Glossary

The entirety of parts or devices connected together, of which at least one is a moving part, also as applicable drive elements, control and supply circuits, etc., which are brought together for a particular application, such as processing, treating, material handling and preparation of material. The entirety of several machines, which are so arranged and controlled that they operate together as a single unit to achieve one and the same purpose, is also considered to be a “machine”.

which gives the enable signal, when a machine has come to a standstill, e.g. to open a guard device. In case of a fault, the fail-safe standstill monitor takes up the safe condition. See also standstill monitor.

A device to prevent the automatic re-start of a machine after interruption and renewed enable of the protected field during a dangerous part of the machine cycle or after a change in the mode of operation or actuation of the machine.

After a safety function has been requested the safety relay module only switches on again once a reset button (also referred to as start button) has been actuated.

The contrary is the operating mode "Auto start" (Automatic start), which is only admissible under certain conditions (if there is no danger of an unexpected restart) or a reset comes from somewhere else (with a quality corresponding to control category 1 to EN 954-1). Not admissible, for example, in emergency-stop command devices, in accessible rooms etc.

"Trailing edge" or "Edge detection" in this connection means that it is not the rising edge (upon actuating the button) that generates the start signal but the trailing edge after releasing the button. The analysis of the trailing edge or edge detection is an additional safety measure before an unexpected restart in the case of a manipulated or defective button.

Direction of actuation and switching function (NO/NC) can be determined by the choice of actuating magnet (N or S magnet)

Testing/Inspection principles of the German assessment committee for electrical engineering

is present if the risk is justifiably small or in the absence of unjustifiable risks.

Consumers/actuators e.g. power contactor to control motors, solenoid-operated valves etc., connected downstream of safety relay modules (safety enables).

This word often appears in the Machinery Directive and in standards but without comment or definition. It stands for an undetermined and nonoriented (i.e. not directed to humans and/or things) hazard.

Modulated light which is transmitted via a lens onto the object to be detected or the reflector and is reflected by this, to the receiver via a second lens and is electronically evaluated.

Inductive proximity switch based on the Namur principle to DIN 19234

Time until hazard is no longer present, e.g. on motor standstill

Inherently safe for the eyes to EN 60825-1, no protective measures are necessary for the eyes.

Befehlsgeber, der elektronisch bei Einbringung von festen und flüssigen Materialien, z.B. Glas, Holz, Papier, Metall, Kunststoff, Lebensmittel, Flüssigkeiten usw., in seinen Wirkungsbereich berührungslos und kontaktlos schaltet.

Serves for the registration of travel, positions or speeds. The encoder gives a definite number of electrical impulses for each revolution.

which can be manipulated using simple items, e.g. an uncoded magnet. Uncoded magnetic safety sensors must therefore be mounted in a concealed position, so that manipulation with simple items is not possible.

Reihen-Parallelschaltung, z.B. von Sicherheitsschaltgeräten

Erkennung des Kurzschlusses durch einen Sicherheitsbaustein zwischen den Anschlussleitungen zweier benachbarter Kontakte/Schalter, z.B. zwischen S13 und S22

Voltage controlled drop-out of relay on de-energisation after a preset or fixed time.

Permanent magnets are mounted adjacent to the side of the contacts to deflect the polarised DC switching arc. The arc is thus extinguished more quickly and contact wear reduced.

Stillsetzen durch sofortiges Ausschalten der Energiezufuhr (ungesteuertes Stillsetzen)

Cable lenghts will depend on the cable cross section used. The cable resistance should not exceed a value of 30 ohm (refer to formula). Cable lengths up to 1,000 m will not usually present any problem.

Beschaltungsmöglichkeit eines Sicherheits-Relais-Bausteins, in dem bei 2-kanaliger Ansteuerung auch Kurzschlüsse zwischen den Eingangskanälen erkannt werden. Ein Querschluss kann beispielsweise durch das Quetschen einer Mantelleitung entstehen mit der Folge, dass (u.a.) eine 2-kanalige Not-Aus-Schaltung auch bei nur einem fehlerhaften Öffnerkontakt (Zweitfehler) keine Abschaltung auslöst.

Sicherheits-Relais-Bausteine mit Querschlussüberwachung empfehlen wir für die Steuerungskategorie 4 gemäß EN 954-1 zwingend (es sei denn die Kabelverlegung würde in zwei separaten Mantelleitungen erfolgen) und für die Steuerungskategorie 4 gemäß EN 954-1 als zusätzliche Maßnahme, wenn (ACHTUNG: Konflikt mit EN 60204-1!) die Kabelverlegung im Sicherheitsstromkreis (ganz oder teilweise) ungeschützt erfolgt (erfolgen muss) und ein Beschädigungsrisiko besteht.

Permanent magnets are mounted adjacent to the side of the contacts to deflect the polarised DC switching arc. The arc is thus extinguished more quickly and contact wear reduced.

Beim Abschalten wird die Energie solange aufrecht erhalten, bis der Stillstand der Maschine erreicht ist. Nach Erreichen des Stillstandes erfolgt die Unterbrechung der Energiezufuhr (gesteuertes Stillsetzen)

A source of possible injury or damage to health or “Potential source of damage”

A timing relay which gives an enable signal, when a preset time has elapsed, e.g. to open a guard device. In case of a fault, the fail-safe timer takes up the safe condition.

are pressure-sensitive sensors, which react on the effect of a defined force of an object or a person.

The maximum time duration between the response of the sensor function and the OFF condition of the output switching elements, see also response time.

EEx d IIC T6
EEx: General designation
d: Ignition protection: “Flameproof enclosure“
IIC: Explosion group, materials: Ethylene,
Town gas, Acetaldehyde
T6: Temperature class: 85 °C

is a programmed blanking-out of a part of the protected field of a safety light curtain. This function allows a continuous supply of materials to power-operated equipment, such as brake presses, without the machine being switch off.

A separating protective device or such as is used as a safety measure in order to protect persons from a present or potential hazard.

Within the sense of standardisation another term for control category. According to the philosophy of the standard setter, the different measures of realising a suitable control category under consideration of a risk leads to a residual risk. In this respect therefore the categories do not represent a hierarchy. Rather they are equivalent.

Every area in or around a machine in which a person is in hazard of injury or damage to health. Note: The hazard which brings this risk is either always present or can occur unexpectedly. In newer proposals, the term “Hazard zone” is also mentioned.

A sensor which electronically switches with neither physical contact nor moving parts when light-reflecting material is brought into its area of operation.

Connection facility for non-floating outputs of sensors.
Typically for AOPD’s = Active Optoelectronic Protective Devices, also referred to formerly as "Contact Free Protective Device".

An area which is itself not safety relevant, which supports the area security, e.g. as prewarning before the protected field. This field serves to avoid unintentional stopping of the machine or plant. On AGVS, the measured values of this field can also be used to support navigation.

After actuation, the mechanical position switch or safety switch remains in its switching position and must be manually reset.

A sensor which electronically switches with neither physical contact nor moving parts when ferro-magnetic parts, e.g. metal, are brought into its area of operation.

comprise a emitter and a receiver. The emitter is aligned such that a maximum proportion of the pulsed light from its diode falls onto the physically and optically separate light receiver. This evaluates the light received such that it can be clearly differentiated from ambient light or other light sources. An interruption of the light beam brings about switching of the output.

Not part of our product range.

A positioning element which positively operates a position switch. Cam disks are driven by door hinges, for example.

Intentional overcoming of safety switches either manually or by using readily available items, e.g. screws, keys, coins or tools which are needed for the normal operation of the machine. See protection against manipulation.

Unterteilung zur Beschreibung des Abschaltverhaltens bei Handlungen im Notfall

A complete identification and analysis of all possible hazards for the risk analysis. Also termed hazard analysis in the Machinery Directive. According to Article 100a this stems from the hazard situation and exposure to the hazard, according to Article 118a from the hazard potential based on the operative conditions and surroundings.

Monitored semiconductor outputs serve as safety outputs and can be used in the further circuitry to control contactors, Emergency Stop units or safety PLC systems. The monitored semiconductor outputs are of equal value to positive-guided relay outputs in relation to fault security.

Protective devices with micro-processor-based outputs ("safe semi-conductor outputs") generate text signals to check the correct function of the semi-conductor outputs which may disturb the input level of safety relay modules under certain conditions. Test pulse specimens of commercially available protective devices (of market leading manufactures), in particular of AOPDs, have already been taken into consideration in the circuitry development of our modules and do not generate any interference.

Redundancy is understood to be the existence of more functional means in one unit than necessary to satisfy the required function.

The maximum anglular divergence between the optical axis of the light from the emitter and that received by the receiver within which the AOPD continues to operate normally

safety-related outputs of a safety relay module for the connection of actuators downstream. Refer also to "Analysis level".

Declaration of the manufacturer for the use of a product within the European Community according to the appropriate standards

Connection between the actuator and the switch contact by means of which force exerted on the actuator is directly transmitted to the contact.

A device without separating function, which eliminates or reduces a risk either alone or in combination with a separating protective device.

Inductive proximity switch which is insensitive to strong electro-magnetic fields.

See bi-stable contact

To monitor a number of guard devices; units are connected together by conventional wiring

Devices can be operated on AC or DC supply.

The part of an ESPE which is connected to the machine control system and moves to the OFF condition if the sensor section is actuated during normal operation.

A sensor which electronically switches with neither physical contact nor moving parts, but when solid or liquid materials, e.g. glass, wood, paper, metal, plastic, food or liquids are brought into its sensing range.

Code of practice of German industrial assessors,
which gives references and suggestions regarding
technical products.

Begrifflichkeit unterschiedlicher Bedeutung beim Thema "Maschinensicherheit".

In Zusammenhang mit steuerungstechnischen Fragen ist in der Regel die "Steuerungskategorie" eines sicherheitsgerichteten Teils einer Maschinensteuerung gemäß EN 954-1 gemeint (Bewertung der zusätzlichen Maßnahmen im Hinblick auf die nötige/angestrebte Risikoreduzierung). Siehe hierzu auch BIA-Report 6/97: Kategorien für sicherheitsbezogene Steuerungen

Daneben existiert der Begriff der STOP-Kategorie. Siehe hierzu auch "STOP-Kategorien".

Manchmal wird auch von Sicherheitsschaltern der Kategorie 1 (Schalter mit integrierten Betätigungsorganen = traditionelle Positionsschalter, z.B. Rollenhebelschalter) gesprochen oder von Sicherheitsschaltern der Kategorie 2 (Schalter mit getrennten Betätigungsorganen). Diese Unterteilung hat keinerlei Bezug zur Kategorisierung nach EN 954-1 und betrifft nur die Unterscheidung der beiden unterschiedlichen Arbeitsweisen der Schalter.

Zum Begriff der Steuerungskategorie anverwandte Begriffe:

• SIL (= Safety Integrity Level) entstammt IEC EN 61508 bzw. IEC EN (draft) 62061,
• AK (= Anforderungsklasse) entstammt DIN VDE V 19250/19251 in Verbindung mit DIN VDE V 0801,
• PL (= "Performance Level") entstammt prEN ISO 13849-1 (mittelfristiger Nachfolger von EN 954-1).

Probability of the occurrence of an injury or damage to health. This stands in relationship to the frequency of entry or the duration of presence.

Fuse defective (see LED for operating voltage)

Possible causes: short circuit in the wiring system, earthing short in the wiring system, wrong wiring, overburdening of the outputs.

Module does not start up

• operating voltage too low;
• wire break in reset circuit;
• reset button (sensory system in general) defective;
• feedback circuit defective/open;
• protective device(s) not ready for operation;
• protective device has only switched on 1 channel;
• check start conditions (Reset : Auto start);
• cross-short setting/check wiring in this respect

.... in the case of two-hand modules

NC/NO contacts of the actuators may not overlap.

Need more help?

Please consult our "Agencies" or our employees directly:

Klaus Forbach
Phone: +49 (0)641 9848-273
Fax: +49 (0)641 9848-420

kforbach@remove-this.elan.schmersal.de

Mika Lehtisaari
Phone: +49 (0)641 9848-399
Fax: +49 (0)641 9848-420

mlehtisaari@remove-this.elan.schmersal.de

Ulrich Hofmann
Phone: +49 (0)641 9848-452
Fax: +49 (0)641 9848-294

uhofmann@remove-this.elan.schmersal.de

Thomas Rühl
Phone: +49 (0)0641 9848-453
Fax: +49 (0)641 9848-266

truehl@remove-this.elan.schmersal.de

The Test push button can be used to check the switch-off function of an evaluation unit. When the Test button is operated, the enable contacts must open.

Photo-electric proximity sensors or fibre-optic sensors with reflector.

Safety sensors (Proximity switches for safety functions)

Based on our self-image as specialist for devices and systems serving the protection of man, machine and plant, the Schmersal group offers its customers a broad range of information in the form of specialised books, newsletters, brochures and detailed descriptions in the form technical catalogues.

Please consult your responsible sales partner or the companies of the Schmersal group.

info@remove-this.schmersal.de

info@remove-this.elan.schmersal.de

Current load as dependent on ambient temperature (refer to example).

If a moving mechanical component automatically moves another with it either by means of direct contact or via rigid parts.

A contact which is closed in the rest condition.

Breakage of the actuating wire on pull-wire switches trips the contacts, thus protecting against unnoticed damage.

To monitor a number of guard devices; modules are connected together by ribbon cables

To provide additional enabling paths; units are connected together by conventional wiring

Series-parallel circuits, e.g. of safety switching devices.

These are technological alternatives to relay-based circuitry. They include, for example, programmable compact safety controllers, stored program safety controllers and safety bus systems. Alternatives are particularly interesting for complex machines (if otherwise more than 5 ... 8 safety relay modules are required), for integrated production systems and plants and in tasks requiring a high logic depth of inputs and outputs as well as high demands on visualisation and diagnostic options.

Under the heading of programmable electronics with safety function the following are offered within the Schmersal group:

• K.A. Schmersal GmbH, Wuppertal, offers the sensor/actuator interface "ASi-Safety-at-Work",

• and Elan Schaltelemente GmbH & Co. KG, Wettenberg, offers the compact safety controllers "ESALAN Compact" and "ESALAN safety field bus system", and the "ESALAN-SafetyController" for the safety-related movement and position monitoring of multi-axle machines and in particular of robots.

2fach-Sicherheits-Relais-Baustein für Not-Aus-/Not-Stop-Befehlsgeräte, Verriegelungseinrichtungen u.ä. mit differenziertem Abschaltverhalten (= die Anforderung der Sicherheitsfunktion des einen angeschlossenen Sicherheitsschaltgeräts, z.B. Not-Aus, betrifft alle Sicherheitsfreigaben und die des zweiten Sicherheitsschaltgeräts nur einen Teil der Sicherheitsfreigaben). Siehe hierzu auch "Elan SRB 202CA" und "Elan SRB 400CA".

Electronic fuse (e.g. instead of a glass tube fuse) which responds in the case of excessive currents and only enables the circuitry once the power supply has been switched off and switched on again. The additional measure of switching on and switching off the power supply serves to additional protect against unexpected restart of a hazardous movement, particularly in the operating mode "Auto start" once a short circuit has been eliminated.

Testing of the correct function of subsequent power contactors (or other actuator/contact multiplication) by the NC contacts (preferably with positive operation or comparable) being brought back to the start circuit of the safety relay module. A renewed start process can therefore only be initiated if the NC contacts are closed (in rest position). WARNING: the feedback circuit is no substitute for a 2-channel actuator level (or only under certain circumstances).

is only operative in stroke operation (single or double stroke). It prevents uncontrolled release of the machine stroke. This provides that interventions in the protected field are only accepted as strokes when they are carried out within a predetermined time (e.g. 30s) after the stroke cancellation contact is closed. If this does not take place within this period of time, the re-start interlock is activated.

Photo-electric proximity sensors or fibre-optic sensors without reflector.

Law on electromagnetic compatibility. The EMC Directive applies to appliances which contain electrical and/or electronic components which can cause electro-magnetic interference or the operation which can be affected by such interference.

Positively driven contacts are understood to mean that the NC and NO contacts in a contact system can never be simultaneously opened or simultaneously closed. It must be ensured that a contact distance of at least 0.5 mm exists for the entire serviceable life also in faulty state (contact welding).

The detection capacity of an optoelectronic guard device is the size of obstacle which is recognised in all positions of the protected field and leads to a switch-off signal.

The version of a contact separation as direct result of a determined movement of the operating part of the switch via non-flexible parts.

A contact which is open in the rest condition.

The evaluation electronics to monitor the switching conditions of the contacts is integrated in the switch or safety sensor.

To provide additional enabling paths; modules are connected together by ribbon cables

Term with differing meaning with respect to the subject of "machine safety".

In connection with control issues, this usually refers to the "Control category" of a safety-related part of machine control system to EN 954-1 (assessment of additional measures with respect to necessary / aspired-to reduction). Refer also to BIA-report 6/97: Kategorien für sicherheitsbezogene Steuerungen.

Reference is also made to the STOP category. Refer also to "STOP categories" in this respect.

Reference is also sometimes made to safety switches of the category 1 (switch with integrated actuating organs = traditional positions switch, e.g. roller leaver switch) or to safety switches of category 2 (switch with separate actuating organs). This subdivision has no connection with the categorisation under EN 954-1 and only refers to the distinction between the two different modes of operation of the switches.

Terms used with respect to the control category:

• SIL (= Safety Integrity Level) comes from IEC EN 61508 and IEC EN (draft) 62061,
• DC (= Demand Class) comes from DIN VDE V 19250/19251 in connection with DIN VDE V 0801,
• PL (= "Performance Level") comes from prEN ISO 13849-1 (medium term successor to EN 954-1)

Mode of operation 1: Switches on which the switch contacts and operating element are designed to form a single functional unit. Mode of operation 2: Switches on which the switch contacts and operating element do not form a functional unit, but are functionally brought together or separated on actuation of the switch.

Herstellererklärung für ein Produkt zum Einsatz innerhalb der Europäischen Gemeinschaft entsprechend der angegebenen Normen.

Signalling outputs of a safety relay module which signalise the states of the circuitry (of the module itself or of the periphery connected upstream or downstream, depending on version), e.g. to an operational stored program controller. Important for visualisation and diagnosis (key-word: fault management).

A timing relay which gives an enable signal when a preset time has elapsed, e.g. to open a guard device. In case of a fault, the secure timer takes up the safe condition.

Another word for "Safety relay modules" (comes from the testing principle GS-ET-20: Principles for the testing and certification of relay safety combinations).

“Actions in case of emergency” Stopping in emergency: An action in a case of emergency which is determined to stop a process or movement which is dangerous. Switching off in emergency: An action in a case of emergency which is determined to cut off the electrical supply to a complete or a part of an electrical installation, if there is a risk of an electric shock or some other risk of electrical origin.

safety-related parts of a machine control system with the task of ensuring by means of monitored "redundancy" that no hazardous states or damage to the machine or the product can be caused by errors or faults in the electrical equipment or the probability of such faults or errors occurring is reduced. Refer also in this respect to EN 954-1.

Distance (differential) between the points at which a contact makes and breaks the circuit

The actuator and NC contact must be connected by a direct drive path without sprung parts.

A mechanical, electrical or other device to prevent operation of a machine element under predetermined conditions (usually as long as a separating guard device is not closed).

With overlapping contacts, the NO contact closes before the NC contact opens.

On actuation, opens and closes an electrical circuit at two contact points in each case, see contact diagrams.

Individual modules which are connected together by ribbon cables.

Bei der Kontaktüberdeckung schließt der Schließer, bevor der Öffner öffnet.

A sensor which electronically switches with neither physical contact nor moving parts when light-reflecting material is brought into its area of operation. The fibre-optic sensor comprises a basic unit and a fibre-optic cable.

Maximum current burden for all enabling contacts of a safety relay module.

Risk which remains after carrying out protective measures; the remaining tolerable risk in spite of protective measures.

Term follows the new definition of EN 60204-1 section 9.2.5.4 (emergency actions: shut-down in an emergency = electrical safety / stop in emergency = functional safety).

The circuitry of safety relay modules (including the circuitry of Schmersal/Elan types PROTECT and SRB) will usually correspond to control category 4 to EN 954-1. The specification of the control category refers to the module itself, i.e. the control category both of the sensor and the actuator level will depend on it and will depend on structure and incorporation.

The circuitry of the safety relay module ELAN ("SRB-NA-R-C.25") distinguishes between an interruption of the power supply (case 1) and the demand for a safety function, e.g. the actuation of an emergency-stop control device (case 2). In case 1, the module restarts automatically (operating mode "Auto start") and in case 2 it requires a "Reset" signal. Safety relay modules with differentiated restart may only be used under certain conditions of use, for example, to protect service personnel when deployed in otherwise closed operating rooms.

Positively driven contacts are understood to mean that the NC and NO contacts in a contact system can never be simultaneously opened or simultaneously closed. It must be ensured that a contact distance of at least 0.5 mm exists for the entire serviceable life also in faulty state (contact welding).

With the assistance of the ISD, the switching conditions and possible errors in case of a fault can be quickly identified. Depending on the version of the safety monitoring module, the switching conditions and faults are shown via multi-colour LED’s or provided to the user on a transistor output. The switching conditions and faults can be identified with the assistance of the ISD tables.

On actuation, opens and closes an electrical circuit at one contact point in each case, see contact diagrams.

The devices recognise and monitor signals of hazardous movements and process them in accordance with a set limit value to achieve a control command.

By comparison with monitoring devices used for operational functions, the safety-related standstill and motion watchdogs are characterised by special measures and features which, depending on the safety level to be realised, also guarantee the safety function in the case of error and/or detection. The error analysis refers both to the devices and to the parts of the safety circuit set up before them.

Typical tasks for safety-related standstill and motion watchdogs are as follows:

• Control of solenoid-operated magnets in interlocking devices with locking depending on hazardous overtravel;

• Monitoring of "STOP category 2" (safe stop / safe operational stop);

• Monitoring of reduced speed in special operation of machines and plants with open protective devices.

Various device versions are available for the above tasks both in the Schmersal and in the Elan product range. Please request a main catalogue (Schmersal) or the SSW catalogue (Elan).

Defined blanking-out of a part of the protected field of a safety light curtain with varying position of the blanking, see also blanking.

After a safety function has been requested the safety relay module only switches on again once a reset button (also referred to as start button) has been actuated.

The contrary is the operating mode "Auto start" (Automatic start), which is only admissible under certain conditions (if there is no danger of an unexpected restart) or a reset comes from somewhere else (with a quality corresponding to control category 1 to EN 954-1). Not admissible, for example, in emergency-stop command devices, in accessible rooms etc.

"Trailing edge" or "Edge detection" in this connection means that it is not the rising edge (upon actuating the button) that generates the start signal but the trailing edge after releasing the button. The analysis of the trailing edge or edge detection is an additional safety measure before an unexpected restart in the case of a manipulated or defective button.

After a safety function has been requested the safety relay module only switches on again once a reset button (also referred to as start button) has been actuated.

The contrary is the operating mode "Auto start" (Automatic start), which is only admissible under certain conditions (if there is no danger of an unexpected restart) or a reset comes from somewhere else (with a quality corresponding to control category 1 to EN 954-1). Not admissible, for example, in emergency-stop command devices, in accessible rooms etc.

"Trailing edge" or "Edge detection" in this connection means that it is not the rising edge (upon actuating the button) that generates the start signal but the trailing edge after releasing the button. The analysis of the trailing edge or edge detection is an additional safety measure before an unexpected restart in the case of a manipulated or defective button.

