A strategy for safe motion

26 December 2008

Armin Glaser, Head of Product Management, and Andreas Hahn, Product Manager at Pilz GmbH addressed an audience at the recent SPS/IPC/Drives show in Nürnberg on the subject of safety in motion control.

Armin Glaser (left) and Andreas Hahn
Armin Glaser (left) and Andreas Hahn

For many years, the Pilz brand has stood for safety and the protection of man and machine in the automation industry. We paved the way for machine safety, institutionalised it, influenced the development of the standards and brought the first products successfully to market.

Safety is an essential component for any type of automation. The central importance of safety is no longer questionned, even by the market. Safety cannot be “decreed” through regulations; however, in well co-ordinated solutions it can contribute to ergonomics, availability and, ultimately, productivity.

Nowadays, machine safety and automation are increasingly merging. Dovetailing between the two areas is particularly significant. At Pilz we pay particular attention to this, as it is the only way to offer our users consistent overall concepts. What’s important to us is intelligent dovetailing, in which the needs of safety are considered right from the start.


Pilz pursues a “four-pronged strategy”, as presented to the technical public in 2004. This includes the horizontal expansion of the product range, the transfer from SafetyBUS p to SafetyNET p, dovetailing of safety and standard control functionalities and the expansion of the services range.

With the integration of safety into drive technology we now support each of the four prongs.

First, with safe motion we are taking care of the horizontal expansion of the product range.

Second we are providing another example of intelligent dovetailing of safety and standard control technology.

Third, when developing our real-time Ethernet SafetyNET p we paid particular attention to the requirements of safety and drive technology by offering an especially fast protocol version. Its scan time of 62.5 µs meets the requirements of digital servo technology with regard to current and speed control.

Fourth, we are adding expertise and application knowledge to our product range in the motion control sector. After all, the products are literally only half the battle: users also have to know how to apply them to achieve machine safety.By incorporating safe motion into our product range we can once more offer the market a universal solution: from sensor technology to signal processing through to safe actuator technology.

In our view, it’s not enough to provide a technical innovation to ensure a product’s success on the market. What really influences the success of a solution is the benefit to the user: making an application simpler, carefully guiding the user through the standards and legislation.


One of today’s main challenges in automation is to improve interaction between man and machine in order to unlock the potential for greater economy. In the past, for example, physical separation between man and the hazardous movement has been characteristic of safe automation. If access was required, the process was transferred to a safe condition using safety gate switches. This was a proven procedure, based on very robust, simple principles. However, it’s a disadvantage that the production process has to be regularly stopped and restarted. It’s essential to increase machine availability / productivity without having to endure long recommissioning times due to the safety functions.

Safe drive solutions are therefore a primary component for complete automation. They protect man and machine, without restricting the production process. The challenge lies in the seamless dovetailing of safety technology with complex motion control structures.

With the integration of safety functions users have all-in-one solutions, which will contribute to ergonomics, availability and, ultimately, machine productivity.


The new Machinery Directive comes into force on 29 December 2009 and will surely present a particular challenge to machine manufacturers and operators. The general expectation is that the conversion process will not make the safety solution any easier for users. The whole process chain – sensor technology, monitoring, actuator technology – is assessed using mathematical models. We consider it vital to be represented in every segment of this chain. In this respect, safe drive technology is an important component in the portfolio. In terms of the new safety standards, we can expect the value of compatible, overall solutions to rise significantly.

The new Machinery Directive requires machine functions to be re-assessed and forces the user to consider new operating modes. In the present status you cannot work when a safety gate is open; a hard shutdown, however, is clearly detrimental to productivity. Safe monitoring of velocity and rotational speed provides an alternative solution. Safety can be implemented discretely, i.e. externally, using the PNOZmulti safety system for example, or it can be integrated using the new generation of servo amplifiers PMCprotego DS.


Automation has to be simple and safe. Decentralisation of control functionalities is the future. At the same time the user needs to maintain a centralised perspective of a distributed control system. That’s the route we are taking with the automation system PSS4000.

We will be presenting this to the general technical public at the 2009 Hannover Fair. This shows that we are taking into account the requirements of our customers, who have challenged us to provide complete solutions comprising safety and standard control technology.

With PSS4000 we will have a system that combines both requirements. However, the user can always rest assured that the needs of safety technology have been considered from the outset. What’s more, our automation system is a genuine alternative to existing solutions. We have used our application knowledge and safety expertise to simplify the decentralisation of control functionalities and reduce the engineering work.

Equally, a networked automation system is intended to satisfy the requirements of the control technology, safety technology, visualisation and diagnostic function and, finally, motion control. These are the tasks we will implement with our new automation system PSS4000. Control functions and safe motion control are the focus of our activities.

Just for show: Armin Glaser with yellow motors
Just for show: Armin Glaser with yellow motors

Feedback from our customers strengthens our belief that we are on the right track.


The following presentation was made by Andreas Hahn, Product Manager at Pilz.

