ 3-14, 3-26, 3-31, 3-67, 4-23, 8-5
Assessment procedure........................................ 3-11
Associação Brasileirade Normas Técnicas (ABNT)............................... 3-44
Asynchronous motor..................................7-24, 7-27
Austrian Standards Institute (ÖNorm)................. 3-18
Authorised representative.................... 3-6, 3-9, 3-75
Automatic............................................................ 5-18
Automation technology................... 5-11, 5-22, 5-28,
		
5-30, 5-36, 6-6
Axes....................... 5-19, 5-36, 7-7, 7-14, 7-16, 7-17,
7-18, 7-20, 7-26, 7-41

2017-08© Pilz GmbH & Co. KG, 2017

• B
B10d.............3-26, 3-31, 3-60, 3-68, 5-26, 7-31, 7-34
Basic drive module (BDM).................................... 7-10
Basic physical knowledge................................... 8-37
Basic safety standards
and technical safety standards........................... 7-28
Bernoulli’s equation............................................. 8-41
BG (Federal law).........................................5-11, 5-30
BGIA (The German Institutefor Occupational Safety and Health)................... 3-23
Block diagram............... 7-29, 7-31, 7-33, 7-35, 7-42
bmwfi................................................................... 3-78
Body measurements........................................... 3-19
Bottom-up........................................................... 3-70
Brake............................ 7-20, 7-25, 7-30, 7-31, 7-32,
8-33, 8-34, 8-35
Brake test............................................................ 7-20
Braking.......................... 7-15, 7-16, 7-18, 8-27, 8-33
Braking ramp..............................................7-15, 7-16
British Standard (BS)........................................... 3-18
Broken shearpin.................................................. 5-18
Bus scan time.................................................6-7, 6-8
Bus systems...................................... 5-4, 5-21, 5-22,• C
Calculation tool..........................................3-24, 3-75
Calibration reports............................................... 3-79
CAN..................................................................... 6-11
CANopen......................................................6-8, 6-11
CANopen standard.............................................. 6-11
Category....................... 3-27, 3-32, 3-65, 3-68, 3-69,
4-20, 7-6, 7-12, 7-15, 7-16, 7-32, 7-37,
8-58, 8-59, 8-60, 8-61, 8-62, 8-63
Categories, classification- Performance level b.......................................... 8-59
- Performance level b.......................................... 8-60
- Performance level d.......................................... 8-61
- Performance level e.................................8-62, 8-63
Cavitation............................................................ 8-43
CCC..................................................................... 3-47
CCF factor..................................................3-26, 3-31
CE mark��������3-5, 3-10, 3-11, 3-15, 3-40, 3-42, 3-51
CE marking...................................3-5, 3-6, 3-7, 3-10,
3-12, 3-15, 3-17, 3-53, 3-75
CEN.................................................. 3-18, 3-41, 3-42
CENELEC......................................... 3-18, 3-41, 3-42
Check valve...................................... 8-13, 8-30, 8-51
Circuit-based solutions....................................... 8-27
Circuit diagram.......................5-11, 8-25, 8-26, 8-29,
		
8-34, 8-35, 8-36, 8-44, 8-46,
		
8-47, 8-48, 8-49, 8-50, 8-51, 8-56

9 Appendix• Symbols, 0–9
1999/5/EC........................................................... 3-16
2001/95/EC......................................................... 3-16
2003/10/EC......................................................... 3-16
2006/42/EC.....................3-5, 3-10, 3,11, 3-16, 3-17,
3-44, 3-53, 4-4, 4-6
2009/104/EC....................................................... 3-80
2014/30/EU......................................................... 3-16
2014/35/EU......................................................... 3-16
2014/53/EU......................................................... 3-16
3 contactor combination.............5-3, 5-6, 7-24, 7-25
89/686/EEC......................................................... 3-16
β factor................................................................ 3-31
λD......................................................................... 3-32
λDD........................................................................ 3-26
λDtotal..................................................................... 3-26

9-3

Chapter 9 Appendix

9.1 Index

9 Anhang

Circuitry..........................................................5-3, 5-7
Clamping cartridge.....................................8-33, 8-35
CLC/TS 61496-2:2006........................................ 3-20
CLC/TS 61496-3:2008....................... 3-20, 3-37, 4-7
CNC..................................................................... 5-27
Commissioning.......................3-10, 3-40, 3-42, 3-44,
3-49, 3-50, 3-57, 5-6, 5-39, 7-9
Common cause factor......................................... 3-31
Communauté Européenne.................................... 3-5
Communication error............................................. 6-3
Communication function....................................... 6-4
Communication hierarchy..................................... 6-8
Communication media.......................................... 6-7
Competent persons............................................. 3-80
Complete drive module (CDM)............................ 7-10
Component identification.................................... 8-36
Conduct contrary to safety.................................. 4-24
Configurable safety relays................. 5-4, 5-11, 5-12,
5-13, 5-14, 5-15, 5-16,
5-17, 5-18, 5-19, 5-20
Configuration..........................3-28, 3-57, 4-17, 5-26,
7-22, 7-25, 8-25, 8-34,
8-35, 8-39, 8-55
Configuration tools.............................................. 5-11
Conformity......................... 3-5, 3-7, 3-12, 3-14, 3-76
Conformity assessment...............3-5, 3-9, 3-14, 3-76
Conformity assessment procedures................... 3-17
Connection identification.................................... 8-36
Connection logic................................................... 5-8
Contact-based technology...........................5-9, 5-13
Continuity equation....................................8-41, 8-45
Control circuit diagrams...................................... 3-14
Control devices..........................................4-20, 4-24
Controlled braking............................................... 7-15
Controlled loop status......................................... 7-17
Controlled stop................................. 7-12, 7-15, 7-16
Controller (SRP/CS)............................................. 7-28
Controller enable............................................7-5, 7-6
Controller inhibit.................................................. 4-21
Controlling valves................................................ 5-32
Control of the oil flow.......................................... 8-45
Control system............. 3-20, 3-29, 3-33, 3-67, 4-11,
5-21, 5-22, 5-27,5-29, 5-39, 6-6, 7-11
Control technology....................5-3, 5-22, 5-24, 5-29
Control valve....................................................... 5-20
Control variable..............................................7-5, 7-6
Converter.............4-21, 6-8, 7-4, 7-5, 7-6, 7-25, 7-31
Counter no. ......................................................... 6-12
Couplings or fastenings...................................... 8-56
CRC..................................................................... 6-12
Cross muting....................................................... 5-16
Crushing.......................................................3-19, 4-7
CSA (Canadian Standards Association).............. 3-42

9-4

Cycle initiation..................................................... 5-18
Cycles of operations........................................... 7-31
Cyclical data channel.......................................... 6-11
• D
DACH.................................................................. 3-78
Daisy chain wiring............................................... 6-10
DAkkS (German Accreditation Body).......3-75, 3-78,
		
3-79, 3-80, 3-81
Danger prevention............................................... 8-11
Dangers................... 3-14, 4-3, 4-8, 4-22, 4-26, 4-28,
		
