The crane safety control system is the final safeguard for equipment and personnel. It executes SIL3 safety logic independently of the standard PLC motion-control layer, using the PROFIsafe protocol to communicate with frequency inverters and safety I/O. In hazardous scenarios—emergency stop, overspeed, limit-switch overtravel, or load slipping—the system delivers a safety response in under 20 ms. Kelude Heavy Industry has built a standardized safety architecture around the Siemens S7-1500F series safety CPU, integrating four core safety functions: Safe Torque Off (STO), Safe Limited Speed (SLS), Safety Brake Control (SBC), and Safe Direction Indication (SDI). This article walks through the complete engineering practice—from system design and hardware selection to safety logic programming, certification, and commissioning.

Crane Safety System Architecture and SIL Rating Breakdown

The crane safety control system is designed in accordance with IEC 61508 and ISO 13849-1 (Machinery Safety — Safety-Related Parts of Control Systems), targeting Safety Integrity Level (SIL) 3, which corresponds to a probability of dangerous failure per hour below 10⁻⁷. The architecture follows a strict separation between the standard control layer and the independent safety layer: the standard control layer uses an S7-1500 CPU (e.g., 1513-1 PN) to execute motion-control logic, while the safety layer runs on an S7-1500F safety CPU (e.g., 1515F-2 PN or 1517F-3 PN/DP) operating independently. Both layers coexist on the same PROFINET network via the PROFIsafe protocol.

