machine guarding

For more than 50 years, Schmersal has dedicated itself to understanding man-machine safety hazards. Based on that experience, this handbook has been pre-pared. It represents a compilation of our responses to the most frequently-askedquestions from people who are actively engaged in designing machine-guard sys-tems. A complementary tutorial video is also available upon request.

The handbook concludes with a convenient condensed catalog of selectedSchmersal interlock safety switches and controllers that satisfy a vast array of safetyapplications and challenges. Should you desire more detailed technical data, pleasewrite or call for these product catalogs.

MAN-MACHINESAFEGUARDINGRequirements & Techniques

TYPICAL SAFETY INTERLOCK SWITCH APPLICATIONS

CHANGING MAN-MACHINESAFEGUARDING RULESToday worker safety is an issue of major concern to man-ufacturers worldwide. OSHA guidelines, more stringentANSI standards, and the recently adopted EuropeanMachinery Directive (EMD) are evidence of theincreased emphasis being given to employee safety inthe workplace.

Selected reference standards and guidelines aimed atachieving heightened levels of safety include:

. American National Standards Institute(ANSI) B11.19 1990(ANSI) B11.20 1991. OSHA 29 CFR 1910. ISA S84.01. ANSI/RIA 15.06-1992. IEC 204 Part 1. EN 292 Parts 1 & 2. EN 954 Part 1. European Union Machinery Directive (EMD)89/392/EEC

Each establishes minimum safety requirements to whichmanufacturers and employers must comply. And eachpresents new challenges to the plant safety spe-cialist and equipment designer … especial-ly where safety guards ancillary to theproduction equipment’s functionaldesign are required. For exam-ple, ANSI Standard B11.19-1990 appl ies to bothmachine tool OEM’s andtheir industrial users.

NEW SAFETY CONCEPTS ANDTECHNIQUESThe goal of these new and emerging guidelines is to pro-vide heightened levels of protection to machine opera-tors, helpers, and maintenance personnel. Toward thisgoal they have embraced several new safety systemconcepts including:

. positive-break contacts. greater tamper-resistance. positive-guided relays. fault detection. single component failure control reliability

Conventional limit switches, proximity sensors, magnetswitches and other conventional position-sensing andcontrol devices traditionally used as safety interlocks donot meet contemporary requirements. Consequently,when used in such applications, they are regarded asunsafe.

“SAFETY-SPECIFIC” COMPONENTSNew switches, sensors and controls have been designedspecifically for safety applications. They include:

. keyed interlock switches

. keyed interlock switches with solenoidlatching

. sealed coded-magnetsensors

. push/pull operatedemergency cable-pullswitches

. positive-break hingeswitches

. positive-break limitswitches

. positive-breaksafety edges

. safety controllers

INTRODUCTION

2

Each of these components is designed to overcome oneor more of the limitations of conventional “non-safety”components, and help the safety specialist and equip-ment designers to better address their responsibility …to ensure that machinery, built or purchased, does notexpose the operators, helpers or maintenance personnelto hazards.

Additionally, safety specialists and equipment designershave recognized:

(1) the greater degree of protection the new devices offer

(2) the importance of providing the greatest level of work-er protection

(3) the need to go beyond mere compliance with stan-dards/guidelines to minimize their company’s liabilityexposure

(4) their responsibility to ensure that equipment, built orpurchased, must not pose hazardous conditions tothe employees when operated.

These safety-specific components are listed in a briefoverview at the end of this handbook.

TOWARD A BETTERUNDERSTANDINGThe emergence of new safetyrequirements, and the relateddevices which satisfy thesecriteria, have precipitatedmany questions. Typical ofthese are:

. What exactly are “positive-break” devices?

. What is “positive-mode” installation, and why is itsafer?

. What are “fail-to-safe” devices?

. What are “positive-guided” contacts, and why are theyrecommended in safety circuits?

. How do I, the OEM or user, benefit from use of suchsafety devices?

. What is meant by “control reliability,” and how is itachieved?

. What is “risk assessment,” and how is it measured?

The answers to these, and other related questions, arethe subjects of this brief booklet. We hope it provides youwith:

. a better understanding of the new and emergingmachinery safety requirements

. a basic understanding of the unique safety devicesdesigned to meet these requirements

. a knowledge of the benefits to be derived from the useof such safety components.

And we hope it stimulates you to learn more aboutthe requirements for, and ways to achieve, a

safer workplace.

International symbol for Positive-Break contacts

3

4

TABLE OF CONTENTS

I. Man-Machine Safeguarding Principles and Practices . . . . . . . . . . . . . . . . . 7

II. Control Reliability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17

III. Risk Assessment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21

IV. Safety Standards, CE Marking and the European Machinery Directive . . 25

V. Safety Controllers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26

VI. Applications and Solutions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29

VII. Short-Form Catalog . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31

Topic Page

MACHINE GUARD CLOSED MACHINE GUARD OPEN

POSITIVE-BREAK NORMALLY-CLOSED CONTACTSFORCED TO OPEN BY A NON-RESILIENT MECHANICAL MECHANISM.

B 1 2 3 4

Starting Point

S1

S2

F1P1

P2

P1

P2F2

Safety Category

SafetyGuardClosed

ContactsClosed

Contacts forcedopen by non-

resilientmechanical member

SafetyGuardOpen

Normally-Closed Contacts(for monitoring)

Normally-Open Contacts

(for machine control)

Normally-Closed Contacts

Open

Normally-Open Contacts

Closed

Actuator

Actuator

Gap Tolerance

Positive-Break Contacts Positive-Mode Mounting

Positive-Guided Contacts Risk Assessment

5

I. Man-Machine SafeguardingPrinciples & Practices

Safety professionals recognize that, in many factories,workers often override or bypass safeguards intended toprotect them from injury. Reported motivation includesreal or perceived inconvenience, production incentives,familiarity with the equipment, or simply the challengepresented by the presence of the safeguard to be defeat-ed.

Consequently, manufacturers are increasingly recogniz-ing the need for, and their obligation to provide, safetyinterlocks which are not easily defeated/bypassed by theoperator or maintenance personnel.

Additionally, safety standards-making groups encourageuse of interlocks which are not easily defeated using sim-ple, readily-available means (such as a paper clip, tape,rubber band, piece of rope, screwdriver, etc.).

For example, the American National StandardsInstitute’s (ANSI) B11.19 1990, Reference Standard forSafeguarding Machine Tools specifically requires:

. Barrier guards that protect against unauthorizedadjustment or circumvention.

. Interlock devices that are not easily bypassed.

. Reduced liability

With the growing number of product liability cases, com-panies are recognizing the benefits of designing safetycircuits with interlock devices that are difficult to defeat.To further reduce their liability exposure, firms are select-ing only those devices that have been tested and certi-fied for use in safety applications by a recognized, inde-pendent third-party agency.

Manufacturers are encouraged to surpass safety designexpectations. As cited at a recent DESIGN NEWS semi-nar entitled “Product Liability — A Survival Kit for the90’s”, jurors expect companies to go beyond mere com-pliance. They give greater benefit to firms who havedesigned their products with the latest state-of-the-artmachine guarding safety devices.

Why should machine guard interlocks be“tamper resistant”?

“Difficult to defeat” is a subjective term related to work-ers’ propensity to override or bypass safety devicesintended to protect them from injury. Colloquially itmeans that the relevant devices or systems cannot bedefeated or bypassed using readily available means

(such as a piece of wire, tape, simple hand tool, etc.). Itimplies the basic safety interlock switch design serves asa deterrent to easily overriding or bypassing its intendedfunction.

What is meant by the term “difficult to defeat”when related to safety interlock switches in safetystandards such as ANSI B11.19, ANSI B11.20,ANSI-RIA 15.02, OSHA 1910.212, et al?

1

2

6

Safety interlock switch manufacturers are addressingthis requirement by:

. Designing two-piece keyed interlocks which feature ageometrically-unique actuating key and associatedoperating mechanism which function together todeter “bypassing”.

. Designing “coded-magnet” sensors whose multiplereed contacts can only be actuated in the presenceof a matched magnetic field array.

. Encouraging “positive-mode” mounting of single-piece interlock switches.

How is this requirement (“difficult to defeat”)being addressed by safety interlock switchmanufacturers?

3

“Positive-break” safety interlocks are electromechanicalswitches designed with normally-closed (NC) electricalcontacts which, upon switch actuation, are forced toopen by a non-resilient mechanical drive mechanism.(Spring actuators are not considered positive-breakmechanisms.)

One example of a “positive-break” safety interlock isshown in the photo below. This third-party certified andwidely used safety switch features a two-piece construc-tion: an electromechanical switching mechanism and ageometrically-unique actuator key.

A simple illustration of this design concept is shown inFigure 2.

The actuator key is typically mounted to a movable guard– such as an access door, protective grating, equipmenthood, or plexiglass safety cover. When the guard isclosed, the actuator mates with the electromechanicalswitching mechanism. Upon opening of the movableguard, the actuator key mechanically rotates a cammechanism – forcing the NC electrical contacts to openthe safety circuit.