5-7, 5-30, 7-30, 8-5, 8-7, 8-8, 8-9, 8-10,		
8-12, 8-15, 8-16, 8-17, 8-19, 8-23, 8-28, 8-55
DAP..................................................................... 3-78
Data security mechanism...................................... 6-4
DCavg.................................................................... 3-26
DC value.....................................................3-26, 3-70
Decentralised safety technology........................... 6-3
Declaration of conformity..........................3-10, 3-14,
3-17, 3-44, 3-45, 3-55, 3-59
Declaration of incorporation.......................3-10, 3-14
Defeating safeguards....................... 4-20, 4-22, 4-24
Design defect...................................................... 4-27
Design of safeguards.......................................... 4-11
Design principles................................................. 3-21
Detection of shorts across contacts................... 5-21
Deterministic hazards....................................8-9, 8-15
Diagnostic capability............................................. 5-6
Diagnostic coverage (DC)................ 3-26, 3-27, 3-60,		
4-14, 7-31, 8-32, 8-33
Diagnostic data................................................... 5-13
Diagnostic purposes............................................. 5-4
Diagnostic test interval (T2).................................. 3-34
Differential circuit................................................. 8-50
DIN.............................................................3-18, 3-34
DIN EN ISO 14118���������������������������������������������� 4-21
DIN EN ISO 17020............................................... 3-75
Direction of approach.......................................... 3-28
Direction of rotation......................................7-7, 7-35
Directives............................ 3-3, 3-4, 3-5, 3-12, 3-15,
3-16, 3-40, 3-42, 3-43, 3-44,
3-45, 3-51, 3-54, 3-64, 3-75
Directives and laws in America........................... 3-40
Directives and laws in Asia.................................. 3-45
Directives and laws in Australia........................... 3-49
Directives and laws in New Zealand................... 3-50
Direct safety technology.............................8-15, 8-16
Disconnection from voltage.........................5-4, 5-10
Distance monitoring...................................3-55, 5-31
DKD..................................................................... 3-78
Documentation............... 3-7, 3-14, 3-48, 3-62, 3-66,		
3-67, 3-72, 4-13, 5-26, 8-4, 8-5
Domestic law......................................................... 3-3© Pilz GmbH & Co. KG, 20172017-08

Chapter 9 Appendix

9.1 Index• E
EC Declaration of Conformity................ 3-5, 3-6, 3-9,
3-10, 3-15, 3-17, 3-53, 3-75
Electrical codes (NEC)......................................... 3-41
Electrical safety................................................... 3-33
Electronic cam disk (synchronous motion)......... 7-26
Electronics.......................................... 3-18, 5-6, 5-37
Electronic safety relays........................... 5-4, 5-6, 5-9
Electrosensitive
Elliptical curve (resulting motion)......................... 7-26
EMC-attributable disturbances............................. 6-4
EMC Directive.............................................3-12, 3-16
EMC load............................................................... 6-7
EMC requirements......................................3-20, 3-36
Emergency stop.........................3-81, 5-3, 5-6, 5-28,
		
5-32, 5-37, 7-28, 8-36
Emergency stop devices..................................... 7-34
EN/IEC 61508...............................................7-7, 7-11
EN/IEC 61800-5-2..........................................7-3, 7-6
EN 1005-1 to -4:2008.......................................... 3-19
EN 1005-5:2007.................................................. 3-19
EN 1010............................................................... 4-24
EN 1037............................................................... 4-21
EN 1037:2008...................................................... 3-19
EN 1088............................................................... 3-36
EN 1088:2008...................................................... 3-19
EN 12453:2000.................................................... 3-19
EN 292................................................................. 3-19
EN 349:1993+A1:2008.......................................... 4-7
EN 349:2008........................................................ 3-19
EN 415................................................................. 7-28

2017-08© Pilz GmbH & Co. KG, 2017

EN 547-1 to -3:2008............................................ 3-19
EN 574:2008........................................................ 3-19
EN 60204-1...................................... 3-33, 7-12, 8-55
EN 60204-1:2010.......................................3-20, 3-33
EN 60947-5-1:2009............................................. 3-20
EN 60947-5-2:2012............................................. 3-20
EN 60947-5-3:2005............................................. 3-20
EN 60947-5-4:2003............................................. 3-20
EN 60947-5-5:2013............................................. 3-20
EN 60947-5-6:2001............................................. 3-20
EN 60947-5-7:2003............................................. 3-20
EN 60947-5-8:2006............................................. 3-20
EN 60947-5-9:2007............................................. 3-20
EN 61326-3 Parts 1+2:2008.......................3-20, 3-36
EN 61496-1:2010................................................ 3-20
EN 61496-3:2003................................................ 3-20
EN 61508.....3-23, 3-29, 3-33, 3-34, 3-35, 3-38, 3-67
EN 61508 Parts 1-7:2010...........................3-20, 3-33
EN 61511 Parts 1-3:2004...........................3-20, 3-29
EN 61784-3:2010.......................................3-20, 3-23
EN 61800-5-2:2007....................................3-20, 3-38
EN 61800.................................7-10, 7-11, 7-12, 7-13
EN 62061................................3-24, 3-29, 3-32, 3-33,
3-67, 3-68, 3-72, 4-11
EN 62061:2016...........................................3-20, 3-29
EN 692................................................................. 7-28
EN 693................................................................. 7-28
EN 953:2009........................................................ 3-19
EN 954-1............................................ 3-9, 3-67, 4-20
EN 999................................................................. 3-28
Enable principle................................................... 5-24
Enabling switch............................................5-7, 7-34
Encoder.............................. 5-19, 7-7, 7-8, 7-9, 7-36,
7-37, 7-38, 7-40
Encoder line................................................5-19, 7-25
Encoder signal...........................5-19, 7-7, 7-37, 7-38
Encoder systems........ 7-7, 7-8, 7-9, 7-19, 7-22, 7-25
Encroachment from behind........................4-18, 4-19
Energy supply............................4-21, 5-3, 7-30, 8-55
EN ISO 10218-1............................... 3-52, 3-53, 7-28
EN ISO 11161:2010....................................3-19, 3-39
EN ISO 12100-1 and 2...............................3-19, 3-21
EN ISO 12100:2010....................................3-19, 3-21
EN ISO 13849-1............. 3-9, 3-21, 3-23, 3-24, 3-25,
		
3-26, 3-27, 3-29, 3-33, 3-38, 3-54, 3-60,		
3-61, 3-62, 3-63, 3-64, 3-66,3-67, 3-68,
		
3-74, 3-75, 4-11, 5-14, 5-19, 5-26, 7-12,		
7-28, 7-29, 7-31, 7-32, 7-34, 8-28
EN ISO 13849-1:2009......................................... 3-19
EN ISO 13849-2.....................3-24, 3-66, 3-67, 3-73,
EN ISO 13849-2:2012................................3-19, 3-24
EN ISO 13855.........................3-28, 3-57, 4-15, 4-16,
		