<p style="line-height:1.8;color:#262626;font-size:16px;">The hardware architecture of the safety control system is structured in three layers. The detection layer includes F-DI fail-safe digital input modules (collecting signals from Emergency Stop Buttons, Limit switches, safety door locks, and Overspeed Switches) and F-AI safety analog input modules (collecting signals from safety encoders and Load Sensors). The control layer uses an S7-1500F safety CPU to run the safety program, with safety logic programmed in F-LAD or F-SCL and validated via the Safety Admin tool in TIA Portal. The actuation layer uses F-DQ safety digital output modules to drive Safety Relays, brake solenoids, and the STO terminals on VFDs. The F-DQ modules feature built-in dual-channel disconnection, ensuring that a single fault cannot compromise the safety function.</p>\\\\n\\\\n<h2 style="font-size:22px;font-weight:600;color:#1a1a1a;border-bottom:2px solid #1e3a5f;padding-bottom:8px;margin-top:32px;">F-CPU Selection and PROFIsafe Safety Communication</h2>\\\\n\\\\n<p style="line-height:1.8;color:#262626;font-size:16px;">The S7-1500F series safety CPUs integrate an F-runtime safety execution environment on top of the standard CPU. The F-runtime operates as a separate execution layer sharing the same CPU as the standard user program. Safety programs are written in F-LAD and compiled into certified safety code using the Safety Admin tool in TIA Portal. Kelude selects different F-CPU models for overhead crane projects based on capacity and safety function complexity: the CPU 1515F-2 PN (with 128 KB program memory and 256 KB safety F-memory) is used for standard cranes in the 20–50 t range; the CPU 1517F-3 PN/DP (512 KB program memory, supports distributed safety I/O) is chosen for heavy-duty cranes above 50 t or applications requiring expanded safety functions; and the CPU 1511F-1 PN (48 KB program memory, integrated safety I/O, designed for compact control cabinets) is used for simple crane safety upgrades.</p>\\\\n\\\\n<p style="line-height:1.8;color:#262626;font-size:16px;">The PROFIsafe safety communication protocol is the foundation for SIL3-rated safety data transmission. PROFIsafe layers the F-host and F-device safety levels on top of standard PROFINET RT communication. Safety data is exchanged between the F-host (safety CPU) and F-devices (F-DI/F-DQ modules, VFD safety functions) via PROFIsafe telegrams. Each PROFIsafe telegram contains 2 bytes of safety data and a 1-byte CRC checksum (16-bit CRC + 8-bit CRC). The communication frame embeds a continuous watchdog counter (F_WD_Time default 150 ms) and connection identifiers (F_Source_Add/F_Dest_Add), ensuring data integrity, timeliness, and correctness. PROFIsafe telegrams are transmitted in parallel with standard PROFINET telegrams within the I/O cycle, without impacting the real-time performance of motion control. The safety data refresh rate matches the I/O cycle, typically 4–8 ms.</p>\\\\n\\\\n<p style="line-height:1.8;color:#262626;font-size:16px;">Configuring PROFIsafe in TIA Portal involves establishing an F-connection between the F-CPU and F-DI/F-DQ modules in the device view, setting the F_Source_Add and F_Dest_Add parameters (range 1–65534), and configuring the F monitoring time F_WD_Time and the F_iPar_CRC check version number. The safety program is compiled and simulation-validated using the Safety Administration editor and test functions in TIA Portal. The F-runtime automatically generates a 16-bit CRC identifier for each safety block; any code modification results in a CRC change, triggering re-validation of the safety subroutine.</p>\\\\n\\\\n<h2 style="font-size:22px;font-weight:600;color:#1a1a1a;border-bottom:2px solid #1e3a5f;padding-bottom:8px;margin-top:32px;">Dual-Channel Emergency Stop Circuit and Safety I/O Redundancy</h2>\\\\n\\\\n<p style="line-height:1.8;color:#262626;font-size:16px;">The Emergency Stop circuit in the overhead crane control system employs dual-channel redundancy design. The two channels are electrically and logically independent, and either channel can independently cut off the main power supply. Channel A acquires the normally closed contact signals from the Emergency Stop Buttons (SB1–SB4) via an F-DI 16×24V DC module. The safety CPU performs a dual-channel comparison in the safety program—the signal states of Channel A and Channel B must match within 500 ms, otherwise an F-Diff fault is triggered and the system enters a stop state. Channel B directly connects the auxiliary contacts of the Emergency Stop Buttons through I/O wiring, which are then routed via the forcibly guided contacts of Safety Relay K1 into the coil control circuit of main contactor KM1. This dual-channel design meets the SIL3 system requirements of IEC 61508—a single point fault will not result in loss of the safety function.</p>\\\\n\\\\n<p style="line-height:1.8;color:#262626;font-size:16px;">The selection of safety I/O modules follows the fail-safe principle—in the event of any single component fault within the module, the output must automatically switch to a safe state (i.e., open/de-energized). Each input channel of the F-DI 16×24V DC module has two independent test pulse generators that output two phase-opposite test pulses to the sensor/button terminals. Line short circuits and ground faults are detected by reading back these pulses. The output channels of the F-DQ 8×24V DC/2A module feature built-in dual-channel disconnection—each output is controlled by two independent switching elements in series, so a fault in either one disconnects the load supply. The test pulse frequency for safety output signals is 1 Hz (i.e., 500 ms high level + 500 ms low level per test cycle). The F-CPU synchronously refreshes the F-DQ output states within each safety scan cycle (20 ms).</p>\\\\n\\\\n<p style="line-height:1.8;color:#262626;font-size:16px;">Emergency Stop Buttons are arranged in accordance with ISO 13850 (Safety of machinery—Emergency stop function—Principles for design). Each overhead crane is equipped with an Emergency Stop Button in the operator's cab, on the floor remote control, on the maintenance platform, and at both End Carriages. All Emergency Stop Buttons are of the red mushroom-head type (diameter ≥ 30 mm) and are set against a yellow background on the panel. Limit switches use positive opening contact mechanisms to ensure the safety circuit can still be interrupted even if the contacts are welded. The final limit switch and deceleration limit switch are installed independently and do not share a mounting bracket.</p>\\\\n\\\\n<h2 style="font-size:22px;font-weight:600;color:#1a1a1a;border-bottom:2px solid #1e3a5f;padding-bottom:8px;margin-top:32px;">Redundant Dual Brake Control and Load Slipping Prevention</h2>\\\\n\\\\n<p style="line-height:1.8;color:#262626;font-size:16px;">The braking system of the overhead crane Hoisting mechanism is the core actuating component of the safety control system. Kelude equips each crane with two independent Disc Brakes (Brake A and Brake B) within the SIL3 safety architecture. Each brake consists of an independent electromagnet and pad assembly. The Double Brake shares a common Brake wheel but is mechanically installed completely independently. During normal operation, both brakes open and close simultaneously. In the event of a failure in one brake, the other can independently perform the braking function, satisfying the single-point fault tolerance requirement of SIL3.</p>\\\\n\\\\n<p style="line-height:1.8;color:#262626;font-size:16px;">The control sequence of the Double Brake is critical for preventing Load slipping. Opening sequence: The safety CPU simultaneously sends opening commands to Brake A and Brake B via the F-DQ module—F-DQ channel 1 drives the electromagnet MK1 of Brake A, and channel 2 drives the electromagnet MK2 of Brake B. After MK1 and MK2 are energized, both brake pads release simultaneously. The release position is detected by magnetic Proximity Switches SQ1 (Brake A) and SQ2 (Brake B) on the brakes, and the signals are sent back to the safety CPU via the F-DI module. Only after confirming that both brakes are fully open does the VFD receive the run enable. Closing sequence: The safety CPU issues the closing command after the motor has decelerated to zero speed—channels 1 and 2 of the F-DQ are de-energized simultaneously. After MK1 and MK2 lose power, the brake pads are pressed against the Brake wheel by spring force. After confirming the closed position, the safety CPU maintains zero speed for 300 ms before releasing the VFD enable.</p>\\\\n\\\\n<p style="line-height:1.8;color:#262626;font-size:16px;">Brake synchronization deviation detection: The safety CPU records the switching time difference Δt between MK1 and MK2 (from command issuance to Proximity Switch state change) during each Hoisting cycle. When Δt exceeds the set synchronization threshold (default 50 ms), the system records a synchronization deviation event. If the deviation exceeds the threshold for three consecutive cycles, or a single deviation exceeds 100 ms, the safety CPU triggers an F-Diff alarm—the PLC immediately stops operation and enables STO. The Operation Panel displays the "Brake Not Synchronized" fault code, and the system can only be reset after maintenance personnel check the electromagnet supply voltage and brake pad wear condition. Regarding brake wear compensation, the system accumulates the opening time (t_open) and closing time (t_close) of each Brake application and compares them with the initial nominal values (t_open ≈ 150 ms, t_close ≈ 100 ms). Based on the brake pad wear trend, the system automatically adjusts the lead time of the opening command to ensure the actual opening point and Braking torque remain within the safe range. Parameter self-tuning is performed automatically after 2,000 cycles of compensation.</p>\\\\n