On backlash of guard devices, the end position of a position switch with safety function is often “overrun“, so that the NC contact opens and the NO contact remains open. This leads to a fault indication from the safety monitoring module. In order to avoid this, jumper connections can be used to bring about an extension of the enable delay time.

The safety relay modules for this group (housing width 22.5 or 45 mm) differ from the following points of view (refer also in this respect to product overview "Safety relay modules"):

• multifunctional safety relay modules,
  
• more diagnosis/visualisation,
  
• more safety enables,
  
• monitoring of NC/NO contact combinations,
  
• other supply voltages,
  
• other networks,
  
• two-hand switches.

Snap action system with two galvanically separated contact bridges

In the case of supply voltages (24 VDC) there may be a delayed rise in voltage at the activation moment of the entire system as a result of a short term peaks in the power supply units used. The modules of the type series PROTECT-SRB (Schmersal) and SRB (Elan) have circuitry which also compensates for a "slow" rise in voltage in order to avoid functional disturbances in the "Auto start" operating mode.

Switch with one NC and one NO contact, see contact diagrams to IEC 60617.

Schmersal/Elan internal term for safety relay modules to which all types of protective devices (also AOPD's and safety solenoid-operated switches) can be connected and which also offer additional functions such as visualisation and diagnostic facilities.

Die Kontaktreibung erhöht die Kontaktsicherheit und bricht leichte Kontaktverklebungen auf. Dies gewährleistet bei kleinsten Strömen und Spannungen eine gute Leitfähigkeit.

Suitable for use in humidity of max. 100%. Contacts with ceramic insulation, suitable for voltages up to 500 VAC.

This push button is used, for example, to clear all faults stored in the fault memory.

safety-related outputs of a safety relay module for the connection of actuators downstream. Refer also to "Analysis level".

The safety relay modules of this group (housing width 22.5 mm) are suitable for the connection of 1- and 2-channeled commercially available protective devices (non-floating inputs are usually also admissible here) and of emergency stop command devices. They optionally have the operation mode "Reset / Auto start" and two or three safety enables and a signalling contact. Refer also in this respect to product overview "Safety relay modules".

On a cyclic operating process, after two interventions in the protected field (e.g. removal of a finished part and placing in next workpiece) and following enable from the protected field, the machine is automatically started by the AOPD. The further actions are carried out as for “Single stroke” mode of operation.

Not part of our product range.

Shown by the way of example of the modules ELAN "SRB 308IT" and ELAN "SRB 219IT" (with time delayed enable).

Connection facility foru p to 6 protective devices and/or emergency-stop command devices acting on one enable level.

Bei der Kontaktstaffelung schließen oder öffnen die Kontakte nacheinander.

Safety relay modules for two-hand switches (protective device requiring the simultaneous use of both hands, i.e. the hands are kept from the hazardous area in order to initiate the operation of a machine and maintain operation for as long as a hazardous state exists. They must first satisfy the safety requirements laid down in particular in EN 574. Refer also to ELAN "SRB 201ZH".

The maximum time duration between actuation of the sensor function and the OFF condition of the output switching elements

Safety output which is monitored for correct function by the safety monitoring module

A connection of devices of this type will usually be admissible for all multifunctional safety relay modules of type series PROTECT-SRB, but under consideration of the limit value specified in the data sheets for voltages and current (refer in this respect to data sheet information). The circuitry of the respective modules contains a current and voltage limitation which is essential for safety reasons if devices are connected with NC contacts (in order to counter the risk of contact welding). In the case of devices with NC/NO combinations the current and voltage limitation will be an advantage of availability.

Safety solenoid-operated switches are frequently offered as (certified) subsystem, consisting of sensor and analysis unit (from K.A. Schmersal GmbH as "BNS/AES combinations"). This is associated with the advantage that the "sensor/analysis unit" interface is already tested. In the case of a separate structure (see above) the interface responsibility will be with the user.

www.elan.de/tweb/gb/prod_index.html

By means of the coded actuating magnets, the coded magnetic safety sensors are protected against manipulation by simple means. Actuation using conventional magnets and tools is thus eliminated.

A manually operated switch, in particular for Emergency Stop operations, often with latch.

Das Gerät ist nicht mit Mikroprozessoren ausgestattet. Steuerung und Auswertung, z.B. eines Schutztürwächters, ist in Relaistechnik ausgeführt.

The basic safety standards, which lay down the basic terms and the guiding principles for all machines.

After a safety function has been requested the safety relay module only switches on again once a reset button (also referred to as start button) has been actuated.

The contrary is the operating mode "Auto start" (Automatic start), which is only admissible under certain conditions (if there is no danger of an unexpected restart) or a reset comes from somewhere else (with a quality corresponding to control category 1 to EN 954-1). Not admissible, for example, in emergency-stop command devices, in accessible rooms etc.

"Trailing edge" or "Edge detection" in this connection means that it is not the rising edge (upon actuating the button) that generates the start signal but the trailing edge after releasing the button. The analysis of the trailing edge or edge detection is an additional safety measure before an unexpected restart in the case of a manipulated or defective button.

An enabling path is the safe output of the safety monitoring module which can be integrated in the safety circuit of the machine. In the safe switched- off condition, this circuit must always be open, since the safe condition must always be reached by switching off the electrical supply (“fail-safe” mode of operation). The enabling path is formed by the NO contacts of the safety relays wired in series.

www.schmersal.com

www.elan.de

These are technological alternatives to relay-based circuitry. They include, for example, programmable compact safety controllers, stored program safety controllers and safety bus systems. Alternatives are particularly interesting for complex machines (if otherwise more than 5 ... 8 safety relay modules are required), for integrated production systems and plants and in tasks requiring a high logic depth of inputs and outputs as well as high demands on visualisation and diagnostic options.

Under the heading of programmable electronics with safety function the following are offered within the Schmersal group:

• K.A. Schmersal GmbH, Wuppertal, offers the sensor/actuator interface "ASi-Safety-at-Work",

• and Elan Schaltelemente GmbH & Co. KG, Wettenberg, offers the compact safety controllers "ESALAN Compact" and "ESALAN safety field bus system", and the "ESALAN-SafetyController" for the safety-related movement and position monitoring of multi-axle machines and in particular of robots.

These devices are coded to protect against manipulation by simple means. They cannot be actuated using a normal magnet.

Bypass function: Temporary automatic suppression of one or more safety functions during the normal operation of the machine (EN 61496) by means of a safety control system, e.g. to enable the movement of material into the hazardous area to take place.

Stellglied, das einen Positionsschalter zwangläufig betätigt. Kurvenscheiben werden durch Scharniere von Drehtüren angetrieben.

1. The respective C standards will determine the manner in which locks in safety circuits of a machine control system are to be used. If the designer satisfies this norm he simultaneously also satisfies the requirements of the Machine Directive.

Deviations from the C standard are nevertheless possible at the responsibility of the designer but in these cases the designer must be able to prove that the deviating solution guarantees a safety level which is at least comparable.

If there is no C standard for the case of use, additional information is provided on the use of locks in the B standards.

2. Additional monitoring switches:

An additional monitoring switch serves the purposes of error control and error detection in the event of the safety critical failure of the lock e.g. in the case of an important damage to the internal mechanics.

It is possible to forego the use of an additional monitoring switch

• if an optimal fit is guaranteed, i.e. if a robust door guide with a stable end stop is provided for the entire serviceable life of the door,
• if the admissible locking force has been observed,
• if the actuator is permanently linked with the protective devices, preferably in a concealed position,
• if the actuator consists of one part is has not made of plastic or cast metal,
• if locks have a failsafe mechanism.

Irrespective of this we recommend the use of a second monitoring switch:

• in applications in control category 4 to EN 954-1,
• in non-visible hazard sources, e.g. in the case of radiation, electrical shock and similar.

1. In the case of interlocking devices without locking (in the case of safety switches) a double arrangement is advisable for increased risks if nothing else is proposed in the respective C standard.

Safety group standards, which deal with a particular safety aspect that is applicable to a wide range of machines.

A combination of the probability and the severity of the possible injury or damage to health of a dangerous situation, see EN 292-1, 3.7. The risk, in relation to the hazard seen, is also designated as a function of the amount of possible damage and the probability of this damage occurring.

Time needed for entry into or intervention in the dangerous area, as calculated based on an approach speed.

The contacts are arranged to rub against each other on opening and closing to increase the level of contact reliability and break contacts which are slightly stuck together. This ensures good conductivity with low currents and voltages.

www.elan.de/tweb/gb/prod_index.html

Double safety relay module for emergency-stop control devices, interlocking devices and similar, with differentiated shut-down behaviour (= the demand for the safety function of the safety switchgear connected, e.g. emergency stop, refers to all safety enables and that of the second safety switchgear to only one part of the safety enables). Refer also in this respect to ELAN "SRB 202CA" and ELAN "SRB 400CA".

Safety relay modules to monitor a temporary automatic suppression of one or several safety function(s) during the normal operation of a machine. Refer also here to ELAN "SRB-MSK".

An indication output which shows the condition of the evaluation unit or the guard device or gives an error code.

Make more concrete statements and offer possible solutions for the safety aspects dealt with generally in the basic standards, such as safe distances, surface temperatures, etc.

The use of available information with the aim of recognising dangerous incidents and assessing the risk.

Fuse defective (see LED for operating voltage)

Possible causes: short circuit in the wiring system, earthing short in the wiring system, wrong wiring, overburdening of the outputs.

Module does not start up

• operating voltage too low;
• wire break in reset circuit;
• reset button (sensory system in general) defective;
• feedback circuit defective/open;
• protective device(s) not ready for operation;
• protective device has only switched on 1 channel;
• check start conditions (Reset : Auto start);
• cross-short setting/check wiring in this respect.

... in the case of two-hand modules

NC/NO contacts of the actuators may not overlap.

Need more help?

Please consult our "Agencies" or our employees directly:

Klaus Forbach
Phone: +49 (0)641 9848-273
Fax: +49 (0)641 9848-420

kforbach@remove-this.elan.schmersal.de

Mika Lehtisaari
Phone: +49 (0)641 9848-399
Fax: +49 (0)641 9848-420

mlehtisaari@remove-this.elan.schmersal.de

Ulrich Hofmann
Phone: +49 (0)641 9848-452,
Fax: +49 (0)641 9848-294

uhofmann@remove-this.elan.schmersal.de

Thomas Rühl
Phone: +49 (0)0641 9848-453
Fax: +49 (0)641 9848-266

truehl@remove-this.elan.schmersal.de

Connection level (inputs) for protective devices and emergency-stop command devices. Refer also to the other key-words:

• "Control, 1- or 2-channeled",
• "Emergency-stop command devices",
• "Non-floating inputs",
• "Safety solenoid-operated switches".

For the “Protect” mode of operation, the enable of the switching output is carried out automatically after the end of the protected field interruption (or in case of activation of the restart interlock after resetting) and the end of the protected field interruption.

Devices without coding are intended only for concealed mounting. They can be actuated by any magnet of the BP range.

Type designation for electronic evaluation units for safety functions (Safety monitoring modules)

Include concrete statements or possible solutions for safety equipment such as twohand operation circuits, interlocking devices, etc.

A complete assessment of the probability and the severity of possible injury or damage to health in a dangerous situation, in order to select suitable safety measures. In EN 1050, this term is used as a part of the risk analysis.

A combination of parts and/or components which operate together to provide entry protection or recognition of presence (area protection). ESPE is equipment on which a switching process is brought about by changes in optical fields. The switching process caused by the change in field serves to prevent the start of a dangerous movement or to interrupt a dangerous movement.

Monitoring of the rotation of the motor is not carried out by sensors on the shaft but by direct monitoring of the back e.m.f. at the motor terminals.

The area within which persons or objects are recognised by the ESPE.

safety-related circuitry within a safety relay module, "responsible" for monitoring the input signals, signal processing and control of the enabling level (including the Safety enables). Usually additional status displays and signalling contacts, for example, for operating voltage, switched state of the relay contacts, etc.

Machine safety standards or subject standards which relate to specific safety characteristics of individual types of machine or of machine groupings.

A process to determine whether a risk is acceptable, based on risk analysis and taking into account factors such as social, commercial and environmental aspects.

E = Single fault secure, Control Category 3 to EN 954-1. In normal operation, at least two output signal switching devices (OSSD) must move into the OFF condition, if the sensor unit is activated (Violation of protected field) or the power supply to the ESPE is interrupted.

www.schmersal.com

www.elan.de

Manipulation is when a safety device or safety switch is made inoperative.

The contact/switch travel details shown in the catalogue illustrate the switching behaviour on actuation from position 0 (= unactuated) up to the maximum end position. Closed contacts are represented by dark shading and open contacts by white areas. Other features are shown by means of symbols which are explained inside the back cover.

A unit which determines an interruption of an optical beam generated by the unit itself by an object within the protected field which is not transparent by measurement using optoelectronic emitter and receiver.

A process of risk analysis and risk evaluation. In EN 292-1, these terms are not used in the same sense.

S = Self-monitoring, Control Category 4 to EN 954-1. Protective equipment on which the protecting function is not detracted by a fault within the ESPE. Up to three faults must be recognised within the response time.

Part of a machine which is particularly used as a type of physical barrier for protection. Depending on the conditions, a separating guard device can be called an enclosure, a cover, a screen, a door, sheathing, etc.

Protection against the ingress of solid foreign bodies (Foreign body protection) Protection of persons against contact with live or moving parts (Protection against contact) Protection against the ingress of water (Water protection)

See feedback circuit.

The appliance safety law forms the basis to put the EC Recommendations to Article 100a of the Articles of Rome into effect in national law. The individual EC Recommendations are put into effect by decrees. These apply to manufacturers and importers.

T = Testing, Control Category 2 to EN 954-1. Protective equipment on which the protecting function is checked by means of reaction to an external test signal. An ESPE-T must at least be provided with a start-up test, i.e. testing must take place each time on switch-on. In addition, the possibility of cyclic testing must be provided.

Series circuits of protective devices and emergency-stop command devices do not facilitate control category 4 to EN 954-1 (safety even in cases of error accumulation), maximum control category 3 in the case of a 2-channel series circuit. A different assessment may arise if maintenance intervals are incorporated in the assessment.

With respect to error accumulation (to be taken into consideration for control category 2 to SC4, EN 954-1) there is a risk (see following case study) that an initial short-circuit of the contacts switched in series can be "neutralised" (if a second guard is opened) and then a restart is possible with an undetected error.

Diagram 1:
First error:

• short circuit via contact S1.1 (guard 1)
• guard 1 is opened
• module shuts down on 1 channel
• guard 2 is opened
• module shuts down on 2 channels
• restart is possible

Diagram 2:

• second error added for guard 1
• short circuit via contact S2.1

Diagram 3:

• guard 1 is opened
• module does not shut down
• hazardous state

The above problem does not exist if a safety relay module is used per protective device or emergency-stop device. Please also consider the "Start-up testing" point in this connection.

www.elan.de/tweb/gb/prod_navi.html

Contactor or relay on which the NC and NO contacts are galvanically separated from each other but mechanically connected together.

After a safety function has been requested the safety relay module only switches on again once a reset button (also referred to as start button) has been actuated.

The contrary is the operating mode "Auto start" (Automatic start), which is only admissible under certain conditions (if there is no danger of an unexpected restart) or a reset comes from somewhere else (with a quality corresponding to control category 1 to EN 954-1). Not admissible, for example, in emergency-stop command devices, in accessible rooms etc.

"Trailing edge" or "Edge detection" in this connection means that it is not the rising edge (upon actuating the button) that generates the start signal but the trailing edge after releasing the button. The analysis of the trailing edge or edge detection is an additional safety measure before an unexpected restart in the case of a manipulated or defective button.

Electrical equipment with Certificate of Conformity to the standards EN 50014 to EN 50020 for areas with explosion hazards

On a cyclic operating process, after one intervention in the protected field (e.g. placing in next workpiece) and following enable from the protected field, the machine is automatically started by the AOPD. Any further intervention produces the stop command of the protecting device. During the part of the machine movement which is not dangerous, e.g. for the return movement of the slide, the intervention stroke is cancelled. The cycle can be repeated.

Even if (with a few exceptions) a prototype test is not a statuatory requirement, safety relay modules of the type series PROTECT-SRB (Schmersal) and SRB (Elan) usually have prototype tests from the test and certification body of the Employers' Liability Insurance Association of Precision Mechanics and Electrical Engineering, Cologne. Typical basic circuitry is usually BG prototype tested. The BG tests are based on EN 954-1 and EN 954-2, and on the test principles GS-ET-20 - Principles for the testing and certification of relay safety combinations (edited: HVBG Fachausschuss "Elektrotechnik" Prüf- und Zertifizierungsstelle im BG-Prüfzert).

In addition, almost all assemblies have UL and CSA and c-UL-us certifications (CCC in preparation).

Category B

Requirements (summary):
The safety-related parts of control systems and/or their protective devices as well as their components must be designed, structured, selected, compiled and combined in agreement with the respective standards such that they are able to withstand the influences to be expected.

System behaviour:
The occurrence of an error can lead to a loss of the safety function.

Principle:
Predominantly characterised by selection of components.

Category 1

Requirements (summary):
The requirements of B must be satisfied. Tried and tested components and safety principles must be used.

System behaviour:
The occurrence of an error can lead to a loss of the safety function, but the probability of occurrence is smaller than in category B.

Principle:
Predominantly characterised by selection of components.

Category 2

Requirements (summary):
The requirements of B and the use of tried and tested safety principles must be satisfied. The safety function must be tested at suitable intervals by the machine control system.

System behaviour:
The occurrence of an error can lead to a loss of the safety function between the test intervals. The loss of the safety function is recognised by the test.

Principle:
Predominantly characterised by the structure.

Category 3

Requirements (summary):
The requirements of B and the use of tried and tested safety principles must be satisfied. Safety-related parts must be designed ain such a way that

1. an individual error in each of these parts does not lead to the loss of the safety function and,

2. the individual error is detected whenever performed in an appropriate manner.

System behaviour:
If the individual error occurs the safety function always remains intact. A few but not all the errors are recognised. An accumulation of unrecognised errors can lead to the loss of the safety function.

Principle:
Predominantly characterised by the structure.

Category 4

Requirements (summary):
The requirements of B and the use of tried and tested safety principles must be satisfied. Safety-related parts must be designed in such a way that:

1. an individual error in each of these parts does not lead to the loss of the safety function and,

2. the individual error during or before the next request to the safety function is recognised or, if this is not possible, an accumulation of errors may not lead to the loss of the safety function.

System behaviour:
If the error occur the safety function always remains intact. The errors are recognised in good time to prevent a loss of the safety function.

Principle:
Predominantly characterised by the structure.

Switching system where the switching movement depends on the actuating speed.

Emergency Stop switches on which the actuating element is a wire rope. This can be stretched across the hazardous area and is pulled to actuate the switch.

For the risk assessment to EN 954-1 for safety-relevant electrical circuits, there are five categories for safety related parts of control systems. These categories B, 1, 2, 3 and 4 describe the “resistance” of a control system to faults.

This monitors whether the surface of an AOPD glass is soiled such as to lead to a reduction in the security of detection.

The circuitry of safety relay modules (including the circuitry of Schmersal/Elan types PROTECT and SRB) will usually correspond to control category 4 to EN 954-1. The specification of the control category refers to the module itself, i.e. the control category both of the sensor and the actuator level will depend on it and will depend on structure and incorporation.

A solenoid interlock has the function of locking a separating guard device in the closed position. It is connected to the control system in such a way that the machine cannot be operated if the guard device is not closed and interlocked and that the guard device is held closed until there is no longer a risk of injury.

Number of possible sensor inputs per protective device (or emergency-stop control device). Important for the control category of the sensor level. In the case of 2-channeled control the safety function also remains intact if one channel fails (important for the control category 3 and 4 to EN 954-1).

the latching bolt of a solenoid interlocking device is held in the interlocked position by magnetic force and released by spring force

The unit is notequipped with microprocessors. Control and evaluation, e.g. of a guard door monitor, is carried out using relays

A connection of devices of this type will usually be admissible for all multifunctional safety relay modules of type series PROTECT-SRB, but under consideration of the limit value specified in the data sheets for voltages and current (refer in this respect to data sheet information). The circuitry of the respective modules contains a current and voltage limitation which is essential for safety reasons if devices are connected with NC contacts (in order to counter the risk of contact welding). In the case of devices with NC/NO combinations the current and voltage limitation will be an advantage of availability.

Safety solenoid-operated switches are frequently offered as (certified) subsystem, consisting of sensor and analysis unit (from K.A. Schmersal GmbH as "BNS/AES combinations"). This is associated with the advantage that the "sensor/analysis unit" interface is already tested. In the case of a separate structure (see above) the interface responsibility will be with the user.

Circuitry option for a safety relay module in which short circuits between the input channels in the case of 2-channel control are also detected. A cross short can arise, for example, by a sheathed cable being pinched with the result that a 2-channel emergency-stop circuit does not trigger a shut-down even with only one faulty NC contact (second error).

Safety relay modules with cross-short monitoring are recommended for control category 4 to EN 954-1 (unless the cables are laid in two separate sheathed lines) and for control category 4 to EN 954-1 as an additional measure if (WARNING: conflict with EN 60204-1!) the cables are laid in the safety circuit unprotected (in whole or in part) and there is a risk of damage

the latching bolt of a solenoid interlocking device is held in the interlocked position by spring force and released by magnetic force

of two adjacent contacts or switches, e.g. between S13 and S22. A safety monitoring module can monitor this condition.

A current and voltage restriction is necessary/good idea when connecting safety solenoid-operated switches to safety relay modules. In the case of connecting devices with NC contacts it is essential for safety reasons (in order to counter the risk of contact welding) and with devices with NC/NO contact combinations the current and voltage restriction is an advantage of availability. A connection of safety solenoid-operated switches is usually admissible for all multifunctional safety relay modules of the type series PROTECT-SRB but under consideration of the limit value for voltage and current specified in the data sheets (refer here also to data sheet information).

In addition to the (prime) regulations of the respective C standards (machine safety standards or technical standards referring to a specific safety characteristic of individual machine groups), applies to the structure of safety-related parts of controls EN 954-1 (General design principles) and EN 954-2 (validation).

Testing of the AOPD and its sequential circuit is carried out by the machine control system opening the contact connected to the test/stroke input. This simulates intervention in the protected field, does not however lead to activation of the restart interlock, when the test proceeds successfully. If the contact is operated as part of the machine cycle, this is termed cyclic testing. Cyclic testing simultaneously serves for cancellation of the intervention stroke for single and double stroke modes of operation.

Refer to "Standstill and motion monitoring".

Additional measure recommended for requirements in accordance with control category 4 if the connected protective devices do not have their own start-up testing as, for example, in the case of electro-mechanical interlocking devices.

Start-up testing is only possible for safety relay modules with a so-called 3-relay technology with own start relay. This means that the protective device must first be opened and then closed again after the power supply is switched back before the enables of the safety relay module can be switched through. Start-up testing makes it possible to detect any inconsistencies in the periphery connected upstream and downstream (= "Sensor level" and "Actuator level") if the relay circuitry has lost its capacity for error storage in de-energised state.

Start-up testing tunes the sub-system "Sensory analysis / pre-control level / main control level" in the direction of an overall control category 4 to EN 954-1.

Furthermore, any manipulation of the protective device can be detected using start-up testing. Without start-up testing (or an equivalent measure) the specification of a control category for a module only refers to the circuitry of the module itself.

A programmed fixed reference value for recognition of standstill. On frequency “standstill”, the enable circuits are switched on and solenoid interlocks connected can be opened.

