ISO 16092-3:2017 Machine tools safety — Presses — Part 3: Safety requirements for hydraulic presses

Foreword

ISO (the International Organization for Standardization) is a worldwide federation of national standards bodies (ISO member bodies). The work of preparing International Standards is normally carried out through ISO technical committees. Each member body interested in a subject for which a technical committee has been established has the right to be represented on that committee. International organizations, governmental and non-governmental, in liaison with ISO, also take part in the work. ISO collaborates closely with the International Electrotechnical Commission (IEC) on all matters of electrotechnical standardization.

The procedures used to develop this document and those intended for its further maintenance are described in the ISO/IEC Directives, Part 1. In particular the different approval criteria needed for the different types of ISO documents should be noted. This document was drafted in accordance with the editorial rules of the ISO/IEC Directives, Part 2 (see www.iso.org/directives).

Attention is drawn to the possibility that some of the elements of this document may be the subject of patent rights. ISO shall not be held responsible for identifying any or all such patent rights. Details of any patent rights identified during the development of the document will be in the Introduction and/or on the ISO list of patent declarations received (see www.iso.org/patents).

Any trade name used in this document is information given for the convenience of users and does not constitute an endorsement.

For an explanation on the voluntary nature of standards, the meaning of ISO specific terms and expressions related to conformity assessment, as well as information about ISO's adherence to the World Trade Organization (WTO) principles in the Technical Barriers to Trade (TBT) see the following URL: www.iso.org/iso/foreword.html.

This document was prepared by Technical Committee ISO/TC 39, Machine tools, Subcommittee SC 10, Safety.

A list of all parts in the ISO 16092 series can be found on the ISO website.

Introduction

This document is a “Type C” standard as stated in ISO 12100.

It is of relevance, in particular, for the following stakeholder groups representing the market players with regard to machinery safety:

— machine manufacturers (small, medium and large enterprises);

— health and safety bodies (regulators, accident prevention organizations, market surveillance, etc.).

Others can be affected by the level of machinery safety achieved by the above-mentioned stakeholder groups by means of this document:

— machine users/employers (small, medium and large enterprises);

— machine users/employees (e.g. trade unions, organizations for people with special needs);

— service providers, e.g. for maintenance (small, medium and large enterprises);

— consumers (in case of machinery intended for use by consumers).

The above-mentioned stakeholder groups have been given the possibility to participate in the drafting process of this document.

The machinery concerned and the extent to which hazards, hazardous situations or hazardous events are covered are indicated in the Scope of this document.

When requirements of this type-C standard are different from those which are stated in type-A or type-B standards, the requirements of this type-C standard take precedence over the requirements of the other standards for machines that have been designed and built according to the requirements of this type-C standard.

This document is intended to be applied in addition to ISO 16092-1.

1 Scope

This document, in addition to ISO 16092-1, specifies the technical safety requirements and measures to be adopted by persons undertaking the design, manufacture and supply of hydraulic presses which are intended to work cold metal or material partly made up of cold metal.

The presses covered by this document range in size from small high-speed machines with a single operator producing small workpieces to large relatively slow-speed machines with several operators and large complex workpieces.

This document deals with all significant hazards relevant for hydraulic presses when they are used as intended and under the conditions of misuse which are reasonably foreseeable by the manufacturer (see Clause 4). All the phases of the lifetime of the machinery as described in ISO 12100:2010 have been taken into consideration.

2 Normative references

The following documents are referred to in the text in such a way that some or all of their content constitutes requirements of this document. For dated references, only the edition cited applies. For undated references, the latest edition of the referenced document (including any amendments) applies.

ISO 4413:2010 Hydraulic fluid power — General rules and safety requirements for systems and their components
ISO 12100:2010 Safety of machinery — General principles for design — Risk assessment and risk reduction
ISO 13849-1:2015 Safety of machinery — Safety-related parts of control systems — Part 1: General principles for design
ISO 16092-1:2017 Machine tools safety — Presses — Part 1: General safety requirements
IEC 60947-5-8 Low-voltage switchgear and control gear — Part 5-8: Control circuit devices and switching elements — Three-position enabling switches

3 Terms and definitions

For the purposes of this document, the terms and definitions given in ISO 12100:2010, ISO 13849-1:2015, ISO 16092-1:2017 and the following apply.

ISO and IEC maintain terminological databases for use in standardization at the following addresses:

— ISO Online browsing platform: available at https://www.iso.org/obp

— IEC Electropedia: available at http://www.electropedia.org/

3.1 restraint valve

device which protects against a gravity fall of the slide/ram

4 List of significant hazards

This clause contains all the significant hazards, hazardous situations and events identified by risk assessment as significant for the machines defined in the scope and which require a specific action to eliminate or reduce the risk.

These hazards are listed in ISO 16092-1:2017. Additional hazards are listed in Annex A, Table A.1.

5 Safety requirements and/or measures

5.1 General

Hydraulic presses shall comply with the safety requirements and/or protective/risk reduction measures of this clause. In addition, the machine shall be designed according to the principles of ISO 12100 for relevant but not significant hazards which are not dealt with by this document.

5.2 Basic design considerations

5.2.1 Hydraulic and pneumatic systems — Common features

ISO 16092-1:2017 shall apply.

5.2.2 Pneumatic systems

ISO 16092-1:2017 shall apply.

5.2.3 Hydraulic systems

In addition to requirements given in ISO 16092-1:2017, the following shall apply.

5.2.3.1

Controlled gravity descent may be a deliberate design feature to facilitate rapid closing of the tools.

In such a case, all the oil in the cylinder supporting the slide/ram shall be passed through the main control valve or valves in a redundant and monitored system (see Table 1 and/or Table 2).

5.2.3.2

The circuit shall be protected by pressure limiting valves. These valves shall not be capable of alteration without the use of a tool. Also, they shall be set at a pressure which is no more than 10 % higher than the maximum operating pressure.

5.2.3.3

For down-stroking presses, provision shall be made to protect the cylinder and components containing the fluid in the lower part of the cylinder from damage due to pressure intensification. A relief valve used for this purpose shall be direct operated, sealed and locked against unauthorised adjustment, and shall be set at a pressure at least 10 % above the maximum system pressure so that it only opens in the case of a fault. The components it protects shall be designed to withstand the pressure at which the valve is set. The relief valve shall be constructed so that, if a single break in the spring occurs, the space between the windings remains less than one wire thickness. The spring shall be guided so as to maintain the function of the relief valve.

5.2.4 Electric systems

ISO 16092-1:2017 shall apply.

