Soft Limits, Hard Stops and Overtravel Protection on Stone CNC

Every stone machining centre carries several independent systems that exist to stop an axis before it reaches somewhere it should not go. Soft limits live in the control software. Hard limit switches live on the machine structure. Mechanical stops live at the end of the rails. Following error monitoring watches the gap between what the control commanded and what the encoder reports. Most operators can name one or two of these, and very few shops verify all of them on a schedule. The consequence is that a machine can run for a year with two of its four protection layers quietly out of service and nobody knows until the day the first one is needed.

This guide explains what each layer does, what it depends on, how they are commissioned and how they are verified. It also covers what to do after an overtravel event, because the recovery procedure is where most secondary damage happens: an operator faced with a faulted axis and a red screen will often try the fastest-looking way out and make matters considerably worse. The material applies to bridge saws with numerical control, machining centres, waterjet tables and automated handling equipment, all of which share the same basic protection architecture regardless of which control brand is fitted.

The Four Layers and What Each One Depends On

Soft limits are position boundaries enforced by the control. The control compares the commanded position against a stored travel envelope and decelerates the axis to a controlled stop before it reaches the boundary, without any hardware involvement at all. That is their great virtue: a soft limit stop is smooth, does not shock the mechanics and does not leave the machine in a fault condition that requires special handling. It is also their great weakness, because a soft limit is only meaningful if the control knows where the axis actually is.

That dependency is the single most important thing to understand about soft limits. They require a valid reference, established by homing the machine at power-up against a home switch, an encoder marker or an absolute feedback device. Until the axis is referenced, the control has no trustworthy position, so the soft limits either cannot be applied or are applied against a false origin. An axis that is jogged before homing, or one whose reference has been corrupted, has effectively no software protection even though the parameters are still sitting in the control exactly as they were.

Hard limits are physical switches placed near the ends of travel. Depending on the design, actuating one either signals the control to fault and stop the axis, or directly interrupts drive enable or power. They are the backstop for soft limits and they work regardless of whether the machine is referenced, which is exactly why they exist. Their weakness is that they are physical devices mounted in a wet, abrasive environment, exposed to slurry, vibration and the occasional impact from a slab or a forklift, and a damaged switch gives no indication until it is called upon.

Mechanical hard stops are the last resort: a block, a bumper or a structural feature that physically prevents the carriage from leaving the rail. They are the only layer that cannot fail electrically, and they are also the only one whose activation normally means damage has occurred. A well-designed machine places them beyond the limit switches with enough margin to absorb the axis decelerating from its maximum jog rate. Reaching a hard stop is a reportable event rather than a routine occurrence, and it should always trigger an inspection.

Why Crashes Actually Happen

Reference and offset errors

The most common crash on a stone machining centre has nothing to do with worn hardware. It comes from a mismatch between where the control thinks the part and the tool are and where they really are. A work offset entered for the wrong fixture position, a tool length offset left from the previous tool, a program posted for a different machine or a slab set down a few inches from where the probe expected it will all send an axis confidently into something solid. The protection layers are working correctly; they simply were never asked to stop a move that was inside the legal envelope.

Following error monitoring is the layer that catches many of these. The control continuously compares the commanded position with the encoder feedback, and it faults when the difference exceeds a configured threshold. A tool driven into unyielding material creates exactly that divergence, and a correctly tuned threshold will fault the axis quickly. The problem is that thresholds get widened during commissioning to stop nuisance alarms, and a threshold set generously enough to never complain is also set generously enough to let a collision develop before it reacts.

Mechanical causes that mimic control faults

Lost motion in the drive train produces the same symptom from a different cause. Backlash in a coupling between motor and ballscrew, a worn ballscrew nut, a loose pulley or bearing play all mean the axis does not go exactly where the motor says it went. On a semi-closed loop machine the control cannot see that error directly, and it accumulates. Recognised causes of excessive following error include coupling backlash adding lost motion that the loop reads as error, and control supply voltage sagging during peak current draw and browning out the drive logic.

Backlash compensation masks the symptom without fixing the cause, and that is worth stating plainly. Compensation instructs the control to add a correction on direction reversals, which restores dimensional accuracy for a while, but it does nothing about the wear that created the lost motion and it hides a trend that should be visible. If compensation values need increasing every few months, the machine is telling you a mechanical component is failing. Track those values over time and treat a rising trend as a maintenance signal rather than a routine adjustment.