Kelude Heavy Industry: Overhead Crane & Hoist Solutions

Kelude Heavy Industry specializes in the design, engineering, and manufacturing of heavy-duty overhead cranes, gantry cranes, and electric hoists. With a focus on safety, performance, and longevity, our material handling equipment is built to meet the rigorous demands of industrial environments across the United States and Europe.

Frequently Asked Questions

Q: What is the typical lead time for a standard overhead crane?
A: Lead times vary depending on the crane configuration and customization level. For standard single-girder cranes, lead time is typically 6-8 weeks. Double-girder cranes or heavily customized systems may require 10-14 weeks. We provide a detailed schedule upon receiving your specifications.

Q: Do you provide cranes that comply with European (CE) or North American standards?
A: Yes, our cranes can be designed and manufactured to comply with relevant international standards, including CE marking requirements for the European market and CMAA (Crane Manufacturers Association of America) specifications for North America. We also adhere to ISO 4301 for classification and IEC 60204-32 for electrical equipment.

Q: Can you service or upgrade an existing crane from another manufacturer?
A: Absolutely. We offer inspection, maintenance, and modernization services for cranes of any brand. Our team can retrofit older cranes with new controls, variable-frequency drives, or safety devices to improve performance and compliance with current standards.

Q: What kind of warranty do you offer on your equipment?
A: We provide a standard 12-month warranty on all our cranes and hoists, covering defects in materials and workmanship. Extended warranty options are available upon request. Our warranty is backed by our global service network to ensure prompt support.

Q: How do I determine the right crane capacity for my application?
A: The required capacity depends on the weight of your heaviest load, including any lifting attachments. We recommend adding a safety factor of 15-25% above the maximum anticipated load. Our engineering team can assist you in calculating the correct duty cycle and capacity based on your specific lifting frequency and load profile.

Q: What are the standard safety features included on Kelude cranes?
A: All our cranes include essential safety features such as overload limit switches, emergency stop buttons, low-voltage control circuits, and audible/visual alarms. Optional features include anti-collision systems, zone limiting controls, and load moment indicators for enhanced operational safety.