5.3 Mechanical hazards in the tools area

5.3.1 Major danger zone

ISO 16092-1:2017 shall apply.

5.3.2 Safeguarding measures

In addition to requirements given in ISO 16092-1:2017, the following shall apply.

Slow closing speed used in combination with hold-to-run control devices shall not exceed 10 mm/s. The speed shall not be limited by adjustment of variable parameters (see Tables 1, 2 and Annex F). The hold-to-run control device shall consist of a single button/foot-pedal and shall fulfil the requirements of IEC 60947-5-8. For foot-pedals, the force shall not exceed 350 N for switching from position 2 to position 3.

5.3.3 Other safety requirements

ISO 16092-1:2017 shall apply.

5.3.4 Release of trapped persons between the tools

ISO 16092-1:2017 shall apply.

5.3.5 Release of persons trapped inside enclosed areas

ISO 16092-1:2017 shall apply.

5.3.6 Prevention of gravity fall during maintenance or repair

In addition to requirements given in ISO 16092-1:2017, the following shall apply.

5.3.6.1

On presses with an opening stroke length of more than 500 mm and a depth of table of more than 800 mm, a mechanical restraint device shall be permanently fixed and integrated with the press. It can be manually operated.

If an integrated device, when active, cannot be easily seen from the operator's position, an additional clear indication of the position of the device shall be provided.

5.3.6.2

Where the restraint device is provided as protection during production and is mechanically linked to a main guard which needs to be removed for maintenance purposes, additional mechanical restraint devices, which can be manually positioned where necessary, shall be provided.

5.3.7 Prevention of unintended gravity fall during production (down-stroking press)

5.3.7.1

Measures shall be provided to prevent an unintended gravity fall of the slide/ram in the production mode with manual or automatic feed or removal, see Tables 1 and 2. Such a fall can be due to a failure of the hydraulic system, mechanical failure or a failure of the electrical control system. In this case:

— a mechanical restraint device, or

— a hydraulic restraint device, as defined in 5.3.7.2, or

— a combination of a single valve hydraulic restraint device and a mechanical restraint device

shall be provided.

The restraint devices shall operate automatically and shall be effective whenever the tool is stopped and operator access to the tools is possible.

5.3.7.2

Where mechanical restraint devices are not used, hydraulic restraint devices shall consist of either:

a) two separate hold-up or return cylinders each with a hydraulic restraint valve, capable of independently holding the slide/ram, or
b) two hydraulic restraint valves, one of which is fitted as close as possible to the cylinder outlet, using flanged or welded pipework, capable of holding the slide/ram.

NOTE

Further requirements are given in Tables 1 and 2.

5.3.7.3

On a press made solely for:

— automatic operation in conjunction with interlocking guards with guard locking, or

— use with closed tools, or

— use with fixed enclosing guards,

a single valve hydraulic restraint device, or a mechanical restraint device, shall be provided as a minimum.

5.3.7.4

There shall be a system for monitoring that the restraint system as defined in 5.3.7.1 is functioning correctly, and no press stroke shall be possible after any part of the system has failed (see Tables 1, 2 and Annex D, Figure D.1).

5.3.7.5

Requirements for prevention of unintended strokes are laid down in Tables 1, 2 and ISO 16092-1:2017.

5.4 Control and monitoring system

5.4.1 Control and monitoring functions

In addition to requirements given in ISO 16092-1:2017, the following control and monitoring functions shall apply.

Power interlocking as defined in ISO 14119:2013, may be provided for presses fitted with interlocking guards. The guard interlocking device shall be positively linked with the manually actuated valve to reverse or cut off directly the flow of hydraulic fluid to and from the actuator.

NOTE

For examples of power interlocking, see Figure D.2 and ISO 14119.

5.4.2 Muting

In addition to requirements given in ISO 16092-1:2017, the following shall apply.

The means for setting the point at which the safeguarding system is muted during the closing stroke shall be:

— a position signal, and

— a pressure signal or suitable alternative, signals which actuate when the tools are closed and the machine begins to apply the force.

5.4.3 Selection devices

ISO 16092-1:2017 shall apply.

5.4.4 Position sensors

ISO 16092-1:2017 shall apply.

5.4.5 Control devices

ISO 16092-1:2017 shall apply.

5.4.6 Valves

Manual override devices shall not be fitted to restraint valves. If manual override devices are incorporated into other valves for test or maintenance purposes, they shall require the use of a tool to operate the override.

5.4.7 Performance level of safety functions

Safety functions of hydraulic press shall meet the requirements stated in the Tables 1 and 2. Figure 1 shows an example of all relevant parts of control system of hydraulic press with a safety function to stop down stroke of the slide by ESPE using AOPD.

Example of a safety function with all relevant safety related parts

The performance levels in Tables 1 and 2 are the minimum required performance levels and already take the probability of occurrence into account.

Table 1

Summary of requirements for the operator safeguarding of the danger zones at the tools, die cushions, work-piece ejectors and transfer systems areas (see ISO 16092-1:2017) for different modes of operation — Mode of production: Single cycle, manual feed or removal