The table below summarises the layers, what each one relies on, and how each one fails. Read it as an argument for verifying all of them rather than trusting any single one, because each layer covers the specific gaps left by the others and none of them is complete on its own.

Guarding, Safety Circuits and Operator Access

Overtravel protection and operator protection overlap but are not the same thing. Limit switches protect the machine from itself; guards and interlocks protect people from the machine. In the United States the general machine guarding requirement is that the point of operation of a machine whose operation exposes an employee to injury must be guarded, and the guarding must prevent the operator from having any part of the body in the danger zone during the operating cycle. That obligation applies to a stone machining centre exactly as it applies to any other production machine.

The consensus standard that describes how a guard should perform is the machine safety series covering safeguarding, which sets out requirements for the design, construction, installation, operation and maintenance of guards, safeguarding devices and awareness devices. Inspectors commonly use it as the benchmark for what adequate guarding looks like even when a citation is written against the general regulation. Fixed barrier guards that require a tool to remove are the highest-reliability option where the operator does not need access during normal operation; interlocked guards belong on access points that are opened routinely.

Interlock defeat is endemic in stone shops and it deserves a direct warning. Machines that run wet get opened frequently for cleaning, blade changes and clearing offcuts, and an interlock that stops production is a tempting target for a magnet or a taped-down switch. A defeated interlock removes the layer specifically intended to stop an axis while a person is inside the envelope. Treat any evidence of interlock tampering as a serious finding, investigate why the operator felt it was necessary, and fix the underlying workflow problem rather than simply restoring the switch.

Emergency stop is a complementary function, not a substitute for guarding. It gives an operator a way to remove power quickly once something has already gone wrong, and it must be reachable from every position an operator normally occupies, including the far end of a long bridge saw table. Test emergency stop circuits on a schedule and confirm that each button actually removes power from the axes rather than merely signalling the control, which is a distinction that surprises people during their first real incident.

Overtravel Recovery Without Making It Worse

When an axis trips a hard limit, stop and think before touching anything. The axis is sitting past a boundary and the control is generally inhibiting motion in the direction that caused the fault. Most controls provide an overtravel release function, often a key switch or a screen selection, which temporarily suspends the limit so the axis can be jogged back into the envelope. Use that function, jog slowly, and move only in the direction that reduces the overtravel. Moving further out because the jog direction was guessed wrongly is the most common way a limit trip becomes structural damage.

Keep a short written procedure at the machine so the recovery sequence does not depend on who happens to be on shift. Three or four numbered steps are enough: stop and identify which axis and which direction faulted, engage the overtravel release, jog slowly back into the envelope, then re-home and re-verify offsets before any program is run. Operators under pressure improvise, and improvisation around a faulted axis is expensive. A laminated card taped inside the control cabinet door costs nothing and consistently prevents the second, larger failure that follows the first.

After recovery, re-establish reference before running anything. An overtravel event, and particularly a collision, can shift a position that the control still believes is valid. Re-home every axis, verify the work offset against a known feature with an indicator or a probe, and confirm tool length offsets rather than assuming they survived. If the machine has an absolute feedback system, the reference may be retained, but it is still worth proving against a physical feature rather than trusting the display after an impact.

Inspect the mechanics before returning the machine to production. Check the rail and carriage for damage, the way covers and bellows for tears that will admit slurry, the ballscrew or rack for scoring, and the limit switch and its actuator for deformation from the impact. A switch that stopped an axis violently may have been bent out of position, which quietly moves the boundary it defines. Log the event with date, axis, cause and corrective action, because a pattern of overtravel events on one axis is diagnostic information about that axis.

Commissioning and periodic verification close the loop. At installation, confirm soft limit values against measured physical travel with the actual fixturing in place, confirm that each limit switch actuates before the mechanical stop with adequate margin, and confirm that following error thresholds are tight enough to be useful. Then repeat an abbreviated version of that verification on a defined interval, after any collision, and after any maintenance that disturbs a switch, a cover, a coupling or a control parameter. Verification is inexpensive; discovering a dead protection layer during an incident is not.

Tooling condition is part of crash prevention, because a dull or damaged tool raises cutting forces and pushes an axis toward the following error threshold long before anything visible happens. Our catalog of stone fabrication tooling and equipment includes machining centre consumables such as thin wall core bits for numerically controlled machines, and using tooling rated for the material you are actually cutting keeps spindle loads, axis loads and cycle times predictable. Engineered stone and sintered materials in particular require diamond tooling specified for them.