For machine applications with residual motion after shut-down, key actuated interlocks are available with a sole-noid latch – which, in conjunction with a time-delay,motion detector, position sensor or other machinery sta-tus monitor, can delay access to hazardous areas untilsafe conditions exist.

What are “positive-break” safety interlocks?

4

Actuator keytypically mounted tomovable guard

“Positive-break” switchmechanism, typicallymounted to guardframe

Four optionalactuator keyentry locations(one on backof unit)

FIGURE 1

7FIGURE 2

Conventional versus Positive-Break Contacts



CONVENTIONAL NORMALLY-CLOSED CONTACTSOPEN BY RESILIENT MECHANICAL MECHANISM.

CONTACTS MAY NOT OPEN DUE TO SPRING FAILUREOR WELDED CONTACTS.

POSITIVE-BREAK NORMALLY-CLOSED CONTACTSFORCED TO OPEN BY A NON-RESILIENT MECHANICAL MECHANISM.

MOVABLEMACHINE GUARDACTUATING ACONVENTIONALLIMIT SWITCHWITHSPRING-DRIVENCONTACTS

MOVABLEMACHINE GUARDACTUATING ASAFETY INTERLOCKSWITCH WITHPOSITIVE-BREAKCONTACTS

8FIGURE 3

Conventional “limit” switches are typically designed touse a spring force to open normally-closed electricalcontacts. Such designs are subject to two potential fail-ure modes:

. Spring failure

. Inability of the spring force to overcome “stuck” or“welded” contacts.

When “actuated,” either situation may result in an unsafecondition due to failure to open normally-closed con-tacts. Consequently, such designs are not certified orrecognized as suitable for safety applications.

SCHMERSAL offers several “limit” switches designedwith “positive-break” contacts in both snap-acting andslow-action models for use in safety applications.

Are conventional electromechanical limit switchesdesigned with “positive-break” contacts?5

Devices which feature a “positive-break” design carry thefollowing internationally-recognized (IEC) safety symbol:

These designs meet the international requirementsestablished for such safety interlock switches.

How can I recognize “positive-break” safetyinterlock switches?6

Typically, the positive-break symbolcan be found on products as part ofproduct specification identification,as shown below.

9

A “positive linkage” switch actuator is designed to elimi-nate possible slippage between the actuator and its

mounting shaft. Examples of such designs are pinned,square and serrated shafts (see Figure 4, below).

What is meant by a “positive linkage” switchactuator, and why is it recommended for safetyapplications?

“Positive-mode” mounting assures that an electro-mechanical safety interlock switch is positively-actuatedwhen equipment or machinery shut-down is desired.

Safe “Positive-Mode” Mounting (Figure 5)When mounted in the positive-mode, the non-resilient

mechanical mechanism which forces the normallyclosed (N.C.) contacts to open is directly driven by thesafety guard. In this mounting mode, opening the safetyguard physically forces the N.C. contacts to open whenthe guard is open.

What is “positive-mode” mounting and why is itessential in safety applications?8

FIGURE 4

Pinned Square

Actuator Positive Linkage

Serrated

SafetyGuardClosed

ContactsClosed

Contacts forcedopen by non-

resilientmechanical member

SafetyGuardOpen

FIGURE 5POSITIVE-MODE INSTALLATION

7

10

Unsafe “Negative-Mode” Mounting (Figure 6)When mounted in the “negative-mode,” the force appliedto open the normally-closed (N.C.) safety circuit contactsis provided by an internal spring. In this mounting modethe N.C. contacts may not open when the safety guard is“Open.” (Here welded/stuck contacts, or failure of thecontact-opening spring, may result in exposing themachine operator to a hazardous/unsafe area of themachinery.)

Positive-mode installation is especially important whenusing single-piece safety interlock switches. This installa-tion mode takes full advantage of the device’s “positive-break” design — using the external force applied by thesafety guard to open the N.C. contacts.

SafetyGuardClosed

ContactsClosed

Contacts openby internal

spring force

SafetyGuardOpen

FIGURE 6NEGATIVE-MODE INSTALLATION

When mounted in the “negative-mode” (see Figure 6above), single-piece safety interlock switches can beeasily defeated/circumvented by the operator … oftensimply by taping down the switch actuator when the safe-ty guard is open.

In addition, spring-driven, normally-closed contacts canfail to open due to sticking, contact welding, or a springfailure.

Under such circumstances the operator or maintenancepersonnel may be exposed to an unsafe or hazardouscondition.

Consequently, where possible, two-piece, key-actuated,tamper-resistant safety interlocks are recommended.These devices are designed to be difficult to defeat,while providing the assurance of safety circuit interrup-tion inherent with “positive-break” interlock switchdesigns.

What are the risks of installing single-piece, safetyinterlock switches in the “negative mode”?9

11

Self-Checking: The performing of periodic self-diagnos-tics on a safety control circuit to ensure critical individualcomponents are functioning properly. Faults or failures inselected components will result in system shut-down.

Redundancy: In safety applications, redundancy is theduplication of control circuits/components such that if onecomponent/circuit should fail, the other (redundant) com-ponent/circuit will still be able to generate a stop signal.When coupled with a “self-checking” feature, a safety cir-cuit component failure, or component failure within thesafety circuit monitoring module or safety relay module,

will be automatically detected and the machine shut downuntil the failure is corrected.

Single-Fault Tolerance: A safety circuit is considered tobe single-fault tolerant if no foreseeable single fault willprevent normal stopping action from taking place.

Rugged, “fail-to-safe,” safety circuit controllers (often calledsafety relay modules) are also available that incorporatethe above features to satisfy the “control reliability” require-ments of existing domestic and international safety stan-dards.

What are “self-checking,” “redundancy,”and “single-fault tolerance”?10

OSHA and the European safety standards permit use ofcable-pull switches in E-Stop circuits provided they:

(1) Operate whether the cable is pulled or goes slack (e.g.breaks or is cut).

(2) Feature positive-break NC contacts.

(3) Must be manually reset before the controlled equip-ment can be restarted.

In addition, European Norm EN418 requires that theswitch latch at the same time that the contacts changestate.

SCHMERSAL offers a variety of cable-pull switches thatmeet both EN418 and the OSHA guidelines. These arecomplemented by several safety circuit controllers andsafety relay modules designed expressly for use in E-Stopcircuits.

Are cable-pull switches acceptable for use inE-Stop circuits?11

Reed switches may be used as interlocks in safety cir-cuits provided:

. they are designed to be actuated by a specific(coded) magnetic-field array matched to the switch’sreed-array pattern.

. they are used in combination with a safety controllercapable of periodically checking the integrity and per-formance of the reed switch contacts.

One such combination is shown in Figure 8, below.

Coded-magnets are required to actuate the sensor, thusmaking it difficult for the operator or maintenance per-sonnel to “defeat” or “bypass.”

The safety controller features multiple safety relays withpositive-guided contacts, redundant control circuits, andself-diagnostics that check safety system operation. In

Are reed switches recommended or acceptablein safety circuits and, if so, under what conditions?’12

12

the event of a component or interconnection wiring fail-ure in the safety circuit, or in the safety circuit controller,the unit will shut down the system in a “safe” state.

Note: Reed switches used without an approved safetycircuit controller do not satisfy safety require-ments. Reed switches are susceptible to stickingdue to power surges, shock, or vibration.

Additionally, reed switches tend to fail in the“closed” position. This failure mode cannot beaddressed by using a fuse. To ensure reliability ofa safety circuit using reed-type switches, use of asafety controller is required. Depending upon theapplication, it is also recommended that they fea-ture two independent contacts to permit dual-channel monitoring.

FIGURE 8

“Controlled access” generally refers to a movablemachine guard that is designed such that it can only beopened under specific conditions.Typically such movableguards restrict access to an area of a machine whichcontinues to present a hazard to the operator immedi-ately upon the removal of power. In these situationsopening of the guard is prevented until the hazardouscondition has abated.

This is usually achieved by a solenoid-latching interlockswitch controlled by a motion detector, position sensor,time-delay or other machine-status monitor which releas-es the interlock (allowing the operator to open the guard)only after safe conditions exist.

What is meant by “controlled access”?

13

“Diverse redundancy” is the use of different types ofcomponents and software in the construction of redun-dant circuits/systems performing the same function. Itsuse is intended to minimize or eliminate failure of redun-

dant circuits and components due to the same cause(“common-cause” failure). Such designs serve toincrease the functional reliability of the safety circuits andsystems.

What is “diverse redundancy,” and how does itheighten the reliability of a safety circuit?14

13

For machinery builders who export to the EuropeanUnion, the use of such components designed expresslyfor machine guarding safety systems is mandated by therequirements of the European Machinery Directive andthe need to comply with relevant safety standards. Theserequirements include:

. Use of interlock switches that feature positive-breaknormally closed contacts.

. Use of interlock switches or machine guarding posi-tion sensors, which are tamper-resistant/difficult todefeat.

. (Where risk level dictates) the need to monitor theintegrity of the safety circuit components and itsinterconnection wiring to ensure the system willfunction properly when called upon to do so.