Main safety system	Hazardous movement	Safety function	Minimum required PL (PLr) for safety function and I, L and O	Basis for the design of input, logic, output of safety function
Requirement for category of Input, Logic and Output^a	I – Input (sensor area)	L – Logic (control)	O – Output (pre-actuator)
Closed tools used as the only means of protection [see ISO 16092-1:2017 a)]	Movement (e.g. closing stroke) of the slide, die cushions, (workpiece) ejectors	Cycle initiation/Stop	PL a	Cat B	Any^g	Any	Hydraulic system (see 5.2.3)
Closed tools used in a press with other operating modes with different main safety systems [see ISO 16092-1:2017 a)]	Cycle initiation/Stop	PL a	Cat B	Any^g	Any
Fixed enclosing guard used as the only means of protection [see ISO 16092-1:2017 b)]	Movements of the slide, die cushions, work-piece ejectors and transfer systems	Cycle initiation/Stop	PL a	Cat B	Any^g	Any
Slow closing speed and hold to run control for a press solely made for this use [see ISO 16092-1:2017 h) and 5.3.2.1]	Movement (e.g. closing stroke) of the slide, die cushions, workpiece ejectors	Hold to run control	PL d	Cat 3	2 electromechanical contacts ^{g h}	Safety related logic	Monitored hydraulic valves (see 5.3.7.2 and 5.3.7.4)
Slow closing speed	PL d	Fault exclusion	No Input (Permanent limitation of speed by hydraulic means)	No Logic (Permanent limitation of speed by hydraulic means)	Permanent 10 mm/s speed limitation hydraulic device. Flow limiting valve (e.g. an orifice) permitting fault exclusion shall be used (see ISO 13849-2:2012)
Slow closing speed and hold to run control for a press where the speed exceeds 10 mm/s in other operating modes [see ISO 16092-1:2017 h) and 5.3.2.1]	Movement (e.g. closing stroke) of the slide, die cushions, workpiece ejectors	Hold to run control	PL d	Cat 3	2 electromechanical contacts ^{g h}	Safety related logic	Monitored hydraulic valves (see 5.3.7.2 and 5.3.7.4)
Slow closing speed	PL d	Cat 2^k	No specific input (Slow closing speed control system is mainly enabled by selection means function)	Safety related logic^l	Monitored hydraulic valve ^l in combination with permanent 10 mm/s speed limitation hydraulic device or flow limiting valve permitting fault exclusion (e.g. an orifice) shall be used (see ISO 13849-2:2009)
Interlocking guard with or without guard locking (with or without early opening feature) or control guard (with or without early opening feature) [see ISO 16092-1:2017 c), d) and e)]	Movements (e.g. closing stroke) of the slide and die cushions	Cycle initiation by other control device than the guard	PL a	Cat B	Any but not actuated by the guard itself	Any	Logic control shall act on the appropriate part of the electrical control system
Cycle initiation by control guard	PL e^{b c}	Cat 4	Interlocking device of the guard	Safety related logic
Stop by interlocking device of guard without guard locking [see ISO 16092-1:2017b)]	PL e^{b c}	Cat 4	Interlocking device (2 sensors or equivalent solution)^{e f}	Safety related logic	Hydraulic system (see 5.2.3 and 5.3.7.4)
Interlocking guard with or without guard locking (with or without early opening feature) or control guard (with or without early opening feature) [see ISO 16092-1:2017 c), d) and e)]	Movements (e.g. closing stroke) of the slide and die cushions	Stop by interlocking device of guard with guard locking [see ISO 16092-1:2017a)]	PL e^{b c}	Cat 4	Interlocking device of guard with guard locking (2 sensors or equivalent solution)^{e f}	Safety related logic	Hydraulic system (see 5.2.3 and 5.3.7.4)
Interlocking guard with or without guard locking (with or without early opening feature) or control guard (with or without early opening feature) [see ISO 16092-1:2017 c), d) and e)]	Movements (e.g. closing stroke) of the slide and die cushions	Prevention of restart by an additional safeguarding of a control guard by AOPD (see ISO 16092-1:2017)	PL d	Cat 3	AOPD	Safety related logic	Logic control shall act on the appropriate part of the electrical control system
Interlocking guard with or without guard locking (with or without early opening feature) or control guard (with or without early opening feature) [see ISO 16092-1:2017 c), d) and e)]	Movements (e.g. closing stroke) of the slide and die cushions	Prevention of restart by an additional safeguarding of a control guard by interlocking guard (see ISO 16092-1:2017)	PL c	Cat 1 for Input, Cat 3 for Logic and Output	Interlocking device	Safety related logic	Logic control shall act on the appropriate part of the electrical control system
Movements of work-piece ejectors and transfer systems	Stop by interlocking device of guard without guard locking [see ISO 16092-1:2017b)]	PL d^{b d}	Cat 3	Interlocking device (2 sensors or equivalent solution)^{e f}	Safety related logic	Hydraulic or pneumatic system
Stop by interlocking device of guard with guard locking [see ISO 16092-1:2017a)]	PL d^{b d}	Cat 3	Interlocking device of guard with guard locking (2 sensors or equivalent solution)^{e f}
Interlocking guard with or without guard locking (with or without early opening feature) or control guard (with or without early opening feature) [see ISO 16092-1:2017 c), d) and e)]	Movements of work-piece ejectors and transfer systems	Prevention of restart by an additional safeguarding of a control guard by AOPD (see ISO 16092-1:2017)	PL d	Cat 3	AOPD	Safety related logic	Logic control shall act on the appropriate part of the electrical control system
Interlocking guard with or without guard locking (with or without early opening feature) or control guard (with or without early opening feature) [see ISO 16092-1:2017 c), d) and e)]	Movements of work-piece ejectors and transfer systems	Prevention of restart by an additional safeguarding of a control guard by interlocking guard (see ISO 16092-1:2017)	PL c	Cat 1 for Input, Cat 3 for Logic and Output	Interlocking device	Safety related logic	Logic control shall act on the appropriate part of the electrical control system
Interlocking guard with or without guard locking (see ISO 16092-1:2017)	Drive and transmission (see ISO 16092-1:2017)	Stop by interlocking device of guard without guard locking [see ISO 16092-1:2017 b)]	PL c	Cat 1	Interlocking device	Safety related logic	Electric, hydraulic or pneumatic system
Stop by interlocking device of guard with guard locking [see ISO 16092-1:2017 c)]	PL c
Interlocking guard opened for tool setting only [see ISO 16092-1:2017 c) and 5.5.6]	Movements of the slide, die cushions, work-piece ejectors and transfer systems	Stop by interlocking device of guard	PL c	Cat 1 for Input, Cat 3 for Logic and output	Interlocking device	Safety related logic	Same output than those used for safeguarding measures used in production mode
ESPE using AOPD [see ISO 16092-1:2017 f) and 5.3.2.11]	Movements (e.g. closing stroke) of the slide and die cushions	Cycle initiation by other control device than the AOPD	PL a	Cat B	Any but not actuated by the AOPD itself^g	Any	Logic control shall act on the appropriate part of the electrical control system
Cycle initiation by AOPD	PL e ^c	Cat 4	AOPD	Safety related logic
Stop by AOPD	PL e ^c	Cat 4	Hydraulic system (see 5.2.3 and 5.3.7.4)
ESPE using AOPD [see ISO 16092-1:2017 f) and 5.3.2.11]	Movements (e.g. closing stroke) of the slide and die cushions	Muting (see ISO 16092-1:2017)	Same as of the safety function on which it is acting^p	^—	Position signal and a pressure signal or suitable alternative (see 5.4.2)	^—	^—
Movements of work-piece ejectors and transfer systems	Stop by AOPD	PL d ^d	Cat 3	AOPD	Safety related logic	Hydraulic or pneumatic system
Muting (see ISO 16092-1:2017) Not allowed for transfer system	Same as of the safety function on which it is acting	^—	Position signal and a pressure signal or suitable alternative (see 5.4.2)	Logic control shall act on the appropriate part of the electrical control system
Movements of the slide, die cushions, work-piece ejectors and transfer systems	Prevention of restart by an additional safeguarding by AOPD [see ISO 16092-1:2017 c)]	PL d	Cat 3	AOPD
