Safety Relays

What is a Safety Relay

A safety relay, more precisely a safety monitoring relay or safety relay module, is an electromechanical or hybrid device that monitors a safety input (emergency stop, safety gate switch, light curtain, two-hand control or safety mat) and, on demand, removes power from the machine actuators through redundant, force-guided contacts. It is the implementation layer of a safety-related part of a control system, sitting between the safety sensor and the final switching element such as a contactor or drive enable. Its defining property is that it monitors itself: the device continuously checks that its own internal relays and its external wiring are healthy, and it will not enable its outputs unless every channel agrees.

The distinction from an ordinary control relay is fundamental and is the reason a separate product category exists. A standard relay has independent contacts and no internal diagnostics, so a single welded or stuck contact can silently defeat a stop function with no outward sign. A safety relay is built from force-guided (mechanically linked) relays per EN 50205, packages two of them in a redundant arrangement, runs a self-test pulse on every on-off cycle, and reads back the state of the downstream contactors through an external feedback loop before it allows a restart. This combination of redundancy, self-monitoring and diagnostic coverage is what lets it carry a Performance Level (PL) or Safety Integrity Level (SIL) rating, which a general-purpose relay can never claim.

Functionally, a typical unit exposes a recognizable terminal set: A1 and A2 for the supply, S11/S12 and S21/S22 for the two safety input channels, S33/S34 (or Y1/Y2) for the reset and external device monitoring loop, and numbered output contacts such as 13/14, 23/24 and 33/34 for normally open safety contacts plus 41/42 for a normally closed signal contact. When both input channels are made and the feedback loop is healthy, the internal relays pick up, the safety outputs close, and the machine is allowed to run. When the input opens, both channels drop, the outputs open within milliseconds, and the machine is commanded to stop.

Historically, machine safety moved from single hardwired contacts, through purpose-built force-guided relay logic in the 1980s, to the integrated safety relay module pioneered by Pilz with the PNOZ in 1987, the first device to combine redundancy, self-monitoring and a compact DIN-rail format. The harmonized standards followed: EN 954-1 introduced the architectural Categories B, 1, 2, 3 and 4 in 1996, and these were superseded by EN ISO 13849-1 with quantitative Performance Levels in 2006 and the parallel IEC/EN 62061 SIL framework. Today configurable and software-parameterizable modules, such as the Siemens 3SK2, sit alongside fully programmable safety controllers, but the discrete safety relay remains the most common and most auditable solution for simple machines.

Four engineering attributes determine whether a safety relay is fit for a given machine: the required Performance Level or SIL it must support, the stop category it must execute (instantaneous or delayed), the number and rating of its output contacts, and whether it provides external device monitoring for the downstream contactors. Get these four right and the rest of the selection is detail. Get one wrong, and the installed safety function will not actually achieve the Performance Level the risk assessment demanded, even if every component is individually certified.

Safety Relay Types and Functions

Safety relays divide along two axes: by the safety function they monitor, and by their internal switching technology and configurability. The function defines what sensor the relay expects and what logic it runs; the technology defines contact life, switching speed and how many functions one device can handle. Mixing these axes up is a common procurement error, because a module that is perfect for one E-STOP cannot be stretched to coordinate a ten-zone line. The table below classifies the mainstream device types by configurability and typical scope.

Single-function safety relays are the most common and the easiest to audit. One module monitors one E-STOP loop or one interlocked gate and switches two or three safety outputs. There is no software, the wiring diagram is on the side of the unit, and a third-party assessor can verify the whole function by inspection. The Pilz PNOZ X classic range and the base modules of the PNOZsigma PNOZ s family, the Siemens SIRIUS 3SK1, and the Rockwell Guardmaster MSR127 all serve this role. Their limit is scale: every added function means another module, more wiring, and a more complex reset scheme.

Solid-state safety relays replace the output relay contacts with self-tested semiconductor outputs, called OSSDs (output signal switching devices). They have no contacts to wear, so cycle life is effectively unlimited and switching is fast, which suits high-frequency duties such as muting and presence sensing. The trade-off is that solid-state outputs cannot switch large or highly inductive loads directly and usually drive external contactors. The Omron G9SE and the solid-state members of the PNOZsigma range are representative.

