Skip to main content

Positioning Accuracy and Interlocks on Automated Transfer Cars

An automated transfer car has to put a heavy load within a few millimeters of a furnace, press, machine tool, or crane pickup point, cycle after cycle for the life of the line, and it has to know when it must not move at all. UTEC Industrial designs, engineers, machines, fabricates, and installs custom material handling systems for aerospace and heavy industry from its Spokane Valley, WA facility, integrating Allen-Bradley PLC and motion control with in-house CNC machining, heat treating, and stress relief. This article covers the two halves of that problem: the position sensing and control that make a heavy car dock accurately, and the separate safety functions, guard interlocks, bumpers, and emergency stops that keep people out of its path. Both sit at the downstream end of the build chain, design → engineering → parts machining → fabrication → assembly → weld fatigue → stress relief → drives → controls → tuning → monitoring, and both depend on the upstream links: as engineering reasoning, a car that skews or flexes may not dock repeatably however good its sensor is.

What sets the positioning accuracy an automated transfer car needs?​

The tolerance comes from the station the car serves, not from the car. A car that pushes a charge into a furnace, presents a workpiece to a machine-tool fixture, lines up with a second track, or waits under a crane pickup point has to arrive inside the tolerance that station can accept. The positioning budget then has to cover everything between the command and the load's actual position:

  • Sensor accuracy and repeatability. For one laser distance sensor family, SICK's DL100 Pro, the operating instructions' technical data give accuracy of ±2.0 to ±3.0 mm and repeatability of ±0.5 to ±2.0 mm, depending on the range variant, measured on the Diamond Grade reflective tape the table names.
  • Temperature drift. The same sensor's drift is typically 0.1 mm/K, so ambient swings in an unheated bay count.
  • Stopping. The drive's deceleration and final approach, which depend on the load carried.
  • Mechanics. Wheel-to-rail clearance, frame flexibility, and the fit of the load on its supports.

A short budget shows the method. Assume a docking tolerance of ±10 mm, the ±2.0 mm accuracy of the 100 m variant, and a 30 K swing in bay temperature between winter nights and summer afternoons. Drift is 0.1 mm/K × 30 K = 3 mm, and accuracy plus drift uses 5 mm of the 10 mm, leaving 5 mm for stopping and mechanics. Where the car returns to taught positions, repeatability rather than absolute accuracy governs, and the 100 m variant's ±0.5 mm repeatability (statistical error 1 sigma, constant environmental conditions, minimum warm-up time 10 minutes) leaves far more margin. The drive, brake, and wheel design that set the stopping and mechanical terms are covered in the rail-guided transfer car design article (SICK 2025, DL100 Pro Operating Instructions 8024484, Tables 49 and 55).

Why do driven-wheel encoder counts lose position on a heavy car?​

An encoder on a travel motor measures motor rotation, not car position, and several things sit between the two on a heavy car. The first is wheel slip. A heavy car that accelerates or brakes harder than the adhesion at its driven wheels allows will slip, and the counts run on while the car does not. The second is wheel wear, which changes the effective rolling diameter so that a fixed count per millimeter drifts over the wheels' life. The third is the encoder's own mounting.

The first two points are engineering reasoning, not a cited rule: no source in this library quantifies wheel-to-rail slip on transfer cars. They are why this article recommends an absolute position source that does not depend on the driven wheels, such as a laser distance sensor or an encoder on a non-driven measuring wheel.

The third point is documented. Siemens' SINAMICS S120 Safety Integrated Function Manual lists, as a residual risk of a single-encoder system, that a break of the encoder shaft, a loose encoder shaft coupling, or a loose encoder housing makes the encoder signals remain static while still returning a correct level, and prevents fault detection while the drive is in a stop state such as SOS. For excluding those faults it calls for an FMEA and a fault-exclusion process according to IEC 61800-5-2 (cited without an edition year), or for a two-encoder system with the encoders not mounted on the same shaft. The manual describes actual value synchronization, activated for example on systems or machines with slip, which averages the two channels' actual values and monitors a maximum slip once per cross-check cycle. In this article's reading, a motor encoder paired with a load-side position source is the car version of that two-encoder arrangement (Siemens 2020, SINAMICS S120 Safety Integrated Function Manual, §2.3 and §5.2.15.4; IEC 61800-5-2:2016).