On standstill of a machine, the monitor gives the enable signal for a guard device to be opened. In case of a fault, the secure standstill monitor takes up the safe condition.

After a safety function has been requested the safety relay module only switches on again once a reset button (also referred to as start button) has been actuated.

The contrary is the operating mode "Auto start" (Automatic start), which is only admissible under certain conditions (if there is no danger of an unexpected restart) or a reset comes from somewhere else (with a quality corresponding to control category 1 to EN 954-1). Not admissible, for example, in emergency-stop command devices, in accessible rooms etc.

"Trailing edge" or "Edge detection" in this connection means that it is not the rising edge (upon actuating the button) that generates the start signal but the trailing edge after releasing the button. The analysis of the trailing edge or edge detection is an additional safety measure before an unexpected restart in the case of a manipulated or defective button.

The feedback circuit can also be used to provide a start function by connecting an additional Start push button (NO) into the feedback circuit. The evaluation unit only gives the enable signal when the feedback circuit is closed.

A device which brings the ESPE into the interlocked condition when the electrical supply to the ESPE is switched on or interrupted and switched on again.

A manual or automatic test to EN 61496-1, which is carried out when an ESPE or a guard door monitor has been switched on, to test the complete safety-related control system before the first machine movement is started.

Additional measure recommended for requirements in accordance with control category 4 if the connected protective devices do not have their own start-up testing as, for example, in the case of electro-mechanical interlocking devices.

Start-up testing is only possible for safety relay modules with a so-called 3-relay technology with own start relay. This means that the protective device must first be opened and then closed again after the power supply is switched back before the enables of the safety relay module can be switched through. Start-up testing makes it possible to detect any inconsistencies in the periphery connected upstream and downstream (= "Sensor level" and "Actuator level") if the relay circuitry has lost its capacity for error storage in de-energised state.

Start-up testing tunes the sub-system "Sensory analysis / pre-control level / main control level" in the direction of an overall control category 4 to EN 954-1.

Furthermore, any manipulation of the protective device can be detected using start-up testing. Without start-up testing (or an equivalent measure) the specification of a control category for a module only refers to the circuitry of the module itself.

Circuits serving the safety of individual require special failsafe and error-tolerant measures with respect to detection in the case of error. This is a statuatory requirement based in Germany on the Device Safety Act (GSG) and in Europe on the EC Machine Directive (MD). With respect to the subject of "Controllers", Annex 1, point 1.2.1 of the EC Machine Directive specifies as follows with respect to the basic safety and health requirements in the design and construction of machines and safety components:

"Controllers are to be designed and constructed in such a way that they function safely and reliably so that no dangerous situations may arise. In particular, they must be designed and constructed in such a way that

they withstand the operational stress and outside influences to be expected,

errors in the logic system do not lead to dangerous situations."

Filling in this requirement is a matter for the standard setters according to the so-called new approach of the EC Directive. EN 954-1 and EN 954-2 apply in particular to safety-related parts of machine controllers.

A distinction is made between a safe STOP in three categories.

STOP of category 0 to EN 60204-1 (9.2.2):

Uncontrolled stop by immediate (< 200 ms) shut-down of the power supply to the actuators (refer also to 3.5.6).

STOP of category 1 t oEN 60204-1 (9.2.2):

Controlled stop by interrupting the power supply to the actuator level if, for example, the hazardous movement has been brought to a standstill (time-delayed shut-down of the power supply). Refer also 3.11.

Example (see figure): the controller enable of an electronic drive is shut down immediately by means of an enable of the STOP category 0 and the power contactor only after the operational braking time of the motor (= STOP category 1).

STOP of category 2 t oEN 60204-1 (9.2.2):

Controlled stop. The power supply to the drive element is not interrupted. Additional measures to EN 1037 (protection from unexpected restart) are necessary, e.g. by the use of safety-related standstill watchdog.

Shutdown by immediate switching-off of the power supply (uncontrolled shutdown).

When switching off, the supply is maintained until the machine has come to a standstill. When standstill has been reached, the power supply is interrupted (controlled shutdown).

Division to describe the switching-off characteristics relating to actions in emergencies.

Switching capacity of the enabling contacts (product of current and voltage).

The entirety of parts or devices connected together, of which at least one is a moving part, also as applicable drive elements, control and supply circuits, etc., which are brought together for a particular application, such as processing, treating, material handling and preparation of material. The entirety of several machines, which are so arranged and controlled that they operate together as a single unit to achieve one and the same purpose, is also considered to be a “machine”.

which gives the enable signal, when a machine has come to a standstill, e.g. to open a guard device. In case of a fault, the fail-safe standstill monitor takes up the safe condition. See also standstill monitor.

A device to prevent the automatic re-start of a machine after interruption and renewed enable of the protected field during a dangerous part of the machine cycle or after a change in the mode of operation or actuation of the machine.

After a safety function has been requested the safety relay module only switches on again once a reset button (also referred to as start button) has been actuated.

The contrary is the operating mode "Auto start" (Automatic start), which is only admissible under certain conditions (if there is no danger of an unexpected restart) or a reset comes from somewhere else (with a quality corresponding to control category 1 to EN 954-1). Not admissible, for example, in emergency-stop command devices, in accessible rooms etc.

"Trailing edge" or "Edge detection" in this connection means that it is not the rising edge (upon actuating the button) that generates the start signal but the trailing edge after releasing the button. The analysis of the trailing edge or edge detection is an additional safety measure before an unexpected restart in the case of a manipulated or defective button.

Direction of actuation and switching function (NO/NC) can be determined by the choice of actuating magnet (N or S magnet)

Testing/Inspection principles of the German assessment committee for electrical engineering

is present if the risk is justifiably small or in the absence of unjustifiable risks.

Consumers/actuators e.g. power contactor to control motors, solenoid-operated valves etc., connected downstream of safety relay modules (safety enables).

This word often appears in the Machinery Directive and in standards but without comment or definition. It stands for an undetermined and nonoriented (i.e. not directed to humans and/or things) hazard.

Modulated light which is transmitted via a lens onto the object to be detected or the reflector and is reflected by this, to the receiver via a second lens and is electronically evaluated.

Inductive proximity switch based on the Namur principle to DIN 19234

Time until hazard is no longer present, e.g. on motor standstill

Inherently safe for the eyes to EN 60825-1, no protective measures are necessary for the eyes.

Befehlsgeber, der elektronisch bei Einbringung von festen und flüssigen Materialien, z.B. Glas, Holz, Papier, Metall, Kunststoff, Lebensmittel, Flüssigkeiten usw., in seinen Wirkungsbereich berührungslos und kontaktlos schaltet.

Serves for the registration of travel, positions or speeds. The encoder gives a definite number of electrical impulses for each revolution.

which can be manipulated using simple items, e.g. an uncoded magnet. Uncoded magnetic safety sensors must therefore be mounted in a concealed position, so that manipulation with simple items is not possible.

Reihen-Parallelschaltung, z.B. von Sicherheitsschaltgeräten

Erkennung des Kurzschlusses durch einen Sicherheitsbaustein zwischen den Anschlussleitungen zweier benachbarter Kontakte/Schalter, z.B. zwischen S13 und S22

Voltage controlled drop-out of relay on de-energisation after a preset or fixed time.

Permanent magnets are mounted adjacent to the side of the contacts to deflect the polarised DC switching arc. The arc is thus extinguished more quickly and contact wear reduced.

Stillsetzen durch sofortiges Ausschalten der Energiezufuhr (ungesteuertes Stillsetzen)

Cable lenghts will depend on the cable cross section used. The cable resistance should not exceed a value of 30 ohm (refer to formula). Cable lengths up to 1,000 m will not usually present any problem.

Beschaltungsmöglichkeit eines Sicherheits-Relais-Bausteins, in dem bei 2-kanaliger Ansteuerung auch Kurzschlüsse zwischen den Eingangskanälen erkannt werden. Ein Querschluss kann beispielsweise durch das Quetschen einer Mantelleitung entstehen mit der Folge, dass (u.a.) eine 2-kanalige Not-Aus-Schaltung auch bei nur einem fehlerhaften Öffnerkontakt (Zweitfehler) keine Abschaltung auslöst.

Sicherheits-Relais-Bausteine mit Querschlussüberwachung empfehlen wir für die Steuerungskategorie 4 gemäß EN 954-1 zwingend (es sei denn die Kabelverlegung würde in zwei separaten Mantelleitungen erfolgen) und für die Steuerungskategorie 4 gemäß EN 954-1 als zusätzliche Maßnahme, wenn (ACHTUNG: Konflikt mit EN 60204-1!) die Kabelverlegung im Sicherheitsstromkreis (ganz oder teilweise) ungeschützt erfolgt (erfolgen muss) und ein Beschädigungsrisiko besteht.

Permanent magnets are mounted adjacent to the side of the contacts to deflect the polarised DC switching arc. The arc is thus extinguished more quickly and contact wear reduced.

Beim Abschalten wird die Energie solange aufrecht erhalten, bis der Stillstand der Maschine erreicht ist. Nach Erreichen des Stillstandes erfolgt die Unterbrechung der Energiezufuhr (gesteuertes Stillsetzen)

A source of possible injury or damage to health or “Potential source of damage”

A timing relay which gives an enable signal, when a preset time has elapsed, e.g. to open a guard device. In case of a fault, the fail-safe timer takes up the safe condition.

are pressure-sensitive sensors, which react on the effect of a defined force of an object or a person.

The maximum time duration between the response of the sensor function and the OFF condition of the output switching elements, see also response time.

EEx d IIC T6
EEx: General designation
d: Ignition protection: “Flameproof enclosure“
IIC: Explosion group, materials: Ethylene,
Town gas, Acetaldehyde
T6: Temperature class: 85 °C

is a programmed blanking-out of a part of the protected field of a safety light curtain. This function allows a continuous supply of materials to power-operated equipment, such as brake presses, without the machine being switch off.

A separating protective device or such as is used as a safety measure in order to protect persons from a present or potential hazard.

Within the sense of standardisation another term for control category. According to the philosophy of the standard setter, the different measures of realising a suitable control category under consideration of a risk leads to a residual risk. In this respect therefore the categories do not represent a hierarchy. Rather they are equivalent.

Every area in or around a machine in which a person is in hazard of injury or damage to health. Note: The hazard which brings this risk is either always present or can occur unexpectedly. In newer proposals, the term “Hazard zone” is also mentioned.

A sensor which electronically switches with neither physical contact nor moving parts when light-reflecting material is brought into its area of operation.

Connection facility for non-floating outputs of sensors.
Typically for AOPD’s = Active Optoelectronic Protective Devices, also referred to formerly as "Contact Free Protective Device".

An area which is itself not safety relevant, which supports the area security, e.g. as prewarning before the protected field. This field serves to avoid unintentional stopping of the machine or plant. On AGVS, the measured values of this field can also be used to support navigation.

After actuation, the mechanical position switch or safety switch remains in its switching position and must be manually reset.

A sensor which electronically switches with neither physical contact nor moving parts when ferro-magnetic parts, e.g. metal, are brought into its area of operation.

comprise a emitter and a receiver. The emitter is aligned such that a maximum proportion of the pulsed light from its diode falls onto the physically and optically separate light receiver. This evaluates the light received such that it can be clearly differentiated from ambient light or other light sources. An interruption of the light beam brings about switching of the output.

Not part of our product range.

A positioning element which positively operates a position switch. Cam disks are driven by door hinges, for example.

Intentional overcoming of safety switches either manually or by using readily available items, e.g. screws, keys, coins or tools which are needed for the normal operation of the machine. See protection against manipulation.

Unterteilung zur Beschreibung des Abschaltverhaltens bei Handlungen im Notfall

A complete identification and analysis of all possible hazards for the risk analysis. Also termed hazard analysis in the Machinery Directive. According to Article 100a this stems from the hazard situation and exposure to the hazard, according to Article 118a from the hazard potential based on the operative conditions and surroundings.

Monitored semiconductor outputs serve as safety outputs and can be used in the further circuitry to control contactors, Emergency Stop units or safety PLC systems. The monitored semiconductor outputs are of equal value to positive-guided relay outputs in relation to fault security.

Protective devices with micro-processor-based outputs ("safe semi-conductor outputs") generate text signals to check the correct function of the semi-conductor outputs which may disturb the input level of safety relay modules under certain conditions. Test pulse specimens of commercially available protective devices (of market leading manufactures), in particular of AOPDs, have already been taken into consideration in the circuitry development of our modules and do not generate any interference.

Redundancy is understood to be the existence of more functional means in one unit than necessary to satisfy the required function.

The maximum anglular divergence between the optical axis of the light from the emitter and that received by the receiver within which the AOPD continues to operate normally

safety-related outputs of a safety relay module for the connection of actuators downstream. Refer also to "Analysis level".

Declaration of the manufacturer for the use of a product within the European Community according to the appropriate standards

Connection between the actuator and the switch contact by means of which force exerted on the actuator is directly transmitted to the contact.

A device without separating function, which eliminates or reduces a risk either alone or in combination with a separating protective device.

Inductive proximity switch which is insensitive to strong electro-magnetic fields.

See bi-stable contact

To monitor a number of guard devices; units are connected together by conventional wiring

Devices can be operated on AC or DC supply.

The part of an ESPE which is connected to the machine control system and moves to the OFF condition if the sensor section is actuated during normal operation.

A sensor which electronically switches with neither physical contact nor moving parts, but when solid or liquid materials, e.g. glass, wood, paper, metal, plastic, food or liquids are brought into its sensing range.

Code of practice of German industrial assessors,
which gives references and suggestions regarding
technical products.

Begrifflichkeit unterschiedlicher Bedeutung beim Thema "Maschinensicherheit".

In Zusammenhang mit steuerungstechnischen Fragen ist in der Regel die "Steuerungskategorie" eines sicherheitsgerichteten Teils einer Maschinensteuerung gemäß EN 954-1 gemeint (Bewertung der zusätzlichen Maßnahmen im Hinblick auf die nötige/angestrebte Risikoreduzierung). Siehe hierzu auch BIA-Report 6/97: Kategorien für sicherheitsbezogene Steuerungen

Daneben existiert der Begriff der STOP-Kategorie. Siehe hierzu auch "STOP-Kategorien".

Manchmal wird auch von Sicherheitsschaltern der Kategorie 1 (Schalter mit integrierten Betätigungsorganen = traditionelle Positionsschalter, z.B. Rollenhebelschalter) gesprochen oder von Sicherheitsschaltern der Kategorie 2 (Schalter mit getrennten Betätigungsorganen). Diese Unterteilung hat keinerlei Bezug zur Kategorisierung nach EN 954-1 und betrifft nur die Unterscheidung der beiden unterschiedlichen Arbeitsweisen der Schalter.

Zum Begriff der Steuerungskategorie anverwandte Begriffe:

• SIL (= Safety Integrity Level) entstammt IEC EN 61508 bzw. IEC EN (draft) 62061,
• AK (= Anforderungsklasse) entstammt DIN VDE V 19250/19251 in Verbindung mit DIN VDE V 0801,
• PL (= "Performance Level") entstammt prEN ISO 13849-1 (mittelfristiger Nachfolger von EN 954-1).

Probability of the occurrence of an injury or damage to health. This stands in relationship to the frequency of entry or the duration of presence.

Fuse defective (see LED for operating voltage)

Possible causes: short circuit in the wiring system, earthing short in the wiring system, wrong wiring, overburdening of the outputs.

Module does not start up

• operating voltage too low;
• wire break in reset circuit;
• reset button (sensory system in general) defective;
• feedback circuit defective/open;
• protective device(s) not ready for operation;
• protective device has only switched on 1 channel;
• check start conditions (Reset : Auto start);
• cross-short setting/check wiring in this respect

.... in the case of two-hand modules

NC/NO contacts of the actuators may not overlap.

Need more help?

Please consult our "Agencies" or our employees directly:

Klaus Forbach
Phone: +49 (0)641 9848-273
Fax: +49 (0)641 9848-420

kforbach@remove-this.elan.schmersal.de

Mika Lehtisaari
Phone: +49 (0)641 9848-399
Fax: +49 (0)641 9848-420

mlehtisaari@remove-this.elan.schmersal.de

Ulrich Hofmann
Phone: +49 (0)641 9848-452
Fax: +49 (0)641 9848-294

uhofmann@remove-this.elan.schmersal.de

Thomas Rühl
Phone: +49 (0)0641 9848-453
Fax: +49 (0)641 9848-266

truehl@remove-this.elan.schmersal.de

The Test push button can be used to check the switch-off function of an evaluation unit. When the Test button is operated, the enable contacts must open.

Photo-electric proximity sensors or fibre-optic sensors with reflector.

Safety sensors (Proximity switches for safety functions)

Based on our self-image as specialist for devices and systems serving the protection of man, machine and plant, the Schmersal group offers its customers a broad range of information in the form of specialised books, newsletters, brochures and detailed descriptions in the form technical catalogues.

Please consult your responsible sales partner or the companies of the Schmersal group.

info@remove-this.schmersal.de

info@remove-this.elan.schmersal.de

Current load as dependent on ambient temperature (refer to example).

If a moving mechanical component automatically moves another with it either by means of direct contact or via rigid parts.

A contact which is closed in the rest condition.

Breakage of the actuating wire on pull-wire switches trips the contacts, thus protecting against unnoticed damage.

To monitor a number of guard devices; modules are connected together by ribbon cables

To provide additional enabling paths; units are connected together by conventional wiring

Series-parallel circuits, e.g. of safety switching devices.

These are technological alternatives to relay-based circuitry. They include, for example, programmable compact safety controllers, stored program safety controllers and safety bus systems. Alternatives are particularly interesting for complex machines (if otherwise more than 5 ... 8 safety relay modules are required), for integrated production systems and plants and in tasks requiring a high logic depth of inputs and outputs as well as high demands on visualisation and diagnostic options.

Under the heading of programmable electronics with safety function the following are offered within the Schmersal group:

• K.A. Schmersal GmbH, Wuppertal, offers the sensor/actuator interface "ASi-Safety-at-Work",

• and Elan Schaltelemente GmbH & Co. KG, Wettenberg, offers the compact safety controllers "ESALAN Compact" and "ESALAN safety field bus system", and the "ESALAN-SafetyController" for the safety-related movement and position monitoring of multi-axle machines and in particular of robots.

2fach-Sicherheits-Relais-Baustein für Not-Aus-/Not-Stop-Befehlsgeräte, Verriegelungseinrichtungen u.ä. mit differenziertem Abschaltverhalten (= die Anforderung der Sicherheitsfunktion des einen angeschlossenen Sicherheitsschaltgeräts, z.B. Not-Aus, betrifft alle Sicherheitsfreigaben und die des zweiten Sicherheitsschaltgeräts nur einen Teil der Sicherheitsfreigaben). Siehe hierzu auch "Elan SRB 202CA" und "Elan SRB 400CA".

Electronic fuse (e.g. instead of a glass tube fuse) which responds in the case of excessive currents and only enables the circuitry once the power supply has been switched off and switched on again. The additional measure of switching on and switching off the power supply serves to additional protect against unexpected restart of a hazardous movement, particularly in the operating mode "Auto start" once a short circuit has been eliminated.

Testing of the correct function of subsequent power contactors (or other actuator/contact multiplication) by the NC contacts (preferably with positive operation or comparable) being brought back to the start circuit of the safety relay module. A renewed start process can therefore only be initiated if the NC contacts are closed (in rest position). WARNING: the feedback circuit is no substitute for a 2-channel actuator level (or only under certain circumstances).

is only operative in stroke operation (single or double stroke). It prevents uncontrolled release of the machine stroke. This provides that interventions in the protected field are only accepted as strokes when they are carried out within a predetermined time (e.g. 30s) after the stroke cancellation contact is closed. If this does not take place within this period of time, the re-start interlock is activated.

Photo-electric proximity sensors or fibre-optic sensors without reflector.

Law on electromagnetic compatibility. The EMC Directive applies to appliances which contain electrical and/or electronic components which can cause electro-magnetic interference or the operation which can be affected by such interference.

Positively driven contacts are understood to mean that the NC and NO contacts in a contact system can never be simultaneously opened or simultaneously closed. It must be ensured that a contact distance of at least 0.5 mm exists for the entire serviceable life also in faulty state (contact welding).

The detection capacity of an optoelectronic guard device is the size of obstacle which is recognised in all positions of the protected field and leads to a switch-off signal.

The version of a contact separation as direct result of a determined movement of the operating part of the switch via non-flexible parts.

A contact which is open in the rest condition.

The evaluation electronics to monitor the switching conditions of the contacts is integrated in the switch or safety sensor.

To provide additional enabling paths; modules are connected together by ribbon cables

Term with differing meaning with respect to the subject of "machine safety".

In connection with control issues, this usually refers to the "Control category" of a safety-related part of machine control system to EN 954-1 (assessment of additional measures with respect to necessary / aspired-to reduction). Refer also to BIA-report 6/97: Kategorien für sicherheitsbezogene Steuerungen.

Reference is also made to the STOP category. Refer also to "STOP categories" in this respect.

Reference is also sometimes made to safety switches of the category 1 (switch with integrated actuating organs = traditional positions switch, e.g. roller leaver switch) or to safety switches of category 2 (switch with separate actuating organs). This subdivision has no connection with the categorisation under EN 954-1 and only refers to the distinction between the two different modes of operation of the switches.

Terms used with respect to the control category:

• SIL (= Safety Integrity Level) comes from IEC EN 61508 and IEC EN (draft) 62061,
• DC (= Demand Class) comes from DIN VDE V 19250/19251 in connection with DIN VDE V 0801,
• PL (= "Performance Level") comes from prEN ISO 13849-1 (medium term successor to EN 954-1)

Mode of operation 1: Switches on which the switch contacts and operating element are designed to form a single functional unit. Mode of operation 2: Switches on which the switch contacts and operating element do not form a functional unit, but are functionally brought together or separated on actuation of the switch.

Herstellererklärung für ein Produkt zum Einsatz innerhalb der Europäischen Gemeinschaft entsprechend der angegebenen Normen.

Signalling outputs of a safety relay module which signalise the states of the circuitry (of the module itself or of the periphery connected upstream or downstream, depending on version), e.g. to an operational stored program controller. Important for visualisation and diagnosis (key-word: fault management).

A timing relay which gives an enable signal when a preset time has elapsed, e.g. to open a guard device. In case of a fault, the secure timer takes up the safe condition.

Another word for "Safety relay modules" (comes from the testing principle GS-ET-20: Principles for the testing and certification of relay safety combinations).

“Actions in case of emergency” Stopping in emergency: An action in a case of emergency which is determined to stop a process or movement which is dangerous. Switching off in emergency: An action in a case of emergency which is determined to cut off the electrical supply to a complete or a part of an electrical installation, if there is a risk of an electric shock or some other risk of electrical origin.

safety-related parts of a machine control system with the task of ensuring by means of monitored "redundancy" that no hazardous states or damage to the machine or the product can be caused by errors or faults in the electrical equipment or the probability of such faults or errors occurring is reduced. Refer also in this respect to EN 954-1.

Distance (differential) between the points at which a contact makes and breaks the circuit

The actuator and NC contact must be connected by a direct drive path without sprung parts.

A mechanical, electrical or other device to prevent operation of a machine element under predetermined conditions (usually as long as a separating guard device is not closed).

With overlapping contacts, the NO contact closes before the NC contact opens.

On actuation, opens and closes an electrical circuit at two contact points in each case, see contact diagrams.

Individual modules which are connected together by ribbon cables.

Bei der Kontaktüberdeckung schließt der Schließer, bevor der Öffner öffnet.