Configurable safety relays, such as the Siemens 3SK2, bridge the gap to a full controller. One base device, sometimes expanded with output modules, implements five to fifteen functions selected by DIP switch or by parameterization software, without the cost, validation burden or training of a safety PLC. They are the pragmatic choice for a mid-size machine that has outgrown a handful of discrete relays but does not need networked safety. Above roughly fifteen functions, when zones must be coordinated and diagnostics fed onto a PROFIsafe or CIP Safety network, a programmable safety controller is justified, and the discrete relay gives way to the safety PLC.

By function, the same device families cover E-STOP monitoring, safety gate and interlock monitoring, light-curtain and laser-scanner (OSSD) monitoring, two-hand control to the categories of ISO 13851, speed and standstill monitoring, and safety mat or edge monitoring. A two-hand control relay, for example, additionally enforces a synchronous-actuation time window of typically 0.5 s between the two buttons, a logic an E-STOP relay does not contain. This is why the function, not just the rating, has to match the sensor.

Force-Guided Contacts and Architecture

The technology that makes a relay a safety relay is the force-guided, or mechanically linked, contact set defined by EN 50205. In a force-guided relay the normally open (make) and normally closed (break) contacts are joined by a rigid mechanical carrier, so they are physically prevented from ever both being closed at the same time. EN 50205 sets the acceptance criterion quantitatively: if any normally open contact welds shut, the linked normally closed contacts must remain open by at least 0.5 mm for the entire life of the relay. This single guarantee is the foundation of contact-fault detection: a normally closed mirror contact that is forced open whenever the safety output is closed gives the monitoring circuit a trustworthy readback.

EN 50205 distinguishes construction classes. In a Type A relay all contacts are force-guided to each other; in a Type B relay at least one contact is force-guided while others may be standard, which is acceptable where only specific contacts carry the safety function. For machine safety duties the relevant property is simply that the safety output contacts and the mirror contact are force-guided as a set, so the open state of the mirror reliably proves the open state of the output. An ordinary relay offers no such linkage, which is why parallel or series contacts on a standard relay cannot substitute for one force-guided device.

The second pillar is the dual-channel, self-monitoring architecture. A safety relay module contains two internal force-guided relays driven by two independent input channels (S11/S12 and S21/S22). The device cross-monitors the two channels: if one channel opens and the other does not within the expected window, or if the discrepancy persists, the module faults and refuses to enable. Modern units also output test pulses on the input lines so that a cross-fault, a short between the two channels or a short to 24 V, is detected and treated as a demand. On every on-off cycle the module verifies that both internal relays actually changed state, which is the per-cycle self-test that ordinary relays lack.

The third pillar is external device monitoring (EDM), the feedback loop that extends diagnostic coverage from inside the relay out to the final contactors. The normally closed mirror contacts of the two downstream power contactors are wired in series into a feedback input (commonly Y1-Y2 or routed through S33/S34). Before the relay will re-enable after a stop, it checks that these mirror contacts are closed, proving the contactors genuinely dropped out. If a power contactor welds, its mirror stays open, the EDM check fails, and the relay will not reset. Without EDM, a welded downstream contactor would go undetected and the machine could restart with the hazard live; EDM is therefore required to reach Category 4 and Performance Level e. The table below maps the architectural Categories of EN ISO 13849-1 to their structural requirements and achievable Performance Level.

A single safety relay can support different Categories depending on how it is wired: a dual-channel E-STOP with cross-monitoring and EDM realizes Category 4, whereas the same module fed from one channel only realizes at most Category 1. This is the most under-appreciated point in selection: the device certification states the highest Category and PL the module can reach, but the achieved Category is set by the installed wiring and the quality of the sensor and contactors around it.

Stop Categories, PL and SIL Standards

Two different families of standards govern safety relays, and confusing them is the most frequent specification mistake. The first family defines how the machine stops: IEC/EN 60204-1 specifies three stop categories, and ISO 13850 governs the emergency stop function itself. The second family defines how reliably the safety function works: EN ISO 13849-1 with its Performance Levels and architectural Categories, and IEC/EN 62061 with its Safety Integrity Levels, both derived from the base standard IEC 61508. Note that the word "Category" appears in both families with completely different meanings: a stop category is about power removal, an architectural Category is about fault tolerance.

