I have a few questions with regards to using safety relays in safety interlock circuits. The application area is small fully automated assembly machines (pick and place, small resistance welders, etc.). Actuators are
typically pneumatic cylinders with occasional small servo or stepper drives for simple positioning purposes. These questions do not refer to robot or stamping press applications.
E-stop removes all energy from the system including dumping the air. Access to the machines is provided by hinged doors which allow you to reach into but not fully enter the machines (i.e. the machines are too small for
you to walk inside).

The first question is how do you commonly see these devices actually being used in machines built within the past five years? Note that I am not asking you to give recommendations or application advice, I am just asking you to describe how you most commonly see people apply them whether you agree with that method or not.
I am particularly concerned with how access to the machine by qualified personnel for occasional set-up and troubleshooting is affected.

For example, I have seen a number of machines (implemented by people other than myself) in which a safety relay is simply used to replace a conventional contactor as the MCR, and the door switches and e-stop buttons (positive break) are wired with redundant contacts to this device.
I have seen set-up and trouble shooting access provided as either no access at all (which of course simply requires people to find various ways around the guards), or access is provided by using a key switch to over-ride the guards. The latter case relies upon the PLC program to ensure that no unexpected machine motions occur in this mode.
I would like to know if either of the above (no 'official' access, or access with an over-ride key) are common, or if some other means is typically used.

There has been some speculation that a proper implementation requires two safety relays, each performing a separate function. One relay
acts as an emergency stop relay and is tripped by an e-stop button (or pull cord, etc.) only. All energy is removed from the system including
disconnecting electric control power and dumping the air. This also provides the low voltage drop-out function. A 'start' button must be pressed to
re-enable this relay once it has tripped.
The second relay is connected to the guard switches. If a guard door is opened, electrical power is removed from the interlocked devices (i.e. power is disconnected from the PLC output cards). No machine motion can occur with the guards open regardless of what the PLC may be attempting to do. Since the air is not dumped from the machine, this still provides access
to the machine for set-up and trouble shooting. The relay is reset (re-enabled) upon closing the door.
I would like to know if the above method is commonly implemented. It is somewhat more expensive (two relays rather than one), but it would seem to offer greater security than the previously mentioned methods. I have not thus far seen this method used in a machine.


The final question is to ask for your opinions on the relative merits of the various makes of safety relays, particularly Jokab versus Pilz (although I would be interested in any other brands you would like to recommend as well). We currently have several brands installed and we would like to standardise on just one for spare parts.

The Ministry of Labour here has issued new regulations (with additional guidelines forthcoming) on machine guarding. I would like to get a better idea of what the general practice is with safety relays in places where they have been longer established.


**********************
Michael Griffin
London, Ont. Canada
[email protected]
**********************

 

I think instead of using two relays, one for e-stop and other for guard switches you can use one relay with e-stop and use one contact of the same relay to supply power to PLC output.
The incoming power to this contact should have the guard interlocks in series. So if a guard is opened no power is suplied to the PLC output as a
result there's no motion. In case of e-stop the start button can be remained pressed to switch on the relay. So both your purposes are solved with a
single relay with full security (at half cost). But I am not sure if your safety rules will permit this though I see no reason not to permit it.

Pradeep Chatterjee
M-30/7,
TELCO Colony,
Jamshedpur-831004 (India)
Email: [email protected]
Ph:91-0657-487549 (R)

 

The problem with the above idea is that there is nothing monitoring the guard door switches to see if they are working correctly. There is also no redundancy in this method either. I *have* seen the above done, but with
a normal contactor as an MCR rather than a safety relay.
The concept which was outlined in the original letter was that since the emergency stop and guard doors need different functionality, they need separate safety relays. That is, the main MCR monitors the emergency stop button (with redundant contacts), is reset manually, and removes *all* energy including dumping the air, hydraulic motors, etc. The second relay
monitors the guard door switches (with redundant contacts), is reset automatically, and does not dump the air. The output contacts of both relays
are in series.
The concept is based on the idea that in a fully automated machine without an operator the greatest risk is during set-up and troubleshooting
operations. If the safety of the personnel during these operations depends upon software interlocks, then what is the reasoning for using a safety relay for the MCR?
However, the original question was not what is the *best* method, or even a *good* method. Rather the question was what are the common methods employed in countries or regions where safety relays are generally used?


**********************
Michael Griffin
London, Ont. Canada
[email protected]
**********************

 

We have been using separate relays for E Stop and guards for many years now. The major reason is convenience. We do not require the operator to reset the E Stop every time he or she opens a guard door. Also is some cases we use guards that are locked until the machine comes to a stop which obviously requires separate relays. We also use zoned guards where opening a particular guard door will only stop a certain part of the machine not the entire machine so again here we need not only separate relays for the guards and E Stop but for each guard zone. Our company uses the same approach in Europe and other parts of the world as it wants to keep the machines the same wherever they are located.

Our machines though extensively automated have operators to load materials, adjust and inspect the product. Ideally the machine never stops but in practice we are not there yet. Our corporate standards do not allow us to use software interlocks for personal safety, everything is hard wired.

James Bouchard

 

The method described in fact deals with the power being cut off which is supplied to the PLC output modules "only which requires to be isolated when
guards are opened". It is not a software interlock. It suggests that one contact of the MCR to be used, to supply power to the required output modules, whose incoming power line has all the guard interlocks hardwired. So even if an output gets "on" through software logic no power will be suplied from the output modules which requires isolation if any of the guard switches are open. In case of e-stop all power is removed as the MCR is tripped and in cases of guards opening air is not dumped but power related
to prevent motion in certain required movements can be prevented. This has another advantage that even one can check the software logic in case of any problem without causing any movements. However this is not any "best" method. It's only we have used in some places and it worked fine.

Pradeep Chatterjee
M-30/7,
TELCO Colony,
Jamshedpur-831004 (India)
Email: [email protected]
Ph:91-0657-487549 (R)