A sensor which electronically switches with neither physical contact nor moving parts when light-reflecting material is brought into its area of operation. The fibre-optic sensor comprises a basic unit and a fibre-optic cable.

Maximum current burden for all enabling contacts of a safety relay module.

Risk which remains after carrying out protective measures; the remaining tolerable risk in spite of protective measures.

Term follows the new definition of EN 60204-1 section 9.2.5.4 (emergency actions: shut-down in an emergency = electrical safety / stop in emergency = functional safety).

The circuitry of safety relay modules (including the circuitry of Schmersal/Elan types PROTECT and SRB) will usually correspond to control category 4 to EN 954-1. The specification of the control category refers to the module itself, i.e. the control category both of the sensor and the actuator level will depend on it and will depend on structure and incorporation.

The circuitry of the safety relay module ELAN ("SRB-NA-R-C.25") distinguishes between an interruption of the power supply (case 1) and the demand for a safety function, e.g. the actuation of an emergency-stop control device (case 2). In case 1, the module restarts automatically (operating mode "Auto start") and in case 2 it requires a "Reset" signal. Safety relay modules with differentiated restart may only be used under certain conditions of use, for example, to protect service personnel when deployed in otherwise closed operating rooms.

Positively driven contacts are understood to mean that the NC and NO contacts in a contact system can never be simultaneously opened or simultaneously closed. It must be ensured that a contact distance of at least 0.5 mm exists for the entire serviceable life also in faulty state (contact welding).

With the assistance of the ISD, the switching conditions and possible errors in case of a fault can be quickly identified. Depending on the version of the safety monitoring module, the switching conditions and faults are shown via multi-colour LED’s or provided to the user on a transistor output. The switching conditions and faults can be identified with the assistance of the ISD tables.

On actuation, opens and closes an electrical circuit at one contact point in each case, see contact diagrams.

The devices recognise and monitor signals of hazardous movements and process them in accordance with a set limit value to achieve a control command.

By comparison with monitoring devices used for operational functions, the safety-related standstill and motion watchdogs are characterised by special measures and features which, depending on the safety level to be realised, also guarantee the safety function in the case of error and/or detection. The error analysis refers both to the devices and to the parts of the safety circuit set up before them.

Typical tasks for safety-related standstill and motion watchdogs are as follows:

• Control of solenoid-operated magnets in interlocking devices with locking depending on hazardous overtravel;

• Monitoring of "STOP category 2" (safe stop / safe operational stop);

• Monitoring of reduced speed in special operation of machines and plants with open protective devices.

Various device versions are available for the above tasks both in the Schmersal and in the Elan product range. Please request a main catalogue (Schmersal) or the SSW catalogue (Elan).

Defined blanking-out of a part of the protected field of a safety light curtain with varying position of the blanking, see also blanking.

After a safety function has been requested the safety relay module only switches on again once a reset button (also referred to as start button) has been actuated.

The contrary is the operating mode "Auto start" (Automatic start), which is only admissible under certain conditions (if there is no danger of an unexpected restart) or a reset comes from somewhere else (with a quality corresponding to control category 1 to EN 954-1). Not admissible, for example, in emergency-stop command devices, in accessible rooms etc.

"Trailing edge" or "Edge detection" in this connection means that it is not the rising edge (upon actuating the button) that generates the start signal but the trailing edge after releasing the button. The analysis of the trailing edge or edge detection is an additional safety measure before an unexpected restart in the case of a manipulated or defective button.

After a safety function has been requested the safety relay module only switches on again once a reset button (also referred to as start button) has been actuated.

The contrary is the operating mode "Auto start" (Automatic start), which is only admissible under certain conditions (if there is no danger of an unexpected restart) or a reset comes from somewhere else (with a quality corresponding to control category 1 to EN 954-1). Not admissible, for example, in emergency-stop command devices, in accessible rooms etc.

"Trailing edge" or "Edge detection" in this connection means that it is not the rising edge (upon actuating the button) that generates the start signal but the trailing edge after releasing the button. The analysis of the trailing edge or edge detection is an additional safety measure before an unexpected restart in the case of a manipulated or defective button.

On backlash of guard devices, the end position of a position switch with safety function is often “overrun“, so that the NC contact opens and the NO contact remains open. This leads to a fault indication from the safety monitoring module. In order to avoid this, jumper connections can be used to bring about an extension of the enable delay time.

The safety relay modules for this group (housing width 22.5 or 45 mm) differ from the following points of view (refer also in this respect to product overview "Safety relay modules"):

• multifunctional safety relay modules,
  
• more diagnosis/visualisation,
  
• more safety enables,
  
• monitoring of NC/NO contact combinations,
  
• other supply voltages,
  
• other networks,
  
• two-hand switches.

Snap action system with two galvanically separated contact bridges

In the case of supply voltages (24 VDC) there may be a delayed rise in voltage at the activation moment of the entire system as a result of a short term peaks in the power supply units used. The modules of the type series PROTECT-SRB (Schmersal) and SRB (Elan) have circuitry which also compensates for a "slow" rise in voltage in order to avoid functional disturbances in the "Auto start" operating mode.

Switch with one NC and one NO contact, see contact diagrams to IEC 60617.

Schmersal/Elan internal term for safety relay modules to which all types of protective devices (also AOPD's and safety solenoid-operated switches) can be connected and which also offer additional functions such as visualisation and diagnostic facilities.

Die Kontaktreibung erhöht die Kontaktsicherheit und bricht leichte Kontaktverklebungen auf. Dies gewährleistet bei kleinsten Strömen und Spannungen eine gute Leitfähigkeit.

Suitable for use in humidity of max. 100%. Contacts with ceramic insulation, suitable for voltages up to 500 VAC.

This push button is used, for example, to clear all faults stored in the fault memory.

safety-related outputs of a safety relay module for the connection of actuators downstream. Refer also to "Analysis level".

The safety relay modules of this group (housing width 22.5 mm) are suitable for the connection of 1- and 2-channeled commercially available protective devices (non-floating inputs are usually also admissible here) and of emergency stop command devices. They optionally have the operation mode "Reset / Auto start" and two or three safety enables and a signalling contact. Refer also in this respect to product overview "Safety relay modules".

On a cyclic operating process, after two interventions in the protected field (e.g. removal of a finished part and placing in next workpiece) and following enable from the protected field, the machine is automatically started by the AOPD. The further actions are carried out as for “Single stroke” mode of operation.

Not part of our product range.

Shown by the way of example of the modules ELAN "SRB 308IT" and ELAN "SRB 219IT" (with time delayed enable).

Connection facility foru p to 6 protective devices and/or emergency-stop command devices acting on one enable level.

Bei der Kontaktstaffelung schließen oder öffnen die Kontakte nacheinander.

Safety relay modules for two-hand switches (protective device requiring the simultaneous use of both hands, i.e. the hands are kept from the hazardous area in order to initiate the operation of a machine and maintain operation for as long as a hazardous state exists. They must first satisfy the safety requirements laid down in particular in EN 574. Refer also to ELAN "SRB 201ZH".

The maximum time duration between actuation of the sensor function and the OFF condition of the output switching elements

Safety output which is monitored for correct function by the safety monitoring module

A connection of devices of this type will usually be admissible for all multifunctional safety relay modules of type series PROTECT-SRB, but under consideration of the limit value specified in the data sheets for voltages and current (refer in this respect to data sheet information). The circuitry of the respective modules contains a current and voltage limitation which is essential for safety reasons if devices are connected with NC contacts (in order to counter the risk of contact welding). In the case of devices with NC/NO combinations the current and voltage limitation will be an advantage of availability.

Safety solenoid-operated switches are frequently offered as (certified) subsystem, consisting of sensor and analysis unit (from K.A. Schmersal GmbH as "BNS/AES combinations"). This is associated with the advantage that the "sensor/analysis unit" interface is already tested. In the case of a separate structure (see above) the interface responsibility will be with the user.

www.elan.de/tweb/gb/prod_index.html

By means of the coded actuating magnets, the coded magnetic safety sensors are protected against manipulation by simple means. Actuation using conventional magnets and tools is thus eliminated.

A manually operated switch, in particular for Emergency Stop operations, often with latch.

Das Gerät ist nicht mit Mikroprozessoren ausgestattet. Steuerung und Auswertung, z.B. eines Schutztürwächters, ist in Relaistechnik ausgeführt.

The basic safety standards, which lay down the basic terms and the guiding principles for all machines.

After a safety function has been requested the safety relay module only switches on again once a reset button (also referred to as start button) has been actuated.

The contrary is the operating mode "Auto start" (Automatic start), which is only admissible under certain conditions (if there is no danger of an unexpected restart) or a reset comes from somewhere else (with a quality corresponding to control category 1 to EN 954-1). Not admissible, for example, in emergency-stop command devices, in accessible rooms etc.

"Trailing edge" or "Edge detection" in this connection means that it is not the rising edge (upon actuating the button) that generates the start signal but the trailing edge after releasing the button. The analysis of the trailing edge or edge detection is an additional safety measure before an unexpected restart in the case of a manipulated or defective button.

An enabling path is the safe output of the safety monitoring module which can be integrated in the safety circuit of the machine. In the safe switched- off condition, this circuit must always be open, since the safe condition must always be reached by switching off the electrical supply (“fail-safe” mode of operation). The enabling path is formed by the NO contacts of the safety relays wired in series.

www.schmersal.com

www.elan.de

These are technological alternatives to relay-based circuitry. They include, for example, programmable compact safety controllers, stored program safety controllers and safety bus systems. Alternatives are particularly interesting for complex machines (if otherwise more than 5 ... 8 safety relay modules are required), for integrated production systems and plants and in tasks requiring a high logic depth of inputs and outputs as well as high demands on visualisation and diagnostic options.

Under the heading of programmable electronics with safety function the following are offered within the Schmersal group:

• K.A. Schmersal GmbH, Wuppertal, offers the sensor/actuator interface "ASi-Safety-at-Work",

• and Elan Schaltelemente GmbH & Co. KG, Wettenberg, offers the compact safety controllers "ESALAN Compact" and "ESALAN safety field bus system", and the "ESALAN-SafetyController" for the safety-related movement and position monitoring of multi-axle machines and in particular of robots.

These devices are coded to protect against manipulation by simple means. They cannot be actuated using a normal magnet.

Bypass function: Temporary automatic suppression of one or more safety functions during the normal operation of the machine (EN 61496) by means of a safety control system, e.g. to enable the movement of material into the hazardous area to take place.

Stellglied, das einen Positionsschalter zwangläufig betätigt. Kurvenscheiben werden durch Scharniere von Drehtüren angetrieben.

1. The respective C standards will determine the manner in which locks in safety circuits of a machine control system are to be used. If the designer satisfies this norm he simultaneously also satisfies the requirements of the Machine Directive.

Deviations from the C standard are nevertheless possible at the responsibility of the designer but in these cases the designer must be able to prove that the deviating solution guarantees a safety level which is at least comparable.

If there is no C standard for the case of use, additional information is provided on the use of locks in the B standards.

2. Additional monitoring switches:

An additional monitoring switch serves the purposes of error control and error detection in the event of the safety critical failure of the lock e.g. in the case of an important damage to the internal mechanics.

It is possible to forego the use of an additional monitoring switch

• if an optimal fit is guaranteed, i.e. if a robust door guide with a stable end stop is provided for the entire serviceable life of the door,
• if the admissible locking force has been observed,
• if the actuator is permanently linked with the protective devices, preferably in a concealed position,
• if the actuator consists of one part is has not made of plastic or cast metal,
• if locks have a failsafe mechanism.

Irrespective of this we recommend the use of a second monitoring switch:

• in applications in control category 4 to EN 954-1,
• in non-visible hazard sources, e.g. in the case of radiation, electrical shock and similar.

1. In the case of interlocking devices without locking (in the case of safety switches) a double arrangement is advisable for increased risks if nothing else is proposed in the respective C standard.

Safety group standards, which deal with a particular safety aspect that is applicable to a wide range of machines.

A combination of the probability and the severity of the possible injury or damage to health of a dangerous situation, see EN 292-1, 3.7. The risk, in relation to the hazard seen, is also designated as a function of the amount of possible damage and the probability of this damage occurring.

Time needed for entry into or intervention in the dangerous area, as calculated based on an approach speed.

The contacts are arranged to rub against each other on opening and closing to increase the level of contact reliability and break contacts which are slightly stuck together. This ensures good conductivity with low currents and voltages.

www.elan.de/tweb/gb/prod_index.html

Double safety relay module for emergency-stop control devices, interlocking devices and similar, with differentiated shut-down behaviour (= the demand for the safety function of the safety switchgear connected, e.g. emergency stop, refers to all safety enables and that of the second safety switchgear to only one part of the safety enables). Refer also in this respect to ELAN "SRB 202CA" and ELAN "SRB 400CA".

Safety relay modules to monitor a temporary automatic suppression of one or several safety function(s) during the normal operation of a machine. Refer also here to ELAN "SRB-MSK".

An indication output which shows the condition of the evaluation unit or the guard device or gives an error code.

Make more concrete statements and offer possible solutions for the safety aspects dealt with generally in the basic standards, such as safe distances, surface temperatures, etc.

The use of available information with the aim of recognising dangerous incidents and assessing the risk.

Fuse defective (see LED for operating voltage)

Possible causes: short circuit in the wiring system, earthing short in the wiring system, wrong wiring, overburdening of the outputs.

Module does not start up

• operating voltage too low;
• wire break in reset circuit;
• reset button (sensory system in general) defective;
• feedback circuit defective/open;
• protective device(s) not ready for operation;
• protective device has only switched on 1 channel;
• check start conditions (Reset : Auto start);
• cross-short setting/check wiring in this respect.

... in the case of two-hand modules

NC/NO contacts of the actuators may not overlap.

Need more help?

Please consult our "Agencies" or our employees directly:

Klaus Forbach
Phone: +49 (0)641 9848-273
Fax: +49 (0)641 9848-420

kforbach@remove-this.elan.schmersal.de

Mika Lehtisaari
Phone: +49 (0)641 9848-399
Fax: +49 (0)641 9848-420

mlehtisaari@remove-this.elan.schmersal.de

Ulrich Hofmann
Phone: +49 (0)641 9848-452,
Fax: +49 (0)641 9848-294

uhofmann@remove-this.elan.schmersal.de

Thomas Rühl
Phone: +49 (0)0641 9848-453
Fax: +49 (0)641 9848-266

truehl@remove-this.elan.schmersal.de

Connection level (inputs) for protective devices and emergency-stop command devices. Refer also to the other key-words:

• "Control, 1- or 2-channeled",
• "Emergency-stop command devices",
• "Non-floating inputs",
• "Safety solenoid-operated switches".

For the “Protect” mode of operation, the enable of the switching output is carried out automatically after the end of the protected field interruption (or in case of activation of the restart interlock after resetting) and the end of the protected field interruption.

Devices without coding are intended only for concealed mounting. They can be actuated by any magnet of the BP range.

Type designation for electronic evaluation units for safety functions (Safety monitoring modules)

Include concrete statements or possible solutions for safety equipment such as twohand operation circuits, interlocking devices, etc.

A complete assessment of the probability and the severity of possible injury or damage to health in a dangerous situation, in order to select suitable safety measures. In EN 1050, this term is used as a part of the risk analysis.

A combination of parts and/or components which operate together to provide entry protection or recognition of presence (area protection). ESPE is equipment on which a switching process is brought about by changes in optical fields. The switching process caused by the change in field serves to prevent the start of a dangerous movement or to interrupt a dangerous movement.

Monitoring of the rotation of the motor is not carried out by sensors on the shaft but by direct monitoring of the back e.m.f. at the motor terminals.

The area within which persons or objects are recognised by the ESPE.

safety-related circuitry within a safety relay module, "responsible" for monitoring the input signals, signal processing and control of the enabling level (including the Safety enables). Usually additional status displays and signalling contacts, for example, for operating voltage, switched state of the relay contacts, etc.

Machine safety standards or subject standards which relate to specific safety characteristics of individual types of machine or of machine groupings.

A process to determine whether a risk is acceptable, based on risk analysis and taking into account factors such as social, commercial and environmental aspects.

E = Single fault secure, Control Category 3 to EN 954-1. In normal operation, at least two output signal switching devices (OSSD) must move into the OFF condition, if the sensor unit is activated (Violation of protected field) or the power supply to the ESPE is interrupted.

www.schmersal.com

www.elan.de

Manipulation is when a safety device or safety switch is made inoperative.

The contact/switch travel details shown in the catalogue illustrate the switching behaviour on actuation from position 0 (= unactuated) up to the maximum end position. Closed contacts are represented by dark shading and open contacts by white areas. Other features are shown by means of symbols which are explained inside the back cover.

A unit which determines an interruption of an optical beam generated by the unit itself by an object within the protected field which is not transparent by measurement using optoelectronic emitter and receiver.

A process of risk analysis and risk evaluation. In EN 292-1, these terms are not used in the same sense.

S = Self-monitoring, Control Category 4 to EN 954-1. Protective equipment on which the protecting function is not detracted by a fault within the ESPE. Up to three faults must be recognised within the response time.

Part of a machine which is particularly used as a type of physical barrier for protection. Depending on the conditions, a separating guard device can be called an enclosure, a cover, a screen, a door, sheathing, etc.

Protection against the ingress of solid foreign bodies (Foreign body protection) Protection of persons against contact with live or moving parts (Protection against contact) Protection against the ingress of water (Water protection)

See feedback circuit.

The appliance safety law forms the basis to put the EC Recommendations to Article 100a of the Articles of Rome into effect in national law. The individual EC Recommendations are put into effect by decrees. These apply to manufacturers and importers.

T = Testing, Control Category 2 to EN 954-1. Protective equipment on which the protecting function is checked by means of reaction to an external test signal. An ESPE-T must at least be provided with a start-up test, i.e. testing must take place each time on switch-on. In addition, the possibility of cyclic testing must be provided.

Series circuits of protective devices and emergency-stop command devices do not facilitate control category 4 to EN 954-1 (safety even in cases of error accumulation), maximum control category 3 in the case of a 2-channel series circuit. A different assessment may arise if maintenance intervals are incorporated in the assessment.

With respect to error accumulation (to be taken into consideration for control category 2 to SC4, EN 954-1) there is a risk (see following case study) that an initial short-circuit of the contacts switched in series can be "neutralised" (if a second guard is opened) and then a restart is possible with an undetected error.

Diagram 1:
First error:

• short circuit via contact S1.1 (guard 1)
• guard 1 is opened
• module shuts down on 1 channel
• guard 2 is opened
• module shuts down on 2 channels
• restart is possible

Diagram 2:

• second error added for guard 1
• short circuit via contact S2.1

Diagram 3:

• guard 1 is opened
• module does not shut down
• hazardous state

The above problem does not exist if a safety relay module is used per protective device or emergency-stop device. Please also consider the "Start-up testing" point in this connection.

www.elan.de/tweb/gb/prod_navi.html

Contactor or relay on which the NC and NO contacts are galvanically separated from each other but mechanically connected together.

After a safety function has been requested the safety relay module only switches on again once a reset button (also referred to as start button) has been actuated.

The contrary is the operating mode "Auto start" (Automatic start), which is only admissible under certain conditions (if there is no danger of an unexpected restart) or a reset comes from somewhere else (with a quality corresponding to control category 1 to EN 954-1). Not admissible, for example, in emergency-stop command devices, in accessible rooms etc.

"Trailing edge" or "Edge detection" in this connection means that it is not the rising edge (upon actuating the button) that generates the start signal but the trailing edge after releasing the button. The analysis of the trailing edge or edge detection is an additional safety measure before an unexpected restart in the case of a manipulated or defective button.

Electrical equipment with Certificate of Conformity to the standards EN 50014 to EN 50020 for areas with explosion hazards

On a cyclic operating process, after one intervention in the protected field (e.g. placing in next workpiece) and following enable from the protected field, the machine is automatically started by the AOPD. Any further intervention produces the stop command of the protecting device. During the part of the machine movement which is not dangerous, e.g. for the return movement of the slide, the intervention stroke is cancelled. The cycle can be repeated.

Even if (with a few exceptions) a prototype test is not a statuatory requirement, safety relay modules of the type series PROTECT-SRB (Schmersal) and SRB (Elan) usually have prototype tests from the test and certification body of the Employers' Liability Insurance Association of Precision Mechanics and Electrical Engineering, Cologne. Typical basic circuitry is usually BG prototype tested. The BG tests are based on EN 954-1 and EN 954-2, and on the test principles GS-ET-20 - Principles for the testing and certification of relay safety combinations (edited: HVBG Fachausschuss "Elektrotechnik" Prüf- und Zertifizierungsstelle im BG-Prüfzert).

In addition, almost all assemblies have UL and CSA and c-UL-us certifications (CCC in preparation).

Category B

Requirements (summary):
The safety-related parts of control systems and/or their protective devices as well as their components must be designed, structured, selected, compiled and combined in agreement with the respective standards such that they are able to withstand the influences to be expected.

System behaviour:
The occurrence of an error can lead to a loss of the safety function.

Principle:
Predominantly characterised by selection of components.

Category 1

Requirements (summary):
The requirements of B must be satisfied. Tried and tested components and safety principles must be used.

System behaviour:
The occurrence of an error can lead to a loss of the safety function, but the probability of occurrence is smaller than in category B.

Principle:
Predominantly characterised by selection of components.

Category 2

Requirements (summary):
The requirements of B and the use of tried and tested safety principles must be satisfied. The safety function must be tested at suitable intervals by the machine control system.

System behaviour:
The occurrence of an error can lead to a loss of the safety function between the test intervals. The loss of the safety function is recognised by the test.

Principle:
Predominantly characterised by the structure.

Category 3

Requirements (summary):
The requirements of B and the use of tried and tested safety principles must be satisfied. Safety-related parts must be designed ain such a way that

1. an individual error in each of these parts does not lead to the loss of the safety function and,

2. the individual error is detected whenever performed in an appropriate manner.

System behaviour:
If the individual error occurs the safety function always remains intact. A few but not all the errors are recognised. An accumulation of unrecognised errors can lead to the loss of the safety function.

Principle:
Predominantly characterised by the structure.

Category 4

Requirements (summary):
The requirements of B and the use of tried and tested safety principles must be satisfied. Safety-related parts must be designed in such a way that:

1. an individual error in each of these parts does not lead to the loss of the safety function and,

2. the individual error during or before the next request to the safety function is recognised or, if this is not possible, an accumulation of errors may not lead to the loss of the safety function.

System behaviour:
If the error occur the safety function always remains intact. The errors are recognised in good time to prevent a loss of the safety function.

Principle:
Predominantly characterised by the structure.

Switching system where the switching movement depends on the actuating speed.

Emergency Stop switches on which the actuating element is a wire rope. This can be stretched across the hazardous area and is pulled to actuate the switch.

For the risk assessment to EN 954-1 for safety-relevant electrical circuits, there are five categories for safety related parts of control systems. These categories B, 1, 2, 3 and 4 describe the “resistance” of a control system to faults.

This monitors whether the surface of an AOPD glass is soiled such as to lead to a reduction in the security of detection.

The circuitry of safety relay modules (including the circuitry of Schmersal/Elan types PROTECT and SRB) will usually correspond to control category 4 to EN 954-1. The specification of the control category refers to the module itself, i.e. the control category both of the sensor and the actuator level will depend on it and will depend on structure and incorporation.

A solenoid interlock has the function of locking a separating guard device in the closed position. It is connected to the control system in such a way that the machine cannot be operated if the guard device is not closed and interlocked and that the guard device is held closed until there is no longer a risk of injury.