Q: Do you offer remote control operation?
A: Yes, we offer both pendant and wireless radio remote control options. Radio remotes provide increased operator mobility and flexibility, allowing for safer positioning during load handling. We can integrate these controls with variable-frequency drives for precise speed control.

Q: Can your cranes be installed outdoors in harsh weather conditions?
A: Yes, we offer outdoor-rated cranes with weatherproof enclosures, protective coatings, and specialized components designed to withstand rain, snow, extreme temperatures, and corrosive environments. We work with you to select the appropriate level of protection for your specific climate.

Q: What is the maximum span available for your double-girder cranes?
A: Our standard double-girder cranes can be designed for spans up to 150 feet (45 meters). For larger spans, we can engineer custom solutions using specialized structural analysis to ensure stability and performance. Please contact us with your specific requirements.

Q: How often should a crane undergo preventative maintenance?
A: We recommend a preventative maintenance inspection at least once every three months for cranes in regular service. However, the frequency should be based on the duty cycle, operating environment, and manufacturer guidelines. Our service team can develop a customized maintenance schedule for your equipment.

5. Safety Function Implementation: STO / SLS / SBC / SDI

The four core safety functions of the crane safety control system are implemented through the coordinated operation of the S7-1500F safety CPU and the G120 Frequency Inverter via the PROFIsafe interface. All safety functions are programmed in F-LAD and validated through TIA Portal Safety Admin. Each safety function block incorporates dual-channel signal processing, cross-comparison logic, and fail-safe output circuitry.

Safe Torque Off (STO) is the foundational safety function of the crane safety control system, corresponding to the STO sub-function defined in IEC 61800-5-2. STO directly cuts the pulse-enable signal to the G120 Frequency Inverter via PROFIsafe, preventing the motor from generating unintended driving torque, with a response time of less than 20 ms. Trigger conditions include: Emergency Stop Button pressed in the operator's cab, emergency stop activated via the floor remote control, any Limit switch over-travel, safety door lock opened, abnormal feedback from the Double Brake, or a self-diagnostic fault in the safety CPU. Once STO is triggered, the Frequency Inverter automatically performs internal braking (DC injection braking), and the overhead crane comes to a natural stop under inertia and load. To reset STO, a manual confirmation (Reset button) on the Operation Panel is required; the safety CPU verifies that all trigger conditions have been cleared and both brakes are fully engaged before re-enabling operation.

Safely Limited Speed (SLS) continuously monitors motor rotational speed via a safety Encoder (an incremental Encoder whose pulse signals are read through F-DI, or a safety speed Sensor providing direct feedback). When the Trolley or Crane Bridge approaches an end Limit switch at rated speed within 200 mm, the safety CPU sends a speed limit value (10% of rated speed) to the Frequency Inverter via PROFIsafe. The Frequency Inverter automatically executes deceleration, while the safety CPU continuously verifies that the actual speed remains within the defined safe range (≤ 0.3 m/s). If the safety CPU detects that the speed exceeds the SLS threshold (the safety PLC performs a speed comparison: actual speed n_act > SLS threshold n_sls for more than 50 ms), it immediately triggers an SLS-Fault and executes STO. The response time of the SLS function is less than 50 ms.

Safe Brake Control (SBC) works in conjunction with the dual-brake redundancy control described earlier. The SBC function is executed by the F-SBR function block within the safety CPU. The F-SBR outputs two independent SBC_Open commands to the F-DQ modules, controlling the electromagnets of Brake A and Brake B separately. The safety CPU performs an SBC status check during every safety scan cycle: when STO is activated, SLS is triggered, or the safety CPU detects that the Frequency Inverter has been in zero-speed hold for too long, the F-SBR automatically forces both brakes to close and, once fully engaged, sends a "brake closed confirmation" signal to the Frequency Inverter via PROFIsafe. SBC also includes a Braking torque monitoring function — it infers whether sufficient Braking torque is available by evaluating the Load Sensor signal and the motor's zero-speed state after the brakes close. If the Braking torque falls below 80% of the rated value, an SBC warning is triggered.

