The 843ES Safety Encoder: SIL 3 Feedback on the Network You Already Have

Safe speed, direction, and position monitoring has always been more of an architecture problem than a sensing problem. The feedback device is straightforward; getting a safety-rated signal off a rotating shaft and into something that can act on it is where the cost shows up. A dedicated safety encoder, a separate monitoring module to interpret it, its own home-run wiring, and a second validation effort layered on top of the standard control system — two feedback paths for the same shaft, and a panel big enough to hold both.

The Allen-Bradley 843ES safety encoder collapses that. It puts safety-rated feedback directly on EtherNet/IP using CIP Safety, so the same GuardLogix controller running your standard logic consumes position, velocity, and acceleration from the same device, over the same wire, in the same Studio 5000 project. Rockwell positions it as the first and only encoder on the market with CIP Safety over EtherNet/IP rated up to and including SIL 3/PLe.

Auxiliary Feedback, Straight Into the Safety Task

The mechanism worth understanding is what the 843ES replaces. Drive safety functions defined in IEC 61800-5-2 — safely-limited speed, safe direction, safely-limited position — need a trustworthy feedback source, and in a conventional architecture that means separate hardware whose only job is to validate the encoder signal before a safety output acts on it. The 843ES provides that auxiliary feedback directly through EtherNet/IP on CIP Safety, so the advanced drive safety instructions already available in the controller consume it without intermediate hardware. Fewer components in the safety chain isn’t just a BOM argument; it’s fewer things to fail and fewer things to verify during validation.

Practically, you get two connections from one device: a standard connection carrying position, velocity, and acceleration to your standard task, and a safety connection feeding the safety task — both on the same physical network as your motion and I/O traffic.

Specifications in Context

What the Dual Ports Buy You

The embedded switch is easy to skim past, but it changes how you lay out a machine. Two ports let you daisy-chain devices in a linear topology or close the loop into a Device Level Ring, giving you media redundancy without dedicating switch ports to every encoder. On a long conveyor line or a multi-station web handling system, that’s the difference between one homerun per zone and one per device.

Because safety and standard data share the same EtherNet/IP network, you also get zone control: a safety event in one section brings that zone to a safe state while the rest of the machine keeps running, because the standard system has full visibility into what the safety system just did. That same visibility shortens diagnosis — safety events show up where maintenance already looks.

Three Safety Functions, Three Real Machines

Rockwell’s application material maps the 843ES onto three patterns worth recognizing:

• Conveyor — Safely-Limited Speed (SLS). A SafeZone area scanner detects a person entering the warning field and the system monitors conveyor speed against a safe limit. If the conveyor is already at or under the limit when the person crosses into the safety zone, STO is suspended and the conveyor keeps running. Production continues instead of stopping.
• Print roll cleaning — SLS plus Safe Direction (SDI). Operators cleaning rolls need the machine moving, but only slowly and only one way. The 843ES monitors both speed and direction so operation is permitted only in the safe direction, protecting against running nip points while an idler roll maintains pressure.
• Vertical lift / hoist — Safely-Limited Position (SLP). The encoder monitors lift position against a predefined safe state and determines when it’s safe to engage the mechanical brakes — position integrity for a suspended load, exactly the case where a single non-safety-rated feedback path isn’t defensible.

The common thread: all three keep the machine productive through a condition that would otherwise trigger a full stop.

Mechanical Options and Catalog Numbers

The 843ES uses a structured catalog number, built as 843ES + turns + IP + shaft + BA + flange:

Blind-hollow shaft versions are available with a stator coupling, and the feather-key solid shafts prevent relative rotation. Cordsets are standard Allen-Bradley 889D 4-pin M12 A-code for power (braided shield or foil-and-braided, straight or right angle, male or flying leads) and 1585D M12 D-code for Ethernet, including an M12-to-RJ45 option (1585D-M4UBJM-2) for panel terminations.

Where the 843ES Fits — and Where It Doesn’t

This is a strong fit if you’re an OEM or integrator building on GuardLogix, adding drive safety functions to an existing machine, or working toward a SIL 3 / PLe requirement in entertainment, material handling, metals and mining, automotive and tire, or converting, print, and web. Retrofits are a particularly good case: you’re adding a safety function to a machine that already has an EtherNet/IP backbone, and the encoder drops onto it.

It’s a weaker fit if your architecture isn’t Rockwell. The 843ES depends on a GuardLogix 5580ES or Compact GuardLogix 5380ES and Studio 5000 v31 or later — this is an Integrated Architecture play, not a protocol-agnostic safety encoder. It’s also worth confirming the 6 ms safety RPI against your reaction time budget on fast-moving axes before you commit to the design.

Talk Through the Application First

Safety encoders are one of those products where the specification conversation matters more than the datasheet. Shaft and flange choice, the resolution you actually need at the safety channel, and how the 6 ms safety connection fits your total reaction time all depend on the machine.