Movements of the slide, die cushions, work-piece ejectors and transfer systems	Prevention of restart by an additional safeguarding by interlocking guard [see ISO 16092-1:2017 c)]	PL c	Cat 1 for Input, Cat 3 for Logic and output ^r	Interlocking device
Two hand control device [see ISO 16092-1:2017 g) and 5.3.2.12]	Movements (e.g. closing stroke) of the slide and die cushions	Stop and cycle initiation by Two hand control device	PL e^{b c}	Cat 4	Push buttons of two hand control device^{g h}	Safety related logic	Hydraulic system (see 5.2.3 and 5.3.7.4)
Muting (see ISO 16092-1:2017)	Same as of the safety function on which it is acting^p	^—	Position signal and a pressure signal or suitable alternative (see 5.4.2)	^—	^—
Movements of work-piece ejectors and transfer systems	Stop and cycle initiation by Two hand control device	PL d^{b d}	Cat 3	Push buttons of two hand control device^{g h}	Safety related logic	Hydraulic or pneumatic system
Muting (see ISO 16092-1:2017) Not allowed for transfer system	Same as of the safety function on which it is acting	^—	Position signal and a pressure signal or suitable alternative (see 5.4.2)	^—	^—
Movements of the slide, die cushions, work-piece ejectors and transfer systems	Additional means to restrict access (see ISO 16092-1:2017) Stop by interlocking device of guard	PL d^d	Cat 3	Interlocking device (2 sensors or equivalent solution).	Safety related logic	Hydraulic or pneumatic system
Additional means to restrict access (see ISO 16092-1:2017) Stop by ESPE using AOPD or AOPDDR	PL d^d	Cat 3	AOPD or AOPDDR
Safety systems which need reset	Movements of the slide, die cushions, work-piece ejectors and transfer systems	Manual reset (see ISO 16092-1:2017)	Same as of the safety function on which it is acting ^{n p}	Any Cat for Input ^m Same category as of the selected safety functions for Logic	Push button	Safety related logic^m	Logic control shall act on the appropriate part of the electrical control system
Common feature	Movements of the slide, die cushions, work-piece ejectors and transfer systems	Emergency stop function (see ISO 16092-1:2017)	PL c	Cat 1	Emergency stop push button ^h	Safety related logic	Hydraulic or pneumatic system
Safety systems which need selection means	Movements of the slide, die cushions, work-piece ejectors and transfer systems	Means of selection (see ISO 16092-1:2017)	Same as the highest PLr among the selected functions^p	Any Cat for Input Same category as of the selected safety functions for Logic and Output	Selection means, e.g. selector switch, electronic key system	Safety related logic to check plausibility of inputs^j	Logic control shall act on the appropriate parts of the safety system
Means to prevent restart (see ISO 16092-1:2017)	Movements of the slide, die cushions, work-piece ejectors and transfer systems	PSPE: Prevention of restart by interlocking	PL d^d	Cat 3	AOPD or AOPDDR or equivalent device (e.g. pressure sensitive mat)	Safety related logic ^c	Logic control shall act on the appropriate part of the electrical control system
Captive key with interlocking: Prevention of restart by interlocking	Same as of the manual reset of the safety device on which it is acting ^s	Same category as of the manual reset for the safety device	Captive key switch
Captive key without interlocking: Prevention of restart by safety device on which the captive key is acting	Same as of the safety function on which it is acting ^t	Same as of the safety function on which it is acting ^t	Inputs of the safety device the captive key is related to
Mechanical restraint device used during maintenance and repair	Movements of the slide	Interlocking to the press control system (see ISO 16092-1:2017)	PL c	Cat 1	Interlocking device	Safety related logic	Logic control shall act on the appropriate part of the electrical control system
Mechanical restraint device used during production	Movements of the slide	Interlocking to the press control system (see 5.3.6)	PL d	Cat 2
^a In the table, “Requirement for category of Input, Logic and Output” means the following relationships between the requirements of categories for Input, Logic or Output part: — Cat. 4, 3 or 2 can apply instead of Cat. 1; — Cat. 4 or 3 can apply instead of Cat. 2; — Cat. 4 can apply instead of Cat. 3. ^b Fault exclusion, e.g. mechanical break of a sensor is not acceptable. ^c Functional safety described in ISO 16092-1:2017 a) to e) shall apply. ^d Functional safety described in ISO 16092-1:2017 a) to c), and if reasonably practicable 5.4.1.4 d) e) shall apply. ^e Or equivalent solution, e.g. 1 system fulfilling the required PL by itself. Plausibility check required”. ^f See ISO 14119 for the design of interlocking device of guard with guard locking. ^g In case of mobile control device (e.g. foot pedal) provision shall be made to ensure that unintended start-up due to a short circuit in the cable connecting the control device to the control system is prevented. ^h In case of mobile control device, provision shall be made to ensure that the stop function remains operational in case of a short circuit in the connecting cable to the control system. ⁱ Letter “i“ is not used in this table. ^j Plausibility check of inputs shall be provided and shall ensure that one selected position and the relevant safety measures are still operative without any mal-function or dangerous movements are stopped. ^k This part can be considered of category 2 if, either demand rate ≤ 1/100 test rate; or testing occurs immediately upon demand of the safety function and a detected fault leads immediately to a stop of the machine (stop by the output of the testing part of the category 2 system – See ISO 13849-1:2015 NOTE 4 and Figure 10). Restart of the machine shall only be possible after repair. ^l At least one monitored system (e.g. hydraulic directional valves) shall be provided to activate the limited speed. High speed (>10 mm/s) shall be prevented either by this system or by the SRP/CS selecting the speed. If this system fails in the “high speed” position, functioning of the machine shall be impossible in operating modes using hold-to-run control devices with a slow closing speed as safeguarding measures (ISO 16092-1:2017 h). ^m No specific category is required for input, because logic part will only act after actuation or de-actuation of the input and any blocking of the input will not lead to any new reset (See ISO 16092-1:2017). ⁿ It is possible that the manual reset function, which is related to a protective device placed where there is no possibility of access of the whole body of a person into the danger zone, not be subjected to the requirements of PL on this table as a safety function. Only ISO 16092-1:2017 is applied.
^o In the case of additional safeguarding by interlocking guard, P1 is assigned because the guard is in place as a physical obstacle. Even if the interlocking device fails, it is possible that an operator recognizes the guard is removed or opened before initiating a stroke (if additional safeguarding is by AOPD: in case of a failure, an operator can stand undetected between the control guard/primary AOPD and the danger zone). ^p No specific PL is required for this sub function which shall be considered as an internal part of the safety functions on which it is acting. This internal part shall be taken into account in the evaluation of the PL of the relevant safety functions. ^q Letter “q “is not used in this table. ^r The additional safeguarding by interlocking guard shall not be opened frequently during production (e.g. it is opened only for tool setting, trial or maintenance). Where this is not practicable, other means shall be used. ^s Captive key with interlock related to a protective device and preventing a restart shall inhibit the manual reset of the guard as a minimum. ISO 16092-1:2017 applies. ^t No specific PL is required for this sub function which shall be considered as an internal part of the safety functions on which it is acting. This internal part shall be taken into account in the evaluation of the PL of the relevant safety functions.