How does a laser distance sensor measure a car's position, and how accurate is it?​

A laser distance sensor mounted at the end of the track and aimed at a reflector on the car (or the reverse) gives the car's absolute position along the rail without touching the rail or the wheels. SICK's DL100 Pro operating instructions describe the principle and the data a designer needs:

  • Principle. The device determines the distance between sensor and reflector by phase-correlated time-of-flight measurement, and either the reflector or the device can move along the beam. The measured distance can be used for control purposes or in a position control loop.
  • Intended use. Non-contact measurement of distances to system components that are in linear motion, measured on a reflector.
  • Range and accuracy. Measuring ranges of 0.15 to 100 m, 200 m, or 300 m by variant, measured on Diamond Grade DG983 reflective tape, with accuracy of ±2.0, ±2.5, and ±3.0 mm and repeatability of ±0.5, ±1.0, and ±2.0 mm respectively. Accuracy can be up to ±4 mm in the 150 to 180 mm part of the range.
  • Timing. A 1 ms measurement cycle and a 2 ms response time, with a PROFINET output rate of 1 ms or SSI output synchronous to the PLC request.
  • Motion limits. Maximum traversing speed of 15 m/s and maximum acceleration of 15 m/s², which as engineering judgment are well above heavy-car travel rates.
  • Recovery. Initialization time is typically 1.5 s, and under 40 ms after reflector loss.

These are one device's figures, and a different sensor or interface variant has its own data sheet. As engineering reasoning, the recovery time matters to the control design: a beam interrupted by a person, a crane load, or steam is a loss of position, and the PLC has to treat it as a fault that stops or holds the car rather than as a valid reading (SICK 2025, DL100 Pro Operating Instructions 8024484, §2.2, §3.3.2, and Table 49).

How should the laser sensor and reflector be mounted on a moving car?​

The DL100 Pro instructions give these mounting instructions and ratings:

  • Reflector size. The reflector must be big enough that the whole light spot always hits it, and never smaller than 100 mm × 100 mm. The light spot is typically 5 mm + (2 mm × distance in meters). If the sensor rides on the vehicle, a larger reflector is typically necessary to allow for the vehicle's rolling movements.
  • Reflector tilt. Mount the reflector tilted about +1° to +3° in one axis to avoid direct surface reflections. Shiny surfaces parallel to the beam, such as rails, may cause beam switching or light scatter and incorrect measurements, so the reflector is tilted away from them into free space.
  • Laser class. The device is Laser Class 2 under IEC 60825-1:2014, which applies to the safety of laser products emitting in the 180 nm to 1 mm wavelength range and whose objectives include a system of classifying them by degree of optical radiation hazard.
  • Environment. Ambient operating temperature is −20 to +55 °C, −40 to +55 °C with integrated heating, and −20 to +75 °C in the cooler housing, with a warm-up phase needed below −10 °C, a supply of at least 24 V needed below −20 °C, and an IP65 enclosure rating.

A worked sizing step follows directly. For a car with 90 m of travel, a fixed sensor at the track end, and the reflector on the car, the spot at full travel is 5 mm + (2 mm × 90) = 185 mm. The reflector therefore has to be larger than 185 mm on each side, plus whatever margin the car's lateral float and vertical bounce add, which is an assumption to measure on the actual track. As engineering reasoning, mounting the sensor at the fixed end, where cable, heat, and vibration are easier to manage, and the reflector on the car is the simpler arrangement; SICK notes that a sensor on a vehicle typically needs a larger reflector (SICK 2025, DL100 Pro Operating Instructions 8024484, §5.3 and Tables 48 and 55; IEC 60825-1:2014).

Why is a laser positioning sensor not a safety device?​

The sensor that docks the car is not the device that protects people from it. SICK's instructions for the DL100 Pro state that the device does not constitute a safety component in accordance with the applicable safety standards for machines, and that it must not be used in explosion-hazardous or corrosive areas or under extreme ambient conditions. As engineering reasoning, the same can hold for other position-control sensors unless their manufacturer rates them as safety components: accuracy and speed are not the diagnostic coverage and fault behavior a safety function needs.