Stop categories (IEC/EN 60204-1). Stop Category 0 is an uncontrolled stop achieved by the immediate removal of power to the machine actuators, so the machine coasts to rest under friction or gravity; an instantaneous E-STOP relay performs this directly. Stop Category 1 is a controlled stop in which power remains available to brake the motion in a controlled way and is then removed once standstill is reached, which requires a delay-on de-energization safety relay timing the power cutoff. Stop Category 2 is a controlled stop in which power is not removed when standstill is reached. ISO 13850 permits only Stop Category 0 or Category 1 for an emergency stop function, never Category 2.

Performance Level (EN ISO 13849-1). The machinery-sector measure of safety function reliability runs from PL a (lowest) to PL e (highest). PL is semi-quantitative: it combines the architectural Category, the mean time to dangerous failure (MTTFd) of each channel, and the diagnostic coverage (DC), and resolves them through a look-up to a Probability of Dangerous Failure per Hour (PFHd). The required PL for a given machine comes from the risk assessment using severity, frequency of exposure and possibility of avoidance.

Safety Integrity Level (IEC/EN 62061 and IEC 61508). SIL is the purely quantitative framework, expressing safety integrity entirely as a PFHd value computed from component failure rates. In the machinery scope, IEC/EN 62061 covers SIL 1 to SIL 3; SIL 4 exists only in IEC 61508 and is outside machinery. The two frameworks are deliberately interoperable, as the cross-reference table below shows. A flagship E-STOP module such as the Pilz PNOZ s5, the Siemens 3SK1, the Rockwell MSR127 or the Omron G9SE is certified to the top row: PL e, Category 4, SIL CL 3.

Two further documents complete the standards picture. The relay contacts themselves are rated to IEC 60947-5-1, which defines the utilization categories AC-15 and DC-13 used for switching contactor and solenoid coils. And the overall control function lives inside the machine wiring rules of IEC/EN 60204-1. A correct specification therefore cites a stop category, a Performance Level or SIL, an architectural Category, and the contact utilization category together, because each answers a different question.

Key Specification Parameters

Reading a safety relay datasheet is a defined skill. A module may list twenty or more parameters, but only a handful drive the decision: the safety rating (PL, Category, SIL, PFHd), supply voltage, number and type of safety and signal contacts, contact rating and utilization category, response and recovery times, delay range for Category 1, mission time, and width. Each is explained below, with representative figures drawn from the Pilz PNOZ s5, Siemens SIRIUS 3SK1 and Rockwell Guardmaster MSR127 datasheets.

Safety rating. The headline figures are PL, Category and SIL CL, plus the PFHd. The PNOZ s5, 3SK1 and MSR127 are all rated PL e, Category 4 and SIL CL 3, with a PFHd in the PL e band of 1e-8 to 1e-7 per hour. Always read the rating together with its conditions: the PL e claim assumes the relay is wired dual-channel with cross-monitoring and EDM. The same hardware drops to Category 1 or 2 if single-channel wiring or no feedback is used, so the certified number is a ceiling, not a guarantee.

Supply voltage. Two mainstream variants exist: 24 V DC (which must be supplied as SELV or PELV) and a wide-range 48 to 240 V AC/DC version, both offered for the PNOZ s5. The 3SK1 likewise offers 24 V DC and 110 to 240 V AC/DC models. DC supply is preferred on modern machines for its clean cross-monitoring behaviour, while the wide-range AC version suits retrofits onto legacy control voltages.

Contacts. Datasheets state the count of normally open safety contacts and normally closed signal (auxiliary) contacts separately. A common configuration is three NO safety contacts plus one NC signal contact, as on the MSR127 and the Siemens 3SK1111 (three safety NO outputs). Safety contacts switch the load; the NC signal contact is for status indication only and must never be used to switch a safety load. The PNOZ s5 base unit provides instantaneous safety contacts plus delayed safety contacts for Category 1 timing.

Contact rating and utilization category. Contacts are rated under IEC 60947-5-1: AC-15 for AC contactor coils, DC-13 for DC coils and solenoids, which are far harsher than resistive AC-1 or DC-1 because of inductive arcing. A PNOZ s5 carries on the order of 1500 VA at 250 V AC and 150 W at 24 V DC total across its safety contacts, with each contact protected by an external fuse of roughly 6 A gG. Always fit the rated external fuse per safety output, never exceed the utilization rating, and add an RC snubber on AC coils or a freewheel diode on DC coils to extend contact life.