Table 2

Summary of requirements for the operator safeguarding of the danger zones at the tools, die cushions, work-piece ejectors and transfer systems areas (see ISO 16092-1:2017) for different modes of operation — Mode of production: Automatic cycle, Solely automatic feed and removal

Main safety system	Hazardous movement	Safety function	Minimum required PL (PL_r) for safety function and I, L and O	Basis for the design of input, logic, output of safety function
Requirement for category of Input, Logic and Output^a	I – Input (sensor area)	L – Logic (control)	O – Output (pre-actuator)
Closed tools used as the only means of protection (see [ISO 16092-1:2017 a)]	Movement (e.g. closing stroke) of the slide, die cushions, workpiece ejectors	Cycle initiation/Stop	PL a	Cat B	Any^g	Any	Hydraulic system (see 5.2.3)
Closed tools used in a press with different main safety systems [see ISO 16092-1:2017 a)]	Cycle initiation/Stop	PL a	Cat B	Any^g	Any
Fixed enclosing guard used as the only means of protection [see ISO 16092-1:2017 b)]	Movements of the slide, die cushions, work-piece ejectors and transfer systems	Cycle initiation/Stop	PL a	Cat B	Any^g	Any
Interlocking guard with or without guard locking [see ISO 16092-1:2017 c)]	Movements (e.g. closing stroke) of the slide and die cushions	Cycle initiation by other control device than the guard	PL a	Cat B	Any but not actuated by the guard itself	Any	Logic control shall act on the appropriate part of the electrical control system
Stop by interlocking device of guard without guard locking [see ISO 16092-1:2017b)]	PL d^b,d	Cat 3	Interlocking device (2 sensors or equivalent solution)^{e f}	Safety related logic	Hydraulic system (see 5.2.3 and 5.3.7.4)
Stop by interlocking device of guard with guard locking [see ISO 16092-1:2017a)]	PL d^b	Cat 2 ^k	Interlocking device of guard with guard locking^f
Interlocking guard with or without guard locking [see ISO 16092-1:2017 c)]	Movements of work-piece ejectors and transfer systems	Stop by interlocking device of guard without guard locking [see ISO 16092-1:2017b)]	PL d^b	Cat 2^k	Interlocking device ^f	Safety related logic	Hydraulic or pneumatic system
Stop by interlocking device of guard with guard locking [see ISO 16092-1:2017a)]	PL d^b	Cat 2^k	Interlocking device of guard with guard locking^f
Interlocking guard with or without guard locking (see ISO 16092-1:2017)	Drive and transmission (see ISO 16092-1:2017)	Stop by interlocking device of guard without guard locking [see ISO 16092-1:2017 b)]	PL c	Cat 1	Interlocking device	Electric, hydraulic or pneumatic system
Stop by interlocking device of guard with guard locking [see ISO 16092-1:2017 c)]	PL c	Cat 1
Interlocking guard opened for tool setting only [see ISO 16092-1:2017 c) and 5.5.6]	Movements of the slide, die cushions, work-piece ejectors and transfer systems	Stop by interlocking device of guard	PL c	Cat 1 for Input Cat 3 for Logic and Output (see ISO 16092-1:2017)	Same output than those used for safeguarding measures used in production mode
ESPE using AOPD [see ISO 16092-1:2017 f) and 5.3.2.11]	Movements (e.g. closing stroke) of the slide and die cushions	Cycle initiation by other control device than the AOPD	PL a	Cat B	Any but not actuated by the AOPD itself g	Any	Logic control shall act on the appropriate part of the electrical control system
Stop by AOPD	PL d^d	Cat 3			Hydraulic system (see 5.2.3 and 5.3.7.4)
Movements of work-piece ejectors and transfer systems	Stop by AOPD	PL d^d	Cat 3	AOPD	Safety related logic	Hydraulic or pneumatic system
Safety systems which need reset	Movements of the slide, die cushions, work-piece ejectors and transfer systems	Manual reset (see ISO 16092-1:2017)	Same as of the safety function on which it is acting^o	Any Cat for Input ^m Same category as of the selected safety functions for Logic and Output)	Push button	Safety related logic ^m	Logic control shall act on the appropriate part of the electrical control system
Common feature	Movements of the slide, die cushions, work-piece ejectors and transfer systems	Emergency stop function (see ISO 16092-1:2017)	PL c	Cat 1	Emergency stop push button ^h	Safety related logic	Hydraulic or pneumatic system
Means to prevent restart (see ISO 16092-1:2017, 5.3.2.14)	Movements of the slide, die cushions, work-piece ejectors and transfer systems	PSPE: Prevention of restart by interlocking	PL d^d	Cat 3	AOPD or AOPDDR or equivalent device (e.g. pressure sensitive mat)	Safety related logic ^c	Logic control shall act on the appropriate part of the electrical control system
Captive key with interlocking: Prevention of restart by interlocking	Same as of the manual reset of the safety device on which it is acting ^s	Same category as of the manual reset for the safety device	Captive key switch
Captive key without interlocking: Prevention of restart by safety device on which the captive key is acting	Same as of the safety function on which it is acting ^t	Same as of the safety function on which it is acting ^t	Inputs of the safety device the captive key is related to
Safety systems which need selection means	Movements of the slide, die cushions, work-piece ejectors and transfer systems	Means of selection (see ISO 16092-1:2017)	Same as the highest PLr among the selected functions o	Any Cat for Input Same Category as of the selected safety functions for Logic and Output	Selection means, e.g. selector switch, electronic key system	Safety related logic to check plausibility of inputs ^j	Logic control shall act on the appropriate parts of the safety systems
Mechanical restraint device used during maintenance and repair	Movements of the slide	Interlocking to the press control system (see ISO 16092-1:2017)	PL c	Cat 1	Interlocking device	Safety related logic
Mechanical restraint device used during production	Movements of the slide	Interlocking to the press control system (see 5.3.6)	PL d	Cat 2	Interlocking device	Safety related logic	Logic control shall act on the appropriate parts of the safety systems
Slow speed and hold to run control (See ISO 16092-1:2017)	Movements of handling device	Hold to run control	PL c	Cat 2 ^k	2 electromechanical contacts (1 for initiation, 1 for diagnostic) ^{g h}	Safety related logic	Monitored single component
Slow speed	PL c	Cat 2 ^k (or Fault exclusion when practicable)	No input (Permanent limitation of speed by hydraulic means)	No Logic (Permanent limitation of speed by hydraulic means)	Permanent speed limitation less than 33 mm/s component Fault exclusion can apply according to ISO 13849-2:2012, e.g. if a hydraulic flow valve (e.g. an orifice) is used, (See ISO 13849-2:2012)
Inching device (See ISO 16092-1: 2017)	Movements of handling device	Start and automatic stop of a limited movement	PL c	Cat 1 for Start Input Cat 3 for Logic and Output	Any for start ^g	Safety related logic utilizing e.g. fault resistant position detection or time depending on machine speed	Hydraulic or pneumatic system
^a In this table, “Minimum required Category” means the following relationships between the requirements of categories for Input, Logic or Output part: Cat. 4, 3 or 2 can apply instead of Cat. 1; Cat. 4 or 3 can apply instead of Cat. 2; Cat. 4 can apply instead of Cat. 3. ^b Fault exclusion (e.g. mechanical break) of a sensor is not acceptable. ^c Functional safety described in ISO 16092-1:2017 a) to e) shall apply. ^d Functional safety described in ISO 16092-1:2017 a) to c), and if reasonably practicable 5.4.1.4 d) e) shall apply. ^e Or equivalent solution, e.g. 1 system fulfilling the required PL by itself. Plausibility check required. ^f See ISO 14119 for the design of interlocking device of guard with guard locking. ^g In case of mobile control device (e.g. foot pedal) provision shall be made to ensure that unintended start-up due to a short circuit in the cable connecting the control device to the control system is prevented. ^h In case of mobile control device, provision shall be made to ensure that the stop function remains operational in case of a short circuit in the connecting cable to the control system. ⁱ Letter “ i “ is not used in this table. ^j Plausibility check of inputs shall be provided and shall ensure that one selected position and the relevant safety measures are still operative without any mal-function or dangerous movements are stopped. ^k This part can be considered of category 2 if, either demand rate ≤ 1/100 test rate; or testing occurs immediately upon demand of the safety function and a detected fault leads immediately to a stop of the machine (stop by the output of the testing part of the category 2 system – See ISO 13849-1:2015 NOTE 4 and Figure 10). Restart of the machine shall only be possible after repair. ^l At least a monitored hydraulic directional valve shall be used both to switch on the Permanent 10 mm/s speed limitation device and to switch off the “high speed” (>10 mm/s) intended for other modes of operation with safeguarding measures as described in ISO 16092-1:2017 a) to g). If this valve fails in the “high speed” position, functioning of the machine shall be impossible in operating modes using hold-to-run control devices with a slow closing speed as Safeguarding measures [ISO 16092-1:2017 h)]. ^m No specific category is required for input, because logic part will only act after actuation or de-actuation of the input, and any blocking of the input will not lead to any new reset (See ISO 16092-1:2017).
ⁿ It is possible that the manual reset function, which is related to a protective device placed where there is no possibility of access of the whole body of a person into the danger zone, not be subjected to the requirements of PL on this table as a safety function. Only ISO 16092-1:2017 is applied. ^o No specific PL is required for this sub function which shall be considered as an internal part of the safety functions on which it is acting. This internal part shall be taken into account in the evaluation of the PL of the relevant safety functions. ^q Letter “q “is not used in this table. ^r The additional safeguarding by interlocking guard shall not be opened frequently during production (e.g. it is opened only for tool setting, trial or maintenance). Where this is not practicable, other means shall be used. ^s Captive key with interlock related to a protective device and preventing a restart shall inhibit the manual reset of the guard as a minimum. ISO 16092-1:2017 applies. ^t No specific PL is required for this sub function which shall be considered as an internal part of the safety functions on which it is acting. This internal part shall be taken into account in the evaluation of the PL of the relevant safety functions.