That splits the car's intelligence layer into two channels:

  • Position control. The laser or encoder feeds the PLC and drive, which command the car to its target and stop it there.
  • Safety functions. Overtravel protection, speed limits in shared zones, and standstill monitoring can be implemented in safety-related parts of control systems designed to ISO 13849-1:2023, which specifies a methodology and provides related requirements, recommendations and guidance for the design and integration of such parts in high demand and continuous modes of operation, or in drive-integrated safety functions under IEC 61800-5-2:2016, which specifies functional safety requirements for the design, integration and validation of safety-related adjustable speed electrical power drive systems.

In practice, a car may use one laser for docking and a separate safety-rated position or speed source, or cam and limit switches wired to safety inputs, for the protective functions. The safety functions themselves, and how much risk reduction each must deliver, come from the machine's risk assessment, for which ISO 12100:2010 specifies principles of risk assessment and risk reduction for achieving safety in the design of machinery (SICK 2025, DL100 Pro Operating Instructions 8024484, §2.3; ISO 13849-1:2023; IEC 61800-5-2:2016; ISO 12100:2010).

Which drive-integrated safety functions can limit a car's speed, direction, and position?​

Drives with integrated safety can carry several protective functions in the drive itself rather than in external safety relays. Siemens' SINAMICS S120 Safety Integrated Function Manual lists the Safety Integrated functions available under SINAMICS S120 and states that they conform to SIL 2 according to IEC 61508 and to Category 3 and Performance Level d according to DIN EN ISO 13849-1, and that they correspond to the functions according to DIN EN 61800-5-2, under the assumption that they are defined there; the manual cites all three standards without an edition year. Using the definitions the manual gives according to EN 61800-5-2, the functions this article maps onto a transfer car are:

  • Safe Torque Off (STO). Prevents energy that can generate torque from being supplied to the motor.
  • Safe Stop 1 (SS1). Brakes the motor and trips STO after a delay time.
  • Safe Brake Control (SBC). Supplies a safe output signal to control a holding brake.
  • Safe Operating Stop (SOS). Safely monitors the standstill position of a drive; on a car, this article applies it to a car parked at a station while a person works at the load.
  • Safely Limited Speed (SLS). Prevents the motor from exceeding the specified speed limit. The manual's own example is an operator who enters after a protective door is opened and moves a horizontal conveyor slowly with an acknowledgment button in the danger zone, which this article reads as the maintenance-jog case on a car.
  • Safe Direction (SDI). Prevents the motor shaft moving in the wrong direction; this article's application is a car at a station that is allowed to back away but not to advance.
  • Safely Limited Position (SLP). Safely monitors the limits of two traversing or positioning ranges, switched by a safe signal, with a parameterizable stop response when a range is left. SLP is only available with a suitable encoder, needs a safely referenced drive, and may not be enabled together with actual value synchronization.

As engineering reasoning, the encoder residual risk from the earlier answer bears on every position-based function in this list, so the encoder arrangement is part of the safety design, not a detail left to installation (Siemens 2020, SINAMICS S120 Safety Integrated Function Manual, §3.1, §4.1.1 to §4.1.3, §4.2.5, §4.2.7, §4.2.9, §4.3.2, §4.3.4, and §5.3.3).

How are access gates and trapped-key interlocks applied to a car's travel zone?​

A transfer car's travel path is a moving hazard zone the length of the track, and one way to keep people out of it while the car runs is a fence with interlocked gates. ISO 14119:2024 specifies principles for the design and selection of interlocking devices associated with guards, independent of the energy source, gives guidance on measures to minimize the possibility of defeat in a reasonably foreseeable manner, and covers trapped-key interlocking devices and systems for machinery applications. It notes that the processing of the signal to stop the machine and prevent unexpected start-up is covered by other standards, including ISO 13849-1:2023.

Three points shape how those devices are used on a car:

  • Interlocked guards where access is regular. The ILO code for the iron and steel industry says that if workers need regular access to parts of the machine and a fixed guard is not possible, an interlocked guard should be used, so the machine cannot start before the guard is closed and stops if it is opened while running.
  • Guard the nip points. OSHA 29 CFR 1910.212(a)(1) requires one or more methods of machine guarding to protect the operator and other employees in the machine area from hazards such as point of operation, ingoing nip points, and rotating parts. In this article's reading, the pinch between a car's end or deck and a column, door frame, or furnace face is that kind of hazard. Paragraph (a)(2) requires guards to be affixed to the machine where possible, secured elsewhere if attachment to the machine is not possible, and not to be a hazard themselves.
  • Trapped keys for maintenance entry. As engineering practice, a trapped-key sequence can make a maintenance worker remove a key that stops and locks out the car's drive before a gate key is released, and the gate key stays with the worker inside the zone.

