The Press Is Running. Can You Explain How It Stops?

There is a 400-ton straight-side stamping press in a shop outside Detroit that has been running 16 hours a day for 19 years. It stamps automotive brackets at 14 strokes per minute. The SLC-500 1747-L551 in the press control cabinet handles all the safety interlocks: two-hand anti-tie-down, light curtain muting, tonnage monitoring, top stop, and die protection.

The press has never had a serious incident. The safety circuits work. The operators trust the system.

But the OSHA compliance officer standing in front of the press is not asking whether the safety circuits work. She is asking whether you can document how they work. What is the anti-tie-down timing? What is the top-stop angle? What tonnage threshold triggers an overload stop? What conditions allow the light curtains to be muted during die closure?

The plant safety manager looks at the SLC-500 and realizes that the integrator who programmed it closed his shop in 2015. The RSLogix 500 license is on a Windows XP machine in the maintenance office that has not been booted in three years. Nobody currently on staff has ever opened the program.

OSHA 29 CFR 1910.217 is specific about mechanical power press safety requirements. And increasingly, OSHA compliance officers are asking not just "do you have safety devices" but "can you document the logic that controls them."

OSHA 1910.217: What the Standard Actually Requires

The OSHA standard for mechanical power presses (29 CFR 1910.217) covers everything from point-of-operation guarding to brake monitoring. For PLC-controlled presses, the relevant sections are:

1910.217(b)(7) — Control systems: Press control systems must be designed to prevent unintended strokes. Single-stroke mechanisms must return the slide to the top of stroke if the operator removes their hands from the controls before the die closes. The anti-tie-down circuit must require release and re-actuation of both controls for each stroke.

1910.217(b)(13) — Slide counterbalance systems: If the press uses counterbalance springs or air cylinders, the counterbalance must be maintained to prevent the slide from drifting down when the clutch is disengaged.

1910.217(c)(3) — Two-hand controls: Two-hand controls must require concurrent actuation (both hands within 0.5 seconds of each other) and must be anti-tie-down (releasing either control during the stroke must stop the press before the die closes).

1910.217(c)(5) — Presence-sensing devices: Light curtains and other presence-sensing devices must interrupt the stroke when the sensing field is broken. Blanking (allowing objects through the field without stopping the press) must be documented and limited.

1910.217(e)(1) — Tonnage monitoring: For presses equipped with tonnage monitors, the monitoring system must stop the press when tonnage exceeds the capacity rating or the preset limit.

1910.217(h) — Periodic inspection: Press safety systems must be inspected and tested at intervals not exceeding one year. Records of inspections must be maintained.

Every one of these requirements has a corresponding implementation in the PLC program. The two-hand anti-tie-down timing, the light curtain response, the tonnage overload threshold, the top-stop position — they are all ladder logic rungs with specific timer presets, comparison values, and interlock conditions.

Two-Hand Anti-Tie-Down: The Logic That Saves Hands

The two-hand anti-tie-down circuit is the most fundamental press safety device. Its purpose is simple: ensure that both of the operator's hands are on the palm buttons and away from the point of operation when the press strokes.

The requirements are:

1. Both palm buttons must be pressed within 0.5 seconds of each other (concurrent actuation)
2. Both palm buttons must remain held during the entire downstroke
3. Releasing either button during the downstroke must stop the press before the die closes (top-stop)
4. Both buttons must be released and re-pressed for each subsequent stroke (anti-tie-down)
5. Blocking or tying down a palm button must not allow single-hand operation

In an SLC-500, this is typically implemented with three timers and several internal bits:

RUNG: Concurrent Actuation Check
  XIC  Left_Palm_Button    I:1/0
  TON  T4:0  0.5s               — Start 500ms window timer

RUNG: Concurrent Window Check
  XIC  T4:0/TT                  — Timer is timing (window is open)
  XIC  Right_Palm_Button   I:1/1
  OTL  Both_Pressed_In_Window   B3:0/0