5.5 Tool-setting, trial strokes, maintenance and lubrication

In addition to requirements given in ISO 16092-1:2017, the following shall apply.

5.5.1 Movement during tool-setting, maintenance and lubrication

Facilities shall be provided to allow the movement of the slide/ram during tool-setting, maintenance and lubrication to be carried out with guards and protective devices in position and operational (see ISO 16092-1:2017).

Where this is not practicable, at least one of the following facilities shall be provided:

a) two-hand control device in accordance with ISO 16092-1:2017 and arranged so that it cannot be used for production, e.g. by its positioning and distance from the tools area or using slow speed - equal or less than 10 mm/s;
b) slow speed (equal or less than 10 mm/s) and hold-to-run control device;
c) using an inching device.

5.5.2 Movement by inching device

The movement produced by the inching device shall be so small as to prevent a hazardous situation and shall be limited by a time control or by a distance control. The slide/ram movement shall not exceed 6 mm per inching step.

5.6 Mechanical hazards — Other

ISO 16092-1:2017 shall apply.

5.7 Slips, trips and falls

ISO 16092-1:2017 shall apply.

5.8 Protection against other hazards

ISO 16092-1:2017 shall apply.

In addition to requirements given in ISO 16092-1:2017, tanks containing hydraulic fluid shall be designed and placed accordingly to ISO 4413:2010.

6 Verification of the safety requirements and/or measures

Table 3 shall be used together with ISO 16092-1:2017.

The crosses in Table 3 indicate the method(s) by which the safety requirements and protective measures described in Clause 5, Clause 7, Annex B and Annex C shall be verified, together with a reference to the corresponding subclauses in this document.