4-17, 7-33, 8-60

9 Appendix

Doors................................................................... 3-19
dop...............................................................7-31, 7-34
Downward movement......................................... 8-45
Drag error detection............................................ 7-37
Drive-integrated isolation...........7-6, 7-9, 7-12, 7-19,
Drive-integrated motion monitoring...........7-26, 7-36
Drive-integrated safety.... 4-21, 5-35, 7-3, 7-13, 7-18
Drive-integrated safety technology....................... 7-3
Drive.............4-11, 4-21, 7-4, 7-12, 7-15, 7-18, 7-19,
7-24, 7-25, 7-26, 7-27, 7-36, 7-37, 7-38,
7-39, 7-40, 8-4, 8-25, 8-32, 8-37
Drive bus......................................................7-3, 7-26
Drive components......................................7-22, 7-23
Drive electronics...........................................7-4, 7-23
Drive environment............................................... 5-19
Drive pump....................................... 8-52, 8-53, 8-54
Drive system....................... 3-38, 5-19, 7-3, 7-4, 7-6,
7-7, 7-10, 7-11, 7-12, 7-25
Drive technology............ 3-54, 4-21, 5-36, 5-37, 7-6,
7-15, 7-16, 7-22, 7-23, 8-3
Duration of exposure to hazard........................... 3-25

9-5

Chapter 9 Appendix

9.1 Index
EN ISO 13855:2010............................ 3-19, 3-28, 4-7
EN ISO 13857:2008............................ 3-19, 3-28, 4-7
EN ISO 14119:2013�������������������������������������3-36, 4-7
EN ISO 14120:2015���������������������������������������������� 4-7
Environmental requirements................................ 3-73
Error reaction function......................................... 7-25
Error states.......................................................... 5-13
ESPE................................................ 4-16, 4-17, 4-19
Ethernet-based.................................................... 5-15
Ethernet-based fieldbus system........................... 6-6
Ethernet....................... 5-15, 5-22, 6-4, 6-6, 6-7, 6-8,
6-9, 6-10, 6-11, 6-12, 6-13, 6-14
Ethernet technology.....................................6-8, 6-13
European co-operation for Accreditation (EA).... 3-78
Ex area................................................................. 5-10
European Union..............................................3-3, 3-4
Evaluation logic..................................................... 5-4
Excessive functionality........................................ 4-27
Exhaust throttles................................................. 8-34
Exposure............................................................. 3-24
External commands............................................ 7-42
External motion monitoringwith one standard encoder................................. 7-37
External motion monitoringwith safe encoder................................................ 7-40
External motion monitoring withstandard encoder and proximity switch.............. 7-38
External motion monitoring with
two standard proximity switches........................ 7-39

9 Anhang• F
Failsafe................................................................ 8-12
Failsafe principle..........................................7-3, 7-25
Failure mode........................................................ 8-30
Fault rectification procedure................................ 4-25
Fault simulation (safety check)............................ 3-75
Fault tolerance..................................................... 3-32
Feasibility tests...................................................... 7-7
Federal Act on Accident Insurance (AIA)............. 3-80
Fibre-optic (FO) cable communication.................. 6-7
Fibre-optic cable..........................................6-7, 6-13
Fieldbus...........3-20, 3-23, 5-13, 5-24, 6-10, 7-7, 7-9
Fieldbus modules................................................ 5-13
Fieldbus standard................................................ 6-11
Fieldbus system................................. 5-13, 6-6, 6-14
Filtration of the hydraulic fluid (RF)...................... 8-57
Fittings................................................................. 8-43
Fixed guards................. 3-19, 4-6, 4-7, 4-8, 4-9, 4-11
Fixed pump................................................8-43, 8-52
Flow forms........................................................... 8-41
Fluid flow............................................................. 8-51
Fluid power system....................................8-37, 8-57
Force and path transmission............................... 8-40

9-6

Freedom of movement........................................ 3-17
Frequency converter.................7-4, 7-10, 7-23, 7-27
Friction shear stress............................................ 8-42
Functional safeguard........................................... 4-21
Functional safety.......... 3-17, 3-20, 3-24, 3-29, 3-33,
3-38, 3-73, 4-21, 5-40, 7-3,
7-10, 7-15, 7-16
Function blocks............. 3-61, 3-63, 3-66, 5-25, 5-33
Function elements���������������������������������������������� 5-25
Function test..................................... 3-73, 3-75, 8-56
• G
Gear pump.................................................8-52, 8-54
German Institute for Standardization (DIN)......... 3-18
German Product Liability Act (ProdHaftG)............ 2-1
German Product Safety Act.......................4-22, 4-27
GOST-R certification............................................ 3-45
Gravitational pressure......................................... 8-39
Guard locking..............................3-36, 4-5, 4-9, 4-11
Guards.................................... 4-4, 4-5, 4-6, 4-8, 4-9,
4-11, 4-14, 4-16, 4-27, 4-28, 8-17
• H
Harmonisation ............................3-3, 3-4, 3-16, 3-18
Harmonised standard.................3-3, 3-4, 3-12, 3-40,
3-41, 3-42, 3-43, 3-44, 3-45,
3-49, 3-50, 3-51, 3-67, 8-9
Hazard............................ 3-8, 3-14, 3-16, 3-21, 3-25,
		
3-70, 4-4, 4-6, 4-8, 4-15, 4-16, 4-17,
		
4-21, 4-26, 4-28, 5-3, 5-40, 7-6, 7-15, 7-18,
		
7-19, 7-25, 8-5, 8-8, 8-9, 8-15, 8-16, 8-19
Hazard assessment............................................. 3-73
Hazard exposure (frequency).....................3-25, 3-30
Health and safety requirements....... 3-12, 3-14, 3-17
High-end safety solutions..................................... 7-3
High Demand Mode............................................ 3-29
Hold..................................................................... 8-31
Holding brake................ 7-20, 7-24, 7-31, 7-32, 8-33
Holding brakes and service brakes............7-20, 7-30
hop...............................................................7-31, 7-34
Hose colours....................................................... 8-36
Hose cross-sections............................................ 8-36
Hose numbers..................................................... 8-36
Hydraulic accumulator........................................ 8-56
Hydraulic circuit................................ 8-44, 8-45, 8-46
Hydraulic controller....................................8-57, 8-63
Hydraulics.................................3-33, 5-28, 8-3, 8-23,
8-25, 8-37, 8-42, 8-59
Hydraulic system................................................. 8-44
Hydraulic systems with hydraulic accumulator.... 8-56
Hydraulic work.................................................... 8-40
Hydro pump........................................................ 8-43
Hydrostatic energy transfer................................. 8-37

