Before the implementation of safety standards as defined in the machinery directive and OSHA the single channel circuit on the left was often used for most machines regardless of the hazard level. In the 1990s several events led to the migration of safety circuits to the dual-channel, redundant circuits shown on the right. One cause was the development of electronic monitoring safety relays. This allowed for circuits to monitor the status of the circuit to ensure that in the case of welded contacts or wires becoming disconnected that control power would be removed from the circuit. It also added a level of redundancy to the circuit making a circuit malfunction much more unlikely.
Another series of events that led to the more advanced and reliable safety circuit was the refinement of safety regulations. EN-954-1 is a European standard that established categories for safety systems related to machine and system control. These categories allowed for the selection of components to prevent safety circuit faults as well as wiring of the system to detect a circuit fault or failure. Since most countries do business with the EU and have to comply with their regulations the Machinery Directive has become the de-facto standard for most of the world. The classifications are listed in a previous post.
Additional regulations and standards that may apply to safety circuits are applied by other countries including Japan (JIS – Japanese Industrial Standards), The United States (OSHA and ANSI), and China (GB Standards). Generally speaking if a safety circuit meets IEC or EN standards it will satisfy these standards also.
The drawings above are purposely generic but most safety relays will have at least these contacts. Note that the safety relay on the right has a set of timed contacts for servos; the idea here is to allow time for a stop command to bring an axis to a controlled halt before removing holding torque from the axis. Additional hardwired measures such as a brake or shot pin may be employed if necessary since the stop command is still considered a software measure.