The overhead crane Safety Monitoring and Management System is designed to GB/T 28264-2017, integrating a safety sensor suite that includes a Lifting Capacity Limiter (QCX-H2Z), travel limit switches, laser anti-collision radar (SICK MLS), an anemometer (ELT-2), and brake wear monitoring. The system runs on Siemens safety PLCs (S7-1500F/S7-1200F) and implements a three-stage alarm interlock logic. It meets IEC 61508 SIL3 functional safety requirements and is suited for high-risk applications such as metal casting, port terminals, and nuclear power plants.

Safety Monitoring System Architecture and Sensor Configuration

Three-Level Alarm & Interlock Logic

The Safety Monitoring System classifies alarms into three levels: Caution (yellow), Warning (orange), and Critical (red). Each level triggers distinct response actions with corresponding response times. The safety interlock logic runs on a Siemens S7-1500F safety PLC, with all safety signals wired through distributed I/O (ET200SP F-RQ). The safety program operates independently from the standard control program in a dual channel architecture. Personnel intrusion detection signals from the overhead crane's AI vision inspection system (see AI Vision Inspection Technical Solution) feed into the critical-level interlock, instantly triggering an emergency stop when personnel enter the lifting zone, with a response time of <100ms.

Caution-level logic executes on the standard PLC (non-safety channel), while Warning and Critical levels run on the safety PLC (safety channel using TÜV-certified function blocks). The safety PLC's diagnostic cycle is set to 50ms (Profinet bus jitter <1ms), ensuring the total response time from sensor acquisition to safety output (relay cutting off the main contactor) meets SIL3 requirements (<50ms). After an interlock triggers, fault data is written to the black-box data recorder and simultaneously uploaded to the control room and cloud via OPC UA.

Safety PLC and Fail-Safe I/O for Overhead Crane Monitoring

The crane safety monitoring system is built on a Siemens S7-1500F safety PLC (CPU 1515F-2 PN) paired with an ET200SP F-RQ fail-safe I/O station. Safety logic is developed in LAD/FBD within TIA Portal Step 7 Safety. Safety-related sensor signals—emergency stop, limit switches, and door interlocks—are read through the fail-safe I/O and transmitted to the safety CPU via PROFINET/PROFIsafe. The safety program runs in dual-channel mode on the safety CPU (two independent logic channels with interlocking), so any single fault—such as one channel outputting 0 while the other outputs 1—immediately triggers a safe shutdown. By sharing hardware between the safety PLC and the crane's standard control program, this approach lowers overall retrofit costs and reduces control cabinet space by roughly 40% compared to a standalone safety controller solution.

The fail-safe I/O station (ET200SP F-RQ) supports up to 24 safe digital inputs and 8 safe digital outputs, with channel-level diagnostics on every input. Wire shorts, sensor wire breaks, and abnormal signal voltages are all detected and trigger a safe stop. The safety PLC sends a safety release signal to the crane's standard PLC every 10 ms; the standard PLC only issues run commands after confirming receipt of that release. This gateway-style architecture allows the safety retrofit to integrate without replacing the existing crane control cabinet.

Kelude Safety System Advantages for Overhead Cranes

Kelude Heavy Industry's crane safety monitoring system has passed all GB/T 28264 tests conducted by the National Quality Supervision and Inspection Center for Hoisting and Transport Machinery, with the safety PLC configuration meeting SIL 3. The system comes standard with a black-box data recorder that stores 30 days of continuous operating data—including load, position, speed, and alarm events—and supports remote data export for compliance audits. Kelude also offers a complimentary on-site risk assessment and functional safety level evaluation report for crane safety systems.

FAQ

Overhead Crane Safety Monitoring System SIL3 Solution: Sensor Configuration and PLC Interlock Design per GB/T 28264

Overhead crane operations carry inherent risks—load drops, runway collisions, and brake failures can all lead to serious incidents. A robust safety monitoring system is therefore not optional but essential. This article walks through a complete SIL3-rated safety monitoring architecture for overhead cranes, designed in compliance with GB/T 28264-2017 and IEC 61508. We cover the safety integrity level breakdown, sensor selection and parameters, and the PLC-based three-level alarm interlock logic with response timing.

Why SIL3 for Overhead Crane Safety Monitoring?

