Engineering · Safety
Industrial Safety Systems
How does a machine know a person is in danger, and what does it do about it?
A machine safety system detects a dangerous situation and brings the machine to a safe state before anyone is hurt. It does this with three things working together: inputs that detect (emergency stop, light curtain, door interlock), logic that decides (a safety relay or safety PLC), and outputs that remove the energy (safety contactors or the drive’s safe torque off). Everything is built in two channels that watch each other, so a single failed part cannot hide. This page walks through each part with things you can press, break and measure. It is a learning aid: real safety functions come from a risk assessment and certified components, designed and validated by competent people.
| Rule | What it means |
|---|
An emergency stop is a back-up, not the first line of defence: guards and light curtains come first. It must be easy to reach, red on a yellow background, and latch down when pressed. Inside, the normally closed (NC) contacts are held closed by the button; pressing it forces them open by positive mechanical action, even if a contact has welded. Opening the circuit removes the safety signal and the logic removes power. Releasing the button only re-arms the circuit: a separate reset, and then a start, are needed, so the machine cannot restart by itself. An E-stop is used for stop category 0 or 1, never category 2.
Safety distance (ISO 13855): S = K × T + C. K is the approach speed, 2000 mm/s for walking; if S comes out at 500 mm or less, K = 1600 mm/s may be used (never below 100 mm). T is the total time from the person entering the field to the hazard stopping: machine stop time plus the light curtain and relay response times. C = 8 × (d − 14) mm for resolutions up to 40 mm. The Safety Fence System page has a fuller calculator and the other fence rules: Safety Fence System.
A light curtain is a row of infrared beams between a transmitter and a receiver. Anything that blocks a beam drops the two safety outputs (OSSD1 and OSSD2) and the machine stops. The resolution is the smallest object that is certain to be detected anywhere in the field: 14 mm for a finger, 30 mm for a hand. The beams are spaced about that far apart, so a smaller object can slip between them. Drag the object to see it. A light curtain does not stop the machine by itself, so it must be mounted far enough away that the machine has stopped before a person can reach the hazard.
| Type (ISO 14119) | How it works | Weakness |
|---|
Guard locking holds the door shut until the hazard has stopped, using either a delay long enough for the worst-case run-down or a standstill monitor. A spring-applied, power-released lock stays locked if power fails and is the usual choice where a run-down hazard exists; a power-applied lock opens when power fails, which suits places where a person could be trapped. Interlocks can be defeated with a spare actuator, magnet or screwdriver, so choose a coding level that makes defeat hard, mount them out of reach, and test each one on a schedule. Several interlocks wired in series on one input can hide a fault, so give important guards their own input or use devices with a safety bus.
| Safety relay | Safety PLC |
|---|
STO is a safety function inside a drive (IEC 61800-5-2). It blocks the gate signals to the output transistors, so the drive cannot make torque-producing current and the motor coasts: it is a stop category 0. Two independent inputs, STO A and STO B, must both be on for the drive to be allowed to run; losing either one disables torque, and a disagreement between them is treated as a fault. STO does not isolate the motor electrically, so lock out the main supply before maintenance. For a controlled stop first, a drive can ramp down and only then use STO (a stop category 1, sometimes called safe stop 1).
| Stop category | Description | Result | Typical use |
|---|
Category 0 cuts the power at once: the motor coasts, and a high-inertia load can take a long time to stop. Category 1 brakes under control and then removes the power. Category 2 brakes under control and keeps the power on, which is an ordinary operational stop, not an emergency stop. The distance travelled while stopping matters, because it decides how far away a light curtain or guard must be.
| Category | Principle | Highest PL reachable | Faults |
|---|
The category describes the structure of the safety function. The performance level (PL a to e) is the reliability result and also depends on the component quality (MTTFd), the diagnostic coverage (DC) and common-cause-failure measures, so the category alone does not give the PL. The risk assessment sets the PL that is required; the tool SISTEMA, or the manufacturer’s data, is used to prove it. Which category suits a machine is decided by that risk assessment, not by the type of machine.
| Performance level | Probability of dangerous failure per hour (PFHd) |
|---|
The E-stop, the door interlock and the light curtain are each wired in two channels to the safety relay. The relay lets its outputs go on only when both channels agree and are healthy, and after a reset. Pressing any input drops the outputs and the motor loses power. Try the faults: a contact welded in one channel makes the two channels disagree, so the relay locks out; a welded contactor is caught because the relay watches the feedback loop. A single fault is detected, and the machine cannot be restarted until it is fixed. That is what category 3 means.
This page explains concepts and uses simplified figures. It is not a design, a risk assessment or a compliance statement. Safety functions must be specified from a risk assessment (ISO 12100), built from certified components used within their ratings, and validated by competent people against the current standards and local law.