As engineering practice, the layout comes first: where the track passes a doorway or a walkway, the fence line, gate positions, and crossing points are decided with the rail, not added afterward (ISO 14119:2024; International Labour Organization 2005, Code of Practice on Safety and Health in the Iron and Steel Industry, §5.4.3.2.2; OSHA 29 CFR 1910.212-1974).

What do bumpers, trip wires, and presence sensing add at the car's ends?​

Where people and the car share floor space, or where the car cannot be fenced along its whole length, protective devices on the car itself can detect a person before the car reaches them. Three device families and their standards are:

  • Pressure-sensitive bumpers and trip wires. ISO 13856-3:2013 gives general principles and requirements for the design and testing of pressure-sensitive protective devices not covered by the other parts of ISO 13856, with specific requirements for bumpers, plates, and trip wires. Its abstract says it deals with the device's design for safety and reliability rather than its suitability for particular applications, and that it is not applicable to specifying the device's dimensions for a particular application, so the bumper's travel on a given car is the designer's calculation.
  • Electro-sensitive protective equipment. Safety laser scanners and light curtains on the car's leading ends, or across its path, are electro-sensitive protective equipment, and IEC 61496-1:2020 specifies general requirements for the design, construction, and testing of non-contact ESPE designed specifically to detect persons or parts of persons as part of a safety-related system; it does not specify the detection zone's dimensions or disposition for a particular application.
  • Safeguard positioning. ISO 13855:2024 specifies requirements for positioning and dimensioning safeguards, including ESPE detection zones, with respect to the approach of the human body or its parts toward hazards, for persons 14 years and older; running, jumping, or falling approaches are not considered. Its requirements govern where an ESPE detection zone sits relative to the hazard, and so how far ahead of the car a sensing field has to reach.

A bumper on a heavy car has to trip early enough for the car to stop before its rigid structure reaches the person, so its compliant travel has to exceed the car's stopping distance from the speed at which it can be struck. That is engineering reasoning, and it is why this article recommends slowing a heavy car in shared areas rather than relying on the bumper at full speed. These devices are different from the mechanical end-of-travel stops and energy-absorbing buffers at the ends of the rail, whose crane-rule benchmarks are covered in the transfer car design article (ISO 13856-3:2013; IEC 61496-1:2020; ISO 13855:2024).

How is the emergency stop designed on a car that travels?​

As design practice, an emergency stop on a car should be reachable from wherever a person might be when something goes wrong: at the car, along the track, at each station, and at the operator position. ISO 13850:2015 specifies functional requirements and design principles for the emergency stop function on machinery, independent of the type of energy used; it applies to all machines except those where an emergency stop would not reduce the risk and hand-held or hand-operated machines, and it does not deal with functions such as braking or disconnecting that can be part of the emergency stop function. It points to IEC 60204-1 for the electrical realization, which this article takes from IEC 60204-1:2016. ISO lists the 2015 edition as to be revised (stage 90.92), with a successor under development, so the edition in force is re-checked before a project's design basis is frozen.

Four points of control design practice specific to travelling equipment follow:

  • Coverage. Stop devices go on the car, at each station, and at intervals along a long track, or a pull-wire runs along the track so a stop can be reached from any point on it.
  • Stop behavior. A heavy car carries enough momentum that removing torque alone may let it coast. The drive-integrated functions in the Siemens manual illustrate the options: STO removes torque-producing energy, SS1 brakes the motor and then trips STO after a delay, and SBC controls the holding brake through a safe output.
  • Communication loss. On radio- or network-controlled cars, loss of the command link has to stop the car.
  • Reset. Resetting the stop does not restart the car; the PLC waits for a separate, deliberate start command.

In this article's reading, an emergency stop is a backup to the other safeguards, not a substitute for guarding, and it does not isolate energy for maintenance, as the maintenance answer below explains (ISO 13850:2015; IEC 60204-1:2016; Siemens 2020, SINAMICS S120 Safety Integrated Function Manual, §4.1.1 to §4.1.3).