For machinery builders selling in the U.S., the use ofsuch components is encouraged by the safety guidelinesand standards of the Federal government and severalindustry standards-making groups including:

. OSHA (Occupational Health & Safety Administration)

. ANSI (American National Standards Institute)

. UL (Underwriters Laboratories)

. ISA (Instrument Society of America)

. SAE (Society of Automotive Engineers).

Why are safety interlock switches and safetycontrollers required?15

Proper selection and installation of safety interlocks whichhave been tested and certified by an approved, indepen-dent safety testing body benefits the equipment manufac-turer by:

. Providing greater protection from injury for machineoperators, maintenance personnel, set-up and otheruser personnel.

. Satisfying international safety regulations … a must forU.S. equipment manufacturers who wish to export tothe European Economic Community.

. Enhancing product marketability.

. Satisfying safety standards and guidelines againstwhich manufacturer’s responsibility, in the event of aninjury, is judged.

. Reducing liability risks.

. Minimizing insurance claims/costs.

As an OEM, what are the benefits of usingpositive-break and tamper-resistant interlocks insafety applications?

16

14

Proper selection and installation of such safety interlockswhich have been tested and certified by an approved,independent testing body benefit the in-plant user by:

. Providing greater protection from injury for machineoperators, maintenance personnel, and otheremployees.

. Reducing liability risks.

. Minimizing insurance claims/costs.

. Satisfying safety standards and guidelines againstwhich employer responsibility, in the event of aninjury, is measured.

. Reducing the indirect costs associated with workerinjury (e.g. lost production, loss of skilled workers,reduced productivity due to employee stress, etc.)

As an “in-plant” user, what are the benefits of usingpositive-break, and/or tamper-resistant interlocksin safety applications?

17

While SCHMERSAL is not the only manufacturer of suchdevices, there are a number of factors which favor yourconsideration. These include:

(1) All SCHMERSAL safety interlocks have been third-party tested and certified to meet relevant directives— all are CE-compliant.

(2) Each can be provided with a Declaration ofConformity.

(3) Each has been designed expressly for safety appli-cations to meet the requirements of ANSI, OSHAand the European Machinery Directive.

(4) SCHMERSAL’s individually-coded keyed interlocks(AZ16zi, AZ17zi, and AZM170zi) provide the highestlevel of tamper resistance.

(5) SCHMERSAL’s safety interlocks and related con-trollers have been proven in thousands of installa-tions worldwide.

(6) SCHMERSAL’s microprocessor-based Series AESsafety controllers feature integrated systems diag-nostics which, using a visual colored LED displaypattern, help identify the type of system fault that hasoccurred and its location (to minimize downtime).

(7) SCHMERSAL’s safety controllers are easily integrat-ed with their more than 200 “positive-break” interlockswitches and coded-magnet sensors to achieve anydesired safety level. And, they are also compatiblewith other manufacturers’ safety-approved compo-nents.

What are the benefits of using SCHMERSAL safetyinterlock switches and related controls?18

15

II. Control Reliability

“Control reliability” implies that the safety device or sys-tem is designed, constructed and installed such that thefailure of a single component within the device or system

shall not prevent normal machine stopping action fromtaking place … but shall prevent a successive machinecycle from being initiated.

What is meant by “control reliability”?

19

Safety systems which are “single component failure con-trol reliable” meet the requirements of a Category 3

safety-related control system as defined by the harmo-nized European machinery safety standard EN954-1.

How does this definition of “control reliability”relate to the European machinery safetyrequirements?

20

16

Positive-guided relays feature N.O. and N.C. contactswhich operate interdependently. For such relays, the N.O.and N.C. contacts can never be closed simultaneously. Inthe event one of the contacts welds closed, the other con-tacts cannot change state. For example, should one ormore of the N.O. contacts weld/stick shut when closed, theN.C. contact(s) will remain open with a minimum gap of0.5mm.

A simple illustration of the interdependent function of pos-itive-guided contacts is shown in Figure 9.

This unique feature is desirable in machine safety circuitswhere “fail- to-safe” and/or “single component failure con-trol reliability” is desired. The positive relationship (interde-pendent operation) between N.O. and N.C. contacts per-mit self-checking/monitoring of the performance of thesedevices. Such relays provide a higher level of safety sys-tem integrity and reliability.

What are “positive-guided” or “force-guided”relays, and why are they preferred overconventional relays when designing safety systems?

21

POSITIVE-GUIDED CONTACTS CONVENTIONAL CONTACTS

UN-ENERGIZED STATE

ENERGIZED STATE

UN-ENERGIZED STATE

Normally-Closed

Contacts(for monitoring)

Normally-Open

Contacts(for machine control)

Normally-Closed

Contacts(for monitoring)

Normally-Open

Contacts(for machine control)

Normally-Closed

ContactsOpen

Normally-Open

ContactsClosed

Normally-Closed

ContactsOpen

Actuator

Actuator

Gap Tolerance

Actuator

Actuator

Normally-Open

ContactsClosed

Normally-ClosedContacts willremain open,

maintaining a minimumgap of 0.5mm

Normally-OpenContactweldedclosed

Normally-closedContacts will

return toN.C. state

Normally-Open Contact

WeldedClosed

WELD WELD

Gap Tolerance

FIGURE 9POSITIVE-GUIDED VS. CONVENTIONAL CONTACTS

17

“Control reliability” implies that the safety device or sys-tem is designed, constructed and installed such that thefailure of a single component within the device or systemshall not prevent normal machine stopping action fromtaking place … but shall prevent a successive machinecycle from being initiated. To achieve this, safety con-trollers are typically designed with dual logic circuits,each of which can provide safety circuit checking/moni-toring. These functionally-equivalent logic circuits cross-monitor each other, as well as checking the safety circuitfor component failures, short circuits, open circuits, etc.

Since these controllers detect faults in the safety circuitcomponents and interconnection wiring to effectmachine shutdown, such “redundant” self-monitoring cir-cuits enhance safety system reliability. In so doing they

provide a higher level of safety for the machine operatorand maintenance personnel.

To heighten the integrity and reliability of these units,SCHMERSAL engineers have had each of the redun-dant logic circuit microprocessors programmed by a dif-ferent software specialist … thus reducing the probabili-ty of a simultaneous logic-circuit malfunction due to aprogramming error.

Use of such safety controllers, in combination with safe-ty interlock switches, tamper-resistant coded-magnetswitches, and emergency cable-pull switches enablescontrol engineers to achieve the “single component fail-ure control reliability” required by OSHA, ANSI, and inter-national machine guarding safety standards/guidelines.

What are “redundant” logic circuits, and what aretheir benefits in safety circuit applications?22

“Fail-to-safe” safety devices are designed such that a com-ponent failure will cause the device to attain rest in a safecondition. This term is generally applied to electronic safe-ty interlock systems using non-mechanical presence orposition sensors (such as reed switches, proximity switch-

es, et al) and/or safety controllers. Such controllers areoften designed to feature redundancy, self-diagnostics,and positive-guided contacts.

What characterizes “fail-to-safe” operation?

23

18

Heightened awareness and concern for worker safety has,and is, precipitating compelling reasons for such upgradesor enhancements. These are embodied in a variety ofindustrial safety standards and guidelines against whichmachinery manufacturers’ and users’ level of responsibili-ty and degree of liability are measured.

Several of these current and emerging standards andguidelines are listed under references at the end of thisbooklet. The following excerpts are provided simply toillustrate the importance and need to consider providingnew or improved safety systems.

OSHA Guidelines

OSHA 1910.212 “General Requirements for allmachines”: “One or more methods of machine guardingshall be provided to protect the operator and otheremployees from hazards… The guarding device shall bein conformity with any appropriate Standards thereof…”

OSHA 1910.5 “Applicability of Standards”: “Any Standardshall apply according to its terms to any employment andplace of employment in any industry even though particu-

lar Standards are prescribed for the industry…”

OSHA 1910.6 “Incorporation by Reference”: “TheStandards of agencies of the U.S. Government, and orga-nizations which are not agencies of the U.S. Governmentwhich are incorporated by reference in this part, have thesame force and effect as other Standards in this part…”

ANSI B11.19-1990 Machine Tool Safeguarding…

4.1.1.4: “The employer shall ensure that barrier guards areinstalled, maintained, and operated so as to protectagainst unauthorized adjustment or circumvention…”

5.5.1 “Control Reliability”: When required by the perfor-mance requirements of safeguarding, the device, system,or interface shall be designed, constructed and installedsuch that a single component failure shall not prevent nor-mal stopping action from taking place…”

1.3.1 and 1.3.2: The grace period for OEM’s to conformwith new safeguards was Feb. 1991. Employers (industri-al users) were required to bring existing safeguards intoconformance by March, 1994.

Why should I upgrade or enhance my current safetyinterlock or safety barrier design?24

In selected situations the occurrence of known possiblecomponent failures (“faults”) can be minimized by thesafety system design or component selection. Simpleexamples are:

(1) the use of an overrated contactor to preclude the pos-sibility of contact welding.

(2) design of a machine guard such that the interlockswitch actuator cannot be damaged.