Table 3

Safety requirements and/or measures to be verified

Sub-clause	Safety requirements and/or measures	Visual inspection^a	Performance check/test^b	Measurement^c	Drawings/ Calculations/ Technical data^d
5.2	Basic design considerations
5.2.3	Hydraulic systems
5.2.3.1	Controlled gravity descent		x		x
5.2.3.2	Pressure limiting valve	x	x		x
5.2.3.3	Pressure relief valve	x	x		x
5.3	Mechanical hazards in the tools area
5.3.2	Safeguarding measures
5.3.2.1	Speed control	x	x	x	x
5.3.2.2	Warning-, Danger- signals	x
5.3.6	Prevention of gravity fall during maintenance or repair
Mechanical restrained device	x	x		x
5.3.7	Prevention of unintended gravity fall during production (down-stroking press)
Mechanical, hydraulic or combined restrained devices	x	x	x	x
5.4	Control and monitoring system
5.4.1	Control and monitoring functions
Manually actuated valves	x	x		x
5.4.2	Muting
Muting: position and pressure signal	x	x		x
5.4.6	Valves
No override on restraint valves	x	x		x
Tool for manual override on other valves	x	x		x
5.4.7	Performance of safety functions
Requirements of Tables 1 and 2 are met	x	x	x	x
5.5	Tool-setting, trial strokes, maintenance, lubrication
Movement of the slide/ram with guards and protective devices operational
Two-hand-control device, slow speed and hold-to-run device	x	x	x	x
Inching device	x	x		x
5.8	Protection against other hazards
Tanks	x	x
Clause 7	Information for use
7.2	Marking	x
7.3	Warnings	x
7.4	Instruction handbook	x
Annex B	Calculation of minimum distances	x		x	x
Annex C	Response time of the hydraulic system		x	x

^a Visual inspection is used to verify the features necessary for the requirement by visual examination of the components supplied.

^b A performance check/test verifies that the features provided perform their function in such a way that the requirement is met.

^c Measurement verifies by the use of instruments that requirements are met, to the specified limits.

^d Drawings/calculations/technical data verifies that the design characteristics of the components provided meet the requirements.

7 Information for use

7.1 General

ISO 16092-1:2017 shall apply.

7.2 Marking

In addition to requirements given in ISO 16092-1:2017, the minimum and maximum values of the closing and working speed shall be marked.

7.3 Warnings

ISO 16092-1:2017 shall apply.

7.4 Instruction handbook

In addition to requirements given in ISO 16092-1:2017, if presses are designed according to 5.3.2, the safe method of working shall be described.

Annex A Significant hazards, hazardous situations and protective measures

This annex contains the significant hazards, hazardous situations and events identified by risk assessment as significant for this type of machinery and which require action to eliminate or reduce the risk. See Table A.1.

Table A.1

Significant hazards, hazardous situations and protective measures

ISO 12100:2010, Annex B	Origin of hazards	Hazardous situations on presses	Relevant clause in this document
1 Mechanical hazards
A.1	Gravity	Production Maintenance or repair	5.2.3.1, 5.3.6, 5.3.7, 7
A.2	High pressure	All modes of operation and maintenance situation	5.2.3.2, 5.2.3.3, 5.4.1, 5.4.2, 5.4.6, 5.4.7, 5.5, 7
A.3	Moving elements	All operations	5.3, 5.8, 7

Annex B Calculation of minimum distances

In addition to requirements given in ISO 16092-1:2017, the following shall apply.

When calculating the overall system stopping performance (see Annex C), the following features shall be taken into account under the severest normal conditions:

a) the influencing temperature of the relevant parts of the system;
b) the pressure condition resulting in the longest stopping time.

Annex C The response time of the hydraulic system

C.1

For each machine, a check of the difference in the response time of the valves in the hydraulic system shall be made during the construction of the press. This verifies that the redundant function of the hydraulic system operates as intended. The measurements shall be repeated to verify the accuracy of the stopping performance.

C.2

The response time of each channel shall be measured at least 10 times. The highest measured value or the mean plus 3 times the standard deviation, whichever is the greater, shall be used in the calculation of the safety distance (see Annex B).

C.3

The difference in time measured for each channel shall be included in the information provided to the user [see ISO 16092-1:2017 s)].

C.4

An example of how the stopping time measurement equipment can be connected is given in Annex E.

Annex D Interlocking devices associated with guards

D.1

Figure D.1 illustrates an example of interlocking by means of two cam-operated switches, one operating positively (B1) and one negatively (B2) in conjunction with a redundant and monitored hydraulic circuit. The positive mode switch (B1), when actuated, is held in the shut-off position by a cam attached to the guard whenever the guard is in any position other than fully closed. The complete closing of the guard releases the switch, allowing the contact to close by the action of the return spring. When the guard is opened, the contact is opened by the cam. The complete closing operates the negative mode switch and closes the contact. As soon as the guard begins to open, the switch is reversed by the action of a spring when the operating mechanism is released and the contact opens.

Closed contacts of the positive and the negative mode switches enable the machine to be set in motion.

D.2

Figure D.2 illustrates an example of direct power interlocking (see Tables 1 and 2).

Example of a redundant and monitored hydraulic control circuit (cat. 4) for a down-stroking press (redundancy and monitoring in the electrical circuit not shown)

Example of power interlocking (see 5.4.1)

Annex E The connection of the stopping time measurement equipment

E.1

In Figure D.1, the protective device operates on K1, K2 and K4. Thus, a normal safety stop is achieved by deactivating K1, K2 and K4.

E.2

The normal stopping time is measured by connecting the stopping time equipment to the protective device.

E.3

Since the response time of the valves can vary within a wide range, the stopping time may be prolonged if a fault in one valve occurs. For this reason, it is necessary to check the individual response time of each hydraulic stopping function.

E.4

In the example shown in Figure D.1, the first stopping function is achieved by K1 + K2, and the second by K4 alone. Therefore, the measurement equipment is first connected to K1 and K2 only, and the stopping time is noted. Secondly, the equipment is connected only to K4, and the stopping time is also noted.

Annex F Examples for hydraulic speed limitation

F.1 General

These examples show the methods of speed limitation in hydraulic control system. The methods can be used as safeguarding measure as defined in ISO 16092-1:2017 h) (hold-to-run control devices with a slow closing speed).

Other valves necessary for machine functions (e.g. pressure relief valve, see 5.2.3.3 and Figure D.1) are not shown.

The safety functions are stopping of the hazardous movement and prevention of unintended start.

NOTE

Electrical safety related control system is also necessary to achieve the required PL, but it is not dealt with in these examples.

F.2 EXAMPLE 1

Hydraulic control system of a press solely made to be used with slow closing speed and hold to run control device, PLd, category 3. Speed limitation is achieved by V1 in conjunction with limited pump flow.

Hydraulic control circuit in category 3, PL = d

F.3 EXAMPLE 2

Part of hydraulic control system of a press made to be used with slow closing speed and hold to run control device (PLd, category 3) or with high closing speed (PL and category not shown).

Hydraulic control circuit typically for slide movement with slow speed

F.4 EXAMPLE 3

Hold to run control device with slow speed for auxiliary functions in category 2, PL = d.