© Pilz GmbH & Co. KG, 20172017-08

Chapter 9 Appendix

9.1 Index

2017-08© Pilz GmbH & Co. KG, 2017

• J
JIS standards (Japanese Industrial Standards)..... 3-46
Jog function...................................... 7-18, 7-33, 7-34
Jog mode........................................... 7-3, 7-18, 8-59
• L
Laser scanners........................3-37, 4-19, 5-10, 5-16
Law of friction...................................................... 8-42
LD (Ladder Logic/Ladder Diagram)..................... 5-21
Leakages....................................................8-23, 8-55
Lifecycle..................................3-33, 3-38, 3-63, 7-22
Lifecycle phases.................................................. 3-14
Lift stops.............................................................. 8-56
Light beam devices....................3-37, 3-75, 4-6, 4-8,
8-17, 8-25, 8-35
Light curtains................... 3-37, 3-59, 3-75, 4-17, 5-6
Limbs.................................................. 3-19, 3-28, 4-7
Limit value.................... 3-53, 3-56, 3-57, 3-58, 3-59,
3-65, 5-19, 7-3, 7-9, 7-12,
7-14, 7-15, 7-16, 7-17, 7-18, 7-19,
7-24, 7-25, 7-26, 8-5, 8-55
Limit value violation.................7-12, 7-14, 7-19, 7-42
Low-noise design................................................ 8-55
Low demand mode............................................. 3-29
Low Voltage Directive.................................3-12, 3-16
• M
Machine availability............................................... 7-6
Machine components.......................................... 3-10
Machine cycle..................................................... 7-34
Machinery.............3-5, 3-6, 3-7, 3-8, 3-9, 3-10, 3-11,
3-12, 3-14, 3-15, 3-16, 3-17, 3-19, 3-20,
3-21, 3-23, 3-24, 3-25, 3-28, 3-29, 3-33,
3-36, 3-37, 3-39, 3-40, 3-41, 3-42, 3-43,
3-44, 3-45, 3-46, 3-47, 3-48, 3-49, 3-50,
3-51, 3-53, 3-55, 3-56, 3-57, 3-58, 3-64,
3-67, 3-68, 3-69, 3-70, 3-72, 3-73, 3-75, 3-80,
4-3, 4-4, 4-5, 4-7, 4-8, 4-11, 4-12, 4-15, 4-16,
4-18, 4-19, 4-21, 4-22, 4-24, 4-25, 4-27, 4-29,

5-3, 5-4, 5-6, 5-7, 5-10, 5-14, 5-16, 5-22, 5-26,

5-27, 5-28, 5-31, 5-32, 5-35, 5-37, 5-38, 5-40,

5-41, 6-8, 6-14, 7-3, 7-7, 7-9, 7-12, 7-23, 7-25,

7-28, 7-30, 8-3, 8-4, 8-5, 8-7, 8-8, 8-9, 8-12,
8-15, 8-16, 8-17, 8-19, 8-23, 8-24, 8-25, 8-27,

8-28, 8-35, 8-36, 8-55, 8-56, 8-60
Machinery Directive....... 3-5, 3-6, 3-7, 3-8, 3-9, 3-10,
3-11, 3-12, 3-14, 3-15, 3-16, 3-17, 3-19,
3-24, 3-29, 3-41, 3-43, 3-44, 3-45, 3-47, 3-49,
3-50, 3-53, 3-81, 4-4, 4-7, 8-3, 8-9, 8-35
- Annex I........................................... 3-10, 3-12, 3-44
- Annex II B.......................................................... 3-10
- Annex IV............................................................ 3-10
- Annex VI............................................................ 3-10

9 Appendix• I
I/O interconnection.......................................7-9, 7-26
IEC/TR 62061-1:2009.......................................... 3-20
IEC/TR 62685:2010....................................3-20, 3-23
IEC/TS 62046:2008....................................3-20, 3-37
IEC 60204-1..................................... 7-14, 7-15, 7-16
IEC 61131............................................................ 5-25
IEC 61496-2:2013......................................3-20, 3-37
IEC 61508................. 3-18, 3-34, 3-36, 6-7, 6-11, 8-9
IL (Instruction List)............................................... 5-21
Import.................................................................... 3-7
Importer............................................................... 3-48
Incorrect message sequence................................ 6-4
Incremental encoder............................................ 7-27
Indirect safety technology................................... 8-17
Industrial communication networks...........3-20, 3-23
Industrial Safety and Health Law (Japan)............ 3-46
Industrie 4.0...................................... 5-38, 5-40, 5-41
Informative safety technology....................8-15, 8-19
Injury, severity of.................................................. 3-25
Inputs/outputs............................................5-11, 5-21
Installation....................................................3-56, 5-7
Installation process............................................... 5-7
Integrated fault detection.................................... 4-13
Integrated safe shutdown path..................7-14, 7-23
Interfaces/communication................................... 7-22
Interlock.............................. 4-4, 4-5, 4-9, 4-11, 4-24,
		
4-25, 4-27, 4-29, 5-28, 8-55
Interlocking concept
for special operating modes................................ 4-25
Interlocking device............ 3-19, 3-36, 4-5, 4-7, 4-23
Intermediate circuit............................... 7-5, 7-6, 7-23
International Accreditation Forum (IAF)............... 3-78
International ElectrotechnicalCommission (IEC)................................................ 3-18
International Laboratory Accreditation
Cooperation (ILAC).............................................. 3-78
International Organizationfor Standardization (ISO)..................................... 3-18
Interruption........................ 5-4, 5-37, 7-6, 7-12, 8-16
Inverted rectifier..............................................7-5, 7-6
IS ......................................................................... 4-15
ISmax(i).................................................................... 4-15
ISmax...................................................................... 4-15
ISO/IEC 17020..................................................... 3-79
ISO/IEC 17025..................................................... 3-79
ISO/OSI reference model...................................... 6-9
ISO/TR 23849:2010............................................. 3-20
ISO 14118:2000................................................... 3-19
ISO 14119........................................... 3-19, 3-36, 4-9
ISO 15189............................................................ 3-79
ISO 9001 standard.............................................. 3-79

9-7

Chapter 9 Appendix

9.1 Index

9 Anhang

Mains contactor.................................................... 7-5
Maintenance unit.....................8-24, 8-27, 8-29, 8-36
Manipulation of safeguards................................. 4-22
Manual start-up valve.......................................... 8-27
Manual valve....................................................... 8-27
Manufacturer........3-3, 3-4, 3-5, 3-6, 3-7, 3-10, 3-12,
3-14, 3-15, 3-23, 3-33, 3-38, 3-40, 3-41, 3-42,
3-44, 3-49, 3-50, 3-51, 3-54, 3-56, 3-60,
3-62, 3-63, 4-22, 4-24, 4-26, 4-27, 5-11, 5-26,
5-31, 7-11, 7-25, 7-31, 7-39, 7-40, 8-9, 8-35
Manufacturing process..................... 3-74, 5-30, 7-11
Master-slave system............................................. 6-6
Measurements...........................3-58, 3-74, 3-78, 6-6
Mechanical dangers.....................................8-8, 8-10
Mechanical movements...............................7-7, 8-55
Mechanical spring............................ 8-25, 8-30, 8-36
Mechanics...................... 3-18, 3-33, 5-37, 5-38, 8-3,
		