How do PLC logic and zone permissives sequence a car's moves?​

Everything above comes together in the PLC program that decides when the car may move and where it may go. In this article's design practice, a move is gated by a chain of permissives:

  1. Destination ready. The receiving station reports ready: furnace door open, press at top of stroke, machine-tool fixture unclamped, or crane clear of the pickup point.
  2. Load seated. Load presence, and on weighing cars a load cell reading within rating, confirms the load is on its supports.
  3. Zone clear. All gates in the travel zone are closed and locked, and no presence sensor is tripped.
  4. Position valid. The laser or encoder reading is present, plausible, and agrees with the second position source within a set tolerance.
  5. Safety functions healthy. The safety-rated channel reports no fault.

Only then does the PLC release the move, with the drive profile set for the load carried and a slowdown point before the target. A disagreement between the two position sources, or a reading that jumps, stops the car and raises an alarm rather than being averaged away. Logix 5000 controller tasks can be configured as continuous, periodic, or event, and a periodic task executes automatically based on a preconfigured interval, so the position check and interlock logic can run in a periodic task at a fixed rate. The ILO code's recommendation that all electrical installations be appropriately designed and include appropriate protection systems, such as automatic shut-off systems, interlocks, and emergency controls, states a related principle. UTEC Industrial builds this sequencing on Allen-Bradley ControlLogix and CompactLogix controllers with PanelView and FactoryTalk operator interfaces, EtherNet/IP networks, and UL 508A control panels (Rockwell Automation 1756-RM094N-EN-P-2025; International Labour Organization 2005, Code of Practice on Safety and Health in the Iron and Steel Industry, §5.4.2.5).

How is a car made safe for maintenance, and what does the coil-cart fatality show?​

Positioning and interlock systems protect people while the car runs. Maintenance needs a different layer: as engineering reasoning, a stopped car is not by that fact a safe car. OSHA's lockout/tagout standard, 29 CFR 1910.147-1989, defines an energy-isolating device as a mechanical device that physically prevents the transmission or release of energy, and states that push buttons, selector switches, and other control-circuit-type devices are not energy-isolating devices. This article reads that as meaning a PLC stop, an e-stop, or a drive's safe torque-off does not replace lockout at the main disconnect. After lockout, all potentially hazardous stored or residual energy must be relieved, disconnected, restrained, and otherwise rendered safe, which this article reads on a car as covering the parked car on a grade, a raised table, and charged accumulators.

NIOSH FACE Report 98-14 describes a fatality during repair work under a coil cart supported only on forklift forks. A machine operator died after a 9,700-pound coil cart, used to bring steel coils to a press, fell on him: the chain had come off the chain-and-sprocket assembly under the cart, the operator used a forklift to lift the cart about a foot and crawled under it to re-install the chain, and the cart slipped off the forks. NIOSH investigators concluded that employers should ensure lockout/tagout procedures are reviewed, revised where applicable, implemented, and enforced; that equipment is used for its intended purpose; that good housekeeping is practiced; and that a competent person is available on all shifts to identify and correct hazardous situations.

For the car designer, this article draws the lessons as designed-in means of support and access: jacking points and rated blocking for any work under the car, drive chains and sprockets reachable from outside the car's footprint, and rail stops or blocking devices, which the ILO code recommends to protect workers required to work on tracks or in vehicle travel areas (OSHA 29 CFR 1910.147-1989; NIOSH FACE Report 98-14, 1998; International Labour Organization 2005, Code of Practice on Safety and Health in the Iron and Steel Industry, §13.2.2.17).

How are positioning and interlocks proven at acceptance and then monitored?​

A positioning and interlock design is only as good as its test record. Factory and site acceptance tests for an automated car should prove, under load:

  • Docking. Repeated moves to each station at full and empty load, with the stopping position measured against the station tolerance.
  • Tuning. Each drive tuned to the inertia it actually moves. The Kinetix 5700 commissioning procedure repeats its Test and Tune step for each axis, and states that actual bandwidth values depend on the application and can require adjustment once motor and load are connected; in this article's practice, a car tuned empty is retuned loaded.
  • Safety functions. Each interlock, gate, bumper, scanner, and stop device tripped deliberately, with the car's actual stopping distance measured.
  • Position faults. The laser beam blocked and the reflector removed, confirming the car stops rather than moving on a stale reading.
  • Referencing. For drive-integrated position functions, safe referencing checked, since SLP depends on a safely referenced drive.

