Machine safety logic scales with risk, and Schneider's Preventa range organizes the scaling into three recognizable tiers: the XPSCM single-beam monitor for a guarded point, the XPS modular safety controllers for multi-device circuits, and the Harmony XPS platform when the safety architecture becomes a system. The selection discipline is the risk assessment's output — performance level and architecture — not catalog enthusiasm.
XPSCM: one beam, one decision
The single-beam monitor watches exactly one photoelectric barrier and drives the contactor path — the minimal honest answer for a single guarded access point on a press or a simple machine. Its virtue is auditability: one device, one function, testable in minutes. Its limit is equally plain: two beams already need more logic than it owns.
XPS modular: the multi-device middle
The XPS modular safety controllers take E-stops, gate switches, light curtains and two-hand controls into one safety relay architecture with category-appropriate monitoring — dual-channel circuits, discrepancy timing, contactor feedback. This is the tier most machines actually need: several safety inputs, a structured output path, and a configuration a machine builder certifies once and repeats per machine.
Harmony XPS: the platform tier
Where safety becomes a plant architecture — zones, muting, diagnostics reporting upward, integrated displays — the Harmony XPS platform carries the function with configuration depth and network presence. It is the tier that talks to the line's controller as a peer rather than as a set of contacts.
The decision rule
Count safety functions, not devices: one guarded point — XPSCM; several interlocked functions on one machine — XPS modular; line-level architecture with diagnostics and integration — Harmony XPS. Escalate by the risk assessment, and stop escalating when the assessment stops asking.
Can a modular XPS replace a safety PLC?
For fixed, certified machine logic, yes — modular controllers carry performance levels to the machines' assessments. A safety PLC earns its keep where logic changes frequently or line-wide coordination lives in the safety layer; that is a different problem class.
Why does contactor feedback keep failing audits?
Because welded contacts are the classic silent failure — the safety output commands off, but the contactor never opened. Monitored feedback (mirrored contacts into the safety module) is what turns "off command sent" into "off verified," and auditors read exactly that difference.