Management has clearly defined objectives for machinery and production equipment: higher productivity, availability and safety on one side, less engineering and maintenance work on the other.

Safe motion – the implementation of safety functions for one or more drive axes – brings a clear benefit in this respect and opens up new horizons.

Safe motion from Pilz is addressed to all users who literally want to play safe in matters relating to safety. Drive-integrated safety is of particular interest for manufacturers of packaging machines, servo presses or gantries for pick-and-place applications, among others.


With safe motion, “setup” mode can be implemented with much greater ease and efficiency. The “Safe stop 2” function protects the operator, should the drive start up unexpectedly. “Safely limited speed” enables the machine operator to avoid a hazard in timely fashion. A jog function can be implemented using “Safe direction”. Thanks to these safety functions, the operator can work in an open detection zone, and is therefore closer to the process. This can reduce setup times by up to 50 per cent.


Used in conjunction with intelligent sensor technology such as the SafetyEYE safe camera system, safe motion meets the requirement for more flexible, more ergonomic interaction between man and machine.

With SafetyEYE it’s possible to divide the monitored zone into warning and detection zones, based on the application. This way, a violation of the detection zone does not directly or automatically cause a machine to stop completely. If the system detects a person within the warning zone, the machine speed can initially be reduced via “safely limited speed,” while a visual or audible warning signal is issued simultaneously. Should the person step back out of the warning zone, the machine will immediately return to normal operating speed.

Only if SafetyEYE registers a violation of the detection zone will the machine be brought to a safe condition via the “Safe stop 2” functions. This means that in many cases, safety fences are no longer necessary.


Conventional solutions rely on safe logic and safe motion monitoring in additional external devices. The new Pilz servo amplifiers PMCprotego DS provide integrated safety functions.

Used in conjunction with the new safety card PMCprotego S it provides a fully-fledged safe drive solution, offering the user numerous safety functions, from safe stop to safe motion functions, right through to safe brake functions.


- “Safe torque off”

The power to the motor is safety removed directly within the servo amplifier, so that the drive is unable to generate any hazardous movements. This function is used to prevent the drive from starting up unexpectedly.

- “Safe stop 1”

With a "safe stop 1" function, the drive is brought to a controlled stop and then the power to the motor is safely removed. Once at standstill the drive cannot generate any hazardous movements.

- “Safe stop 2”

With this function, the drive is brought to a controlled stop and a safe operating stop is then initiated. With a safe operating stop, the drive's control functions are maintained in full. This means that axes remain synchronised, even without additional holding brakes.

Servo amplifier PMCprotego
Servo amplifier PMCprotego


- “Safe operational stop”

This function monitors the stop position reached by the axis and prevents any deviation from the position window. The drive’s control functions are maintained in full. If the position strays outside of the monitored window, the drive is shut down safely.

- “Safely limited speed”

The drive is monitored to check that a defined maximum speed is not exceeded. If the limit value is exceeded, the drive is shut down safely.

- “Safe speed range”

This adds minimum speed monitoring to the “safely limited speed” function.

- “Safe direction”

This function guarantees that a drive can only move in one (defined) direction.


- “Safe brake control”

This function enables brakes to be controlled safely, preventing suspended loads from falling.

- “Safe brake test”

This function checks the function of the brake and enables faults in the control and on the brake’s mechanics to be detected. The brake test may be carried out in each production cycle or only every 24 h, depending on the specific application and the requirement from the risk analysis.

This function is used to check the effectiveness of the brakes. Not only does this significantly increase the safety of these solutions, e.g. for applications with suspended loads, but it also considerably reduces the amount of maintenance work required. Maintenance can be carried out automatically; maintenance engineers are no longer required.


Parameters for the safety card can be set quickly and simply via a software tool. First of all the user determines the functions he wishes to use, then he can define the tolerances and limit values. If he is using several safety cards, he can set the parameters centrally via a software tool. The cards that are used are displayed in a tree structure.

Thanks to the clear graphical interface, parameters can be set simply and quickly. The status of the safety card can be displayed online. This means that the operating status, error stack and other data can be monitored continuously.

With drive-integrated safety functions, motion can be monitored exactly where it arises. This means that reaction times are reduced considerably, which is very significant for safety, particularly with highly dynamic drives. Costs are also reduced, as there are fewer higher level safety components.

Control and feedback of the safety functions on the PMCprotego DS are performed via safe inputs and outputs. This guarantees the device's openness towards standard market systems. The safety functions are also independent of the motor or encoder type that is used. This gives the user the opportunity to equip his machine to suit his individual needs. The slot for expansion cards enables numerous fieldbus systems to be connected. This means that overall solutions can also be implemented in conjunction with third-party products.

Safety on the servo amplifier PMCprotego DS is based on the evaluation of internal system variables. Unlike other solutions, a second encoder is not required in order to achieve SIL2 (3), PL d (e), Category 3 (4), which reduces the overall costs. Safety is achieved using one standard encoder.

Contact Details and Archive...

Related Articles...

Additional Information...

Print this page | E-mail this page