In service, trending can show problems before they become faults. The gap between the motor encoder count and the laser position, trended per move, can show driven-wheel slip and wheel wear, and rising correction at the final approach can point to a mechanical change such as a loose reflector or a frame that has moved; both uses of the data are engineering practice rather than a cited rule. UTEC Industrial performs factory acceptance testing and on-site commissioning, so these tests can be written into the purchase order and witnessed at both stages. Requirements like the station tolerance and each interlock's function are best written as verifiable statements in the user requirement specification (Rockwell Automation 2198-UM002E-EN-P, Kinetix 5700; Siemens 2020, SINAMICS S120 Safety Integrated Function Manual, §4.3.2 and §4.3.4; SICK 2025, DL100 Pro Operating Instructions 8024484, Table 49).

Related Articles

References​

  • IEC 60204-1:2016 (Ed. 6.0): Safety of Machinery -- Electrical Equipment of Machines -- Part 1: General Requirements. International Electrotechnical Commission, 2016.
  • IEC 60825-1:2014: Safety of laser products — Part 1: Equipment classification and requirements. International Electrotechnical Commission, 2014.
  • IEC 61496-1:2020: Safety of machinery — Electro-sensitive protective equipment — Part 1: General requirements and tests. IEC, 2020 (Ed.4).
  • IEC 61800-5-2:2016: Adjustable speed electrical power drive systems — Part 5-2: Safety requirements — Functional. International Electrotechnical Commission, 2016.
  • International Labour Organization. Code of Practice on Safety and Health in the Iron and Steel Industry. International Labour Office, 2005.
  • ISO 12100:2010: Safety of machinery — General principles for design — Risk assessment and risk reduction. ISO, 2010.
  • ISO 13849-1:2023: Safety of machinery — Safety-related parts of control systems — Part 1: General principles for design. International Organization for Standardization, 2023.
  • ISO 13850:2015: Safety of machinery — Emergency stop function — Principles for design. International Organization for Standardization, 2015.
  • ISO 13855:2024: Safety of machinery — Positioning of safeguards with respect to the approach of the human body. ISO, 2024.
  • ISO 13856-3:2013: Safety of machinery — Pressure-sensitive protective devices — Part 3: General principles for design and testing of pressure-sensitive bumpers, plates, wires and similar devices. International Organization for Standardization, 2013.
  • ISO 14119:2024: Safety of machinery — Interlocking devices associated with guards — Principles for design and selection. International Organization for Standardization, 2024.
  • NIOSH. Machine Operator Dies After Being Crushed by 9,700-Pound Coil Cart—Pennsylvania. FACE Report 98-14, 1998.
  • OSHA 29 CFR 1910.147-1989: The Control of Hazardous Energy (Lockout/Tagout). Occupational Safety and Health Administration, 1989.
  • OSHA 29 CFR 1910.212-1974: General Requirements for All Machines. U.S. Department of Labor, 1974.
  • Rockwell Automation 1756-RM094N-EN-P-2025: Logix 5000 Controllers Design Considerations. Rockwell Automation, 2025.
  • Rockwell Automation 2198-UM002E-EN-P (2018): Kinetix 5700 Servo Drives User Manual. Rockwell Automation, 2018.
  • SICK 8024484: DL100 Pro PROFINET/SSI Distance Sensor: Operating Instructions. SICK AG, 2025.
  • Siemens 6SL3097-5AR00-0BP3: SINAMICS S120 Safety Integrated Function Manual, Edition 06/2020. Siemens AG, 2020.

Ready to Discuss a Material Handling System?​

UTEC Industrial designs, engineers, machines, fabricates, and installs custom material handling systems for heavy industry, from the stress-relieved structure and drives to the Allen-Bradley PLC controls, tuning, and monitoring that run them, at its Spokane Valley, WA facility. Send UTEC the application, loads, and duty cycle to start a system review.

Request a Quote →

Questions? Call (509) 922-1832 or email sales@utec.co

Last updated on