RUNG: Anti-Tie-Down Check
  XIO  Left_Palm_Button    I:1/0  — Left must have been released
  XIO  Right_Palm_Button   I:1/1  — Right must have been released
  OTL  Buttons_Released         B3:0/1

RUNG: Stroke Permissive
  XIC  Both_Pressed_In_Window   B3:0/0
  XIC  Buttons_Released         B3:0/1  — Must release between strokes
  XIC  Top_Of_Stroke            I:1/4   — Press must be at top
  XIC  Die_Protection_OK        B3:0/5
  XIC  Tonnage_OK               B3:0/6
  OTE  Clutch_Engage            O:2/0

RUNG: Top-Stop on Release
  XIO  Left_Palm_Button    I:1/0  — Either button released
  BST
  XIO  Right_Palm_Button   I:1/1
  NXB  BND
  XIC  Clutch_Engaged           B3:0/7  — Only during active stroke
  OTE  Top_Stop_Command         O:2/1   — Command immediate stop

The 0.5-second concurrent actuation window, the anti-tie-down release requirement, and the top-stop-on-release logic are all OSHA requirements implemented in ladder. The timer preset (T4:0 preset = 500), the specific input addresses (I:1/0, I:1/1), and the output addresses (O:2/0 clutch, O:2/1 top-stop) are the documentation an OSHA inspector needs to see.

If you cannot produce this documentation — if you cannot show the inspector which timer controls the concurrent window and what its preset is — you have a citation.

Tonnage Monitoring: Detecting Problems Before They Become Disasters

A tonnage monitor measures the force exerted by the press during each stroke. The force profile over the stroke (tonnage vs. crank angle) is a signature that reveals the health of the die, the material, and the press itself.

Normal operation produces a consistent tonnage profile: force builds as the punch enters the material, peaks at full engagement, and drops as the punch retracts. Abnormalities in this profile indicate:

• Overload: Tonnage exceeds the press capacity or the die rating. This can crack the frame, break the die, or cause a catastrophic structural failure.
• Slug pull: A piece of scrap material is pulled upward by the punch on retraction, doubling the force on the next stroke. Shows as a secondary tonnage spike on the upstroke.
• Misaligned die: Tonnage is higher on one side than the other, indicating the die is not seated properly or the ram is tilting.
• Material variation: Tonnage is consistently higher or lower than baseline, indicating a change in material thickness, hardness, or temper.

The tonnage monitor hardware (strain links on the press frame connections, a signal conditioning module, and a high-speed analog input to the PLC) is the sensing side. The PLC program does the analysis.

In an SLC-500 press controller, tonnage monitoring typically works like this:

1. A high-speed analog input (1746-NI16I or similar) samples the strain link signal at a rate synchronized to the crank rotation
2. The program reads the analog value at specific crank angle positions (using a resolver or encoder input)
3. The peak tonnage per stroke is compared to a setpoint (the overload threshold)
4. If peak tonnage exceeds the threshold, the press is commanded to stop at top dead center
5. A tonnage fault bit is set and latched until manually acknowledged

The overload threshold is the critical parameter. It is typically set to 80-90% of the press capacity rating (for a 400-ton press, the overload setpoint might be 340 tons). But this value lives in an integer register in the SLC-500 — N7:42 or wherever the integrator put it — and if you do not know where it is or what it is set to, you cannot verify it.

Worse: if someone changed it. A common pattern in stamping shops is that a die setter encounters an overload fault, cannot figure out why, and increases the tonnage threshold to make the fault go away. The die keeps running, the press keeps running, and now the overload protection is effectively disabled because the threshold is set above the press capacity.

The only way to catch this is to read the PLC program, find the tonnage comparison rung, and verify the setpoint.

Light Curtain Muting: The Most Misunderstood Safety Function

Light curtains (AOPD — Active Opto-electronic Protective Devices) protect the point of operation by detecting when a hand or body enters the die area. When the light curtain beam is broken, the press stops.