(3) use of positive-break safety interlock switches togeth-er with a safety controller, such that the possibility of acontact weld resulting in the loss of the safety functionis eliminated.

The elimination of such faults are a compromise betweenthe technical safety requirements and the theoretical prob-ability of their occurrence. Design engineers are permittedto exclude such faults when constructing the machinery’ssafety system. However, each “fault exclusion” must beidentified, justified, and documented in the Technical Filesubmitted to satisfy the European Machinery Directive.

What is “fault exclusion” and how does it affectsafety circuit design?25

19

III. Risk Assessment

Various machines present different types of hazards andrisks to the operator and/or maintenance personnel. Riskassessment is a systematic means of quantifying these

risk levels in order to determine the scope of the requiredsafety system needed to protect personnel from possibleinjury.

What is “risk assessment”?

26

Different machines and processes have different levels ofrelative risk. Determining this relative risk level involvesevaluating four major factors. These include:

(1) Severity of the potential injury.(2) Frequency of exposure to the potential hazard.(3) Possibility of avoiding the hazard if it occurs.

One approach provides guidelines for risk assessmentbased upon five defined levels of risk. These levels rangefrom the lowest risk (level B) in which the severity of injuryis slight and/or there is relatively little likelihood of occur-rence, to the highest risk (level 4) in which the likelihood ofa severe injury (if the safety system fails) is relatively high.

This particular method is depicted in Figure 10, in whichthe following qualitative definitions apply:

S: Severity of potential injuryS1: slight injury (bruise)S2: severe injury (amputation or death)

F: Frequency of exposure to potential hazardF1: infrequent exposureF2: frequent to continuous exposure

P: Possibility of avoiding the hazard if it occurs (general-ly related to the speed/frequency of movement ofhazard point and distance to hazard point)P1: possibleP2: less possible

For further details of the above, the reader is referred tothe EN 954-1 (Safety of Machinery: Principles for theDesign of Related Control Systems).

Another methodology is outlined in ANSI’s TechnicalReport B11.TR3. This guideline suggests a “task-based”review of potential hazards by both the equipment design-er and the ultimate end-user.

How do I go about assessing the risk level presentedby a machine or manufacturing process?27

B 1 2 3 4

Starting Point

S1

S2

F1P1

P2

P1

P2F2

Safety Category

FIGURE 10

Selection of the Safety Category:A brief overview of these safety categories is providedin Figure 11.

Preferred categories

Possible categories, which require additionalmeasures

Over-dimensioned measures for the relevant risk

20

The European harmonized standard, EN954-1 (Safety ofMachinery — Design of Safety Related ControlSystems), outlines five relative levels of risk associatedwith the operation/maintenance of machinery. Thegreater the possibility and/or severity of injury, the

greater the requirements are on the design and integrityof the machine safety systems.

In general, these levels of risk are defined as follows:

What are the defined levels of relative risk formachinery within which the safety systemshould be designed?

28

ºSafetyCat.

General SafetySystem Requirements

General SafetySystem Behavior

B Safety system designed tomeet operational requirementsand withstand expected externalinfluences.

(This category is usually satis-fied by selecting componentscompatible with the applicationconditions … e.g. temperature,voltage, load, etc.)

A single fault orfailure in the safe-ty system canlead to the loss ofthe safety func-tion.

1 Safety system must meet therequirements of Category B, butmust use “well-tried” safety princi-ples and components.

“Well-tried” principles and com-ponents include those which:. avoid certain faults … e.g.

short circuits.. reduce probability of faults… e.g. over-rating selected com-ponents, over-dimensioning forstructural integrity.. detect faults early … e.g.ground fault protection.. assure the mode of the fault… e.g. ensure an open circuitwhen it is vital that power beinterrupted should an unsafe con-dition arise.. limit the consequences ofthe fault.

A single fault orfailure in the safe-ty system canlead to the loss ofthe safety func-tion. However, theuse of “well tried”safety principlesand safety compo-nents results in ahigher level ofsafety system reli-ability.

2 Safety system must meet therequirements of Category B. Inaddition the machine shall beprevented from starting if a faultis detected upon application ofmachine power, or upon periodicchecking during operation.

(This suggests the use of asafety relay module with redun-dancy and self-checking. Single-channel operation is permittedprovided that the input devices …such as machine guard inter-locks, E-stop pushbuttons, et al… are tested for proper operationon a regular basis.)

Here, too, a sin-gle fault or failurein the safety sys-tem can lead tothe loss of thesafety functionbetween thechecking intervals.However, periodicchecking maydetect faults andpermit timelymaintenance ofthe safety system.

SafetyCat.

General SafetySystem Requirements

General SafetySystem Behavior

3 Safety system must meet therequirements of Category B. Inaddition the safety control systemmust be designed such that asingle fault will not lead to theloss of the safety function. And,where practical, the single faultwill be detected.

(This requires redundancy inthe safety circuit monitoring mod-ule and the use of dual-channelmonitoring of the input and out-put devices such as machineguard interlock switches, E-stoppushbuttons, safety relays, etc.)

Here a singlefault or failure inthe safety systemwill not lead to theloss of the safetyfunction and,where possible,will be detected.

4* Safety system must meet therequirements of Category B. Inaddition the safety control systemmust be designed such that asingle fault will not lead to theloss of the safety function andwill be detected at or before thenext demand on the safety sys-tem. If this is not possible, thenthe accumulation of multiplefaults must not lead to the loss ofthe safety function.

(This also requires redundancyin the safety circuit and the use ofdual-channel monitoring of theinput and output devices such asmachine guard interlock switches,E-stop pushbuttons, safety relays,etc. Here the number of allowablefaults will be determined by theapplication, technology used, andsystem structure.)

Here a singlefault or failure inthe safety systemwill not lead to theloss of the safetyfunction, and it willbe detected intime to prevent theloss of the safetyfunction.

FIGURE 11

*Category 4 safety requirements are usually associatedwith extremely high-risk applications. Since general machinedesign practice respects classic safety hierarchy, in whichmost machine hazards are either:. designed out,. guarded against (if they cannot be designed out), and,. (as a last resort) warned against,Category 4 requirements may arise relatively infrequently.

21

Within the above defined levels of risk, a Category 3 safe-ty system would satisfy OSHA and ANSI’s requirement fora “control reliable” safety circuit. Here use of an appropri-ate fail-to-safe, safety controller in combination with one ormore safety interlock switches and/or coded-magnet sen-

sors will meet the single component failure detection andsystem shutdown criteria, while preventing a successivemachine cycle from being initiated when a fault is detect-ed.

Which of these risk category safety systemrequirements is consistent with OSHA and ANSI’srequirement for a “control reliable” safety circuit?

29

Machine safety system control reliability can be achievedthrough use of:

. Safety components which feature fail-to-safe design.

. Electromechanical safety interlocks which featurepositive-break N.C. contacts.

. Use of safety relays which feature positive-guidedcontacts.

. Use of self-checking safety controllers.

. Use of redundant monitoring/checking circuits andrelated safety system components.

The selection of these components will, of course, be afunction of the application and its level of risk assess-ment. SCHMERSAL has available an applications andsafety circuit wiring handbook to serve as a reference forselecting, designing and wiring the appropriate safetycircuit for a given level of risk assessment.

How can the safety system requirements, andthe requirement for machine safety system“control reliability,” be satisfied?

30

Category 1 and 2 safety system requirements can beachieved without the use of safety controllers. However,this requires very careful design of the safety control cir-cuit and a thorough understanding of the standards relat-

ed to the Machinery Directive. Use of a safety circuit con-troller ensures meeting Category 1 and 2 requirementswithout a time-consuming study of the machine controlsystem.

Are safety controllers needed whenaddressing Category 1 or 2 safety systemrequirements?

31

22

Category 4 safety system requirements are typically asso-ciated with extremely high-risk applications in which:

(a) The severity of a potential injury is extremely high (e.g.amputation or death).

(b) The employee/operator is exposed to the hazard high-ly frequently or continuously.

(c) There is little possibility of the employee/operatoravoiding the hazard.

Classic safety hierarchy states that dangers should be:

(1) designed out;

(2) guarded against, if they cannot be designed out; andthen

(3) (as a last resort) warned against.

Since this classic safety hierarchy reflects generalmachine design practice, few machines present Category4 risk conditions.

When Category 4 safety requirements are encountered(that is, when the safety control system must be able todetect any single fault, or provide multiple fault tolerance,without loss of the safety function), it is important toremember these define the performance requirements ofthe overall safety system … not of the individual compo-nents. (This, of course, is true for all safety categories …not only Category 4.)

In this “system” context, it is clear that safety system com-ponent selection and design for equipment assessed as aCategory 4 risk will be dictated by the number of faults thesystem can tolerate without loss of the safety function.Hence the appropriate safety system components areapplication-specific, requiring a thorough understanding ofthe operation of the machinery and its control system.

Use of a safety controller rated at Category 4 does not, initself, assure the overall safety system meets this level ofperformance requirements.