The safety integrity level (SIL) determines how reliable a safety function must be. For overhead cranes—especially those handling heavy or hazardous loads—SIL3 is the industry benchmark. It requires a probability of dangerous failure per hour (PFH) between 10⁻⁸ and 10⁻⁷, meaning the safety system can fail dangerously only once every 100 to 1,000 years of continuous operation. Achieving this level demands redundant sensors, a certified safety PLC, and a well-defined interlock strategy.

Under GB/T 28264-2017, the safety monitoring system must continuously acquire, process, and display critical operating parameters. When any parameter exceeds a preset threshold, the system triggers a corresponding alarm level and, if necessary, automatically cuts power to the crane's motion mechanisms. The standard classifies alarms into three levels, each with distinct response requirements—this is where the three-level interlock design comes in.

Core Safety Sensors and Their Parameters

The monitoring system gathers data from a network of sensors strategically placed across the crane. Each sensor feeds into the safety PLC, which evaluates the data against preset limits and initiates the appropriate response. Below is the complete sensor configuration used in this SIL3 design.

All sensors are selected with SIL2 or higher capability and used in a 1oo2 (one-out-of-two) or 2oo3 (two-out-of-three) voting architecture where required to meet the overall SIL3 target. Redundant sensors are physically separated to avoid common-cause failures.

Safety PLC Architecture: S7-1500F / S7-1200F

The safety logic is executed on a Siemens SIMATIC S7-1500F or S7-1200F fail-safe PLC. These controllers are certified to SIL3 per IEC 61508 and feature integrated safety functions such as safe torque off, safe stop, and safe speed monitoring. The PLC continuously reads all sensor inputs, runs the interlock logic, and drives the output relays that control the crane's contactors and variable-frequency drives (VFDs).

In this design, the safety PLC operates independently from the standard crane control PLC. This separation ensures that a failure in the standard control system does not compromise the safety functions. The two PLCs communicate via a fail-safe PROFIsafe connection for status exchange, but the safety PLC retains full authority to shut down the crane regardless of the standard PLC's state.

Three-Level Alarm Interlock Logic and Response Timing

The interlock logic is organized into three alarm levels, each with a defined response. The thresholds and response times are configurable via the HMI, but the default values below represent a typical configuration for a medium-capacity overhead crane.

The response times above are measured from the moment the sensor signal crosses the threshold to the moment the output relay de-energizes. These values account for sensor response, PLC scan cycle, and output relay switching time. In practice, the S7-1500F achieves a typical safety response time of 50–80 ms for a simple interlock chain, well within the SIL3 requirement.

HMI and Data Logging for Compliance

A touchscreen HMI (typically a Siemens TP900 or similar) displays real-time values for all monitored parameters, current alarm status, and historical trend curves. The system logs all events—including sensor readings, alarm triggers, and operator actions—to a non-volatile memory card. This data log is essential for post-incident analysis and for demonstrating compliance with GB/T 28264-2017 during audits.

The HMI also provides a configuration menu for setting alarm thresholds, response times, and sensor calibration offsets. Access to this menu is password-protected and restricted to authorized maintenance personnel.

Standards Compliance and Certification

The system is designed to meet the following standards:

• GB/T 28264-2017 — Safety monitoring and management system for cranes: general requirements (primary design basis)
• IEC 61508 — Functional safety of electrical/electronic/programmable electronic safety-related systems (SIL3 certification basis)
• ISO 4301 (equivalent to GB/T 3811) — Cranes: classification
• ISO 12480 (equivalent to GB/T 6067) — Cranes: safe use
• ISO 4306 (equivalent to GB/T 14405 and GB/T 5905) — Cranes: vocabulary and test methods
• IEC 60204-32 (equivalent to GB/T 24810 and GB/T 5226) — Safety of machinery: electrical equipment of cranes

The safety PLC, sensors, and output relays are all selected from components with proven SIL ratings. A third-party functional safety assessment can be performed on request to issue a SIL3 certificate for the complete system.

Conclusion: A Complete SIL3 Safety Package

This SIL3 overhead crane safety monitoring system combines certified sensors, a fail-safe PLC, and a clearly defined three-level alarm interlock strategy. It meets the requirements of GB/T 28264-2017 and aligns with international functional safety standards. The result is a crane that not only operates more safely but also provides the documented evidence needed for regulatory compliance and insurance purposes.

For cranes operating in critical applications—such as molten metal handling, large-capacity lifting, or multi-crane bays—this system provides the level of protection that modern safety standards demand. Contact Kelude for a detailed engineering proposal tailored to your specific crane configuration and duty cycle.