Number of possible sensor inputs per protective device (or emergency-stop control device). Important for the control category of the sensor level. In the case of 2-channeled control the safety function also remains intact if one channel fails (important for the control category 3 and 4 to EN 954-1).

the latching bolt of a solenoid interlocking device is held in the interlocked position by magnetic force and released by spring force

The unit is notequipped with microprocessors. Control and evaluation, e.g. of a guard door monitor, is carried out using relays

A connection of devices of this type will usually be admissible for all multifunctional safety relay modules of type series PROTECT-SRB, but under consideration of the limit value specified in the data sheets for voltages and current (refer in this respect to data sheet information). The circuitry of the respective modules contains a current and voltage limitation which is essential for safety reasons if devices are connected with NC contacts (in order to counter the risk of contact welding). In the case of devices with NC/NO combinations the current and voltage limitation will be an advantage of availability.

Safety solenoid-operated switches are frequently offered as (certified) subsystem, consisting of sensor and analysis unit (from K.A. Schmersal GmbH as "BNS/AES combinations"). This is associated with the advantage that the "sensor/analysis unit" interface is already tested. In the case of a separate structure (see above) the interface responsibility will be with the user.

Circuitry option for a safety relay module in which short circuits between the input channels in the case of 2-channel control are also detected. A cross short can arise, for example, by a sheathed cable being pinched with the result that a 2-channel emergency-stop circuit does not trigger a shut-down even with only one faulty NC contact (second error).

Safety relay modules with cross-short monitoring are recommended for control category 4 to EN 954-1 (unless the cables are laid in two separate sheathed lines) and for control category 4 to EN 954-1 as an additional measure if (WARNING: conflict with EN 60204-1!) the cables are laid in the safety circuit unprotected (in whole or in part) and there is a risk of damage

the latching bolt of a solenoid interlocking device is held in the interlocked position by spring force and released by magnetic force

of two adjacent contacts or switches, e.g. between S13 and S22. A safety monitoring module can monitor this condition.

A current and voltage restriction is necessary/good idea when connecting safety solenoid-operated switches to safety relay modules. In the case of connecting devices with NC contacts it is essential for safety reasons (in order to counter the risk of contact welding) and with devices with NC/NO contact combinations the current and voltage restriction is an advantage of availability. A connection of safety solenoid-operated switches is usually admissible for all multifunctional safety relay modules of the type series PROTECT-SRB but under consideration of the limit value for voltage and current specified in the data sheets (refer here also to data sheet information).

In addition to the (prime) regulations of the respective C standards (machine safety standards or technical standards referring to a specific safety characteristic of individual machine groups), applies to the structure of safety-related parts of controls EN 954-1 (General design principles) and EN 954-2 (validation).

Testing of the AOPD and its sequential circuit is carried out by the machine control system opening the contact connected to the test/stroke input. This simulates intervention in the protected field, does not however lead to activation of the restart interlock, when the test proceeds successfully. If the contact is operated as part of the machine cycle, this is termed cyclic testing. Cyclic testing simultaneously serves for cancellation of the intervention stroke for single and double stroke modes of operation.

Refer to "Standstill and motion monitoring".

Additional measure recommended for requirements in accordance with control category 4 if the connected protective devices do not have their own start-up testing as, for example, in the case of electro-mechanical interlocking devices.

Start-up testing is only possible for safety relay modules with a so-called 3-relay technology with own start relay. This means that the protective device must first be opened and then closed again after the power supply is switched back before the enables of the safety relay module can be switched through. Start-up testing makes it possible to detect any inconsistencies in the periphery connected upstream and downstream (= "Sensor level" and "Actuator level") if the relay circuitry has lost its capacity for error storage in de-energised state.

Start-up testing tunes the sub-system "Sensory analysis / pre-control level / main control level" in the direction of an overall control category 4 to EN 954-1.

Furthermore, any manipulation of the protective device can be detected using start-up testing. Without start-up testing (or an equivalent measure) the specification of a control category for a module only refers to the circuitry of the module itself.

A programmed fixed reference value for recognition of standstill. On frequency “standstill”, the enable circuits are switched on and solenoid interlocks connected can be opened.

On standstill of a machine, the monitor gives the enable signal for a guard device to be opened. In case of a fault, the secure standstill monitor takes up the safe condition.

After a safety function has been requested the safety relay module only switches on again once a reset button (also referred to as start button) has been actuated.

The contrary is the operating mode "Auto start" (Automatic start), which is only admissible under certain conditions (if there is no danger of an unexpected restart) or a reset comes from somewhere else (with a quality corresponding to control category 1 to EN 954-1). Not admissible, for example, in emergency-stop command devices, in accessible rooms etc.

"Trailing edge" or "Edge detection" in this connection means that it is not the rising edge (upon actuating the button) that generates the start signal but the trailing edge after releasing the button. The analysis of the trailing edge or edge detection is an additional safety measure before an unexpected restart in the case of a manipulated or defective button.

The feedback circuit can also be used to provide a start function by connecting an additional Start push button (NO) into the feedback circuit. The evaluation unit only gives the enable signal when the feedback circuit is closed.

A device which brings the ESPE into the interlocked condition when the electrical supply to the ESPE is switched on or interrupted and switched on again.

A manual or automatic test to EN 61496-1, which is carried out when an ESPE or a guard door monitor has been switched on, to test the complete safety-related control system before the first machine movement is started.

Additional measure recommended for requirements in accordance with control category 4 if the connected protective devices do not have their own start-up testing as, for example, in the case of electro-mechanical interlocking devices.

Start-up testing is only possible for safety relay modules with a so-called 3-relay technology with own start relay. This means that the protective device must first be opened and then closed again after the power supply is switched back before the enables of the safety relay module can be switched through. Start-up testing makes it possible to detect any inconsistencies in the periphery connected upstream and downstream (= "Sensor level" and "Actuator level") if the relay circuitry has lost its capacity for error storage in de-energised state.

Start-up testing tunes the sub-system "Sensory analysis / pre-control level / main control level" in the direction of an overall control category 4 to EN 954-1.

Furthermore, any manipulation of the protective device can be detected using start-up testing. Without start-up testing (or an equivalent measure) the specification of a control category for a module only refers to the circuitry of the module itself.

Circuits serving the safety of individual require special failsafe and error-tolerant measures with respect to detection in the case of error. This is a statuatory requirement based in Germany on the Device Safety Act (GSG) and in Europe on the EC Machine Directive (MD). With respect to the subject of "Controllers", Annex 1, point 1.2.1 of the EC Machine Directive specifies as follows with respect to the basic safety and health requirements in the design and construction of machines and safety components:

"Controllers are to be designed and constructed in such a way that they function safely and reliably so that no dangerous situations may arise. In particular, they must be designed and constructed in such a way that

they withstand the operational stress and outside influences to be expected,

errors in the logic system do not lead to dangerous situations."

Filling in this requirement is a matter for the standard setters according to the so-called new approach of the EC Directive. EN 954-1 and EN 954-2 apply in particular to safety-related parts of machine controllers.

A distinction is made between a safe STOP in three categories.

STOP of category 0 to EN 60204-1 (9.2.2):

Uncontrolled stop by immediate (< 200 ms) shut-down of the power supply to the actuators (refer also to 3.5.6).

STOP of category 1 t oEN 60204-1 (9.2.2):

Controlled stop by interrupting the power supply to the actuator level if, for example, the hazardous movement has been brought to a standstill (time-delayed shut-down of the power supply). Refer also 3.11.

Example (see figure): the controller enable of an electronic drive is shut down immediately by means of an enable of the STOP category 0 and the power contactor only after the operational braking time of the motor (= STOP category 1).

STOP of category 2 t oEN 60204-1 (9.2.2):

Controlled stop. The power supply to the drive element is not interrupted. Additional measures to EN 1037 (protection from unexpected restart) are necessary, e.g. by the use of safety-related standstill watchdog.

Shutdown by immediate switching-off of the power supply (uncontrolled shutdown).

When switching off, the supply is maintained until the machine has come to a standstill. When standstill has been reached, the power supply is interrupted (controlled shutdown).

Division to describe the switching-off characteristics relating to actions in emergencies.

Switching capacity of the enabling contacts (product of current and voltage).

The entirety of parts or devices connected together, of which at least one is a moving part, also as applicable drive elements, control and supply circuits, etc., which are brought together for a particular application, such as processing, treating, material handling and preparation of material. The entirety of several machines, which are so arranged and controlled that they operate together as a single unit to achieve one and the same purpose, is also considered to be a “machine”.

which gives the enable signal, when a machine has come to a standstill, e.g. to open a guard device. In case of a fault, the fail-safe standstill monitor takes up the safe condition. See also standstill monitor.

A device to prevent the automatic re-start of a machine after interruption and renewed enable of the protected field during a dangerous part of the machine cycle or after a change in the mode of operation or actuation of the machine.

After a safety function has been requested the safety relay module only switches on again once a reset button (also referred to as start button) has been actuated.

The contrary is the operating mode "Auto start" (Automatic start), which is only admissible under certain conditions (if there is no danger of an unexpected restart) or a reset comes from somewhere else (with a quality corresponding to control category 1 to EN 954-1). Not admissible, for example, in emergency-stop command devices, in accessible rooms etc.

"Trailing edge" or "Edge detection" in this connection means that it is not the rising edge (upon actuating the button) that generates the start signal but the trailing edge after releasing the button. The analysis of the trailing edge or edge detection is an additional safety measure before an unexpected restart in the case of a manipulated or defective button.

Direction of actuation and switching function (NO/NC) can be determined by the choice of actuating magnet (N or S magnet)

Testing/Inspection principles of the German assessment committee for electrical engineering

is present if the risk is justifiably small or in the absence of unjustifiable risks.

Consumers/actuators e.g. power contactor to control motors, solenoid-operated valves etc., connected downstream of safety relay modules (safety enables).

This word often appears in the Machinery Directive and in standards but without comment or definition. It stands for an undetermined and nonoriented (i.e. not directed to humans and/or things) hazard.

Modulated light which is transmitted via a lens onto the object to be detected or the reflector and is reflected by this, to the receiver via a second lens and is electronically evaluated.

Inductive proximity switch based on the Namur principle to DIN 19234

Time until hazard is no longer present, e.g. on motor standstill

Inherently safe for the eyes to EN 60825-1, no protective measures are necessary for the eyes.

Befehlsgeber, der elektronisch bei Einbringung von festen und flüssigen Materialien, z.B. Glas, Holz, Papier, Metall, Kunststoff, Lebensmittel, Flüssigkeiten usw., in seinen Wirkungsbereich berührungslos und kontaktlos schaltet.

Serves for the registration of travel, positions or speeds. The encoder gives a definite number of electrical impulses for each revolution.

which can be manipulated using simple items, e.g. an uncoded magnet. Uncoded magnetic safety sensors must therefore be mounted in a concealed position, so that manipulation with simple items is not possible.

Reihen-Parallelschaltung, z.B. von Sicherheitsschaltgeräten

Erkennung des Kurzschlusses durch einen Sicherheitsbaustein zwischen den Anschlussleitungen zweier benachbarter Kontakte/Schalter, z.B. zwischen S13 und S22

Voltage controlled drop-out of relay on de-energisation after a preset or fixed time.

Permanent magnets are mounted adjacent to the side of the contacts to deflect the polarised DC switching arc. The arc is thus extinguished more quickly and contact wear reduced.

Stillsetzen durch sofortiges Ausschalten der Energiezufuhr (ungesteuertes Stillsetzen)

Cable lenghts will depend on the cable cross section used. The cable resistance should not exceed a value of 30 ohm (refer to formula). Cable lengths up to 1,000 m will not usually present any problem.

Beschaltungsmöglichkeit eines Sicherheits-Relais-Bausteins, in dem bei 2-kanaliger Ansteuerung auch Kurzschlüsse zwischen den Eingangskanälen erkannt werden. Ein Querschluss kann beispielsweise durch das Quetschen einer Mantelleitung entstehen mit der Folge, dass (u.a.) eine 2-kanalige Not-Aus-Schaltung auch bei nur einem fehlerhaften Öffnerkontakt (Zweitfehler) keine Abschaltung auslöst.

Sicherheits-Relais-Bausteine mit Querschlussüberwachung empfehlen wir für die Steuerungskategorie 4 gemäß EN 954-1 zwingend (es sei denn die Kabelverlegung würde in zwei separaten Mantelleitungen erfolgen) und für die Steuerungskategorie 4 gemäß EN 954-1 als zusätzliche Maßnahme, wenn (ACHTUNG: Konflikt mit EN 60204-1!) die Kabelverlegung im Sicherheitsstromkreis (ganz oder teilweise) ungeschützt erfolgt (erfolgen muss) und ein Beschädigungsrisiko besteht.

Permanent magnets are mounted adjacent to the side of the contacts to deflect the polarised DC switching arc. The arc is thus extinguished more quickly and contact wear reduced.

Beim Abschalten wird die Energie solange aufrecht erhalten, bis der Stillstand der Maschine erreicht ist. Nach Erreichen des Stillstandes erfolgt die Unterbrechung der Energiezufuhr (gesteuertes Stillsetzen)

A source of possible injury or damage to health or “Potential source of damage”

A timing relay which gives an enable signal, when a preset time has elapsed, e.g. to open a guard device. In case of a fault, the fail-safe timer takes up the safe condition.

are pressure-sensitive sensors, which react on the effect of a defined force of an object or a person.

The maximum time duration between the response of the sensor function and the OFF condition of the output switching elements, see also response time.

EEx d IIC T6
EEx: General designation
d: Ignition protection: “Flameproof enclosure“
IIC: Explosion group, materials: Ethylene,
Town gas, Acetaldehyde
T6: Temperature class: 85 °C

is a programmed blanking-out of a part of the protected field of a safety light curtain. This function allows a continuous supply of materials to power-operated equipment, such as brake presses, without the machine being switch off.

A separating protective device or such as is used as a safety measure in order to protect persons from a present or potential hazard.

Within the sense of standardisation another term for control category. According to the philosophy of the standard setter, the different measures of realising a suitable control category under consideration of a risk leads to a residual risk. In this respect therefore the categories do not represent a hierarchy. Rather they are equivalent.

Every area in or around a machine in which a person is in hazard of injury or damage to health. Note: The hazard which brings this risk is either always present or can occur unexpectedly. In newer proposals, the term “Hazard zone” is also mentioned.

A sensor which electronically switches with neither physical contact nor moving parts when light-reflecting material is brought into its area of operation.

Connection facility for non-floating outputs of sensors.
Typically for AOPD’s = Active Optoelectronic Protective Devices, also referred to formerly as "Contact Free Protective Device".

An area which is itself not safety relevant, which supports the area security, e.g. as prewarning before the protected field. This field serves to avoid unintentional stopping of the machine or plant. On AGVS, the measured values of this field can also be used to support navigation.

After actuation, the mechanical position switch or safety switch remains in its switching position and must be manually reset.

A sensor which electronically switches with neither physical contact nor moving parts when ferro-magnetic parts, e.g. metal, are brought into its area of operation.

comprise a emitter and a receiver. The emitter is aligned such that a maximum proportion of the pulsed light from its diode falls onto the physically and optically separate light receiver. This evaluates the light received such that it can be clearly differentiated from ambient light or other light sources. An interruption of the light beam brings about switching of the output.

Not part of our product range.

A positioning element which positively operates a position switch. Cam disks are driven by door hinges, for example.

Intentional overcoming of safety switches either manually or by using readily available items, e.g. screws, keys, coins or tools which are needed for the normal operation of the machine. See protection against manipulation.

Unterteilung zur Beschreibung des Abschaltverhaltens bei Handlungen im Notfall

A complete identification and analysis of all possible hazards for the risk analysis. Also termed hazard analysis in the Machinery Directive. According to Article 100a this stems from the hazard situation and exposure to the hazard, according to Article 118a from the hazard potential based on the operative conditions and surroundings.

Monitored semiconductor outputs serve as safety outputs and can be used in the further circuitry to control contactors, Emergency Stop units or safety PLC systems. The monitored semiconductor outputs are of equal value to positive-guided relay outputs in relation to fault security.

Protective devices with micro-processor-based outputs ("safe semi-conductor outputs") generate text signals to check the correct function of the semi-conductor outputs which may disturb the input level of safety relay modules under certain conditions. Test pulse specimens of commercially available protective devices (of market leading manufactures), in particular of AOPDs, have already been taken into consideration in the circuitry development of our modules and do not generate any interference.

Redundancy is understood to be the existence of more functional means in one unit than necessary to satisfy the required function.

The maximum anglular divergence between the optical axis of the light from the emitter and that received by the receiver within which the AOPD continues to operate normally

safety-related outputs of a safety relay module for the connection of actuators downstream. Refer also to "Analysis level".

Declaration of the manufacturer for the use of a product within the European Community according to the appropriate standards

Connection between the actuator and the switch contact by means of which force exerted on the actuator is directly transmitted to the contact.

A device without separating function, which eliminates or reduces a risk either alone or in combination with a separating protective device.

Inductive proximity switch which is insensitive to strong electro-magnetic fields.

See bi-stable contact

To monitor a number of guard devices; units are connected together by conventional wiring

Devices can be operated on AC or DC supply.

The part of an ESPE which is connected to the machine control system and moves to the OFF condition if the sensor section is actuated during normal operation.

A sensor which electronically switches with neither physical contact nor moving parts, but when solid or liquid materials, e.g. glass, wood, paper, metal, plastic, food or liquids are brought into its sensing range.

Code of practice of German industrial assessors,
which gives references and suggestions regarding
technical products.

Begrifflichkeit unterschiedlicher Bedeutung beim Thema "Maschinensicherheit".

In Zusammenhang mit steuerungstechnischen Fragen ist in der Regel die "Steuerungskategorie" eines sicherheitsgerichteten Teils einer Maschinensteuerung gemäß EN 954-1 gemeint (Bewertung der zusätzlichen Maßnahmen im Hinblick auf die nötige/angestrebte Risikoreduzierung). Siehe hierzu auch BIA-Report 6/97: Kategorien für sicherheitsbezogene Steuerungen

Daneben existiert der Begriff der STOP-Kategorie. Siehe hierzu auch "STOP-Kategorien".

Manchmal wird auch von Sicherheitsschaltern der Kategorie 1 (Schalter mit integrierten Betätigungsorganen = traditionelle Positionsschalter, z.B. Rollenhebelschalter) gesprochen oder von Sicherheitsschaltern der Kategorie 2 (Schalter mit getrennten Betätigungsorganen). Diese Unterteilung hat keinerlei Bezug zur Kategorisierung nach EN 954-1 und betrifft nur die Unterscheidung der beiden unterschiedlichen Arbeitsweisen der Schalter.

Zum Begriff der Steuerungskategorie anverwandte Begriffe:

• SIL (= Safety Integrity Level) entstammt IEC EN 61508 bzw. IEC EN (draft) 62061,
• AK (= Anforderungsklasse) entstammt DIN VDE V 19250/19251 in Verbindung mit DIN VDE V 0801,
• PL (= "Performance Level") entstammt prEN ISO 13849-1 (mittelfristiger Nachfolger von EN 954-1).

Probability of the occurrence of an injury or damage to health. This stands in relationship to the frequency of entry or the duration of presence.

Fuse defective (see LED for operating voltage)

Possible causes: short circuit in the wiring system, earthing short in the wiring system, wrong wiring, overburdening of the outputs.

Module does not start up

• operating voltage too low;
• wire break in reset circuit;
• reset button (sensory system in general) defective;
• feedback circuit defective/open;
• protective device(s) not ready for operation;
• protective device has only switched on 1 channel;
• check start conditions (Reset : Auto start);
• cross-short setting/check wiring in this respect

.... in the case of two-hand modules

NC/NO contacts of the actuators may not overlap.

Need more help?

Please consult our "Agencies" or our employees directly:

Klaus Forbach
Phone: +49 (0)641 9848-273
Fax: +49 (0)641 9848-420

kforbach@remove-this.elan.schmersal.de

Mika Lehtisaari
Phone: +49 (0)641 9848-399
Fax: +49 (0)641 9848-420

mlehtisaari@remove-this.elan.schmersal.de

Ulrich Hofmann
Phone: +49 (0)641 9848-452
Fax: +49 (0)641 9848-294

uhofmann@remove-this.elan.schmersal.de

Thomas Rühl
Phone: +49 (0)0641 9848-453
Fax: +49 (0)641 9848-266

truehl@remove-this.elan.schmersal.de

The Test push button can be used to check the switch-off function of an evaluation unit. When the Test button is operated, the enable contacts must open.

Photo-electric proximity sensors or fibre-optic sensors with reflector.

Safety sensors (Proximity switches for safety functions)

Based on our self-image as specialist for devices and systems serving the protection of man, machine and plant, the Schmersal group offers its customers a broad range of information in the form of specialised books, newsletters, brochures and detailed descriptions in the form technical catalogues.

Please consult your responsible sales partner or the companies of the Schmersal group.

info@remove-this.schmersal.de

info@remove-this.elan.schmersal.de

Current load as dependent on ambient temperature (refer to example).

If a moving mechanical component automatically moves another with it either by means of direct contact or via rigid parts.

A contact which is closed in the rest condition.

Breakage of the actuating wire on pull-wire switches trips the contacts, thus protecting against unnoticed damage.

To monitor a number of guard devices; modules are connected together by ribbon cables

To provide additional enabling paths; units are connected together by conventional wiring

Series-parallel circuits, e.g. of safety switching devices.

These are technological alternatives to relay-based circuitry. They include, for example, programmable compact safety controllers, stored program safety controllers and safety bus systems. Alternatives are particularly interesting for complex machines (if otherwise more than 5 ... 8 safety relay modules are required), for integrated production systems and plants and in tasks requiring a high logic depth of inputs and outputs as well as high demands on visualisation and diagnostic options.

Under the heading of programmable electronics with safety function the following are offered within the Schmersal group:

• K.A. Schmersal GmbH, Wuppertal, offers the sensor/actuator interface "ASi-Safety-at-Work",

• and Elan Schaltelemente GmbH & Co. KG, Wettenberg, offers the compact safety controllers "ESALAN Compact" and "ESALAN safety field bus system", and the "ESALAN-SafetyController" for the safety-related movement and position monitoring of multi-axle machines and in particular of robots.

2fach-Sicherheits-Relais-Baustein für Not-Aus-/Not-Stop-Befehlsgeräte, Verriegelungseinrichtungen u.ä. mit differenziertem Abschaltverhalten (= die Anforderung der Sicherheitsfunktion des einen angeschlossenen Sicherheitsschaltgeräts, z.B. Not-Aus, betrifft alle Sicherheitsfreigaben und die des zweiten Sicherheitsschaltgeräts nur einen Teil der Sicherheitsfreigaben). Siehe hierzu auch "Elan SRB 202CA" und "Elan SRB 400CA".

Electronic fuse (e.g. instead of a glass tube fuse) which responds in the case of excessive currents and only enables the circuitry once the power supply has been switched off and switched on again. The additional measure of switching on and switching off the power supply serves to additional protect against unexpected restart of a hazardous movement, particularly in the operating mode "Auto start" once a short circuit has been eliminated.

Testing of the correct function of subsequent power contactors (or other actuator/contact multiplication) by the NC contacts (preferably with positive operation or comparable) being brought back to the start circuit of the safety relay module. A renewed start process can therefore only be initiated if the NC contacts are closed (in rest position). WARNING: the feedback circuit is no substitute for a 2-channel actuator level (or only under certain circumstances).

is only operative in stroke operation (single or double stroke). It prevents uncontrolled release of the machine stroke. This provides that interventions in the protected field are only accepted as strokes when they are carried out within a predetermined time (e.g. 30s) after the stroke cancellation contact is closed. If this does not take place within this period of time, the re-start interlock is activated.