Safe Direction Indication (SDI) prevents the overhead crane from moving in an unintended direction before a reverse command is issued to the Trolley or crane travel mechanism. SDI determines the actual direction of motion by analyzing the phase relationship of the safety Encoder pulses and compares it against the direction feedback from the Frequency Inverter. If the safety CPU detects that the actual direction of motion contradicts the commanded direction for more than 100 ms, it triggers an SDI-Fault and executes STO. SDI direction conflicts are typically caused by incorrect Frequency Inverter Parameter settings (reversed phase sequence in the motor cable) or incorrect Encoder wiring. After an STO trigger, maintenance personnel must inspect the wiring and Parameters before performing a manual reset.

6. Commissioning, Validation & Safety Certification Process

Commissioning and validation of the crane safety control system follows a six-step procedure. Step 1 – Safety Parameter Configuration: Create the safety program (F-LAD) in the TIA Portal Safety Editor, and configure the PROFIsafe connection parameters for the F-CPU and F-DI/F-DQ modules: F_Source_Add (F-CPU address), F_Dest_Add (F-module address), F_WD_Time (default 150 ms), F_iPar_CRC version number, and F_Param_CRC. Each safety function block is assigned dual-channel variables; the cross-comparison logic is generated automatically by the F-runtime. After compilation, obtain the F-prog CRC and F-CRC signatures — if the two do not match, the safety program has been modified and must be re-validated.

Step 2 – Offline Simulation: Load the safety program into PLCSIM Advanced, connect virtual F-DI/F-DQ modules, and use the PLCSIM Safety Simulation function to simulate three fault scenarios: emergency stop activation, limit switch overtravel, and abnormal brake feedback. In the simulation environment, verify STO response time (≤20 ms), SLS speed threshold triggering accuracy (≤5%), SBC dual-brake synchronization deviation monitoring (50 ms threshold triggers F-Diff alarm), and SDI direction conflict detection (100 ms threshold triggers STO). Once all safety functions pass simulation, generate a Safety Validation Report.

Step 3 – On-Site Wiring Verification: Use a multimeter and oscilloscope to verify the test pulses on the F-DI modules (1 Hz square wave, 24 V amplitude) and the dual-channel disconnection function of the F-DQ modules. Measure the dual-channel wiring of the emergency stop button separately: the pulse waveform at the F-DI terminal on Channel A and the hard-wired auxiliary contact continuity on Channel B, confirming that both channels properly interrupt the safety circuit when the emergency stop button is pressed. The measured supply voltage to the brake electromagnet must fall within 22.8–24.5 V; capture the electromagnet energizing current curve on the oscilloscope (peak ≈1.6 A, steady-state holding current ≈0.8 A).

Step 4 – Load Function Testing: Perform three trigger tests under both no-load and rated-load conditions: operator-cab emergency stop, remote-control emergency stop, and limit overtravel. Each trigger must verify correct execution of all safety functions — STO, SLS, SBC, and SDI: after STO triggers, the VFD pulse enable must be disconnected within 20 ms and the Drive-CLiQ status changes to Fault; after SLS triggers, the speed curve deceleration slope must match the VFD deceleration parameters with a maximum overshoot of ≤10%; after SBC triggers, both brakes must close simultaneously with Δt ≤50 ms; SDI direction conflict is simulated by reversing the encoder A/B phases. All test data is recorded in the commissioning report.

Step 5 – TÜV Certification Preparation: Compile the safety-related documentation: system architecture description (defining the functional separation and interfaces between the safety layer and the standard control layer), safety function definition table (quantifying trigger conditions, response times, and reset methods for STO/SLS/SBC/SDI), FMEA analysis table (listing all foreseeable single-point failures and their impact on safety functions), PROFIsafe connection parameter configuration table, and the simulation validation report. All documentation is prepared in accordance with EN ISO 13849-1 and IEC 62061.

Step 6 – Ongoing Monitoring & Periodic Inspection: Once the safety control system is in operation, the safety CPU automatically logs safety events (emergency stop activations, SLS activations, brake desynchronization events, F-Diff faults) and generates a 24-hour safety status summary, pushed via OPC UA to the central control room safety management platform. Site maintenance personnel perform a full safety function test quarterly (per the safety-related clauses of ISO 4301 Crane Design Standard), and a third-party inspection body (e.g., TÜV or the National Special Equipment Inspection Institute) conducts an on-site safety function verification every 12 months. Test records are retained until the next inspection cycle.

Frequently Asked Questions