Guide to Safety Relays and Safety Circuits
Safety relays help you build the safety circuits used in machine design. To understand their purpose in keeping operations safe, you need to know the basics of how the relays work and why these circuits are used.
Safety can become confusing because it comes with a large amount of terminology. These terms originate in the standards that describe safety circuits and functional safety. Those standards also describe safety relays and their operation.
Many of you requested more safety articles after reading about using a normally closed contact as stop button. This article introduces machine safety and safety circuits.
I will use safety relays as examples to show when you need to apply safety to a machine. A safety relay gives us a simple illustration of a safety circuit, including how that circuit works. Understanding the reason for using these relays helps explain their function: they are there to eliminate or reduce risks.
When applying machine safety, you will often need to build a safety circuit. Various circuit arrangements are possible, depending on the level of safety you need. We will look at the operation of safety relays and the methods you can use when building a safety circuit.
The article covers these topics:
Why Use a Safety Relay?
Machines and automation can be dangerous. Even a small motor has enough power to create dangerous situations. Power is one factor; sharp objects such as knives, heavy objects, noise and vibration can also be hazards. Anything capable of causing harm or damaging health is a potential risk.
Whenever you design a new machine or automation system, you therefore need to find the risks and dangerous situations it can create. You can begin to reduce those risks only after you have identified them.
The serious hazards machines can create are subject to strict legal requirements. In the USA, OSHA sets these standards. In the European Union, the requirements are governed by the Machine Directive. These requirements aim to keep machines safe.
Finding every risk and dangerous situation during machine design can be difficult, even though the law requires it. The steps below explain how to identify a machine’s risks. Once identified, you can use measures such as safety relays and other safety devices to eliminate them.
Risk Assessment
Risk assessment comes first. It identifies and evaluates the potential dangers of operating the machine, including all possible hazards and hazardous situations.
To carry out the risk assessment systematically, you can follow ISO 12100 also called:
ISO 12100 Safety of machinery – General principles for design – Risk assessment and risk reduction
This ISO standard helps you identify risks through risk assessment. It provides a series of logical steps for assessing them. Following those steps makes risks easier to find and gives you a systematic procedure for assessing every risk.
The following diagram shows the logical steps in the risk assessment procedure:
Risk Assessment Flow Diagram from ISO 14121
Risk Reduction
ISO 12100 also describes risk reduction: reducing the risks identified in your assessment. You can use one action or several actions to reduce a risk until it is eliminated. Eliminating risks is the aim of this process.
The type of risk determines the actions needed. Inherently safe design is one of the most effective approaches. Removing sharp edges, for example, eliminates the risk of cuts from those edges. Removing the source of the risk in this way is inherently safe design.
Inherently safe design comes first in the risk reduction process. Whenever you need to eliminate a risk, always try to do it through inherently safe design before considering other measures.
Safeguarding
Sometimes inherently safe design is not enough. Some risks remain because an operator can always make a mistake. Placing one or more guards around a moving part, for example, reduces its hazards to prevent accidents. This approach is called safeguarding.
Safeguarding is the action of either preventing a person from coming in contact with the hazard, or eliminating the hazards before a person can come in contact with the hazard.
Moving parts often need to be accessible for maintenance or service, and sometimes for operation. The safeguarding solution depends on the circumstances. Common types include:
- Guards
- Light Curtains
- Safety Mats
- 2-Hand Control
Guards fall into 3 main types:
- Fixed Guards
- Movable Guards
- Powered Guards
Fixed Guards
A fixed guard is welded in place or fastened with screws or nuts, so opening it requires a tool. These guards suit places where only technicians need access.
Fixed Guard for Machine Safety
Movable Guards
Movable guards are the second type. They open and close to provide access, which creates the risk of someone opening a guard while the part is still moving.
Further measures are needed here to eliminate the risk completely. People’s health and wellbeing depend on the protection, so the risks need to be eliminated in full. You therefore need a way to stop the machine when someone opens the guard. Stopping the machine in this situation is one of the requirements for movable guards.