Photo-electric proximity sensors or fibre-optic sensors without reflector.

Law on electromagnetic compatibility. The EMC Directive applies to appliances which contain electrical and/or electronic components which can cause electro-magnetic interference or the operation which can be affected by such interference.

Positively driven contacts are understood to mean that the NC and NO contacts in a contact system can never be simultaneously opened or simultaneously closed. It must be ensured that a contact distance of at least 0.5 mm exists for the entire serviceable life also in faulty state (contact welding).

The detection capacity of an optoelectronic guard device is the size of obstacle which is recognised in all positions of the protected field and leads to a switch-off signal.

The version of a contact separation as direct result of a determined movement of the operating part of the switch via non-flexible parts.

A contact which is open in the rest condition.

The evaluation electronics to monitor the switching conditions of the contacts is integrated in the switch or safety sensor.

To provide additional enabling paths; modules are connected together by ribbon cables

Term with differing meaning with respect to the subject of "machine safety".

In connection with control issues, this usually refers to the "Control category" of a safety-related part of machine control system to EN 954-1 (assessment of additional measures with respect to necessary / aspired-to reduction). Refer also to BIA-report 6/97: Kategorien für sicherheitsbezogene Steuerungen.

Reference is also made to the STOP category. Refer also to "STOP categories" in this respect.

Reference is also sometimes made to safety switches of the category 1 (switch with integrated actuating organs = traditional positions switch, e.g. roller leaver switch) or to safety switches of category 2 (switch with separate actuating organs). This subdivision has no connection with the categorisation under EN 954-1 and only refers to the distinction between the two different modes of operation of the switches.

Terms used with respect to the control category:

• SIL (= Safety Integrity Level) comes from IEC EN 61508 and IEC EN (draft) 62061,
• DC (= Demand Class) comes from DIN VDE V 19250/19251 in connection with DIN VDE V 0801,
• PL (= "Performance Level") comes from prEN ISO 13849-1 (medium term successor to EN 954-1)

Mode of operation 1: Switches on which the switch contacts and operating element are designed to form a single functional unit. Mode of operation 2: Switches on which the switch contacts and operating element do not form a functional unit, but are functionally brought together or separated on actuation of the switch.

Herstellererklärung für ein Produkt zum Einsatz innerhalb der Europäischen Gemeinschaft entsprechend der angegebenen Normen.

Signalling outputs of a safety relay module which signalise the states of the circuitry (of the module itself or of the periphery connected upstream or downstream, depending on version), e.g. to an operational stored program controller. Important for visualisation and diagnosis (key-word: fault management).

A timing relay which gives an enable signal when a preset time has elapsed, e.g. to open a guard device. In case of a fault, the secure timer takes up the safe condition.

Another word for "Safety relay modules" (comes from the testing principle GS-ET-20: Principles for the testing and certification of relay safety combinations).

“Actions in case of emergency” Stopping in emergency: An action in a case of emergency which is determined to stop a process or movement which is dangerous. Switching off in emergency: An action in a case of emergency which is determined to cut off the electrical supply to a complete or a part of an electrical installation, if there is a risk of an electric shock or some other risk of electrical origin.

safety-related parts of a machine control system with the task of ensuring by means of monitored "redundancy" that no hazardous states or damage to the machine or the product can be caused by errors or faults in the electrical equipment or the probability of such faults or errors occurring is reduced. Refer also in this respect to EN 954-1.

Distance (differential) between the points at which a contact makes and breaks the circuit

The actuator and NC contact must be connected by a direct drive path without sprung parts.

A mechanical, electrical or other device to prevent operation of a machine element under predetermined conditions (usually as long as a separating guard device is not closed).

With overlapping contacts, the NO contact closes before the NC contact opens.

On actuation, opens and closes an electrical circuit at two contact points in each case, see contact diagrams.

Individual modules which are connected together by ribbon cables.

Bei der Kontaktüberdeckung schließt der Schließer, bevor der Öffner öffnet.

A sensor which electronically switches with neither physical contact nor moving parts when light-reflecting material is brought into its area of operation. The fibre-optic sensor comprises a basic unit and a fibre-optic cable.

Maximum current burden for all enabling contacts of a safety relay module.

Risk which remains after carrying out protective measures; the remaining tolerable risk in spite of protective measures.

Term follows the new definition of EN 60204-1 section 9.2.5.4 (emergency actions: shut-down in an emergency = electrical safety / stop in emergency = functional safety).

The circuitry of safety relay modules (including the circuitry of Schmersal/Elan types PROTECT and SRB) will usually correspond to control category 4 to EN 954-1. The specification of the control category refers to the module itself, i.e. the control category both of the sensor and the actuator level will depend on it and will depend on structure and incorporation.

The circuitry of the safety relay module ELAN ("SRB-NA-R-C.25") distinguishes between an interruption of the power supply (case 1) and the demand for a safety function, e.g. the actuation of an emergency-stop control device (case 2). In case 1, the module restarts automatically (operating mode "Auto start") and in case 2 it requires a "Reset" signal. Safety relay modules with differentiated restart may only be used under certain conditions of use, for example, to protect service personnel when deployed in otherwise closed operating rooms.

Positively driven contacts are understood to mean that the NC and NO contacts in a contact system can never be simultaneously opened or simultaneously closed. It must be ensured that a contact distance of at least 0.5 mm exists for the entire serviceable life also in faulty state (contact welding).

With the assistance of the ISD, the switching conditions and possible errors in case of a fault can be quickly identified. Depending on the version of the safety monitoring module, the switching conditions and faults are shown via multi-colour LED’s or provided to the user on a transistor output. The switching conditions and faults can be identified with the assistance of the ISD tables.

On actuation, opens and closes an electrical circuit at one contact point in each case, see contact diagrams.

The devices recognise and monitor signals of hazardous movements and process them in accordance with a set limit value to achieve a control command.

By comparison with monitoring devices used for operational functions, the safety-related standstill and motion watchdogs are characterised by special measures and features which, depending on the safety level to be realised, also guarantee the safety function in the case of error and/or detection. The error analysis refers both to the devices and to the parts of the safety circuit set up before them.

Typical tasks for safety-related standstill and motion watchdogs are as follows:

• Control of solenoid-operated magnets in interlocking devices with locking depending on hazardous overtravel;

• Monitoring of "STOP category 2" (safe stop / safe operational stop);

• Monitoring of reduced speed in special operation of machines and plants with open protective devices.

Various device versions are available for the above tasks both in the Schmersal and in the Elan product range. Please request a main catalogue (Schmersal) or the SSW catalogue (Elan).

Defined blanking-out of a part of the protected field of a safety light curtain with varying position of the blanking, see also blanking.

After a safety function has been requested the safety relay module only switches on again once a reset button (also referred to as start button) has been actuated.

The contrary is the operating mode "Auto start" (Automatic start), which is only admissible under certain conditions (if there is no danger of an unexpected restart) or a reset comes from somewhere else (with a quality corresponding to control category 1 to EN 954-1). Not admissible, for example, in emergency-stop command devices, in accessible rooms etc.

"Trailing edge" or "Edge detection" in this connection means that it is not the rising edge (upon actuating the button) that generates the start signal but the trailing edge after releasing the button. The analysis of the trailing edge or edge detection is an additional safety measure before an unexpected restart in the case of a manipulated or defective button.

After a safety function has been requested the safety relay module only switches on again once a reset button (also referred to as start button) has been actuated.

The contrary is the operating mode "Auto start" (Automatic start), which is only admissible under certain conditions (if there is no danger of an unexpected restart) or a reset comes from somewhere else (with a quality corresponding to control category 1 to EN 954-1). Not admissible, for example, in emergency-stop command devices, in accessible rooms etc.

"Trailing edge" or "Edge detection" in this connection means that it is not the rising edge (upon actuating the button) that generates the start signal but the trailing edge after releasing the button. The analysis of the trailing edge or edge detection is an additional safety measure before an unexpected restart in the case of a manipulated or defective button.

On backlash of guard devices, the end position of a position switch with safety function is often “overrun“, so that the NC contact opens and the NO contact remains open. This leads to a fault indication from the safety monitoring module. In order to avoid this, jumper connections can be used to bring about an extension of the enable delay time.

The safety relay modules for this group (housing width 22.5 or 45 mm) differ from the following points of view (refer also in this respect to product overview "Safety relay modules"):

• multifunctional safety relay modules,
  
• more diagnosis/visualisation,
  
• more safety enables,
  
• monitoring of NC/NO contact combinations,
  
• other supply voltages,
  
• other networks,
  
• two-hand switches.

Snap action system with two galvanically separated contact bridges

In the case of supply voltages (24 VDC) there may be a delayed rise in voltage at the activation moment of the entire system as a result of a short term peaks in the power supply units used. The modules of the type series PROTECT-SRB (Schmersal) and SRB (Elan) have circuitry which also compensates for a "slow" rise in voltage in order to avoid functional disturbances in the "Auto start" operating mode.

Switch with one NC and one NO contact, see contact diagrams to IEC 60617.

Schmersal/Elan internal term for safety relay modules to which all types of protective devices (also AOPD's and safety solenoid-operated switches) can be connected and which also offer additional functions such as visualisation and diagnostic facilities.

Die Kontaktreibung erhöht die Kontaktsicherheit und bricht leichte Kontaktverklebungen auf. Dies gewährleistet bei kleinsten Strömen und Spannungen eine gute Leitfähigkeit.

Suitable for use in humidity of max. 100%. Contacts with ceramic insulation, suitable for voltages up to 500 VAC.

This push button is used, for example, to clear all faults stored in the fault memory.

safety-related outputs of a safety relay module for the connection of actuators downstream. Refer also to "Analysis level".

The safety relay modules of this group (housing width 22.5 mm) are suitable for the connection of 1- and 2-channeled commercially available protective devices (non-floating inputs are usually also admissible here) and of emergency stop command devices. They optionally have the operation mode "Reset / Auto start" and two or three safety enables and a signalling contact. Refer also in this respect to product overview "Safety relay modules".

On a cyclic operating process, after two interventions in the protected field (e.g. removal of a finished part and placing in next workpiece) and following enable from the protected field, the machine is automatically started by the AOPD. The further actions are carried out as for “Single stroke” mode of operation.

Not part of our product range.

Shown by the way of example of the modules ELAN "SRB 308IT" and ELAN "SRB 219IT" (with time delayed enable).

Connection facility foru p to 6 protective devices and/or emergency-stop command devices acting on one enable level.

Bei der Kontaktstaffelung schließen oder öffnen die Kontakte nacheinander.

Safety relay modules for two-hand switches (protective device requiring the simultaneous use of both hands, i.e. the hands are kept from the hazardous area in order to initiate the operation of a machine and maintain operation for as long as a hazardous state exists. They must first satisfy the safety requirements laid down in particular in EN 574. Refer also to ELAN "SRB 201ZH".

The maximum time duration between actuation of the sensor function and the OFF condition of the output switching elements

Safety output which is monitored for correct function by the safety monitoring module

A connection of devices of this type will usually be admissible for all multifunctional safety relay modules of type series PROTECT-SRB, but under consideration of the limit value specified in the data sheets for voltages and current (refer in this respect to data sheet information). The circuitry of the respective modules contains a current and voltage limitation which is essential for safety reasons if devices are connected with NC contacts (in order to counter the risk of contact welding). In the case of devices with NC/NO combinations the current and voltage limitation will be an advantage of availability.

Safety solenoid-operated switches are frequently offered as (certified) subsystem, consisting of sensor and analysis unit (from K.A. Schmersal GmbH as "BNS/AES combinations"). This is associated with the advantage that the "sensor/analysis unit" interface is already tested. In the case of a separate structure (see above) the interface responsibility will be with the user.

www.elan.de/tweb/gb/prod_index.html

By means of the coded actuating magnets, the coded magnetic safety sensors are protected against manipulation by simple means. Actuation using conventional magnets and tools is thus eliminated.

A manually operated switch, in particular for Emergency Stop operations, often with latch.

Das Gerät ist nicht mit Mikroprozessoren ausgestattet. Steuerung und Auswertung, z.B. eines Schutztürwächters, ist in Relaistechnik ausgeführt.

The basic safety standards, which lay down the basic terms and the guiding principles for all machines.

After a safety function has been requested the safety relay module only switches on again once a reset button (also referred to as start button) has been actuated.

The contrary is the operating mode "Auto start" (Automatic start), which is only admissible under certain conditions (if there is no danger of an unexpected restart) or a reset comes from somewhere else (with a quality corresponding to control category 1 to EN 954-1). Not admissible, for example, in emergency-stop command devices, in accessible rooms etc.

"Trailing edge" or "Edge detection" in this connection means that it is not the rising edge (upon actuating the button) that generates the start signal but the trailing edge after releasing the button. The analysis of the trailing edge or edge detection is an additional safety measure before an unexpected restart in the case of a manipulated or defective button.

An enabling path is the safe output of the safety monitoring module which can be integrated in the safety circuit of the machine. In the safe switched- off condition, this circuit must always be open, since the safe condition must always be reached by switching off the electrical supply (“fail-safe” mode of operation). The enabling path is formed by the NO contacts of the safety relays wired in series.

www.schmersal.com

www.elan.de

These are technological alternatives to relay-based circuitry. They include, for example, programmable compact safety controllers, stored program safety controllers and safety bus systems. Alternatives are particularly interesting for complex machines (if otherwise more than 5 ... 8 safety relay modules are required), for integrated production systems and plants and in tasks requiring a high logic depth of inputs and outputs as well as high demands on visualisation and diagnostic options.

Under the heading of programmable electronics with safety function the following are offered within the Schmersal group:

• K.A. Schmersal GmbH, Wuppertal, offers the sensor/actuator interface "ASi-Safety-at-Work",

• and Elan Schaltelemente GmbH & Co. KG, Wettenberg, offers the compact safety controllers "ESALAN Compact" and "ESALAN safety field bus system", and the "ESALAN-SafetyController" for the safety-related movement and position monitoring of multi-axle machines and in particular of robots.

These devices are coded to protect against manipulation by simple means. They cannot be actuated using a normal magnet.

Bypass function: Temporary automatic suppression of one or more safety functions during the normal operation of the machine (EN 61496) by means of a safety control system, e.g. to enable the movement of material into the hazardous area to take place.

Stellglied, das einen Positionsschalter zwangläufig betätigt. Kurvenscheiben werden durch Scharniere von Drehtüren angetrieben.

1. The respective C standards will determine the manner in which locks in safety circuits of a machine control system are to be used. If the designer satisfies this norm he simultaneously also satisfies the requirements of the Machine Directive.

Deviations from the C standard are nevertheless possible at the responsibility of the designer but in these cases the designer must be able to prove that the deviating solution guarantees a safety level which is at least comparable.

If there is no C standard for the case of use, additional information is provided on the use of locks in the B standards.

2. Additional monitoring switches:

An additional monitoring switch serves the purposes of error control and error detection in the event of the safety critical failure of the lock e.g. in the case of an important damage to the internal mechanics.

It is possible to forego the use of an additional monitoring switch

• if an optimal fit is guaranteed, i.e. if a robust door guide with a stable end stop is provided for the entire serviceable life of the door,
• if the admissible locking force has been observed,
• if the actuator is permanently linked with the protective devices, preferably in a concealed position,
• if the actuator consists of one part is has not made of plastic or cast metal,
• if locks have a failsafe mechanism.

Irrespective of this we recommend the use of a second monitoring switch:

• in applications in control category 4 to EN 954-1,
• in non-visible hazard sources, e.g. in the case of radiation, electrical shock and similar.

1. In the case of interlocking devices without locking (in the case of safety switches) a double arrangement is advisable for increased risks if nothing else is proposed in the respective C standard.

Safety group standards, which deal with a particular safety aspect that is applicable to a wide range of machines.

A combination of the probability and the severity of the possible injury or damage to health of a dangerous situation, see EN 292-1, 3.7. The risk, in relation to the hazard seen, is also designated as a function of the amount of possible damage and the probability of this damage occurring.

Time needed for entry into or intervention in the dangerous area, as calculated based on an approach speed.

The contacts are arranged to rub against each other on opening and closing to increase the level of contact reliability and break contacts which are slightly stuck together. This ensures good conductivity with low currents and voltages.

www.elan.de/tweb/gb/prod_index.html

Double safety relay module for emergency-stop control devices, interlocking devices and similar, with differentiated shut-down behaviour (= the demand for the safety function of the safety switchgear connected, e.g. emergency stop, refers to all safety enables and that of the second safety switchgear to only one part of the safety enables). Refer also in this respect to ELAN "SRB 202CA" and ELAN "SRB 400CA".

Safety relay modules to monitor a temporary automatic suppression of one or several safety function(s) during the normal operation of a machine. Refer also here to ELAN "SRB-MSK".

An indication output which shows the condition of the evaluation unit or the guard device or gives an error code.

Make more concrete statements and offer possible solutions for the safety aspects dealt with generally in the basic standards, such as safe distances, surface temperatures, etc.

The use of available information with the aim of recognising dangerous incidents and assessing the risk.

Fuse defective (see LED for operating voltage)

Possible causes: short circuit in the wiring system, earthing short in the wiring system, wrong wiring, overburdening of the outputs.

Module does not start up

• operating voltage too low;
• wire break in reset circuit;
• reset button (sensory system in general) defective;
• feedback circuit defective/open;
• protective device(s) not ready for operation;
• protective device has only switched on 1 channel;
• check start conditions (Reset : Auto start);
• cross-short setting/check wiring in this respect.

... in the case of two-hand modules

NC/NO contacts of the actuators may not overlap.

Need more help?

Please consult our "Agencies" or our employees directly:

Klaus Forbach
Phone: +49 (0)641 9848-273
Fax: +49 (0)641 9848-420

kforbach@remove-this.elan.schmersal.de

Mika Lehtisaari
Phone: +49 (0)641 9848-399
Fax: +49 (0)641 9848-420

mlehtisaari@remove-this.elan.schmersal.de

Ulrich Hofmann
Phone: +49 (0)641 9848-452,
Fax: +49 (0)641 9848-294

uhofmann@remove-this.elan.schmersal.de

Thomas Rühl
Phone: +49 (0)0641 9848-453
Fax: +49 (0)641 9848-266

truehl@remove-this.elan.schmersal.de

Connection level (inputs) for protective devices and emergency-stop command devices. Refer also to the other key-words:

• "Control, 1- or 2-channeled",
• "Emergency-stop command devices",
• "Non-floating inputs",
• "Safety solenoid-operated switches".

For the “Protect” mode of operation, the enable of the switching output is carried out automatically after the end of the protected field interruption (or in case of activation of the restart interlock after resetting) and the end of the protected field interruption.

Devices without coding are intended only for concealed mounting. They can be actuated by any magnet of the BP range.

Type designation for electronic evaluation units for safety functions (Safety monitoring modules)

Include concrete statements or possible solutions for safety equipment such as twohand operation circuits, interlocking devices, etc.

A complete assessment of the probability and the severity of possible injury or damage to health in a dangerous situation, in order to select suitable safety measures. In EN 1050, this term is used as a part of the risk analysis.

A combination of parts and/or components which operate together to provide entry protection or recognition of presence (area protection). ESPE is equipment on which a switching process is brought about by changes in optical fields. The switching process caused by the change in field serves to prevent the start of a dangerous movement or to interrupt a dangerous movement.

Monitoring of the rotation of the motor is not carried out by sensors on the shaft but by direct monitoring of the back e.m.f. at the motor terminals.

The area within which persons or objects are recognised by the ESPE.

safety-related circuitry within a safety relay module, "responsible" for monitoring the input signals, signal processing and control of the enabling level (including the Safety enables). Usually additional status displays and signalling contacts, for example, for operating voltage, switched state of the relay contacts, etc.

Machine safety standards or subject standards which relate to specific safety characteristics of individual types of machine or of machine groupings.

A process to determine whether a risk is acceptable, based on risk analysis and taking into account factors such as social, commercial and environmental aspects.

E = Single fault secure, Control Category 3 to EN 954-1. In normal operation, at least two output signal switching devices (OSSD) must move into the OFF condition, if the sensor unit is activated (Violation of protected field) or the power supply to the ESPE is interrupted.

www.schmersal.com

www.elan.de

Manipulation is when a safety device or safety switch is made inoperative.

The contact/switch travel details shown in the catalogue illustrate the switching behaviour on actuation from position 0 (= unactuated) up to the maximum end position. Closed contacts are represented by dark shading and open contacts by white areas. Other features are shown by means of symbols which are explained inside the back cover.

A unit which determines an interruption of an optical beam generated by the unit itself by an object within the protected field which is not transparent by measurement using optoelectronic emitter and receiver.

A process of risk analysis and risk evaluation. In EN 292-1, these terms are not used in the same sense.

S = Self-monitoring, Control Category 4 to EN 954-1. Protective equipment on which the protecting function is not detracted by a fault within the ESPE. Up to three faults must be recognised within the response time.

Part of a machine which is particularly used as a type of physical barrier for protection. Depending on the conditions, a separating guard device can be called an enclosure, a cover, a screen, a door, sheathing, etc.

Protection against the ingress of solid foreign bodies (Foreign body protection) Protection of persons against contact with live or moving parts (Protection against contact) Protection against the ingress of water (Water protection)

See feedback circuit.

The appliance safety law forms the basis to put the EC Recommendations to Article 100a of the Articles of Rome into effect in national law. The individual EC Recommendations are put into effect by decrees. These apply to manufacturers and importers.

T = Testing, Control Category 2 to EN 954-1. Protective equipment on which the protecting function is checked by means of reaction to an external test signal. An ESPE-T must at least be provided with a start-up test, i.e. testing must take place each time on switch-on. In addition, the possibility of cyclic testing must be provided.

Series circuits of protective devices and emergency-stop command devices do not facilitate control category 4 to EN 954-1 (safety even in cases of error accumulation), maximum control category 3 in the case of a 2-channel series circuit. A different assessment may arise if maintenance intervals are incorporated in the assessment.

With respect to error accumulation (to be taken into consideration for control category 2 to SC4, EN 954-1) there is a risk (see following case study) that an initial short-circuit of the contacts switched in series can be "neutralised" (if a second guard is opened) and then a restart is possible with an undetected error.

Diagram 1:
First error:

• short circuit via contact S1.1 (guard 1)
• guard 1 is opened
• module shuts down on 1 channel
• guard 2 is opened
• module shuts down on 2 channels
• restart is possible

Diagram 2:

• second error added for guard 1
• short circuit via contact S2.1

Diagram 3:

• guard 1 is opened
• module does not shut down
• hazardous state

The above problem does not exist if a safety relay module is used per protective device or emergency-stop device. Please also consider the "Start-up testing" point in this connection.

www.elan.de/tweb/gb/prod_navi.html

Contactor or relay on which the NC and NO contacts are galvanically separated from each other but mechanically connected together.

After a safety function has been requested the safety relay module only switches on again once a reset button (also referred to as start button) has been actuated.

The contrary is the operating mode "Auto start" (Automatic start), which is only admissible under certain conditions (if there is no danger of an unexpected restart) or a reset comes from somewhere else (with a quality corresponding to control category 1 to EN 954-1). Not admissible, for example, in emergency-stop command devices, in accessible rooms etc.

"Trailing edge" or "Edge detection" in this connection means that it is not the rising edge (upon actuating the button) that generates the start signal but the trailing edge after releasing the button. The analysis of the trailing edge or edge detection is an additional safety measure before an unexpected restart in the case of a manipulated or defective button.

