What is external device monitoring and how does it relate to machine safety?

According to the Machinery Directive 2006/42/EC, technical protective measures should be used to reduce risks that cannot be avoided through safe design measures. These technical protective measures include safety devices such as door locks, covers, light curtains, and other equipment that monitors the machine movements. When the safety device controls and external device, such as a contactor or relay, to switch off power and stop a machine or prevent a hazardous function, the safety system must also implement measures for external device monitoring.

External device monitoring is typically required to achieve the highest machine safety ratings — PLe Category 3 or 4 per ISO 13849-1, or SIL 3 per IEC 62061.

External device monitoring (EDM) is simply a means by which a safety or protective device, such as a light curtain or safety relay, monitors the state of external devices, such as contactors or machine primary control elements (MPCEs), that are controlled by the safety device. If the external device is found to have an unsafe state, such as fused contacts or problems with wiring, the safety device will lockout.

Simply put, the safety device checks to ensure the external device (a contactor, for example) is de-energized when the safety device is triggered. It does this by using two normally closed (NC) contacts to monitor the status of the normally open (NO) external device contacts (such as machine power contacts). The NC monitoring contacts are mechanically linked to and positively guided by the NO contacts. In this positively-guided configuration, the NC and NO contacts operate together and cannot be closed simultaneously.

When the safety device output is off, the NC monitoring contacts are closed, the contactor’s NO contacts are open, and 24 V is applied to the EDM input. However, if one of the NO contacting elements malfunctions and is closed — for example, by being fused — the monitoring NC contact cannot close, and the required voltage cannot be delivered to the EDM input.

Alternatively, when the safety device output is on, the NC monitoring contacts are open and the contactor’s NO contacts are closed. But if one of the NC monitoring contacts malfunctions (fused closed), the NO contacts cannot close. The safety device recognizes either of these abnormal conditions and prevents the machine or operation from re-starting.

External device monitoring can be implemented as either one-channel monitoring or two-channel monitoring. One-channel monitoring uses contacts that are wired in series, with feedback provided to the start condition of the safety device. Two-channel monitoring requires that the contacts be wired independently, and both NC contacts must be closed before the safety device can be reset. While one-channel monitoring can detect a malfunction in the operation of the contacts, two-channel monitoring can also detect a malfunction in the safety circuit wiring.