How common are Category 4 safety systemrequirements and how can they be satisfied?32

23

IV. Safety Standards,Marking and the

European Machinery Directive

The “CE” mark (for Conformite Europeene) is a symbolapplied to finished products and machinery which meetapplicable European Directives. For electrical and elec-tronic “finished products,” these include the Low VoltageDirective and, where relevant, the ElectromagneticCompatibility (EMC) Directive.

The CE mark on a machine indicates that the machineas a whole conforms to the requirements of theEuropean Machinery Directive (EMD). The EMD statesthat the machine must comply with the Essential Health& Safety requirements and the EMC.

What is the “ ” mark and what does it mean?

33

No, the CE mark is not a safety mark. It simply serves toadvise European customs officials that the product meetsall applicable European Directives, allowing it to be placed

on the European Economic Market Area (The EuropeanUnion and the countries of Iceland, Liechtenstein andNorway).

Does the mark on a safety interlock switch,coded-magnet sensor, safety controller or otherfinished product intended for use in a safetycircuit signify the product is safe?

34

Third-party examination by an approved, independenttesting agency or notified body is required for some safe-ty components. Specific products include light curtains,safety mats, and two-hand controls. In addition somecountries, such as Germany, require third-party certifica-tion for safety circuit controllers.

For most other safety components (such as interlockswitches, coded-magnet sensors, limit switches, et al)self-certification by the manufacturer is acceptable.Despite this liberty, as policy SCHMERSAL has all of

their safety products certified by an independent thirdparty (such as the BG).

Whether third-party or self-certified, all CE-marked com-ponents must be documented by a Declaration ofConformity.This document, signed by a highly positionedtechnical manager (e.g. Director of Engineering, et al),lists all standards and directives to which the productconforms. In addition, component manufacturers mustmaintain technical files documenting test results, etc.

Are third-party approvals needed to apply the mark to safety components?35

24

SCHMERSAL considers all of their safety interlockswitches, sensors and related control accessories asproducts requiring mandatory CE-marking. Conse-quently these products are designed to meet the EMC

and Low Voltage Directives as required. The CE-markingon SCHMERSAL’s products affirms their compliance withthese applicable Directives.

Are machine guarding safety interlock switchesand related safety control productssubject to -marking?

36

Users of CE-marked products have three vehicles ofassurance at their disposal. These include an ECDeclaration of Conformity, EC Type-Examination, andType-Certification (Technical Report). Each of these isdescribed below.

EC Declaration of ConformityThe Declaration of Conformity is mandatory for all prod-ucts that are CE-marked. It is also mandatory formachine components which, if they fail, could lead to adangerous or hazardous condition on the machine.These mandates are defined in the European MachineryDirective, and must be issued by the manufacturer for allproducts that are CE-marked.

This document, signed by a highly-positioned technicalmanager (e.g. Director of Product Development, Directorof Research, Head of Engineering, et al), lists all theStandards and Directives to which the product conforms.It is a self-certification procedure normally undertaken bythe manufacturer.

All SCHMERSAL safety products have a Declaration ofConformity document according to the EuropeanMachinery Directive mandates.

EC Type-ExaminationThis is a third-party examination conducted by anapproved, independent testing agency/notified body(such as the BG in Germany), and is compulsory forselected safety equipment. Here the product is investi-gated to confirm that it conforms to all the Standards andDirectives listed in the Declaration of Conformity.

The examination procedure, the definition of anapproved independent testing agency/notified body, andthe types of safety equipment for which this examinationis mandatory is defined in the European MachineryDirective. (Specific products for which an EC Type-Examination is mandated include light curtains, safetymats, and two-hand controls. In addition the Germanauthorities include safety circuit controllers as requiringsuch testing.)

This examination may only be conducted once, by oneapproved body, whose findings are then valid for theentire European Economic Community.

All SCHMERSAL safety controllers are so tested andcertified. And each can be supplied with an “EC Type-Examination Certificate” issued by a recognized,approved body/notified body.

Type Certification (Technical Report)This is similar to the EC Type-Examination, but is notcompulsory. Here the product is investigated by anapproved independent testing laboratory (usually by anotified body) to confirm that it conforms to all theStandards and Directives listed in the Declaration ofConformity. This examination may be carried out in asmany countries and as often as required.

All SCHMERSAL safety products not covered by an ECType-Examination certificate (such as our electro-mechanical safety interlock switches) have been so test-ed and certified. And each can be supplied with a “TypeCertificate” issued by a recognized, notified body (e.g.BG, TÜV).

Since -marking of safety products is (for mostitems) a self-certification process, how can a userbe assured “ -marked” products truly meetrelevant European Directives?

37

25

The European Machinery Directive applies to all machin-ery that is powered and has moving parts. Excluded aremanually-powered equipment, motor vehicles, medical

machinery and other special equipment … some ofwhich is regulated by other legislation under EuropeanCommunity Directives.

To what type machines does the EuropeanMachinery Directive apply?38

For most classes of machines, the affixing of the CEmark to demonstrate compliance with relevant EuropeanDirectives is a self-certification process. For the mostdangerous types of machines (Schedule 2, Annex IV ofthe European Union Machinery Directive, such as press-es, sawing machines, manually-loaded injection/com-pression plastics molding machines and others listed inthis Schedule), certification must be done by a recog-nized, independent, third party (known in Europe as a“notified body”). A list of notified bodies is available from

The Official Journal of the European Communities, U.S.Contact, UNIPUB; Lanham, MD.

While self-certification of many machines is legallyacceptable, many machinery buyers prefer purchasingmachines which have been evaluated and certified byindependent, recognized third parties.This preference, insome cases, has been precipitated by sale of self-certi-fied machines which were found to not meet relevantDirectives.

Who is responsible for certifying that an affectedmachine complies with the “essential health andsafety requirements” embodied in the EuropeanMachinery Directive?

39

“Consensus Standards” are those industry standardsdeveloped by groups of professionals representing across-section of firms within that industry. Examples arestandards prepared by ANSI (American NationalStandards Association), ISA (Instrument Society ofAmerica), ASME (American Society of SafetyEngineers), SAE (Society of Automatic Engineers) andRIA (Robotics Industry Association). These standardsprovide safety guidelines for machinery designers andusers.

OSHA specifically requires that guarding devices at thepoint-of-operation be in conformity with any appropriatestandards (which include any OSHA or “industry con-sensus standards”). Hence OSHA may cite such con-sensus standards as a basis for their findings andenforcement.

What are “Consensus Standards,”and how do theyrelate to OSHA guidelines?40

26

V. Safety Controllers

Safety controllers (such as SCHMERSAL’s AES andAZR Series) are connected between machine guardinginterlock/E-Stop switches and the machine’s stop controlelements (such as a motor contactor or control relay).

These controllers contain dual, self-checking safety sys-tem monitoring circuits and positive-guided outputrelays. Each is designed to monitor faults in the safetysystem’s interlock/E-Stop switches, the safety circuitinterconnection wiring, and their own internal monitoringcircuits and output relays.

Detection of a fault in the machine’s safety circuit or of anopen machine guard, disables the module’s output sig-nal(s) facilitating machine stoppage, and/or prevents therestarting of the machine until the fault has been cor-rected.

In addition to detecting open guards and/or actuated E-Stop switches, safety controllers are capable of detectingthe following types of safety system faults:

. Guard monitoring switch/sensor failure

. “Open-circuit” in interconnection wiring

. “Short-circuit” in interconnection wiring

. “Short-to-ground” in interconnection wiring

. Welded contact in controlled output device

. (such as positive-guided motor contactor)

. Failure of safety controller’s positive-guided relay(s)

. Fault in safety system monitoring circuit

. Insufficient operating voltage.

Some microprocessor-based safety controllers, such asSCHMERSAL’S AES Series, also feature integrated sys-tem diagnostics with visual LED outputs which indicatesfault type and location — thus minimizing machine down-time.

What are “safety controllers” andwhat are their functions?41

Safety controllers detect and locate system faults. Units are available for use with guard interlock switches,coded-magnet sensors, safety edges, light curtains, E-stops and emergency cable-pull switches to satisfya broad range of application requirements.

27

Safety controllers increase the reliability of the machineguarding safety system. Their ability to detect safety cir-

cuit faults, and shut down the machine until the fault iscorrected, greatly heighten the safety level.

Why should safety controllers be used withsafety interlocks/E-Stops?42

A single-channel safety controller is capable of acceptingonly one (normally-closed) input. When used in safetycircuits they are unable to detect a short-circuit failure inthe interconnection wiring, or a failure of the monitoredinput to change state.

A dual-channel safety controller is capable of acceptingtwo inputs; one to each of its two, redundant self-moni-toring safety circuits. When used in safety circuits theyare typically capable of detecting interconnection wiringfaults (such as short-circuits, open circuits, and groundfaults) or a failure of one of the monitored input(s) to

change state. As such they provide a higher level of safe-ty than single-channel units.

Single-channel safety controllers are suitable for relative-ly low levels of risk assessment (e.g. EN 954-1 SafetyCategories B, 1 and 2). Dual-channel units are appropri-ate when designing “control reliable” safety systems —that is, systems in which a single component failure willnot prevent normal machine stopping action from takingplace, but will prevent a successive machine cycle frombeing initiated.