8-25, 8-28, 8-36
Mechatronic units.......................................5-29, 6-14
Message corruption.............................................. 6-4
Message delay...................................................... 6-4
Message insertion................................................. 6-4
Message loss........................................................ 6-4
Message repetition.........................................6-3, 6-4
Microprocessor technology............................5-6, 5-9
Minimum distances...................3-19, 4-7, 4-17, 8-16
Minimum speed................................................... 7-18
Minimum test interval (T1).................................... 3-34
Mission time (T1).................................................. 3-34
MLA = Multilateral
Recognition Arrangement................................... 3-78
Modularisation.................................. 5-27, 5-29, 5-38
Modular machine design..................................... 6-14
Monitoring function........ 5-4, 5-18, 5-22, 5-28, 7-16,
7-18, 7-25, 7-36, 7-37, 7-38, 7-39, 7-40
Monitoring obligation.......................................... 4-27
Monitoring the direction of rotation..................... 5-32
Motion.............................................. 5-27, 5-28, 5-29
Motion control.................................... 4-21, 7-4, 7-26
Motion control system......................................... 7-26
Motion generation........................................7-4, 7-12
Motion monitoring..................... 7-4, 7-9, 7-24, 7-25,
7-26, 7-27, 7-36, 7-37, 7-38, 7-39, 7-40
Motion monitoring with external devices............ 7-36
Motor............................... 7-3, 7-4, 7-5, 7-6, 7-7, 7-9,
7-10, 7-12, 7-14, 7-15, 7-16,
7-17, 7-19, 7-24, 7-25, 7-31
Motor contactor..............................................7-5, 7-6
Motor current....................................................... 7-19
Motor feedback..................................................... 7-7
Movable guards.................................. 3-19, 4-5, 4-7,
4-9, 4-11, 4-12, 4-14, 4-15
Movable safeguards.............................................. 5-4

9-8

MRA = Mutual Recognition Agreement............... 3-78
MS6-SV......................................................8-28, 8-29
MTTFd – Mean time to dangerous failure........... 3-26,
3-27, 3-31, 3-60, 3-68, 5-26, 7-31,
7-32, 7-34, 7-37, 7-38, 7-39
Multi-turn encoder................................................. 7-7
Muting........................................................4-18, 7-35
Muting function................................ 4-18, 5-10, 5-16
Muting lamp...............................................5-16, 5-17
• N
N/C contacts................................................4-12, 7-6
Navier-Stokes equation....................................... 8-41
NC controller....................................................... 7-26
NFPA (National Fire Protection Association)....... 3-41
NFPA 79.....................................................3-39, 3-41
NFPA 79:2008..................................................... 3-39
NFPA 79:2013..................................................... 3-20
Noise Directive.................................................... 3-16
Noise immunity.................................................... 3-36
Noise immunity requirements.............................. 3-36
Non-safety-related communication function......... 6-4
Normally energised mode................................... 8-58
Normally open principle...................................... 4-19
Normal operation........................................4-27, 8-29
Notified body....................................................... 3-17
• O
Obligation for certification..........................3-45, 3-47
OD – ordinary device........................................... 6-10
Official Journal of the EU...............................3-3, 3-4
Old machine.......................................................... 3-7
Opening frequency.............................................. 4-28
Operating manual......................3-6, 3-14, 3-75, 4-3,
4-22, 4-25, 8-4, 8-19, 8-35
Operating mode selection................................... 5-32
Operating pressure........ 8-24, 8-26, 8-27, 8-35, 8-55
Operating pressure range.................................... 8-55
Operating temperatures...................................... 8-55
Operation................ 3-39, 3-40, 4-3, 4-21, 6-11, 7-12
		
7-14, 7-17, 7-25, 8-36, 8-43
Operator.......3-6, 3-39, 3-43, 3-44, 3-46, 3-49, 3-50,
3-73, 3-75, 4-26, 4-27, 5-7, 5-26, 8-25
Optocoupler......................................... 7-5, 7-6, 7-23
OSHA (Occupational Safety
and Health Organisation).................. 3-18, 3-40, 3-42
OSHA standards.................................................. 3-40
OSI reference model.............................................. 6-9
OSSD..........................................................4-13, 4-15
Overall circuit................. 7-29, 7-32, 7-34, 7-35, 7-42
Overpressure....................................................... 8-38
Overrun................... 5-59, 7-3, 7-19, 7-23, 8-25, 8-35
Own use................................................................ 3-7© Pilz GmbH & Co. KG, 20172017-08

Chapter 9 Appendix

9.1 Index

2017-08© Pilz GmbH & Co. KG, 2017

Pressure drops.................................................... 8-43
Pressure intensifier.............................................. 8-40
Pressure limitation............................ 8-24, 8-57, 8-58
Pressure limitation within the system (VDB)........ 8-57
Pressure losses................................................... 8-43
Pressure sensitive mats..............................4-17, 4-19
Pressure source................................................... 8-36
Pressure transmission......................................... 8-40
Pressure values................................................... 8-24
Presumption of conformity..........3-3, 3-4, 3-24, 3-29
Primary control.................................................... 8-51
Procedures used to attach and monitor.............. 4-28
Process data object (PDO).................................. 6-11
Productivity increase........................................... 5-22
Product liability...................................................... 2-1
Product Safety Directive...................................... 3-16
Product standards............................................... 3-36
Programmable logic controller (PLC).................... 5-3
Protective devices............... 4-5, 4-7, 4-8, 4-16, 8-17
Protective equipment...................... 3-37, 3-75, 3-80,
4-7, 4-8, 4-16, 4-18, 5-18
Protective fence........................3-58, 4-6, 4-15, 4-17
Proximity switch.................................................. 4-13
PSSu multi........................................................... 5-33
Publisher/subscriber principle............................. 6-10
• Q
Quality assurance................................................ 3-79
• R
Radio Equipment Directive.................................. 3-16
Range Monitoring................................................ 5-20
Rated holding torque........................................... 7-31
RC controller....................................................... 7-26
Reaction function............................. 7-14, 7-19, 7-25
Reaction times.............. 3-59, 4-16, 4-17, 5-22, 5-24,
7-3, 7-15, 7-16, 7-18, 7-23, 7-25, 7-42, 8-35
Real-time communication................................... 6-10
Reduction factor.................................................. 7-32
Redundancy............. 4-13, 6-3, 6-5, 8-12, 8-13, 8-14
Redundant design................................................. 5-6
Reed contacts..................................................... 4-15
Reference variable..........................................7-5, 7-6
Relay............................................3-74, 4-15, 5-3, 5-6
Relay circuits......................................................... 5-3
Relay technology............................................5-4, 5-6
Required characteristics of guards
and protective devices.......................................... 4-4
Residual risk..............................3-14, 4-26, 4-27, 8-9
Restart.................... 4-18, 4-21, 5-12, 7-6, 7-23, 8-54
Retrofit................................................................. 7-25
Reynolds number................................................ 8-41
RFID..................................................................... 4-13

9 Appendix• P
Packet Identifier.................................................. 6-12
Parallel circuit................................... 8-47, 8-49, 8-50
Parameter tool..................................................... 5-12
Partly completed machinery.................................. 3-6
Parts of the body............. 3-19, 3-28, 4-7, 4-16, 8-16
Passport to Europe............................................... 3-5
PDS/Safety-related (SR)...................................... 7-10
Peak current IS..................................................... 4-15
Pendulum motion................................................ 5-32
Performance level......... 3-24, 3-25, 3-26, 3-57, 3-60,
3-61, 3-62, 3-63, 3-68, 3-72, 3-75, 5-14,
7-28, 7-29, 7-30, 7-31, 7-32, 7-34, 7-35,
7-37, 7-38, 7-39, 7-40, 7-42, 8-28, 8-29,
8-32, 8-33, 8-58, 8-59, 8-60, 8-61, 8-62, 8-63
Performance level PLr ..................... 3-24, 3-25, 3-27,
3-65, 3-68, 3-71
Personal Protective Equipment Directive............ 3-16
PFD (probability of failure on low demand)......... 3-31
PFHD........................................3-27, 3-32, 3-60, 7-32
Physical performance.......................................... 3-19
PID (packet identifier).......................................... 6-12
Piston forces.................................... 8-38, 8-44, 8-49
Piston pressure force.......................................... 8-38
Piston speed.................................... 8-39, 8-45, 8-49
PL...............3-25, 3-26, 3-27, 3-57, 3-68, 3-70, 4-11,
4-13, 4-14, 7-23, 7-29, 7-32, 7-34, 8-28
Placing on the market......................................... 3-17
PLC controller.............................................5-21, 5-33
PL e.....3-61, 3-65, 4-13, 7-38, 7-39, 7-40, 8-62, 8-62
PL graph........................................... 3-25, 3-27, 7-32
PMCprotego DS.................................................. 5-35
Pneumatic components.............................8-23, 8-24
Pneumatics..................... 3-33, 5-28, 8-3, 8-23, 8-25,
		
