Safety Contactor

I am still having trouble understanding the extent to which I should have to go to ensure that actuators and more specifically motors have power removed when an emergency stop pushbutton is pressed.

A "Standard" safety control circuit has a safety relay with dual channel inputs and a safe off output.
Control power is controlled via this safe off output.
The majority of equipment I see the safe off output feeds a standard non safety rated contactor which acts as an MCR and is the one kills control power to actuators and motor starters. This seems to defeat the purpose of using a safety relay. What happens if the non safety rated MCR contacts are welded shut? Then I hear the argument that your MCR should be safety rated i.e. forcibly guided contacts. OK, appears to have solved that problem.

So now our Safety MCR is supplying power to our motor starter coils which turns our motor on/off. But wait what happens if our motor starter contactor welds shut. See where I am going with this. Every device that controls an actuator should theoretically be safety rated. Where does this end?

Please excuse and grammar/spelling mistakes.

For an old school system, you have the safety relay and then redundant contactors to switch the 3 phase (having a single contactor reduces your SIL level). At that point, your safety system is done, pressing e-stop removes power to the things on the other side of the contactors, regardless of what that thing is or if it is broken or not. Auxiliary contacts on the contactors can switch 24VDC to provide a safe 24V for killing select IO blocks, dumping air, etc (if your safety relay can't handle the amperage or doesn't have enough contacts).

Once you get into VFDs and Servos, most of them have a Safe Torque Off (STO) input that will be SIL3 PLd at least and you don't need to drop 3 phase anymore. Replace the relay with a safe PLC and use safety rated motor starters and you can keep 3-phase on for those too.

We use two contactors. The motor is wired in series through them both. Each contactor is fed back into one channel of the safety relay (via an auxiliary contact). The Safety relay cross checks the operation of both contactors.

Your Safety MCR should never switch any load so the likelihood of the contacts welding is much reduced. You could weld the contacts by passing a very large current, but that should be accounted for with overcurrent protection.

Here is how I set mine up

I do what you call a MCR Loop, it goes through a contact on each.

Control Power to Main E-Stop to Pull cord 1 to Pull cord 2 to etc the last one feeds the coil of the MCR.

Then I supply my output cards power after the contactor is closed and the aux contact on your starters or VFD's. That way when your safety circuit is tripped every thing stops.

Contactors used in a safety application should have two wired in series. The contactors should have force guided contacts (including a non-removable NC aux contact.

If you have redundancy and force guided + mirror contacts then you should be good.

Actually, the FIRST step is to perform a safety evaluation / risk assessment to determine the level of safety you need to implement BEFORE you start throwing parts at it. The level at which you must consider the failure modes of various components in the system is based on the likelihood of failure and what the risks of that failure entail in terms of risk to personnel. So for example a starter controlling a conveyor feeding wood into a saw involves a much higher risk of injury if it welds shut and fails to open when the superhero hits the E-stop just as the bound damsel in distress reaches the blade, compared to a starter running the pump supplying water for the fountain on the bird bath outside.

In general, the older MCR based concept used in North America for years was a "shotgun" approach to personnel safety. Newer regulations are requiring that each individual load or process be evaluated on a case by case basis, and that shotgun approach, although fine for overall shutdowns, may no longer be adequate in all cases. So just putting a Safety Relay on the MCR circuit is, in a way, kind of a waste of effort if not thought through to consider the bigger picture.

I would first start by carrying out a risk assessment then use either 13849 or 62061 to determine the desired rating. This will then allow you to engineer a solution using the correct components.