Electrical equipment with Certificate of Conformity to the standards EN 50014 to EN 50020 for areas with explosion hazards

On a cyclic operating process, after one intervention in the protected field (e.g. placing in next workpiece) and following enable from the protected field, the machine is automatically started by the AOPD. Any further intervention produces the stop command of the protecting device. During the part of the machine movement which is not dangerous, e.g. for the return movement of the slide, the intervention stroke is cancelled. The cycle can be repeated.

Even if (with a few exceptions) a prototype test is not a statuatory requirement, safety relay modules of the type series PROTECT-SRB (Schmersal) and SRB (Elan) usually have prototype tests from the test and certification body of the Employers' Liability Insurance Association of Precision Mechanics and Electrical Engineering, Cologne. Typical basic circuitry is usually BG prototype tested. The BG tests are based on EN 954-1 and EN 954-2, and on the test principles GS-ET-20 - Principles for the testing and certification of relay safety combinations (edited: HVBG Fachausschuss "Elektrotechnik" Prüf- und Zertifizierungsstelle im BG-Prüfzert).

In addition, almost all assemblies have UL and CSA and c-UL-us certifications (CCC in preparation).

Category B

Requirements (summary):
The safety-related parts of control systems and/or their protective devices as well as their components must be designed, structured, selected, compiled and combined in agreement with the respective standards such that they are able to withstand the influences to be expected.

System behaviour:
The occurrence of an error can lead to a loss of the safety function.

Principle:
Predominantly characterised by selection of components.

Category 1

Requirements (summary):
The requirements of B must be satisfied. Tried and tested components and safety principles must be used.

System behaviour:
The occurrence of an error can lead to a loss of the safety function, but the probability of occurrence is smaller than in category B.

Principle:
Predominantly characterised by selection of components.

Category 2

Requirements (summary):
The requirements of B and the use of tried and tested safety principles must be satisfied. The safety function must be tested at suitable intervals by the machine control system.

System behaviour:
The occurrence of an error can lead to a loss of the safety function between the test intervals. The loss of the safety function is recognised by the test.

Principle:
Predominantly characterised by the structure.

Category 3

Requirements (summary):
The requirements of B and the use of tried and tested safety principles must be satisfied. Safety-related parts must be designed ain such a way that

1. an individual error in each of these parts does not lead to the loss of the safety function and,

2. the individual error is detected whenever performed in an appropriate manner.

System behaviour:
If the individual error occurs the safety function always remains intact. A few but not all the errors are recognised. An accumulation of unrecognised errors can lead to the loss of the safety function.

Principle:
Predominantly characterised by the structure.

Category 4

Requirements (summary):
The requirements of B and the use of tried and tested safety principles must be satisfied. Safety-related parts must be designed in such a way that:

1. an individual error in each of these parts does not lead to the loss of the safety function and,

2. the individual error during or before the next request to the safety function is recognised or, if this is not possible, an accumulation of errors may not lead to the loss of the safety function.

System behaviour:
If the error occur the safety function always remains intact. The errors are recognised in good time to prevent a loss of the safety function.

Principle:
Predominantly characterised by the structure.

Switching system where the switching movement depends on the actuating speed.

Emergency Stop switches on which the actuating element is a wire rope. This can be stretched across the hazardous area and is pulled to actuate the switch.

For the risk assessment to EN 954-1 for safety-relevant electrical circuits, there are five categories for safety related parts of control systems. These categories B, 1, 2, 3 and 4 describe the “resistance” of a control system to faults.

This monitors whether the surface of an AOPD glass is soiled such as to lead to a reduction in the security of detection.

The circuitry of safety relay modules (including the circuitry of Schmersal/Elan types PROTECT and SRB) will usually correspond to control category 4 to EN 954-1. The specification of the control category refers to the module itself, i.e. the control category both of the sensor and the actuator level will depend on it and will depend on structure and incorporation.

A solenoid interlock has the function of locking a separating guard device in the closed position. It is connected to the control system in such a way that the machine cannot be operated if the guard device is not closed and interlocked and that the guard device is held closed until there is no longer a risk of injury.

Number of possible sensor inputs per protective device (or emergency-stop control device). Important for the control category of the sensor level. In the case of 2-channeled control the safety function also remains intact if one channel fails (important for the control category 3 and 4 to EN 954-1).

the latching bolt of a solenoid interlocking device is held in the interlocked position by magnetic force and released by spring force

The unit is notequipped with microprocessors. Control and evaluation, e.g. of a guard door monitor, is carried out using relays

A connection of devices of this type will usually be admissible for all multifunctional safety relay modules of type series PROTECT-SRB, but under consideration of the limit value specified in the data sheets for voltages and current (refer in this respect to data sheet information). The circuitry of the respective modules contains a current and voltage limitation which is essential for safety reasons if devices are connected with NC contacts (in order to counter the risk of contact welding). In the case of devices with NC/NO combinations the current and voltage limitation will be an advantage of availability.

Safety solenoid-operated switches are frequently offered as (certified) subsystem, consisting of sensor and analysis unit (from K.A. Schmersal GmbH as "BNS/AES combinations"). This is associated with the advantage that the "sensor/analysis unit" interface is already tested. In the case of a separate structure (see above) the interface responsibility will be with the user.

Circuitry option for a safety relay module in which short circuits between the input channels in the case of 2-channel control are also detected. A cross short can arise, for example, by a sheathed cable being pinched with the result that a 2-channel emergency-stop circuit does not trigger a shut-down even with only one faulty NC contact (second error).

Safety relay modules with cross-short monitoring are recommended for control category 4 to EN 954-1 (unless the cables are laid in two separate sheathed lines) and for control category 4 to EN 954-1 as an additional measure if (WARNING: conflict with EN 60204-1!) the cables are laid in the safety circuit unprotected (in whole or in part) and there is a risk of damage

the latching bolt of a solenoid interlocking device is held in the interlocked position by spring force and released by magnetic force

of two adjacent contacts or switches, e.g. between S13 and S22. A safety monitoring module can monitor this condition.

A current and voltage restriction is necessary/good idea when connecting safety solenoid-operated switches to safety relay modules. In the case of connecting devices with NC contacts it is essential for safety reasons (in order to counter the risk of contact welding) and with devices with NC/NO contact combinations the current and voltage restriction is an advantage of availability. A connection of safety solenoid-operated switches is usually admissible for all multifunctional safety relay modules of the type series PROTECT-SRB but under consideration of the limit value for voltage and current specified in the data sheets (refer here also to data sheet information).

In addition to the (prime) regulations of the respective C standards (machine safety standards or technical standards referring to a specific safety characteristic of individual machine groups), applies to the structure of safety-related parts of controls EN 954-1 (General design principles) and EN 954-2 (validation).

Testing of the AOPD and its sequential circuit is carried out by the machine control system opening the contact connected to the test/stroke input. This simulates intervention in the protected field, does not however lead to activation of the restart interlock, when the test proceeds successfully. If the contact is operated as part of the machine cycle, this is termed cyclic testing. Cyclic testing simultaneously serves for cancellation of the intervention stroke for single and double stroke modes of operation.

Refer to "Standstill and motion monitoring".

Additional measure recommended for requirements in accordance with control category 4 if the connected protective devices do not have their own start-up testing as, for example, in the case of electro-mechanical interlocking devices.

Start-up testing is only possible for safety relay modules with a so-called 3-relay technology with own start relay. This means that the protective device must first be opened and then closed again after the power supply is switched back before the enables of the safety relay module can be switched through. Start-up testing makes it possible to detect any inconsistencies in the periphery connected upstream and downstream (= "Sensor level" and "Actuator level") if the relay circuitry has lost its capacity for error storage in de-energised state.

Start-up testing tunes the sub-system "Sensory analysis / pre-control level / main control level" in the direction of an overall control category 4 to EN 954-1.

Furthermore, any manipulation of the protective device can be detected using start-up testing. Without start-up testing (or an equivalent measure) the specification of a control category for a module only refers to the circuitry of the module itself.

A programmed fixed reference value for recognition of standstill. On frequency “standstill”, the enable circuits are switched on and solenoid interlocks connected can be opened.

On standstill of a machine, the monitor gives the enable signal for a guard device to be opened. In case of a fault, the secure standstill monitor takes up the safe condition.

After a safety function has been requested the safety relay module only switches on again once a reset button (also referred to as start button) has been actuated.

The contrary is the operating mode "Auto start" (Automatic start), which is only admissible under certain conditions (if there is no danger of an unexpected restart) or a reset comes from somewhere else (with a quality corresponding to control category 1 to EN 954-1). Not admissible, for example, in emergency-stop command devices, in accessible rooms etc.

"Trailing edge" or "Edge detection" in this connection means that it is not the rising edge (upon actuating the button) that generates the start signal but the trailing edge after releasing the button. The analysis of the trailing edge or edge detection is an additional safety measure before an unexpected restart in the case of a manipulated or defective button.

The feedback circuit can also be used to provide a start function by connecting an additional Start push button (NO) into the feedback circuit. The evaluation unit only gives the enable signal when the feedback circuit is closed.

A device which brings the ESPE into the interlocked condition when the electrical supply to the ESPE is switched on or interrupted and switched on again.

A manual or automatic test to EN 61496-1, which is carried out when an ESPE or a guard door monitor has been switched on, to test the complete safety-related control system before the first machine movement is started.

Additional measure recommended for requirements in accordance with control category 4 if the connected protective devices do not have their own start-up testing as, for example, in the case of electro-mechanical interlocking devices.

Start-up testing is only possible for safety relay modules with a so-called 3-relay technology with own start relay. This means that the protective device must first be opened and then closed again after the power supply is switched back before the enables of the safety relay module can be switched through. Start-up testing makes it possible to detect any inconsistencies in the periphery connected upstream and downstream (= "Sensor level" and "Actuator level") if the relay circuitry has lost its capacity for error storage in de-energised state.

Start-up testing tunes the sub-system "Sensory analysis / pre-control level / main control level" in the direction of an overall control category 4 to EN 954-1.

Furthermore, any manipulation of the protective device can be detected using start-up testing. Without start-up testing (or an equivalent measure) the specification of a control category for a module only refers to the circuitry of the module itself.

Circuits serving the safety of individual require special failsafe and error-tolerant measures with respect to detection in the case of error. This is a statuatory requirement based in Germany on the Device Safety Act (GSG) and in Europe on the EC Machine Directive (MD). With respect to the subject of "Controllers", Annex 1, point 1.2.1 of the EC Machine Directive specifies as follows with respect to the basic safety and health requirements in the design and construction of machines and safety components:

"Controllers are to be designed and constructed in such a way that they function safely and reliably so that no dangerous situations may arise. In particular, they must be designed and constructed in such a way that

they withstand the operational stress and outside influences to be expected,

errors in the logic system do not lead to dangerous situations."

Filling in this requirement is a matter for the standard setters according to the so-called new approach of the EC Directive. EN 954-1 and EN 954-2 apply in particular to safety-related parts of machine controllers.

A distinction is made between a safe STOP in three categories.

STOP of category 0 to EN 60204-1 (9.2.2):

Uncontrolled stop by immediate (< 200 ms) shut-down of the power supply to the actuators (refer also to 3.5.6).

STOP of category 1 t oEN 60204-1 (9.2.2):

Controlled stop by interrupting the power supply to the actuator level if, for example, the hazardous movement has been brought to a standstill (time-delayed shut-down of the power supply). Refer also 3.11.

Example (see figure): the controller enable of an electronic drive is shut down immediately by means of an enable of the STOP category 0 and the power contactor only after the operational braking time of the motor (= STOP category 1).

STOP of category 2 t oEN 60204-1 (9.2.2):

Controlled stop. The power supply to the drive element is not interrupted. Additional measures to EN 1037 (protection from unexpected restart) are necessary, e.g. by the use of safety-related standstill watchdog.

Shutdown by immediate switching-off of the power supply (uncontrolled shutdown).

When switching off, the supply is maintained until the machine has come to a standstill. When standstill has been reached, the power supply is interrupted (controlled shutdown).

Division to describe the switching-off characteristics relating to actions in emergencies.

Switching capacity of the enabling contacts (product of current and voltage).

This word often appears in the Machinery Directive and in standards but without comment or definition. It stands for an undetermined and nonoriented (i.e. not directed to humans and/or things) hazard.

Every area in or around a machine in which a person is in hazard of injury or damage to health. Note: The hazard which brings this risk is either always present or can occur unexpectedly. In newer proposals, the term “Hazard zone” is also mentioned.

Declaration of the manufacturer for the use of a product within the European Community according to the appropriate standards

Current load as dependent on ambient temperature (refer to example).

The detection capacity of an optoelectronic guard device is the size of obstacle which is recognised in all positions of the protected field and leads to a switch-off signal.

Distance (differential) between the points at which a contact makes and breaks the circuit

The circuitry of the safety relay module ELAN ("SRB-NA-R-C.25") distinguishes between an interruption of the power supply (case 1) and the demand for a safety function, e.g. the actuation of an emergency-stop control device (case 2). In case 1, the module restarts automatically (operating mode "Auto start") and in case 2 it requires a "Reset" signal. Safety relay modules with differentiated restart may only be used under certain conditions of use, for example, to protect service personnel when deployed in otherwise closed operating rooms.

Snap action system with two galvanically separated contact bridges

On a cyclic operating process, after two interventions in the protected field (e.g. removal of a finished part and placing in next workpiece) and following enable from the protected field, the machine is automatically started by the AOPD. The further actions are carried out as for “Single stroke” mode of operation.

After a safety function has been requested the safety relay module only switches on again once a reset button (also referred to as start button) has been actuated.

The contrary is the operating mode "Auto start" (Automatic start), which is only admissible under certain conditions (if there is no danger of an unexpected restart) or a reset comes from somewhere else (with a quality corresponding to control category 1 to EN 954-1). Not admissible, for example, in emergency-stop command devices, in accessible rooms etc.

"Trailing edge" or "Edge detection" in this connection means that it is not the rising edge (upon actuating the button) that generates the start signal but the trailing edge after releasing the button. The analysis of the trailing edge or edge detection is an additional safety measure before an unexpected restart in the case of a manipulated or defective button.

EEx d IIC T6
EEx: General designation
d: Ignition protection: “Flameproof enclosure“
IIC: Explosion group, materials: Ethylene,
Town gas, Acetaldehyde
T6: Temperature class: 85 °C

The maximum anglular divergence between the optical axis of the light from the emitter and that received by the receiver within which the AOPD continues to operate normally

Safety sensors (Proximity switches for safety functions)

Law on electromagnetic compatibility. The EMC Directive applies to appliances which contain electrical and/or electronic components which can cause electro-magnetic interference or the operation which can be affected by such interference.

“Actions in case of emergency” Stopping in emergency: An action in a case of emergency which is determined to stop a process or movement which is dangerous. Switching off in emergency: An action in a case of emergency which is determined to cut off the electrical supply to a complete or a part of an electrical installation, if there is a risk of an electric shock or some other risk of electrical origin.

Term follows the new definition of EN 60204-1 section 9.2.5.4 (emergency actions: shut-down in an emergency = electrical safety / stop in emergency = functional safety).

On backlash of guard devices, the end position of a position switch with safety function is often “overrun“, so that the NC contact opens and the NO contact remains open. This leads to a fault indication from the safety monitoring module. In order to avoid this, jumper connections can be used to bring about an extension of the enable delay time.

safety-related outputs of a safety relay module for the connection of actuators downstream. Refer also to "Analysis level".

Safety output which is monitored for correct function by the safety monitoring module

An enabling path is the safe output of the safety monitoring module which can be integrated in the safety circuit of the machine. In the safe switched- off condition, this circuit must always be open, since the safe condition must always be reached by switching off the electrical supply (“fail-safe” mode of operation). The enabling path is formed by the NO contacts of the safety relays wired in series.

Time needed for entry into or intervention in the dangerous area, as calculated based on an approach speed.

Fuse defective (see LED for operating voltage)

Possible causes: short circuit in the wiring system, earthing short in the wiring system, wrong wiring, overburdening of the outputs.

Module does not start up

• operating voltage too low;
• wire break in reset circuit;
• reset button (sensory system in general) defective;
• feedback circuit defective/open;
• protective device(s) not ready for operation;
• protective device has only switched on 1 channel;
• check start conditions (Reset : Auto start);
• cross-short setting/check wiring in this respect.

... in the case of two-hand modules

NC/NO contacts of the actuators may not overlap.

Need more help?

Please consult our "Agencies" or our employees directly:

Klaus Forbach
Phone: +49 (0)641 9848-273
Fax: +49 (0)641 9848-420

kforbach@remove-this.elan.schmersal.de

Mika Lehtisaari
Phone: +49 (0)641 9848-399
Fax: +49 (0)641 9848-420

mlehtisaari@remove-this.elan.schmersal.de

Ulrich Hofmann
Phone: +49 (0)641 9848-452,
Fax: +49 (0)641 9848-294

uhofmann@remove-this.elan.schmersal.de

Thomas Rühl
Phone: +49 (0)0641 9848-453
Fax: +49 (0)641 9848-266

truehl@remove-this.elan.schmersal.de

A combination of parts and/or components which operate together to provide entry protection or recognition of presence (area protection). ESPE is equipment on which a switching process is brought about by changes in optical fields. The switching process caused by the change in field serves to prevent the start of a dangerous movement or to interrupt a dangerous movement.

E = Single fault secure, Control Category 3 to EN 954-1. In normal operation, at least two output signal switching devices (OSSD) must move into the OFF condition, if the sensor unit is activated (Violation of protected field) or the power supply to the ESPE is interrupted.

S = Self-monitoring, Control Category 4 to EN 954-1. Protective equipment on which the protecting function is not detracted by a fault within the ESPE. Up to three faults must be recognised within the response time.

T = Testing, Control Category 2 to EN 954-1. Protective equipment on which the protecting function is checked by means of reaction to an external test signal. An ESPE-T must at least be provided with a start-up test, i.e. testing must take place each time on switch-on. In addition, the possibility of cyclic testing must be provided.

Electrical equipment with Certificate of Conformity to the standards EN 50014 to EN 50020 for areas with explosion hazards

which gives the enable signal, when a machine has come to a standstill, e.g. to open a guard device. In case of a fault, the fail-safe standstill monitor takes up the safe condition. See also standstill monitor.

A timing relay which gives an enable signal, when a preset time has elapsed, e.g. to open a guard device. In case of a fault, the fail-safe timer takes up the safe condition.

Monitored semiconductor outputs serve as safety outputs and can be used in the further circuitry to control contactors, Emergency Stop units or safety PLC systems. The monitored semiconductor outputs are of equal value to positive-guided relay outputs in relation to fault security.

Fuse defective (see LED for operating voltage)

Possible causes: short circuit in the wiring system, earthing short in the wiring system, wrong wiring, overburdening of the outputs.

Module does not start up

• operating voltage too low;
• wire break in reset circuit;
• reset button (sensory system in general) defective;
• feedback circuit defective/open;
• protective device(s) not ready for operation;
• protective device has only switched on 1 channel;
• check start conditions (Reset : Auto start);
• cross-short setting/check wiring in this respect

.... in the case of two-hand modules

NC/NO contacts of the actuators may not overlap.

Need more help?

Please consult our "Agencies" or our employees directly:

Klaus Forbach
Phone: +49 (0)641 9848-273
Fax: +49 (0)641 9848-420

kforbach@remove-this.elan.schmersal.de

Mika Lehtisaari
Phone: +49 (0)641 9848-399
Fax: +49 (0)641 9848-420

mlehtisaari@remove-this.elan.schmersal.de

Ulrich Hofmann
Phone: +49 (0)641 9848-452
Fax: +49 (0)641 9848-294

uhofmann@remove-this.elan.schmersal.de

Thomas Rühl
Phone: +49 (0)0641 9848-453
Fax: +49 (0)641 9848-266

truehl@remove-this.elan.schmersal.de

Testing of the correct function of subsequent power contactors (or other actuator/contact multiplication) by the NC contacts (preferably with positive operation or comparable) being brought back to the start circuit of the safety relay module. A renewed start process can therefore only be initiated if the NC contacts are closed (in rest position). WARNING: the feedback circuit is no substitute for a 2-channel actuator level (or only under certain circumstances).

Signalling outputs of a safety relay module which signalise the states of the circuitry (of the module itself or of the periphery connected upstream or downstream, depending on version), e.g. to an operational stored program controller. Important for visualisation and diagnosis (key-word: fault management).

A sensor which electronically switches with neither physical contact nor moving parts when light-reflecting material is brought into its area of operation. The fibre-optic sensor comprises a basic unit and a fibre-optic cable.

Defined blanking-out of a part of the protected field of a safety light curtain with varying position of the blanking, see also blanking.

Testing/Inspection principles of the German assessment committee for electrical engineering

A separating protective device or such as is used as a safety measure in order to protect persons from a present or potential hazard.

A source of possible injury or damage to health or “Potential source of damage”

A complete identification and analysis of all possible hazards for the risk analysis. Also termed hazard analysis in the Machinery Directive. According to Article 100a this stems from the hazard situation and exposure to the hazard, according to Article 118a from the hazard potential based on the operative conditions and surroundings.

Probability of the occurrence of an injury or damage to health. This stands in relationship to the frequency of entry or the duration of presence.

Electronic fuse (e.g. instead of a glass tube fuse) which responds in the case of excessive currents and only enables the circuitry once the power supply has been switched off and switched on again. The additional measure of switching on and switching off the power supply serves to additional protect against unexpected restart of a hazardous movement, particularly in the operating mode "Auto start" once a short circuit has been eliminated.

Serves for the registration of travel, positions or speeds. The encoder gives a definite number of electrical impulses for each revolution.

A sensor which electronically switches with neither physical contact nor moving parts when ferro-magnetic parts, e.g. metal, are brought into its area of operation.

To monitor a number of guard devices; units are connected together by conventional wiring

To monitor a number of guard devices; modules are connected together by ribbon cables

The evaluation electronics to monitor the switching conditions of the contacts is integrated in the switch or safety sensor.

A mechanical, electrical or other device to prevent operation of a machine element under predetermined conditions (usually as long as a separating guard device is not closed).

With the assistance of the ISD, the switching conditions and possible errors in case of a fault can be quickly identified. Depending on the version of the safety monitoring module, the switching conditions and faults are shown via multi-colour LED’s or provided to the user on a transistor output. The switching conditions and faults can be identified with the assistance of the ISD tables.

Inherently safe for the eyes to EN 60825-1, no protective measures are necessary for the eyes.

After actuation, the mechanical position switch or safety switch remains in its switching position and must be manually reset.

See bi-stable contact

The entirety of parts or devices connected together, of which at least one is a moving part, also as applicable drive elements, control and supply circuits, etc., which are brought together for a particular application, such as processing, treating, material handling and preparation of material. The entirety of several machines, which are so arranged and controlled that they operate together as a single unit to achieve one and the same purpose, is also considered to be a “machine”.

Permanent magnets are mounted adjacent to the side of the contacts to deflect the polarised DC switching arc. The arc is thus extinguished more quickly and contact wear reduced.

Permanent magnets are mounted adjacent to the side of the contacts to deflect the polarised DC switching arc. The arc is thus extinguished more quickly and contact wear reduced.

Intentional overcoming of safety switches either manually or by using readily available items, e.g. screws, keys, coins or tools which are needed for the normal operation of the machine. See protection against manipulation.

Code of practice of German industrial assessors,
which gives references and suggestions regarding
technical products.