Hydraulic control circuit in category 2, PL = d

Bibliography

Ergonomics principles in the design of work systems

Ergonomic requirements for the design of displays and control actuators — Part 1: Human interactions with displays and control actuators

Ergonomic requirements for the design of displays and control actuators — Part 2: Displays

Ergonomic requirements for the design of displays and control actuators — Part 3: Control actuators

Safety of machinery — Integrated manufacturing systems — Basic requirements

Ergonomics — Manual handling — Part 1: Lifting and carrying

Acoustics — Recommended practice for the design of low-noise machinery and equipment — Part 2: Introduction to the physics of low-noise design

ISO 13849-2:2012Safety of machinery — Safety-related parts of control systems — Part 2: Validation

Safety of machinery — Prevention of unexpected start-up

2013Safety of machinery — Interlocking devices associated with guards — Principles for design and selection

Safety of machinery — Anthropometric requirements for the design of workstations at machinery

Ergonomic design for the safety of machinery — Part 1: Principles for determining the dimensions required for openings for whole-body access into machinery

Ergonomic design for the safety of machinery — Part 2: Principles for determining the dimensions required for access openings

Ergonomic design for the safety of machinery — Part 3: Anthropometric data

Degrees of protection provided by enclosures (IP CODE)

Safety of machinery — Indication, marking and actuation — Part 2: Requirements for marking

Safety of machinery — Ergonomic design principles — Part 2: Interactions between the design of machinery and work tasks

Safety of machinery — Reduction of risks to health from hazardous substances emitted by machinery — Part 1: Principles and specifications for machinery manufacturers

Safety of machinery — Human physical performance — Part 1: Terms and definitions

Safety of machinery — Human physical performance — Part 2: Manual handling of machinery and component parts of machinery

Safety of machinery — Human physical performance — Part 3: Recommended force limits for machinery operation

Explosive atmospheres — Explosion prevention and protection — Part 1: Basic concepts and methodology

Mechanical vibration and shock — Vibration isolation of machines — Information for the application of source isolation

Safety of machinery — Integral lighting of machines

1	overall SRP/CS of a safety function “Stop slide down stroke by ESPE using AOPD”
2	selector switch – modes of operation and mode of safeguarding
3	“Logic”: control parts (Plausibility check of selection, Logic of AOPD, Logic of muting…)
4	output: hydraulic safety related part
5	hydraulic actuator
6	“Input”: ESPE using AOPD
7	“Input”: muting sensors, muting the ESPE during non-hazardous opening stroke

1	slide
2	the components in this envelope should, if possible, be mounted directly to the lower port (connection) of the cylinder to eliminate pipework (see 5.3.7.2 b)
3	machine control
4	guard
5	guard open
6	guard closed
7	pressure relief valve for cylinder protection, set and sealed at least 10 % above maximum system pressure (P ≥ P_max + 10 %) (see 5.2.3.3)
8	pressure relief valve for system protection, set at P_max < P ≤ P_max + 10 % (see 5.2.3.2)
K1	safety valve, monitored e.g. by contact or inductive sensor
K2	hydraulic restraint valve, monitored e.g. by contact or inductive sensor
K3, K4	directional control valve, monitored e.g. by contact or inductive sensor(s)

1	slide
2	power interlocking valve
3	not safety related control system (electric and/or hydraulic)
4	guard open
5	guard closed
6	valve in guard-open-position
7	valve in guard-closed-position

K1	Slide closing movement, restraint valve
K2	Slide opening movement
K3	Slide closing movement
K4	Slide closing movement, head control
R1	Check valve for slide opening
P	Pressure port
V1	Speed limitation
Functional description
—	Slide closing movement is controlled by the control valves K1 and K3 with well-tried safety functionality.
—	Slide opening movement is not hazardous.
—	Slide opening movement is controlled by K2.
—	The closing speed is limited by flow limitation.
Design features
—	Basic and well-tried safety principles are observed and the requirements of category B are met.
—	V1 is a non-adjustable speed limitation, fulfilling the requirements of 5.3.2.2,
—	The flow in P is limited fulfilling the requirements of 5.3.2.2 (e.g. by pump size).
—	K1 and the closed centre position of K2/K3 make up the restraint device according to 5.3.7.2.
—	K1 and K3 are part of the monitored redundant system for slide closing movement.
—	K2 is the valve for slide opening movement monitored in the process.
—	R1 is the check valve for slide opening, required for opening speeds > 10 mm/s. Fault exclusion can be done for R1 if requirements in ISO 13849-2:2012 are fulfilled.

K	Hydraulic control circuit according to Figure D.1
K2, K3	Restraint valves according to 5.3.7.2
K5	Slide closing with slow speed
K6	Slide opening with slow speed
P	Main pressure port
P1	Auxiliary pressure port
V1	Speed limitation
Functional description
—	The speed is limited by V1, which is dimensioned for slow speed in respect of hazardous movements caused by gravity.
—	Slide closing movement in slow speed is controlled by K5 and the restraint valve K2.
—	Slide opening movement is not hazardous.
—	Slide opening movement is controlled by K6. In this case, K2 is not controlled open and act as a check valve.
Design features
—	Basic and well-tried safety principles are observed and the requirements of Category B are met.
—	K is the hydraulic control system according to Figure F.1
—	K2, K3, K5 / K6 are directional control valves with closed centre position, sufficient overlap and spring centring. The safety-oriented switching position is attained by removal of the control signal, no manual override is provided (see 5.4.3).
—	V1 is a non-adjustable speed limitation, fulfilling the requirements of 5.3.2.2.
—	K5 and K6 are monitored in the process.

K1	Slow speed valve, monitored
K2	Valve(s) for high speed (optional)
K3	Direction control
V1, V2	Speed limitation
Functional description
—	Hazardous movements in slow speed are controlled by the control valve(s) K1 with well-tried safety functionality.
—	Optional: Hazardous movements in high speed are controlled by the control valve K2.
—	The speed is limited by V1 and V2.
—	K3 is the valve for direction control, not safety related.
Design features
—	Basic and well-tried safety principles are observed and the requirements of category B are met.
—	V1 and V2 are non-adjustable speed limitation, fulfilling the requirements of 5.3.2.2.
—	K1 is a control valve with closed centre position, sufficient overlap, spring centring and monitoring. The safety-oriented switching position is attained by removal of the control signal.
—	Option K2 is the valve unit for high speed control, fulfilling the PL required for high speed in combination with other protective devices active (see PL-tables).
—	K3 is a proportional directional control valve without any safety related feature.