But there is a problem: the stamped part and the transfer mechanism also break the light curtain beam during normal operation. If the light curtain stopped the press every time a part ejected through the sensing field, the press could never run.

The solution is muting — temporarily suspending the light curtain's stop function during specific portions of the stroke cycle when the die is closed and the point of operation is not accessible. Muting is implemented in the PLC and it is the single most audit-sensitive safety function in a press control system.

OSHA and ANSI B11.1 have specific requirements for muting:

1. Muting is only permitted during the portion of the stroke where the opening between the dies is less than the minimum safety distance (typically 6mm or 1/4 inch). This is calculated from the crank angle and the die geometry.
2. Muting must be activated by position (crank angle), not by time. A timer-based mute that approximates the closed portion of the stroke is not compliant.
3. The muting function must be supervised. If the crank angle sensor fails, muting must be disabled (light curtain remains active at all times).
4. Entry into the muting window must be verified. If the light curtain detects presence before the muting window opens, the press must stop even if the crank angle subsequently enters the muting zone.

In an SLC-500, muting logic typically reads a crank angle encoder (1746-HSCE or discrete cam switch inputs) and activates a muting relay:

RUNG: Muting Window (Die Closed Zone)
  GRT  Crank_Angle  N7:10  180    — Past bottom dead center (180 deg)
  LES  Crank_Angle  N7:10  340    — Before die opens (340 deg)
  XIO  Light_Curtain_Broken_Before_Mute  B3:1/0  — No pre-existing intrusion
  XIC  Encoder_Healthy              B3:1/1
  OTE  Muting_Active                O:3/0  — Muting relay energized

RUNG: Pre-Mute Intrusion Latch
  XIC  Light_Curtain_Broken    I:1/8
  XIO  Muting_Active           O:3/0
  OTL  Light_Curtain_Broken_Before_Mute  B3:1/0

RUNG: Clear Pre-Mute Latch at Top
  GRT  Crank_Angle  N7:10  350
  LES  Crank_Angle  N7:10  10    — Top dead center zone
  OTU  Light_Curtain_Broken_Before_Mute  B3:1/0

The muting window angles (180 to 340 degrees in this example) are specific to the die and the press. Different dies with different shut heights have different muting windows. If the muting window is too wide, the light curtain is inactive when the operator could reach the point of operation. If it is too narrow, the press stops on every stroke because the part ejection breaks the beam outside the muting window.

An OSHA inspector who understands press safety will ask to see the muting logic. They will ask what the muting window angles are and how they were determined. They will ask whether the muting function is supervised (what happens if the encoder fails). They will ask whether pre-mute intrusion detection is implemented.

Die Protection: The Interlock Chain

Die protection refers to the sensors in and around the die that verify proper conditions before allowing the next stroke. Common die protection sensors include:

• Part-out sensor: Verifies that the stamped part has ejected from the die before the next stroke. Prevents double-hits that damage the die and produce scrap.
• Stock feed sensor: Verifies that the strip has advanced the correct distance (feed length) before the next stroke. Prevents short feeds that produce scrap and can damage the die.
• Mislocate sensor: Verifies that the strip is properly positioned (pilot pins engaged) before the next stroke. Prevents misaligned hits.
• Stock buckle sensor: Detects if the strip has buckled between the feeder and the die. Prevents jams that can damage the die and the feeder.

Die protection is typically implemented on a separate SLC-500 (or on a dedicated die protection unit like a Wintriss DiProPSG or a Link Systems Guardian) that communicates with the press control PLC via hardwired discrete signals.

The interlock chain runs through both PLCs:

Die Protection PLC:
  XIC  Part_Out_Sensor      — Part has ejected
  XIC  Feed_Complete         — Strip has advanced
  XIC  Pilot_Located         — Strip is positioned
  XIO  Stock_Buckle          — No buckle detected
  OTE  Die_Protect_OK        — Output to press control PLC

Press Control PLC:
  XIC  Die_Protect_OK   I:1/6    — From die protection PLC
  XIC  Two_Hand_OK       B3:0/0
  XIC  Tonnage_OK        B3:0/6
  XIC  Light_Curtain_OK  B3:1/2
  OTE  Stroke_Permitted  B3:0/8

When OSHA inspects, they trace the entire interlock chain: from the die protection sensor, through the die protection PLC, across the hardwired connection, into the press control PLC, and to the clutch engage output. Every element in that chain must be documented. A missing link — an undocumented condition in either PLC — is a citation.