Response and recovery time. Response time is the delay from the input opening to the safety outputs opening; typical values are about 15 ms for the MSR127, the Omron G9SE and many 3SK1 models, and around 20 ms for the PNOZ s5 instantaneous contacts. Response time matters because it feeds directly into the safety distance calculation for light curtains and scanners (per ISO 13855). Recovery (or reset) time after a power interruption is the interval before the module is ready again, on the order of 200 ms for the PNOZ s5.

Delay range (Category 1). Delay-on de-energization models add a settable off-delay, commonly adjustable from about 0.04 to 300 s in steps, to time the controlled stop before power removal. The PNOZ s5 datasheet specifies that the delayed safety contacts open at the latest after the set delay plus 20 ms plus 15 percent of the set value, a tolerance that must be included in the standstill calculation.

Mission time, width and environment. Functional safety standards assume a maximum mission time (TM) of 20 years for the device, after which it should be replaced regardless of apparent condition. Module width is a packaging concern in a crowded cabinet: the modular PNOZsigma and the Siemens 3SK1 basic unit are 22.5 mm wide, letting them sit side by side on a DIN rail. The full operating temperature range and the vibration rating (to EN 60068-2-6) round out the datasheet for harsh environments. The comparison below summarizes flagship E-STOP modules from four makers.

Selection Decision Factors

To turn the preceding chapters into a specific model, follow the decision sequence below. Most selection errors come not from a single wrong number but from deciding in the wrong order: a procurement engineer who picks a contact count before settling the required Performance Level often ends up with a module that cannot reach the Category the risk assessment demanded. These eight steps form a fixed RFQ template.

1. Required Performance Level or SIL first: read it from the machine risk assessment (EN ISO 13849-1 or IEC 62061). This sets the architectural Category and therefore whether you need single-channel, dual-channel, or dual-channel with full monitoring. Everything else follows from this number.
2. Safety function and sensor type: E-STOP, safety gate, light curtain or scanner (OSSD inputs), two-hand control, or speed/standstill. Match the module's input type to the sensor; an OSSD light curtain needs a relay with OSSD-compatible, test-pulse-aware inputs.
3. Stop category: decide Stop Category 0 (instantaneous relay) or Stop Category 1 (delay-on de-energization relay with a settable off-delay). Large inertia drives and spindles usually need Category 1 to brake before power removal.
4. Contact count and rating: count the independent loads to switch (each contactor, each drive enable) and confirm the safety NO contact count, then verify the AC-15 / DC-13 rating against the actual coil loads. Add an external fuse per output and a snubber or diode on inductive loads.
5. External device monitoring: confirm the module has an EDM feedback input if Category 4 / PL e is required, and plan the mirror-contact wiring of the downstream contactors into the loop.
6. Reset behaviour: choose monitored manual reset (the safest, requiring a deliberate operator action on the rising edge) versus automatic reset, per the risk assessment. E-STOP functions almost always require monitored manual reset.
7. Configurability and scale: below four functions use discrete relays; from five to fifteen consider a configurable module such as the Siemens 3SK2; above fifteen or where networked diagnostics are needed, move to a safety controller. The cost crossover is usually around eight to ten functions.
8. Supply, width and environment: pick 24 V DC (SELV/PELV) for new builds or wide-range AC for retrofits, confirm the DIN-rail width fits the cabinet (22.5 mm for slim modules), and check the temperature and vibration ratings for the installation.

One dimension that is easy to overlook is serviceability and lifecycle. Functional safety standards assume a maximum mission time of 20 years, after which the module must be replaced even if it still appears to work, so long-term spare availability and a stable product line matter. Plug-in terminal blocks, clear on-device LED diagnostics, and a documented validation report shorten both commissioning and the periodic proof test. Pilz, Siemens, Rockwell, Omron, Schmersal, Phoenix Contact and ABB all maintain long-lived product families with local stock and engineering support, which is why they dominate procurement for machines expected to run for a decade or more. Choosing a module from a settled ecosystem is itself a safety decision, because an obsolete relay with no spare is a latent failure waiting on the shelf.