What is the difference between a single and dual-channel safety controller, and when shouldeach be used?

43

Safety controller selection is usually based on:

(1) the type of inputs being monitored (e.g. E-Stops,interlock switches, light curtains, coded-magnet sen-sors, et al).

(2) the number of inputs being monitored.

(3) the number and type of outputs required from thesafety controller (e.g. number of parallel outputs fromthe module’s positive-guided relays and the numberof auxiliary/signaling outputs).

(4) the need/desire to monitor the integrity of the posi-tive-guided contacts in the controlled output device(e.g. motor contactor, control relay, et al).

(5) the level of safety desired (this is usually determinedby a structured risk assessment).

These application parameters will normally narrow, andsimplify, the choice of safety controller to one or twounits.

How do I decide which safety controller to use?44

28

Category 4 safety requirements are usually associatedwith extremely high-risk applications. Consequently thesafety system needed to satisfy these conditions can bequite complex and costly.

Since general machine design practice respects classicsafety hierarchy, most extremely high-risk hazards —that is:

(a) those which the operator cannot avoid

(b) those in which the operator is exposed frequently orcontinuously, and

(c) those which could result in serious injury, amputationor death

are designed-out during machine development or areguarded against (if they cannot be designed-out).

Consequently for most applications it is generally notnecessary to incur the cost/complexity of Category 4safety system design. Many low-risk situations can besatisfied by safety systems that meet the requirements ofCategory B, 1 or 2 as defined by EN 954-1.

In most higher-risk situations, a suitable safety system(and one which meets ANSI’s requirement for “controlreliability”) can be achieved with a system designed tomeet the Category 3 requirements of EN 954-1.

When needed, Category 4 requirements can be satisfiedby proper selection from SCHMERSAL’s wide range ofCE-compliant safety interlocks and related safety con-trollers.

When is it necessary to design a safety system tosatisfy the requirements of EN 954-1 Category 4?45

29

VI. Applications and Solutions

Positive-break and tamper-resistant safety interlocks areinherently safer alternatives to conventional industrialcomponents such as:

. (Non-safety) electromechanical limit switches

. Inductive proximity switches

. Snap-acting position switches (without positive-break)

. Uncoded reed switches

. Hall-effect sensors

. Magnetic position switches

. Photoelectric sensors

Such conventional industrial sensors/switches are notrecommended for safety applications.

For increased safety and reduced liability, only compo-nents which have been tested and certified by an inde-pendent, recognized safety commission/agency are rec-ommended.

Typical applications for these safety interlocks include:

. Metal cutting machine tools

. Metal forming machine tools

. Grinding machines

. Woodworking machinery

. Packaging equipment

. Printing presses

. Stamping/punch presses

. Textile machinery

. Material handling/conveyor lines

. Forging equipment

. Crushing machines

. Sawing systems

. Robot work-cell enclosures

. Emergency trip-wire systems

. Assembly equipment

What are some of the applications in whichpositive-break and tamper-resistant safetyinterlocks are used?

46

The examples on the following pages are representativeof the growing family of safety switches from

SCHMERSAL which satisfy these requirements.

What type safety interlock switches are availablethat are positive-break, tamper resistant,and certified for safety applications?

47

Difficult-to-defeatmultiple-camactuating mechanism(mechanical life: 10 million)

High-strength, corrosion-resistantpolymeric housing (no groundconnector required)

Up to 3 contacts,for dual-channelreliability withsignalling

4 actuator-keyentry points,for ease ofmounting

Integral, non-removableactuating head resists bypassingby preventing access to operatingplunger

Rugged, tamper-resistant, stainlesssteel coded actuatorkey (Individually-coded keys available)

3 threadedknock-outconduit entrypoints for easyinstallation

Electrically-insulated contactsfor added safety (nopotential for crossover)

Optional funnel entry

AZ16Anatomy of the world’s

best-selling interlock switch

And the industry's broadestrange of optional features &accessories…

• Adjustable ball latch• Magnetic door latch• Signal lamps• Short-radius actuator keys• Individually-coded actuator keys• Solenoid-locking• Gold contacts• Explosion-proof models• Key entry closure caps• Actuator key lockout device• LED status indicators

Internationally accepted(CE, UL, CSA, BG, SUVA,SA, NEMKO, TUV, andothers)

normally-closedcontacts (ensure circuit interruption)

Self-lifting terminal clamps (forspeedy installation)

Molded-in, easy-to-read terminalmarkings (help ensure proper wiring)

IP67 sealed housing(tolerant to hostile environments)

Optional “maintained” or“ejecting” actuator key(for applicationversatility)

Optionalquick-connecttermination

31

POSITIVE-BREAKKEYED INTERLOCK SWITCHES

Switch SeriesHousingMaterial

EnvelopeDimensions

ContactConfigurations

ST14Glass-fiber,

reinforced thermoplastic3⁄4" × 11⁄4" × 2" 1 NO & 1 NC

2 NC

AZ17AZ17zi

Glass-fiber,reinforced thermoplastic

11⁄4" × 11⁄4" × 21⁄2" 1 NO & 1 NC2 NC

AZ15/16AZ16zi


11⁄4" × 2" × 3"

1 NC1 NO & 1 NC

2 NC1 NO & 2 NC

3 NC

AZ335 Die-cast aluminum 11⁄2" × 13⁄4" × 41⁄2"

1 NO & 1 NC2 NC

1 NO & 2 NC3 NC

AZ415 Die-cast aluminum 13⁄4" × 31⁄2" × 4" 2 NO & 2 NC

SDG Die-cast aluminum 13⁄4" × 2" × 6"1 NO & 2 NC2 NO & 1 NC

3 NC

SHGV(Key transfer

system)Die-cast aluminum 13⁄4" × 2" × 6"

1 NO & 2 NC2 NO & 1 NC

3 NC

TZGGlass-fiber,

reinforced thermoplastic13⁄4" × 2" × 33⁄4" 1 NO & 1 NC

2 NC

For complete specifications, please request SCHMERSAL Catalog GK-1, or visit our website at www.schmersalusa.com.

VII. Short-FormCatalog

KEYED INTERLOCK SWITCHESWITH SOLENOID LATCHING


EnvelopeDimensions


AZM170AZM170zi


11⁄4" × 21⁄2" × 31⁄2" 1 NO & 1 NC2 NC

AZM160AZM160zi


11⁄4" × 31⁄2" × 51⁄8" 2 NO & 2 NC1 NO & 3 NC

AZM415 Die-cast aluminum 2" × 5" × 51⁄2" 2 NO & 2 NC3 NO & 3 NC

AZM161Glass-fiber,

reinforced thermoplastic11⁄4" × 31⁄2" × 51⁄8" 2 NO & 4 NC

3 NO & 3 NC

TZF/TZMGlass-fiber,

reinforced thermoplastic11⁄2" × 4" × 5" 2 NO & 1 NC

TKF/TKM Die-cast aluminum 21⁄2" × 31⁄2" × 8" 2 NO & 2 NC

TZK Glass-fiber,reinforced thermoplastic

13⁄4" × 31⁄2" × 8" 1 NO & 2 NC

TG-1 Door handle for use with solenoid-latching switches.


32

POSITIVE-BREAKEMERGENCY CABLE-PULL SWITCHES

Switch Series HousingMaterial

MaximumSpan


Rated*

ActuatingForce

ZS75Bidirectional

Die-castaluminum

165 feet2 NO & 2 NC

4 NCYes

(Optional)4-45 lbs.

ZS71Die-cast

aluminum65 feet

1 NO & 1 NC2 NO & 2 NC

Yes(Optional)

13.5 lbs.

ZS441Die-cast

aluminum80 feet

1 NO & 1 NC2 NC

No4-45 lbs.

ZS73Die-cast

aluminum165 feet

1 NO & 1 NC2 NC

Yes(Optional)

6-90 lbs.

ZS75Die-cast

aluminum165 feet

Conformsto

ULCSA

IEC 947-5-1EN 60947-5-1

EN418DIN VDE0660-200

ULCSA

CE (EN418)

IEC 947-5-1EN 60947-5-1

EN418

DIN VDE0660-200

CEBG

EN418IEC 947-5-1

EN 60947-5-1

CEBG

EN418IEC 947-5-1

EN 60947-5-1

1 NO & 1 NC2 NC

2 NO & 2 NC4 NC

Yes(Optional)

6-90 lbs.


POSITIVE-BREAKE-STOP PUSHBUTTON STATIONS

ADSeries Plastic

N/A

1 NO & 2 NC2 NO & 1 NC

3 NC

N/A

EDSeries

Die-castaluminum

2 NO & 2 NC1 NO & 3 NC

4 NCULCSA

EN418EN 60947-5-1

33

34

CODED-MAGNET SENSORS/SWITCHES

Sensor SeriesApproximate

EnvelopeDimensions

OperatingVoltage

ContactConfiguration(s)

BNS 33 3.5"×1.0"×0.5"24 VAC/DC

1 NO & 1 NC

120 VAC/DC

1 NO & 2 NC1 NO1 NC2 NC

BNS 250 1.0"×1.4"×0.5" 24 VDC1 NO & 1 NC1 NO & 2 NC

BNS 300 1.25" ⁄0 24 VDC 1 NC

BNS 333 4.5"×1.7"×1.7" 24 VDC 1 NC

These rugged presence-sensing devices feature a sealed (IP67) housing, making them ideal interlocks in hostile envi-ronments. Their tamper-resistant design and small size make them attractive alternatives to conventional proximity sen-sors, magnetic switches, and limit switches. Used with SCHMERSAL’s matched safety system fault detection and con-trol modules (safety controllers), they allow achieving the highest levels of machine safety.