ISO 12100, the standard covering machine risk reduction, states:
6.3.3.2.3 Requirements for movable guardsMovable guards which provide protection against hazards generated by moving transmission parts shalla) as far as possible when open remain fixed to the machinery or other structure (generally by means of hinges or guides), andb) be interlocking (with guard locking when necessary) (see ISO 14119).
The last part of this quotation states that you need interlocking guards. Interlocking means preventing the machine from starting while the guard is open. You can implement that function using interlock switches, which detect whether a guard is open.
Interlock switches have various designs. These are typical examples used for movable guards:
Magnetic Safety Switch
Each switch has its purpose. Hinge-style safety switches mount on the hinge to detect an open guard. Safety position switches can be used for sliding guards, for example. Other safety switches use a magnetic actuator.
Powered Guards
These switches work in the same way, apart from a special safety switch used for the final guard type: powered guards.
A machine may need longer to stop than an operator needs to open the guard and reach the hazard. A large robot arm or a large motor carrying a heavy load takes time to stop, even with brakes applied. This delay can create hazards despite an interlocking safety switch.
One possible solution is the powered guard or lockable guard. This is a movable guard with a safety switch that locks it. You can keep it locked until you are certain the movement has stopped and the hazard has gone.
Inside a locking safety switch, there is a solenoid. You can usually choose between two types of switch. With the first, energising the solenoid locks the switch. With the other type, the solenoid is used to unlock the switch instead.
Safety-Related Parts of Control Systems
In safeguarding, safety relays belong to the parts of a control system that handle safety. This connection explains where to use them.
Safeguarding with interlocks places requirements on the control system. The interlocks use safety switches, along with other safety devices described later, in the electrical control system. Parts of that system used for safeguarding to eliminate a risk are safety-related parts of the control system.
When building a safety-related control system, focus on making it fail safe. You need to understand what happens if one or more of its parts fail.
Control Categories
Before you start to build the safety system, you need to classify it. There is always a possibility that the system will fail, and the classification takes this into account. Consider an operator opening a guard: if the interlock does not stop the machine, the safety system has failed to eliminate the risk.
For this reason, you need to analyse the risks involved if the safety system itself fails.
The machine must remain safe and free of risks when the safety system fails. The following standard describes the analysis process:
ISO 13849-1 Safety of Machinery – Safety-Related Parts of Control Systems
Many readers will recognise this standard’s five control categories. It sets out five categories for control systems. Classifying a system requires analysing injury severity alongside exposure time to the hazard and the possibility of avoiding it.
I will leave the details of those five categories for another time. Machinery Safety 101 has a series of articles on interlock architectures and the five control categories.
The connection with safety relays begins with category 1, which requires “well-tried components and well-tried safety principles”. Machinery Safety 101 also has some very good material about this.
A safety relay meets the description of a well-tried component. That requirement explains why you use one when building the safety system for your machine.
A PLC, by comparison, is not a well-tried component. When building an automation system or machine, you therefore cannot use a PLC for its safety-related parts.
In category 2-4, the required diagnostic capabilities mean that the components do not have to be well-tried components. Those categories therefore do not carry that requirement.
How does a Safety Relay Work?
With their purpose established, we can look at how safety relays work. There are many variations for different applications. Understanding their operation helps you choose a suitable relay for your project.
Safety relays are well-tried components designed to meet requirements for safety-related parts of control systems. A relay’s data sheet states the highest safety level for which it can be used.
For example, a category 3 safety relay can be used in the safety-related parts of your control system up to category 3. The same relay can also be used in category B, 1 and 2 circuits.
A safety relay can use different techniques to meet the requirements of the different safety categories. Some techniques enable the relay to be used as a well-tried component in the safety-related parts of your control system. Other techniques help you meet the additional requirements of the different categories.