8-26, 8-27, 8-28, 8-32, 8-36
PNOZ............................................................5-3, 8-29
PNOZelog.............................................................. 5-9
PNOZmulti....................... 3-62, 4-21, 5-4, 5-32, 5-33
PNOZsigma........................................................... 5-6
Positioning........................................................... 7-26
Positioning control............................................... 7-26
Position monitoring............................ 5-4, 5-20, 7-19
Position window............................... 7-12, 7-17, 7-19
Possibility of defeat.......................... 3-36, 4-17, 4-18
Power contactor.................................................... 5-4
Power drive system (PDS)................................... 7-10
Press applications............................................... 5-18
Press safety valve................................................ 5-18
Press stroke......................................................... 5-31
Pressure....................... 3-56, 4-23, 4-27, 5-20, 8-24,
		
8-25, 8-26, 8-35, 8-36, 8-37,
		
8-38, 8-39, 8-40, 8-43, 8-44, 8-48,
		
8-49, 8-50, 8-54, 8-55, 8-56

9-9

Chapter 9 Appendix

9.1 Index
Ring area....................................................8-49, 8-50
Risk...............3-14, 3-24, 3-25, 3-30, 4-5, 4-26, 4-28,
		
4-29, 5-3, 8-5, 8-9, 8-19, 8-25, 8-31
Risk analysis........ 3-24, 3-30, 3-46, 4-22, 7-11, 7-18,
7-20, 7-23, 7-28, 7-30, 8-5, 8-9, 8-32
Risk assessment............ 3-9, 3-10, 3-12, 3-13, 3-14,
3-57, 3-59, 3-61, 3-67, 3-68, 3-75, 8-9, 8-26
Risk evaluation............. 3-19, 3-21, 3-22, 3-24, 3-27,
3-30, 3-32, 3-38, 4-17, 4-22, 8-9, 8-55
Risk factors......................................................... 3-21
Risk graph...............................3-24, 3-25, 3-29, 3-30
Risk minimisation................................................ 3-67
Risk reduction.......... 3-19, 3-21, 3-22, 3-55, 5-4, 8-5
Root device......................................................... 6-10
Rotary cam arrangement.................. 5-18, 5-31, 5-32
Rotary encoder.............................6-8, 7-6, 7-7, 7-36,
7-38, 7-39, 7-40
RPmin..................................................................... 4-15
RSA..................................................................... 3-18
RSmin(i)................................................................... 4-15
RTFL (Real Time Frame Line)............... 6-8, 6-9, 6-10
RTFN (Real Time Frame Network)..................6-8, 6-9
Rule violation....................................................... 4-26
Run monitoring.................................................... 5-18

9 Anhang• S
S = (K x T) + C..................................................... 4-17
S = (K x T)............................................................ 4-15
S = K* (t1 + t2) + C.............................................. 4-16
Sabotage............................................................. 4-24
Safe-life............................................................... 8-12
Safe absolute position........................................... 7-7
Safe acceleration range (SAR)...................7-17, 7-36,
7-37, 7-38, 7-40
Safe analogue processing................................... 5-20
Safe brake control (SBC)..................................... 7-20
Safe brake function............................................. 7-20
Safe brake test (SBT).......................................... 7-20
Safe cam (SCA)................................................... 7-19
Safe camera-based solution............................... 7-41
Safe camera systems.......................3-37, 3-81, 4-16,
4-19, 4-20, 7-3
Safe communication.................5-13, 5-15, 6-3, 6-11
Safe condition....................................................... 7-3
Safe controllers............................................5-25, 7-9
Safe control technology.........5-11, 5-28, 5-30, 5-31,
5-35, 5-36, 5-37,
Safe decentralisation........................................... 5-24
Safe direction (SDI).......................... 7-19, 7-35, 7-36,
7-37, 7-38, 7-40
Safe drive function................................................ 7-3
Safe encoder...................................... 5-19, 7-8, 7-40

9-10

Safeguard...............................3-19, 3-20, 3-28, 3-36,
3-37, 3-43, 3-57, 3-59, 3-67,
3-75, 3-80, 3-81, 4-3, 4-4, 4-5, 4-7,
4-8, 4-9, 4-11, 4-12, 4-14, 4-15, 4-16,
4-17, 4-18, 4-19, 4-21, 4-22, 4-24, 4-26,
4-27, 4-28, 4-29, 5-4, 5-18, 7-24, 7-41,
8-9, 8-16, 8-17, 8-18, 8-25, 8-55
Safeguarding detection zones
with a safe camera-based solution..................... 7-41
Safe limit value specification................................. 7-9
Safe logic............................................................. 7-24
Safely limited acceleration (SLA)...............7-17, 7-36,
7-37, 7-38, 7-40
Safely limited increment (SLI).............................. 7-19
Safely limited position (SLP)................................ 7-19
Safely limited speed (SLS).........................7-18, 7-19,
7-33, 7-34, 7-36, 7-37, 7-38, 7-39, 7-40
Safely limited torque (SLT)................................... 7-19
Safely reduced speed................3-54, 3-55, 7-3, 7-18
Safe motion..................................................7-3, 7-28
Safe motion control......................................4-21, 7-4
Safe motion examples ........................................ 7-28
Safe motion function........................................... 7-17
Safe motion monitoring........................ 7-4, 7-9, 7-26
Safe operating stop (SOS)............... 7-16, 7-17, 7-36,
7-37, 7-38, 7-40
Safe reset lock............................................7-14, 7-23
Safe separation............................................7-4, 7-13
Safe speed monitoring (SSM).............................. 7-19
Safe speed range (SSR).................. 7-18, 7-36, 7-37,