BNS 303 1.25" ⁄0 100 VAC/DC1 NO & 1 NC1 NO & 2 NC

Note: When used in safety applications, coded-magnet sensors must be used with a suitable safety controller to satisfy the desired safety control category/level of assessed risk. Schmersal offers a wide selection of safety controllers to meet most application requirements. (Ask for Catalog GK-2).


35

POSITIVE-BREAK HINGEDSAFETY INTERLOCK SWITCHES


Angular Displacementfor Contact Opening


ES 95 SBGlass-fiber,

reinforced thermoplastic7°

1 NO & 1 NC2 NC

TC 235Glass-fiber,

reinforced thermoplastic4.5°

1 NO & 1 NC2 NC1 NC

TC 236 Die-cast zinc,enamel finish

4.5°1 NO & 1 NC

2 NC1 NC

TVS 335TVS 355

Die-cast aluminum,enamel finish

2°1 NO & 1 NC

2 NC

TV8S-521Die-cast zinc,chrome-plated

6°1 NO & 1 NC

2 NC

TESZ*Glass-fiber,

reinforced thermoplastic 4.5°1 NO & 2 NC

3 NC


SAFETY FOOT SWITCHES

GFS3-Position foot control turns equipment “off” when footpedal is released or fully-depressed beyond pressurepoint. Features manual pushbutton reset.

Die-cast zinc,enamel finish

*Available with stainless-steel hinges.

36

POSITIVE-BREAK SAFETY LIMIT SWITCHES


HousingDimensions


Z/T235

TZ/T236

Die-cast zinc

Glass-fiber reinforcedthermoplastic

11⁄4"×11⁄4"×21⁄2"1 NO & 1 NC

2 N02NC

Degree ofProtection

IP67

Z/T256Glass-fibre reinforced

thermoplastic11⁄4"×21⁄4"×2"

1 NO & 1 NC2 N02NC

IP67

Z/T335 Die-cast aluminum 11⁄2"×11⁄4"×3"

1 NO & 1 NC2 N02NC

1 NO & 2 NC3 NC

IP67

Z/T336

Z/T336

Glass-fibre reinforcedthermoplastic

Die-cast aluminum

11⁄2"×11⁄2"×3"1 NO & 1 NC

2 N02NC

IP67

Z332 Die-cast aluminum 11⁄2"×11⁄2"×3" 1 NO & 1 NCIP65

C50Glass-fiber reinforced

thermoplastic1"×11⁄8"×3⁄4" 1 NO & 1 NCIP30


Note: While ideal as a safety interlock switch for safety systems, these rugged limit switches offer the reliability and benefits of positive-break contacts for any position-sensing application.

37For complete specifications, please request SCHMERSAL Catalog GK-1, or visit our website at www.schmersalusa.com.

FAIL-TO-SAFE SAFETY EDGES

SCHMERSAL’s Series SE Safety Edges/Bumpers are available as sub-

assembly components or as custom assemblies produced to user

specifications. The following pages provide details regarding operation,

construction and ordering details. Among the user options are safety

edge profile, mounting frame profile and length. Please contact us if you

have any questions, special needs or require assistance with properly

specifying the safety edge which meets your requirements.

SELECTION GUIDE

New!

38

OVERVIEW OFSCHMERSAL’S SAFETY CONTROLLERS

(For complete specifications and selection guide, please ask for Catalog GK-2)

BASIC FUNCTIONThe SCHMERSAL family of safety circuit monitoring,fault detection and control modules includes two basicdesigns. One utilizes relay logic. The other uses solid-state (microprocessor) logic. Pioneered by SCHMER-SAL, these “safety controllers” provide added featuresand capabilities unachievable with conventional safetyrelay modules.

Both designs feature redundant, dual-channel cross-monitoring logic circuits. These continuously check for,and detect, faults in the system’s safety circuit compo-nents and interconnection wiring. Modules also detectwhen a machine guard interlock/E-stop switch is actuat-ed and, depending upon the model, are capable ofdetecting the following types of potential safety circuitfaults:

• Welded interlock/E-stop switch contacts• Misaligned guard• Open circuits, short circuits or ground faults• Welded/stuck contacts in module’s safety relays• Fault in the module’s monitoring circuits• Inadequate supply voltage to module• Welded/stuck contacts in controlled output motor con-

tactor/control relay• Capacitive/inductive interference on module inputs

In addition, SCHMERSAL’s microprocessor-based safe-ty controllers provide visual LED fault diagnostics whichhelp pinpoint fault locations to minimize equipmentdowntime.

All units are designed to increase the level of safety inthe machine guarding and/or E-stop control circuit.

SERIES AZR & SRB SAFETY CONTROLLERSSCHMERSAL’s AZR and SRB Series features relay-based monitoring logic. Each is capable of detectingactuation of the machine guard interlock or E-stopswitch and selected faults in the safety circuit compo-nents and interconnection wiring. Detection of an openguard, E-stop actuation, or failure of the safety circuit’scomponents or interconnection wiring results in inter-ruption of machine operation.

Unlike many other manufacturers’ safety relay modules,a number of SCHMERSAL’s AZR and SRB Series arecapable of detecting short circuits in the interconnectionwiring and welded/stuck contacts in the controlled out-put device (e.g. motor contactor). All feature an LEDsafety circuit status display.

SERIES AES SAFETY CONTROLLERSSCHMERSAL’s AES Series features microprocessor-based monitoring logic. In addition to performing thefunctions provided by traditional relay-based designs,the AES Series solid-state logic provides added capa-bilities often unavailable in relay-based models. Theseinclude:• Fault identification diagnostics … the AES provides a

variety of flashing, colored LED patterns which indi-cate specific types of faults and their location (thusminimizing equipment downtime).

• Auxiliary semiconductor outputs … for alarm and/orsignaling purposes.

• Modular component design … permitting realizationof the most cost-effective monitoring solution.

• “Diverse redundancy” … use of different componentsand/or programs in the redundant monitoring circuitseliminates “common cause” failures and heightensmodule reliability.

Relay-BasedAZR & SRB Series Safety Controllers

Microprocessor-BasedAES Series Safety Controllers

39

Expressly For Use With Coded-Magnet Sensors

PartNo. Application

Guards orDevices

MonitoredInputs/Guard Feedback

AvailableVoltages

HousingSize(mm)

Max.SafetyCat.

Outputs

NO

-Saf

ety

Au

xilia

ryS

emic

on

du

cto

rT

imed

-NO

Tim

ed-A

uxi

liary

Monitoringcoded

magnetswitches of

typeBNS…12Z

2 1 NO/2 NC

No 24VDC 48 11AES6112

Monitoringcoded

magnetswitches of

typeBNS…12Z

2 1 NO/2 NC

No 24VAC120VAC230VAC

48 11AES7112

Monitoringcoded

magnetswitches of

typeBNS…12Z

1 1 NO/2 NC

No 24VDC24VAC

120VAC230VAC

22.5 11AES1102

Monitoringcoded

magnetswitches of

typeBNS…12Z

2 1 NO/2 NC

No 24VDC24VAC

120VAC230VAC

22.5 11AES1112

This series of safety controllers was specifically designed as a low-cost way of monitoring coded-magnet switches. They featuretriple redundancy; however, there is no internal cross-monitoring nor fault detection. Loss of a channel will not be detected. For thisreason they are suitable for a maximum of Safety Category 1.

SAFETY CONTROLLERS

Selected Features:

. Compliant

. Positive-guided control relays

. Visual fault indication

. Designed expressly for use withcoded-magnet sensors

(For detailed specifications ask for Catalog GK-2)or visit our website at www.schmersalusa.com

40

PartNo. Application

Guards orDevices


AvailableVoltages

HousingSize(mm)

Max.SafetyCat.

Outputs

NO

-Saf

ety

Au

xilia

ryS

emic

on

du

cto

rT

imed

-NO

Tim

ed-A

uxi

liary

MonitoringE-Stops

1 0 Yes 24VDC24 VAC

22.5 23 1AZR31TO

MonitoringGuard

Switchesor

E-Stops

1 1NO/1NCor 2 NC

Yes 24VDC24 VAC

22.5 41 1AZR11RT2

MonitoringGuard

Switches orE-Stops

1 2 NC Yes 24VDC24VAC

120VAC230VAC

45 43 1AZR31T2

MonitoringGuard

Switchesor E-Stops

2-HandControl


120VAC230VAC

45 43 1AZR31R2

MonitoringE-Stops


120VAC230VAC

45 23 2AZR32T1

SERIES AZR SAFETY CONTROLLERS

Selected Features:. Compliant. Positive-guided control relays. Controlled-contactor or relay feedback monitoring. Wide range of compatible input devices. Multiple safety contacts. Auxiliary signaling contacts

41

PartNo. Application

Guards orDevices


AvailableVoltages

HousingSize(mm)

Max.SafetyCat.