These are technological alternatives to relay-based circuitry. They include, for example, programmable compact safety controllers, stored program safety controllers and safety bus systems. Alternatives are particularly interesting for complex machines (if otherwise more than 5 ... 8 safety relay modules are required), for integrated production systems and plants and in tasks requiring a high logic depth of inputs and outputs as well as high demands on visualisation and diagnostic options.

Under the heading of programmable electronics with safety function the following are offered within the Schmersal group:

• K.A. Schmersal GmbH, Wuppertal, offers the sensor/actuator interface "ASi-Safety-at-Work",

• and Elan Schaltelemente GmbH & Co. KG, Wettenberg, offers the compact safety controllers "ESALAN Compact" and "ESALAN safety field bus system", and the "ESALAN-SafetyController" for the safety-related movement and position monitoring of multi-axle machines and in particular of robots.

Mode of operation 1: Switches on which the switch contacts and operating element are designed to form a single functional unit. Mode of operation 2: Switches on which the switch contacts and operating element do not form a functional unit, but are functionally brought together or separated on actuation of the switch.

Individual modules which are connected together by ribbon cables.

The devices recognise and monitor signals of hazardous movements and process them in accordance with a set limit value to achieve a control command.

By comparison with monitoring devices used for operational functions, the safety-related standstill and motion watchdogs are characterised by special measures and features which, depending on the safety level to be realised, also guarantee the safety function in the case of error and/or detection. The error analysis refers both to the devices and to the parts of the safety circuit set up before them.

Typical tasks for safety-related standstill and motion watchdogs are as follows:

• Control of solenoid-operated magnets in interlocking devices with locking depending on hazardous overtravel;

• Monitoring of "STOP category 2" (safe stop / safe operational stop);

• Monitoring of reduced speed in special operation of machines and plants with open protective devices.

Various device versions are available for the above tasks both in the Schmersal and in the Elan product range. Please request a main catalogue (Schmersal) or the SSW catalogue (Elan).

Schmersal/Elan internal term for safety relay modules to which all types of protective devices (also AOPD's and safety solenoid-operated switches) can be connected and which also offer additional functions such as visualisation and diagnostic facilities.

Connection facility foru p to 6 protective devices and/or emergency-stop command devices acting on one enable level.

A manually operated switch, in particular for Emergency Stop operations, often with latch.

Bypass function: Temporary automatic suppression of one or more safety functions during the normal operation of the machine (EN 61496) by means of a safety control system, e.g. to enable the movement of material into the hazardous area to take place.

Safety relay modules to monitor a temporary automatic suppression of one or several safety function(s) during the normal operation of a machine. Refer also here to ELAN "SRB-MSK".

Inductive proximity switch based on the Namur principle to DIN 19234

Connection facility for non-floating outputs of sensors.
Typically for AOPD’s = Active Optoelectronic Protective Devices, also referred to formerly as "Contact Free Protective Device".

A device without separating function, which eliminates or reduces a risk either alone or in combination with a separating protective device.

A contact which is closed in the rest condition.

A contact which is open in the rest condition.

Voltage controlled drop-out of relay on de-energisation after a preset or fixed time.

Not part of our product range.

The part of an ESPE which is connected to the machine control system and moves to the OFF condition if the sensor section is actuated during normal operation.

To provide additional enabling paths; units are connected together by conventional wiring

To provide additional enabling paths; modules are connected together by ribbon cables

With overlapping contacts, the NO contact closes before the NC contact opens.

Modulated light which is transmitted via a lens onto the object to be detected or the reflector and is reflected by this, to the receiver via a second lens and is electronically evaluated.

A sensor which electronically switches with neither physical contact nor moving parts when light-reflecting material is brought into its area of operation.

Connection between the actuator and the switch contact by means of which force exerted on the actuator is directly transmitted to the contact.

If a moving mechanical component automatically moves another with it either by means of direct contact or via rigid parts.

The version of a contact separation as direct result of a determined movement of the operating part of the switch via non-flexible parts.

The actuator and NC contact must be connected by a direct drive path without sprung parts.

Positively driven contacts are understood to mean that the NC and NO contacts in a contact system can never be simultaneously opened or simultaneously closed. It must be ensured that a contact distance of at least 0.5 mm exists for the entire serviceable life also in faulty state (contact welding).

In the case of supply voltages (24 VDC) there may be a delayed rise in voltage at the activation moment of the entire system as a result of a short term peaks in the power supply units used. The modules of the type series PROTECT-SRB (Schmersal) and SRB (Elan) have circuitry which also compensates for a "slow" rise in voltage in order to avoid functional disturbances in the "Auto start" operating mode.

Not part of our product range.

www.elan.de/tweb/gb/prod_index.html

These are technological alternatives to relay-based circuitry. They include, for example, programmable compact safety controllers, stored program safety controllers and safety bus systems. Alternatives are particularly interesting for complex machines (if otherwise more than 5 ... 8 safety relay modules are required), for integrated production systems and plants and in tasks requiring a high logic depth of inputs and outputs as well as high demands on visualisation and diagnostic options.

Under the heading of programmable electronics with safety function the following are offered within the Schmersal group:

• K.A. Schmersal GmbH, Wuppertal, offers the sensor/actuator interface "ASi-Safety-at-Work",

• and Elan Schaltelemente GmbH & Co. KG, Wettenberg, offers the compact safety controllers "ESALAN Compact" and "ESALAN safety field bus system", and the "ESALAN-SafetyController" for the safety-related movement and position monitoring of multi-axle machines and in particular of robots.

www.elan.de/tweb/gb/prod_index.html

For the “Protect” mode of operation, the enable of the switching output is carried out automatically after the end of the protected field interruption (or in case of activation of the restart interlock after resetting) and the end of the protected field interruption.

The area within which persons or objects are recognised by the ESPE.

Manipulation is when a safety device or safety switch is made inoperative.

Protection against the ingress of solid foreign bodies (Foreign body protection) Protection of persons against contact with live or moving parts (Protection against contact) Protection against the ingress of water (Water protection)

www.elan.de/tweb/gb/prod_navi.html

Even if (with a few exceptions) a prototype test is not a statuatory requirement, safety relay modules of the type series PROTECT-SRB (Schmersal) and SRB (Elan) usually have prototype tests from the test and certification body of the Employers' Liability Insurance Association of Precision Mechanics and Electrical Engineering, Cologne. Typical basic circuitry is usually BG prototype tested. The BG tests are based on EN 954-1 and EN 954-2, and on the test principles GS-ET-20 - Principles for the testing and certification of relay safety combinations (edited: HVBG Fachausschuss "Elektrotechnik" Prüf- und Zertifizierungsstelle im BG-Prüfzert).

In addition, almost all assemblies have UL and CSA and c-UL-us certifications (CCC in preparation).

Emergency Stop switches on which the actuating element is a wire rope. This can be stretched across the hazardous area and is pulled to actuate the switch.

A device to prevent the automatic re-start of a machine after interruption and renewed enable of the protected field during a dangerous part of the machine cycle or after a change in the mode of operation or actuation of the machine.

The maximum time duration between the response of the sensor function and the OFF condition of the output switching elements, see also response time.

Redundancy is understood to be the existence of more functional means in one unit than necessary to satisfy the required function.

Photo-electric proximity sensors or fibre-optic sensors with reflector.

Photo-electric proximity sensors or fibre-optic sensors without reflector.

Another word for "Safety relay modules" (comes from the testing principle GS-ET-20: Principles for the testing and certification of relay safety combinations).

Risk which remains after carrying out protective measures; the remaining tolerable risk in spite of protective measures.

After a safety function has been requested the safety relay module only switches on again once a reset button (also referred to as start button) has been actuated.

The contrary is the operating mode "Auto start" (Automatic start), which is only admissible under certain conditions (if there is no danger of an unexpected restart) or a reset comes from somewhere else (with a quality corresponding to control category 1 to EN 954-1). Not admissible, for example, in emergency-stop command devices, in accessible rooms etc.

"Trailing edge" or "Edge detection" in this connection means that it is not the rising edge (upon actuating the button) that generates the start signal but the trailing edge after releasing the button. The analysis of the trailing edge or edge detection is an additional safety measure before an unexpected restart in the case of a manipulated or defective button.

This push button is used, for example, to clear all faults stored in the fault memory.

The maximum time duration between actuation of the sensor function and the OFF condition of the output switching elements

After a safety function has been requested the safety relay module only switches on again once a reset button (also referred to as start button) has been actuated.

The contrary is the operating mode "Auto start" (Automatic start), which is only admissible under certain conditions (if there is no danger of an unexpected restart) or a reset comes from somewhere else (with a quality corresponding to control category 1 to EN 954-1). Not admissible, for example, in emergency-stop command devices, in accessible rooms etc.

"Trailing edge" or "Edge detection" in this connection means that it is not the rising edge (upon actuating the button) that generates the start signal but the trailing edge after releasing the button. The analysis of the trailing edge or edge detection is an additional safety measure before an unexpected restart in the case of a manipulated or defective button.

A combination of the probability and the severity of the possible injury or damage to health of a dangerous situation, see EN 292-1, 3.7. The risk, in relation to the hazard seen, is also designated as a function of the amount of possible damage and the probability of this damage occurring.

The use of available information with the aim of recognising dangerous incidents and assessing the risk.

A complete assessment of the probability and the severity of possible injury or damage to health in a dangerous situation, in order to select suitable safety measures. In EN 1050, this term is used as a part of the risk analysis.

A process to determine whether a risk is acceptable, based on risk analysis and taking into account factors such as social, commercial and environmental aspects.

A process of risk analysis and risk evaluation. In EN 292-1, these terms are not used in the same sense.

is present if the risk is justifiably small or in the absence of unjustifiable risks.

Within the sense of standardisation another term for control category. According to the philosophy of the standard setter, the different measures of realising a suitable control category under consideration of a risk leads to a residual risk. In this respect therefore the categories do not represent a hierarchy. Rather they are equivalent.

safety-related outputs of a safety relay module for the connection of actuators downstream. Refer also to "Analysis level".

Based on our self-image as specialist for devices and systems serving the protection of man, machine and plant, the Schmersal group offers its customers a broad range of information in the form of specialised books, newsletters, brochures and detailed descriptions in the form technical catalogues.

Please consult your responsible sales partner or the companies of the Schmersal group.

info@remove-this.schmersal.de

info@remove-this.elan.schmersal.de

Positively driven contacts are understood to mean that the NC and NO contacts in a contact system can never be simultaneously opened or simultaneously closed. It must be ensured that a contact distance of at least 0.5 mm exists for the entire serviceable life also in faulty state (contact welding).

safety-related parts of a machine control system with the task of ensuring by means of monitored "redundancy" that no hazardous states or damage to the machine or the product can be caused by errors or faults in the electrical equipment or the probability of such faults or errors occurring is reduced. Refer also in this respect to EN 954-1.

The circuitry of safety relay modules (including the circuitry of Schmersal/Elan types PROTECT and SRB) will usually correspond to control category 4 to EN 954-1. The specification of the control category refers to the module itself, i.e. the control category both of the sensor and the actuator level will depend on it and will depend on structure and incorporation.

The safety relay modules for this group (housing width 22.5 or 45 mm) differ from the following points of view (refer also in this respect to product overview "Safety relay modules"):

• multifunctional safety relay modules,
  
• more diagnosis/visualisation,
  
• more safety enables,
  
• monitoring of NC/NO contact combinations,
  
• other supply voltages,
  
• other networks,
  
• two-hand switches.

The safety relay modules of this group (housing width 22.5 mm) are suitable for the connection of 1- and 2-channeled commercially available protective devices (non-floating inputs are usually also admissible here) and of emergency stop command devices. They optionally have the operation mode "Reset / Auto start" and two or three safety enables and a signalling contact. Refer also in this respect to product overview "Safety relay modules".

A connection of devices of this type will usually be admissible for all multifunctional safety relay modules of type series PROTECT-SRB, but under consideration of the limit value specified in the data sheets for voltages and current (refer in this respect to data sheet information). The circuitry of the respective modules contains a current and voltage limitation which is essential for safety reasons if devices are connected with NC contacts (in order to counter the risk of contact welding). In the case of devices with NC/NO combinations the current and voltage limitation will be an advantage of availability.

Safety solenoid-operated switches are frequently offered as (certified) subsystem, consisting of sensor and analysis unit (from K.A. Schmersal GmbH as "BNS/AES combinations"). This is associated with the advantage that the "sensor/analysis unit" interface is already tested. In the case of a separate structure (see above) the interface responsibility will be with the user.

www.schmersal.com

www.elan.de

The contacts are arranged to rub against each other on opening and closing to increase the level of contact reliability and break contacts which are slightly stuck together. This ensures good conductivity with low currents and voltages.

Connection level (inputs) for protective devices and emergency-stop command devices. Refer also to the other key-words:

• "Control, 1- or 2-channeled",
• "Emergency-stop command devices",
• "Non-floating inputs",
• "Safety solenoid-operated switches".

Monitoring of the rotation of the motor is not carried out by sensors on the shaft but by direct monitoring of the back e.m.f. at the motor terminals.

www.schmersal.com

www.elan.de

Part of a machine which is particularly used as a type of physical barrier for protection. Depending on the conditions, a separating guard device can be called an enclosure, a cover, a screen, a door, sheathing, etc.

Series circuits of protective devices and emergency-stop command devices do not facilitate control category 4 to EN 954-1 (safety even in cases of error accumulation), maximum control category 3 in the case of a 2-channel series circuit. A different assessment may arise if maintenance intervals are incorporated in the assessment.

With respect to error accumulation (to be taken into consideration for control category 2 to SC4, EN 954-1) there is a risk (see following case study) that an initial short-circuit of the contacts switched in series can be "neutralised" (if a second guard is opened) and then a restart is possible with an undetected error.

Diagram 1:
First error:

• short circuit via contact S1.1 (guard 1)
• guard 1 is opened
• module shuts down on 1 channel
• guard 2 is opened
• module shuts down on 2 channels
• restart is possible

Diagram 2:

• second error added for guard 1
• short circuit via contact S2.1

Diagram 3:

• guard 1 is opened
• module does not shut down
• hazardous state

The above problem does not exist if a safety relay module is used per protective device or emergency-stop device. Please also consider the "Start-up testing" point in this connection.

On a cyclic operating process, after one intervention in the protected field (e.g. placing in next workpiece) and following enable from the protected field, the machine is automatically started by the AOPD. Any further intervention produces the stop command of the protecting device. During the part of the machine movement which is not dangerous, e.g. for the return movement of the slide, the intervention stroke is cancelled. The cycle can be repeated.

Switching system where the switching movement depends on the actuating speed.

This monitors whether the surface of an AOPD glass is soiled such as to lead to a reduction in the security of detection.

A solenoid interlock has the function of locking a separating guard device in the closed position. It is connected to the control system in such a way that the machine cannot be operated if the guard device is not closed and interlocked and that the guard device is held closed until there is no longer a risk of injury.

the latching bolt of a solenoid interlocking device is held in the interlocked position by magnetic force and released by spring force

A connection of devices of this type will usually be admissible for all multifunctional safety relay modules of type series PROTECT-SRB, but under consideration of the limit value specified in the data sheets for voltages and current (refer in this respect to data sheet information). The circuitry of the respective modules contains a current and voltage limitation which is essential for safety reasons if devices are connected with NC contacts (in order to counter the risk of contact welding). In the case of devices with NC/NO combinations the current and voltage limitation will be an advantage of availability.

Safety solenoid-operated switches are frequently offered as (certified) subsystem, consisting of sensor and analysis unit (from K.A. Schmersal GmbH as "BNS/AES combinations"). This is associated with the advantage that the "sensor/analysis unit" interface is already tested. In the case of a separate structure (see above) the interface responsibility will be with the user.

the latching bolt of a solenoid interlocking device is held in the interlocked position by spring force and released by magnetic force

In addition to the (prime) regulations of the respective C standards (machine safety standards or technical standards referring to a specific safety characteristic of individual machine groups), applies to the structure of safety-related parts of controls EN 954-1 (General design principles) and EN 954-2 (validation).

Refer to "Standstill and motion monitoring".

A programmed fixed reference value for recognition of standstill. On frequency “standstill”, the enable circuits are switched on and solenoid interlocks connected can be opened.

On standstill of a machine, the monitor gives the enable signal for a guard device to be opened. In case of a fault, the secure standstill monitor takes up the safe condition.

After a safety function has been requested the safety relay module only switches on again once a reset button (also referred to as start button) has been actuated.

The contrary is the operating mode "Auto start" (Automatic start), which is only admissible under certain conditions (if there is no danger of an unexpected restart) or a reset comes from somewhere else (with a quality corresponding to control category 1 to EN 954-1). Not admissible, for example, in emergency-stop command devices, in accessible rooms etc.

"Trailing edge" or "Edge detection" in this connection means that it is not the rising edge (upon actuating the button) that generates the start signal but the trailing edge after releasing the button. The analysis of the trailing edge or edge detection is an additional safety measure before an unexpected restart in the case of a manipulated or defective button.

The feedback circuit can also be used to provide a start function by connecting an additional Start push button (NO) into the feedback circuit. The evaluation unit only gives the enable signal when the feedback circuit is closed.

A device which brings the ESPE into the interlocked condition when the electrical supply to the ESPE is switched on or interrupted and switched on again.

A manual or automatic test to EN 61496-1, which is carried out when an ESPE or a guard door monitor has been switched on, to test the complete safety-related control system before the first machine movement is started.

Additional measure recommended for requirements in accordance with control category 4 if the connected protective devices do not have their own start-up testing as, for example, in the case of electro-mechanical interlocking devices.

Start-up testing is only possible for safety relay modules with a so-called 3-relay technology with own start relay. This means that the protective device must first be opened and then closed again after the power supply is switched back before the enables of the safety relay module can be switched through. Start-up testing makes it possible to detect any inconsistencies in the periphery connected upstream and downstream (= "Sensor level" and "Actuator level") if the relay circuitry has lost its capacity for error storage in de-energised state.

Start-up testing tunes the sub-system "Sensory analysis / pre-control level / main control level" in the direction of an overall control category 4 to EN 954-1.

Furthermore, any manipulation of the protective device can be detected using start-up testing. Without start-up testing (or an equivalent measure) the specification of a control category for a module only refers to the circuitry of the module itself.

Circuits serving the safety of individual require special failsafe and error-tolerant measures with respect to detection in the case of error. This is a statuatory requirement based in Germany on the Device Safety Act (GSG) and in Europe on the EC Machine Directive (MD). With respect to the subject of "Controllers", Annex 1, point 1.2.1 of the EC Machine Directive specifies as follows with respect to the basic safety and health requirements in the design and construction of machines and safety components:

"Controllers are to be designed and constructed in such a way that they function safely and reliably so that no dangerous situations may arise. In particular, they must be designed and constructed in such a way that

they withstand the operational stress and outside influences to be expected,

errors in the logic system do not lead to dangerous situations."

Filling in this requirement is a matter for the standard setters according to the so-called new approach of the EC Directive. EN 954-1 and EN 954-2 apply in particular to safety-related parts of machine controllers.

A distinction is made between a safe STOP in three categories.

STOP of category 0 to EN 60204-1 (9.2.2):

Uncontrolled stop by immediate (< 200 ms) shut-down of the power supply to the actuators (refer also to 3.5.6).

STOP of category 1 t oEN 60204-1 (9.2.2):

Controlled stop by interrupting the power supply to the actuator level if, for example, the hazardous movement has been brought to a standstill (time-delayed shut-down of the power supply). Refer also 3.11.

Example (see figure): the controller enable of an electronic drive is shut down immediately by means of an enable of the STOP category 0 and the power contactor only after the operational braking time of the motor (= STOP category 1).

STOP of category 2 t oEN 60204-1 (9.2.2):

Controlled stop. The power supply to the drive element is not interrupted. Additional measures to EN 1037 (protection from unexpected restart) are necessary, e.g. by the use of safety-related standstill watchdog.

Shutdown by immediate switching-off of the power supply (uncontrolled shutdown).

When switching off, the supply is maintained until the machine has come to a standstill. When standstill has been reached, the power supply is interrupted (controlled shutdown).

Division to describe the switching-off characteristics relating to actions in emergencies.

Switching capacity of the enabling contacts (product of current and voltage).

are pressure-sensitive sensors, which react on the effect of a defined force of an object or a person.

Protective devices with micro-processor-based outputs ("safe semi-conductor outputs") generate text signals to check the correct function of the semi-conductor outputs which may disturb the input level of safety relay modules under certain conditions. Test pulse specimens of commercially available protective devices (of market leading manufactures), in particular of AOPDs, have already been taken into consideration in the circuitry development of our modules and do not generate any interference.

The Test push button can be used to check the switch-off function of an evaluation unit. When the Test button is operated, the enable contacts must open.

is only operative in stroke operation (single or double stroke). It prevents uncontrolled release of the machine stroke. This provides that interventions in the protected field are only accepted as strokes when they are carried out within a predetermined time (e.g. 30s) after the stroke cancellation contact is closed. If this does not take place within this period of time, the re-start interlock is activated.

A timing relay which gives an enable signal when a preset time has elapsed, e.g. to open a guard device. In case of a fault, the secure timer takes up the safe condition.

Maximum current burden for all enabling contacts of a safety relay module.

After a safety function has been requested the safety relay module only switches on again once a reset button (also referred to as start button) has been actuated.

The contrary is the operating mode "Auto start" (Automatic start), which is only admissible under certain conditions (if there is no danger of an unexpected restart) or a reset comes from somewhere else (with a quality corresponding to control category 1 to EN 954-1). Not admissible, for example, in emergency-stop command devices, in accessible rooms etc.

"Trailing edge" or "Edge detection" in this connection means that it is not the rising edge (upon actuating the button) that generates the start signal but the trailing edge after releasing the button. The analysis of the trailing edge or edge detection is an additional safety measure before an unexpected restart in the case of a manipulated or defective button.

Suitable for use in humidity of max. 100%. Contacts with ceramic insulation, suitable for voltages up to 500 VAC.

Safety relay modules for two-hand switches (protective device requiring the simultaneous use of both hands, i.e. the hands are kept from the hazardous area in order to initiate the operation of a machine and maintain operation for as long as a hazardous state exists. They must first satisfy the safety requirements laid down in particular in EN 574. Refer also to ELAN "SRB 201ZH".

The basic safety standards, which lay down the basic terms and the guiding principles for all machines.

Safety group standards, which deal with a particular safety aspect that is applicable to a wide range of machines.

Make more concrete statements and offer possible solutions for the safety aspects dealt with generally in the basic standards, such as safe distances, surface temperatures, etc.

Include concrete statements or possible solutions for safety equipment such as twohand operation circuits, interlocking devices, etc.

Machine safety standards or subject standards which relate to specific safety characteristics of individual types of machine or of machine groupings.

which can be manipulated using simple items, e.g. an uncoded magnet. Uncoded magnetic safety sensors must therefore be mounted in a concealed position, so that manipulation with simple items is not possible.

comprise a emitter and a receiver. The emitter is aligned such that a maximum proportion of the pulsed light from its diode falls onto the physically and optically separate light receiver. This evaluates the light received such that it can be clearly differentiated from ambient light or other light sources. An interruption of the light beam brings about switching of the output.

Devices can be operated on AC or DC supply.

Time until hazard is no longer present, e.g. on motor standstill

An area which is itself not safety relevant, which supports the area security, e.g. as prewarning before the protected field. This field serves to avoid unintentional stopping of the machine or plant. On AGVS, the measured values of this field can also be used to support navigation.

Inductive proximity switch which is insensitive to strong electro-magnetic fields.

Breakage of the actuating wire on pull-wire switches trips the contacts, thus protecting against unnoticed damage.