Why SLC-500 Press Controllers Need Documentation Before Migration

There is a practical urgency beyond compliance: the SLC-500 is end-of-life. Rockwell stopped manufacturing the 1747-L551 in 2018. Replacement processors on the secondary market cost $2,000-3,000 (they were $800 new). 1746-series I/O modules are getting scarce. The 1747-CP3 programming cable requires a serial port that modern computers do not have.

Every stamping shop with an SLC-500 press controller is going to migrate eventually — to CompactGuardLogix (1769-L33ERS, 1769-L36ERS) or ControlLogix with GuardLogix safety (1756-L73S). The question is whether they migrate proactively or reactively (when the processor fails and they cannot find a replacement).

A reactive migration of a press safety system is dangerous. Without documentation of the existing safety logic, the new program is written from scratch based on the programmer's understanding of press safety requirements — not based on what the existing system actually does. This introduces two risks:

1. Missing safety functions: The original integrator may have implemented safety functions that are not obvious from the OSHA standard alone. Edge cases, machine-specific interlocks, and failure response logic that was developed through years of operational experience gets lost.

2. Changed behavior: Even if all safety functions are re-implemented, subtle differences in timing, sequencing, or fault response can change how the press behaves. Operators who have relied on specific behaviors for years (e.g., the press always stops at exactly 15 degrees past top dead center on a top-stop command) suddenly have a machine that behaves differently.

The documentation-first migration path avoids both risks:

1. Upload the existing SLC-500 program and generate complete documentation
2. Identify every safety function, its implementation, and its parameters
3. Write a functional specification for the new system based on the documented behavior
4. Implement the new program on CompactGuardLogix
5. Test the new system against the functional specification
6. Verify that behavior matches the documented behavior of the old system

Step 1 — documenting the existing program — is the foundation for everything that follows. Without it, you are guessing.

Practical Steps for Stamping Shops

If you have SLC-500 press controllers and an OSHA inspection is on the horizon (or even if it is not), here is what to do:

Step 1: Back up every press control PLC. Connect to each SLC-500 and save the .RSS file. If you do not have RSLogix 500, your local Rockwell distributor can do this for a few hundred dollars. This is money well spent.

Step 2: Document the safety logic. Upload each program to a PLC analysis tool and generate the I/O map, safety interlock documentation, and parameter list. Identify the two-hand timing values, tonnage thresholds, muting window angles, and die protection interlock chain.

Step 3: Verify the parameters. Compare the documented parameters to OSHA requirements and to the press manufacturer's specifications. Is the concurrent actuation window actually 0.5 seconds or less? Is the tonnage threshold below the press capacity rating? Is the muting window correct for the installed dies?

Step 4: Create a compliance file. For each press, assemble the I/O map, safety logic description, parameter verification, and most recent annual inspection records in a single file. This is what you hand to the OSHA inspector.

Step 5: Plan the migration. With documentation in hand, develop a migration plan for each press. Prioritize by risk: the press with the oldest processor, the fewest spare parts, and the most complex safety logic gets migrated first.

The documentation phase (Steps 1-4) can be completed in weeks, not months. The migration phase (Step 5) is a longer-term capital project, but the documentation gives you the foundation to plan it properly and execute it safely.

Get Started

Upload your SLC-500 press control program to Controls Foundry for free instant analysis. We will parse the ladder logic, map the safety interlocks, extract the tonnage thresholds and muting parameters, and give you an OSHA-ready documentation package.

No RSLogix 500 license required. No controls integrator visit. Just upload the file and get answers.

Upload your PLC program to Controls Foundry