Outputs

NO

-Saf

ety

Au

xilia

ryS

emic

on

du

cto

rT

imed

-NO

Tim

ed-A

uxi

liary

MonitoringE-Stops


120VAC230VAC

45 41 3 1AZR32V1

ZeroSpeedMonitor

1 3ϕVoltage

No 24VDC24VAC

120VAC230VAC

45 43 1AZR31S1

PressMonitor

1 2 NC No 24VDC24VAC

120VAC230VAC

45 41 1AZR20P2

OutputExpander

— — No 24VDC24VAC

120VAC230VAC

100 46 2AZR62A2

TimedOutput

Expander

— — No 24VDC24VAC

120VAC230VAC

100 41 6 2AZR63V2

SERIES AZR SAFETY CONTROLLERS

For complete specifications and wiring information for SCHMERSAL’s wide range of safety controllers,please request Catalog GK-2, or visit our website at www.schmersalusa.com.

42

PartNo. Application

Guards orDevices


AvailableVoltages

HousingSize(mm)

Max.SafetyCat.

Outputs

NO

-Saf

ety

Au

xilia

ryS

emic

on

du

cto

rT

imed

-NO

Tim

ed-A

uxi

liary

MonitoringGuard

Switchesor

E-Stops

1 1 NO/1 NC

or

2 NC

No 24VDC 22.5 31 2AES1135

MonitoringGuard

Switchesor

E-Stops

1 1 NO/1 NC

or

2 NC

No 24VDC 22.5 31 2AES1145

MonitoringGuard

Switchesor

E-Stops

2 1 NO/1 NC

No 24VDC 22.5 31AES1165

MonitoringGuard

Switchesor

E-Stops

1 1 NO/1 NC

or

2 NC


55 31AES2135

MonitoringGuard

Switchesor

E-Stops

2 1 NO/1 NC


55 31AES2165

Selected Features:

. Compliant

. Positive-guided control relays

. Fault identification diagnostics

. Wide range of compatible input devices

SERIES AES MICROPROCESSOR-BASEDSAFETY CONTROLLERS

4343

PartNo. Application

Guards orDevices


AvailableVoltages

HousingSize(mm)

Max.SafetyCat.

Outputs

NO

-Saf

ety

Au

xilia

ryS

emic

on

du

cto

rT

imed

-NO

Tim

ed-A

uxi

liary

MonitoringGuard

Switchesor

E-Stops

1 1 NO/1 NC

Yes 24VDC 22.5 32 1AES1235

MonitoringGuard

Switchesor

E-Stops

1 1 NO/1 NC

Yes 24VDC 55 33 2AES2335

MonitoringGuard

Switchesor

E-Stops

1 1 NO/1 NC

or

2 NC

Yes

Yes

24VDC

120VAC230VAC

100 33

3 2

2AES3335

MonitoringGuard

Switchesor

E-Stops

2 1 NO/1 NC

Yes 24VDC 100 33 2AES3365

MonitoringGuard

Switchesor

E-Stops

1 1 NO/1 NC

or

2 NC

Yes 24VDC 100 34 1 2AES3535

MonitoringGuard

Switchesor

E-Stops

2 1 NO/1 NC

Yes 24VDC 100 34 1 2AES3565


44

PartNo. Application

Guards orDevices


AvailableVoltages

HousingSize(mm)

Max.SafetyCat.

Outputs

NO

-Saf

ety

Au

xilia

ryS

emic

on

du

cto

rT

imed

-NO

Tim

ed-A

uxi

liary

MonitoringGuard

Switchesor

E-Stops

2 1 NO/1NCor

1 NO/2 NCor

2 NCor

3 NC

Yes 24VDC 100 42 2 2AES3267

InputExpander

forAES3267

2 2 NCor

3 NC

No 24VDC 22.5 4AESA1067

MonitoringGuard

Switchesor

E-Stops

1 2 NC Yes 24VDC 100 43 2 4AES3337

MonitoringofSL

Bumpers


120VAC230VAC

50 31ASL2103


45

PartNo. Application

Guards orDevices


AvailableVoltages

HousingSize(mm)

Max.SafetyCat.

Outputs

NO

-Saf

ety

Au

xilia

ryS

emic

on

du

cto

rT

imed

-NO

Tim

ed-A

uxi

liary

AES SAFETY CONTROLLERACCESSORIES

InputExpander

forAES

Series

4 1 NO/1 NC

or2 NC

No 24VDC 100 35AESE3035

Each Schmersal Series AES safety controller comes with its own easy-to-use faultlocator chart. This self-adhesive label may be affixed to the side of the module, orprominently displayed on the control cabinet. It enables service personnel to quick-ly and easily translate the monitor’s colored, flashing LED pattern to identify, locateand correct the safety circuit fault … thus minimizing equipment downtime.

Time-Saving, Highly-VisibleFault Diagnostic Chart

QUICK FAULT LOCATORLED FAULT CODE FAULT LOCATIONGREEN “ON” No faults detected and relay contacts closedYELLOW PULSE @ 0.5 Hz Guard openYELLOW PULSE @ 2 Hz Guard misaligned (or) Welded/stuck switch

contact (or) No start signalYELLOW (1 PULSE) Guard 1 openYELLOW (2 PULSES) Guard 2 openRED (1 PULSE) Guard 1 switch circuit (S1)RED (2 PULSES) Guard 2 switch circuit (S2)RED (3 PULSES) Guard 1 & 2 switch circuitsRED (4 PULSES) Capacitive/inductive interference on inputsRED (5 PULSES) Drop in supply voltage (or)

Internal relay malfunctionRED (6 PULSES) Welded/stuck internal relay contactRED (7 PULSES) AES monitoring circuit

EXCLUSIVELY FOR: AES 3355, 3365, 3555, 3565

46

PartNo. Application

Guards orDevices


AvailableVoltages

HousingSize(mm)

Max.SafetyCat.

Outputs

NO

-Saf

ety

Au

xilia

ryS

emic

on

du

cto

rT

imed

-NO

Tim

ed-A

uxi

liary

ZeroSpeedMonitor

— 2ProximitySwitches

No 24VDC 22.5 31

1 2

2FWS1105

ZeroSpeedMonitor

— 1 or 2ProximitySwitches

&1 StopSignal

No 24VDC 22.5 3FWS1106

ZeroSpeedMonitor

— 1 or 2ProximitySwitches

&1 StopSignal

No 24VDC120VAC230VAC

50 33 1FWS2316

ZeroSpeedMonitor

1 or 2ProximitySwitches

&1 StopSignal

No 24VDC 100 32FWS3506

FWS Zero Speed Monitors and the AZS 2305 Timer Module are designed to apply power to a locking solenoid switch to unlock aftermotion has stopped.

4 1

OnDelayTimer

1 NO/1 NC

Yes 24VDC120VAC230VAC

50 33 2AZS2305

SAFETY CIRCUIT ACCESSORIES

47

The following are some of the current and emergingsafety standards and guidelines which may affectyour equipment design and its use.

• Occupational Health & Safety Administration, Codeof Federal Regulations, Part 1910 (OSHA 29 CFR1910).

• ANSI Technical Report B11.TR3:2000, RiskAssessment and Risk Reduction — A guide to estimate, evaluate and reduce risks associatedwith machine tools.

• ANSI Standard B11.19-1990, SafeguardingReference for B11 Machine Tool Safety Standards

• ANSI Standard B11.20-1991, Safety Requirementsfor Construction, Care, and Use of MachineTools — Manufacturing Systems/Cells.

• ANSI-RIA 15.06-1992, Safety Requirements forIndustrial Robots & Robot Systems.

• ISA S84.01: Safety Instrumented Systems

• EN292, Parts 1 & 2 — Safety of Machinery, BasicConcepts, General Principles of Design

• IEC 204, Part 1, Electrical Equipment of IndustrialMachines (1992)

• European Machinery Directive (EMD) 89/392/EECEssential Health & Safety Requirements Related tothe Design & Construction of Machinery

• EN 954, Part 1, Safety of Machinery — Principlesfor the Design of Safety Related Control Systems

• EN 1088: Safety of Machinery-Interlocking DevicesWith and Without Guard Locking.

REFERENCES

The contents of this booklet represent a brief overview of selected current international and U.S. machine guard-ing safety standards and guidelines affecting machinery builders and users. The material presented is intendedto inform the reader of some of the current and emerging safety issues which may need to be considered.

Due to the booklet’s brevity, and to the diversity of applications which may be affected, we strongly encourageconsulting with official regulatory bodies and relevant safety standards/guidelines.

Toward this goal a partial listing of selected references has been provided.We trust this brief tutorial was of valueand that it encourages further investigation.

machine guarding

Documents