7-38, 7-39, 7-40
Safe stop 1 (SS1)............. 7-12, 7-14, 7-15, 7-16, 7-18
Safe stop 2 (SS2).............................. 7-12, 7-16, 7-17
Safe stop function...................7-14, 7-19, 7-28, 7-32
Safe stop function on vertical axes..................... 7-30
Safe torque off (STO)....................... 7-12, 7-14, 7-15,
7-16, 7-20, 7-23, 7-27, 7-36,
7-37, 7-38, 7-39, 7-40
Safe torque range (STR)...................................... 7-19
Safety-related communication......................6-3, 6-4,
6-5, 6-7, 6-11
Safety-related communication function................ 6-4
Safety-related message.................................6-4, 6-5
Safety Calculator PAScal.........3-24, 3-29, 3-57, 7-32
Safety chain...............................5-4, 5-18, 7-13, 8-31
Safety characteristic data.................................... 7-36
Safety component....................3-6, 3-11, 3-40, 3-44,
3-48, 3-74, 8-23, 8-28, 8-56
Safety controllers......... 3-33, 3-60, 3-61, 3-63, 3-73,
5-4, 5-12, 5-15, 5-21, 5-22, 5-24, 5-25,
5-28, 5-30, 5-31, 5-32, 5-33, 5-35, 5-36,
6-3, 6-7, 6-12, 7-3, 7-14, 7-23, 7-24, 7-28

© Pilz GmbH & Co. KG, 20172017-08

Chapter 9 Appendix

9.1 Index

2017-08© Pilz GmbH & Co. KG, 2017

Servo presses...................................................... 5-31
Set-up mode...........................5-18, 7-18, 7-19, 8-26
Setpoint specification............................................ 7-6
SFF...................................................................... 3-32
Shutdown....................... 4-18, 4-21, 5-3, 5-30, 5-35,
7-3, 7-14, 7-17, 7-18, 7-24, 7-25, 8-61
Shutdown path........... 7-4, 7-5, 7-6, 7-14, 7-23, 7-24
Significant change................................................. 3-8
Significant modification......................................... 3-8
Sin/cos encoder: sin²+cos²=1............................. 7-40
Sine/cosine motor encoder................................. 7-26
Single axis........................................................... 7-26
Single stroke........................................................ 5-18
Sistema................................................................ 3-75
Slide stroke.......................................................... 5-31
Small controllers............... 5-4, 5-6, 5-11, 5-12, 5-13,
		
5-14, 5-15, 5-16, 5-17, 5-18,
		
5-19, 5-20, 5-25, 5-32, 5-33, 536
Smoothness........................................................ 8-52
Software tool.................................... 5-11, 5-32, 5-38
SPDO................................................................... 6-12
Specifications................................... 3-14, 3-63, 3-70
Speed............................. 3-20, 3-38, 5-4, 5-10, 5-12,		
7-10, 7-12, 8-22, 8-43, 8-56, 8-59
Speed control.............................................8-45, 8-51
Speed monitoring................................................ 4-21
Speed threshold.................................................. 7-17
SRCF................................................................... 3-70
Standard encoder......................7-8, 7-36, 7-37, 7-38
Standards................ 3-3, 3-4, 3-12, 3-14, 3-16, 3-17,
3-18, 3-19, 3-21, 3-24, 3-36, 3-37, 3-41,
3-42, 3-43, 3-44, 3-45, 3-46, 3-47, 3-49,
3-50, 3-51, 3-53, 3-67, 3-72, 3-75, 3-76,
3-79, 3-81, 4-7, 4-9, 5-4, 5-18, 5-30,
5-36, 7-3, 7-28, 8-9, 8-36
Standards Australia............................................. 3-49
Standard sensors........................................7-38 7-39
Standards for dimensioning of guards.................. 4-7
Standards for guards............................................. 4-7
Standards for the design of protective devices
or electrosensitive protective equipment.............. 4-7
Standards institute.............................................. 3-18
Standstill...................................3-54, 5-10, 5-19, 7-3,
7-12, 7-14, 7-15, 7-16, 7-42, 8-60
Standstill detection.....................................7-15, 7-16
Standstill position.......................................7-16, 7-17
Standstill threshold.............................................. 7-12
Statistical methods.....................................3-24, 3-29
Steam bubble cavitation..................................... 8-43
Stochastic hazards............................. 8-8, 8-12, 8-15
Stop.................................. 4-5, 4-11, 5-4, 7-12, 7-14,

7-15, 7-16, 7-20
Stop category.............................................7-12, 8-30

9 Appendix

Safety distance.................................. 3-28, 4-6, 4-15,
4-16, 4-17, 7-16, 7-42
Safety functions.............. 3-9, 3-24, 3-27, 3-29, 3-38,
3-54, 3-60, 3-61, 3-63, 3-68, 3-69,
3-70, 3-71, 3-72, 3-73, 5-3, 5-4, 5-6,
5-9, 5-11, 5-19, 5-21, 5-26, 5-32, 5-36,
5-37, 7-3, 7-6, 7-7, 7-10, 7-11, 7-12,
7-13, 7-14, 7-15, 7-16, 7-17, 7-18, 7-19,
7-20, 7-21, 7-23, 7-24, 7-25, 7-26, 7-28,
7-29, 7-30, 7-31, 7-33, 7-36, 7-37, 7-38,
7-39, 7-40, 7-41, 7-42, 8-9, 8-60
Safety gate..................... 3-81, 4-9, 4-11, 4-12, 4-13,
		
4-15, 5-7, 5-9, 5-12, 5-19,
		
5-28, 5-32, 5-37, 7-3
Safety guidelines................................................. 8-19
Safety integrity.................. 7-8, 7-9, 7-11, 7-13, 7-23
Safety integrity level (SIL)........3-30, 3-68, 3-72, 4-11
Safety lockout..................................................... 7-16
SafetyNET p.............6-3, 6-4, 6-5, 6-6, 6-7, 6-8, 6-9,
6-10, 6-11, 6-12, 6-13, 6-14, 7-7
Safety objectives.........................3-3, 3-4, 3-70, 8-28
Safety principles.....................3-23, 3-69, 3-74, 8-26,
		
8-58, 8-59, 8-60, 8-61, 8-62
Safety relays...........................3-33, 4-13, 4-15, 4-18,
5-3, 5-4, 5-5, 5-6, 5-7, 5-8, 5-9,
5-10, 5-11, 5-12, 5-13, 5-23, 5-25, 7-23,
7-24, 7-27, 7-36, 8-29, 8-30, 8-32, 8-33
Safety requirements.......................... 3-9, 3-12, 3-14,
3-17, 3-40, 3-41, 3-42, 3-43, 3-44,
3-48, 3-51, 3-53, 3-72, 5-12, 5-14,
5-22, 5-40, 7-12, 7-25, 8-55, 8-56
Safety switcheswith integrated fault detection............................. 4-13
Screw connections........................... 8-25, 8-26, 8-36
Screw pump........................................................ 8-53
Secondary control............................................... 8-51
Sector standard............. 3-29, 3-33, 3-36, 3-67, 7-11
Segmented shutdowns....................................... 4-24
Semiconductor outputs..................................5-4, 5-6
Sensors............... 3-37, 3-59, 4-11, 4-12, 4-14, 4-18,
		
4-19, 5-4, 5-6, 5-16, 5-17, 5-31, 5-41,
		
6-6, 7-17, 7-24, 7-26, 7-36, 7-38, 8-32
Sensor subsystem......................................7-38, 7-39
Sequence valve................................................... 8-48
Sequential muting............................................... 5-16
Series circuit............................4-14, 4-15, 8-47, 8-49
Series connection.............................4-12, 7-28, 7-29,
		