Safety Relay vs. Normal Relay
Why use a safety relay instead of a normal relay? The differences between them explain why a safety circuit needs a safety relay.
A normal relay is often cheaper, and it can control functions that a safety relay also controls. Why, then, do those functions need to be controlled by safety relays? Answering that question requires understanding the differences between a normal relay and a safety relay, including what makes the safety relay different.
Before examining how the relays operate, we need to return to the safety categories.
Safety Categories and Relays
Normal relays can only be used in safety category B, where a fault can cause the safety function to be lost. Other categories require well-tried safety components, and a fault must not result in the loss of the safety function. From Category 1 upwards, you must use well-tried components.
For the first two categories, normal relays and contactors can therefore provide safety functions because a malfunction that disables the protective function is allowed. Beyond those categories, consider how the safety circuit works both normally and when components fail.
Begin with Category 2, the first category that requires checks for the loss of safety functions.
Allen Bradley Safety Relay
This is where a safety relay helps. A safety circuit built from normal relays and contactors can quickly become complicated and require several components. Safety relays were developed to address that problem. PILZ designed and made the first safety relays, called PNOZ. These have developed considerably, and many are now programmable.
Newer versions of the PILZ PNOZ Safety Relays
How can you check whether the safety functions work?
You can carry out that check using a monitoring safety relay.
Monitoring Safety Relay
There are several methods a safety relay can use to monitor the safety circuit and detect the loss of a safety function. Before looking at the technical details of those methods, we need to understand the principle behind the monitoring safety relay.
The purpose of using a monitoring safety relay comes back to the same need: keeping the system safe.
We need to check for losses in safety functions. The safety function must still work even if the system fails, which is why these checks are needed.
A monitoring safety relay watches the safety function to check whether it has been lost. In most cases, this checking makes a safety relay a suitable choice for the circuit. The relay can meet all the requirements for the safety circuit’s functionality.
Fault Detection
Safety relays can detect four main types of fault:
- Wire break
- Faulty contactor
- Faulty safety actuator
- Timing
Other faults exist, but these account for most of them. Small pulses provide the same detection method for the first three faults.
To detect wire breaks and faulty contactors or actuators, a safety relay sends electrical pulses through the wiring. It measures current flow to check for welded contacts and broken wires.
These checks depend on timing, the other fault-detection method used by safety relays. Redundant contact sets in a safety actuator provide an example. The video below explains this principle using a magnetic safety switch.
Auto reset is not allowed unless the switch’s two contact sets close within a short time interval.
OSSD
Safety relays often have OSSDs, or Output Signal Switching Devices, because these suit safety circuits. For the details of why, Instrumentation Control has published a great article about it.
Internal Diagnostics
The safety relay’s internal operation is also part of the safety circuit. Its internal components need monitoring just as much as the external components do.
Many safety relays have internal diagnostics to monitor faults in internal relays and other components.
Hey, Peter!
I read your post with interest, but I have to point out an important error. At one point you say, “You might ask what this standard has to do with safety relays. The reason for this is that, no matter what category you classify your control system to be in, you have to use “well-tried components and well-tried safety principles”.”
All of the architectural categories in IOS 13849-1 begin with Category B, which amounts to the correct selection of components for the circuit conditions, i.e., the voltage and currents the components are likely to see in normal operation. Each succeeding Category definition begins with “the requirements of Category B shall be met…”
In Category B, neither well-tried components nor well-tried safety principles are required. Well-tried components are required in Category 1 since in order to increase the reliability of single-channel architecture without adding diagnostics requires higher reliability components. Categories 2 through 4 are all based on Category B, plus well-tried safety principles. The diagnostic capability added in each of these architectures compensates for the use of less reliable components. You can use well-tried components in Categories 2-4, but they are not required.
Hi Dough,
Thank you very much for pointing out that mistake. What a bad place to make an error, just before linking to one of your posts which I’m really fond of!
I’m not sure why I wrote that, but I’ve corrected the error. I will read and revise the whole article again as soon as possible.