7-31, 7-33, 7-35
Service data objects............................................ 6-11
Servo amplifier.................................. 7-4, 7-12, 7-14,
7-15, 7-23, 7-26, 7-28
Servo and frequency converter........................... 7-10
Servo converter..........................................7-25, 7-26

9-11

Chapter 9 Appendix

9.1 Index
Stop function..........................7-12, 7-14, 7-19, 7-28,
		
7-29, 7-30, 7-32, 7-34, 7-35
Structural methods.....................................3-24, 3-29
Subscriber.......................................... 6-7, 6-10, 6-14
Suspended loads................................................ 7-20
Switch position sensing...................................... 8-32
Synchronisation................................................... 7-16
Synchronous circuit............................................. 8-47
System examination........................ 3-26, 3-31, 7-22,
		
7-23, 7-24, 7-25, 7-26, 7-27
• T
tcycle.............................................................7-31, 7-34
Technical documentation.............................3-6, 3-14
Technical specifications...................................... 3-14
Telegram............................................... 6-3, 6-4, 6-11
Telegram structure............................................... 6-12
Terminal voltage.................................................... 7-5
Test results.................................................3-14, 3-70
TGA/DATECH...................................................... 3-78
Throttle check valves........................................... 8-34
Time delay..................................................7-15, 7-16
Timeout................................................................. 6-4
Tm mission time................................................... 5-26
tmulti....................................................................... 7-42
Top-down............................................................ 3-70
Topology................................................................ 6-8
Torque measuring system................................... 7-19
Torque monitoring............................................... 5-36
tramp....................................................................... 7-42
Transition periods........................3-3, 3-5, 3-17, 3-48
treac = tmulti + tPMC + tramp......................................... 7-42
treac = tPMC + tramp................................................... 7-42
Two-cylinder control systems
with electric valves.............................................. 8-47
Two-hand control.................................................. 5-6
Two-hand control device..................................... 4-20
Two-hand control devices......................... 3-19, 4-17,
4-20, 8-17, 8-25
Type C................................................................. 3-80
Type examination............................. 3-17, 3-45, 3-48
Types of cavitation............................................... 8-43
TÜV.............................................................5-11, 5-30

UPmax..................................................................... 4-15
Upward movement.............................................. 8-44
User requirements manual.................................... 3-7• V
Validation............... 3-9, 3-14, 3-19, 3-24, 3-57, 3-59,		
3-62, 3-67, 3-68, 3-69, 3-70, 3-71,		
3-72, 3-73, 3-74, 3-75, 4-11, 5-26
Validation of safety functions........... 3-29, 3-71, 3-72
Valve cross-section............................................. 8-45
Valves with defined switching position................ 8-56
Vane pumps......................................................... 8-54
Variable pump..................................................... 8-43
Vent.........................................8-27, 8-28, 8-29, 8-35
Ventilation time.................................................... 8-35
Vertical axes..................................... 7-14, 7-25, 7-30
Viscosity............... 8-22, 8-41, 8-42, 8-43, 8-56, 8-58
Visualisation................................................5-27, 5-29
V model............................................ 3-62, 3-66, 3-72
• W
Walking and hand speed............................4-16, 4-17
Wireless and antenna technology......................... 6-7
Wireless communication....................................... 6-7
Wiring diagram...........................................8-28, 8-29
Wiring requirement................................ 5-7, 5-8, 5-9,		
5-14, 7-12, 7-23, 7-25

9 Anhang• U
UDP/IP-based communication............................. 6-9
UDP/IP communication......................................... 6-8
UL........................................................................ 3-18
Unexpected start-up....................... 3-19, 4-11, 4-21,
7-14, 8-27, 8-55
Unintended restart............................................... 4-21
Upgrade........................................................3-8, 8-36

9-12

© Pilz GmbH & Co. KG, 20172017-08

Chapter 9 Appendix

9.2 Exclusion of liability
Our safety compendium has been compiled
with great care. It contains information about
our company and our products. All statements
are made in accordance with the current statusof technology and to the best of our knowledge
and belief. While every effort has been madeto ensure the information provided is accurate,
we cannot accept liability for the accuracy andentirety of the information provided, except in
the case of gross negligence. In particular,
it should be noted that statements do nothave the legal quality of assurances or assured
properties. We are grateful for any feedback on
the contents.

page 3-10 revised July 2021

2021-07© Pilz GmbH & Co. KG, 2017

9 Appendix© 2017 by Pilz GmbH & Co. KG, Ostfildern
5th, revised and extended edition

Item no.: 775 740
8-8-2-0-100, Printed in Germany

All rights to this safety compendium are reservedby Pilz GmbH & Co. KG. We reserve the right tomake technical changes. Copies may be madefor internal purposes. The names of the products,
goods and technologies used are trademarks of
the respective companies.

9-13

Americas

Australia and Oceania

Scandinavia

BrazilAustralia+45 74436332+55 11 97569-2804+61 3 95600621

Spain

CanadaNew Zealand+34 938497433+1 888 315 7459

+64 9 6345350

Switzerland+41 62 88979-32

Mexico+52 55 5572 1300

EuropeThe Netherlands

USA (toll-free)

Austria+31 347 320477+1 877-PILZUSA (745-9872)+43 1 7986263-0

TurkeyBelgium, Luxembourg+90 216 5775552

Asia+32 9 3217570

United Kingdom

China

France+44 1536 462203+86 21 60880878-216+33 3 88104003

Japan

Germany

You can reach our+81 45 471-2281+49 711 3409-444

international hotline on:

South Korea

Ireland+49 711 3409-222+82 31 778 3300

+353 21 4804983

support@pilz.com

Italy, Malta+39 0362 1826711

Pilz develops environmentally-friendly products using
ecological materials and energy-saving technologies.
Offices and production facilities are ecologically designed,
environmentally-aware and energy-saving. So Pilz offers
sustainability, plus the security of using energy-efficient
products and environmentally-friendly solutions.

Presented by:

Pilz GmbH & Co. KG
Felix-Wankel-Straße 273760 Ostfildern, Germany
Tel.: +49 711 3409-0, Fax: +49 711 3409-133
E-Mail: info@pilz.com, Internet: www.pilz.com
In many countries we are represented by sales partners. Please refer toour homepage www.pilz.com for further details or contact our headquarters.
Printed on 100 % recycled paper for the good of the environment.

8-8-en-3-138, 2021-07 Printed in Germany© Pilz GmbH & Co. KG, 2017

Technical support is available from Pilz round the clock.

CECE®, CHRE®, CMSE®, InduraNET p®, Leansafe®, Master of Safety®, Master of Security®, PAS4000®, PAScal®, PASconfig®, Pilz®, PIT®, PLID®, PMCprimo®, PMCprotego®, PMCtendo®,
PMD®, PMI®, PNOZ®, PRBT®, PRCM®, Primo®, PRTM®, PSEN®, PSS®, PVIS®, SafetyBUS p®, SafetyEYE®, SafetyNET p®, THE SPIRIT OF SAFETY® are registered and protected trademarksof Pilz GmbH & Co. KG in some countries. We would point out that product features may vary from the details stated in this document, depending on the status at the time of publicationand the scope of the equipment. We accept no responsibility for the validity, accuracy and entirety of the text and graphics presented in this information. Please contact our Technical Support
if you have any questions.

Support