Fail-safe inductive proximity sensors certified to EN IEC 60947-5-3 detect ferrous and non-ferrous metal directly, so a coded magnetic actuator or mechanical cam is not required on the guard [S1][S2].
Inside the device, the sensing element and a dedicated monitoring channel watch both target position and dwell time inside an enable zone, and a fault latches the dual PNP outputs to a safe state, which is the PDDB (proximity device with defined behaviour under fault conditions) concept the 2026 IEC revision is built on [S1][S4].
What the 2026 IEC 60947-5-3 revision actually changes
IEC 60947-5-3 ED3 was circulated as Committee Draft for Vote 121A/640/CDV on 2025-02-07 with a voting close on 2025-05-02, and the SC 121A officers have proposed a stability date of 2028, meaning the technical content is treated as stable through that window once published [S4]. The title, "Requirements for proximity devices with defined behaviour under fault conditions (PDDB)", is unchanged from the 2013 edition, but the document supersedes 121A/614/CD and 121A/624A/CC and remains flagged "still under study and subject to change" until the final FDIS stage [S4].
For a process engineer, the practical effect is that any inductive, magnetic, or capacitive safety sensor carrying a 60947-5-3 mark is expected to behave in a defined, documented way when internal faults occur, rather than simply failing to a known state. That contract is what allows a sensor to be counted toward the safety function of a guard, not just toward presence detection [S1][S4]. Suppliers active in this category include ifm, Pepperl+Fuchs, Turck, Sick, Schmersal, IDEM, Rockwell/Allen-Bradley, and Eaton, with the inductive sensor operating principle carried over into the safety variant unchanged [S1][S7][S8].
Selection criteria that actually matter on a guard door
First, confirm the device is rated PDDB, not just a standard proximity switch in a safety relay circuit. AutomationDirect's safety line explicitly requires fail-safe inductive sensors to be wired to a safety relay that accepts OSSD (Output Signal Switching Device) inputs, and the ifm documentation further notes that 2 x PNP fail-safe outputs can drive approved two-channel safety relays without cross-monitoring when configured for plus-switching non-contact guards [S1][S2]. Both cases assume the sensor's outputs are the certified safety signal, not a generic 24 V PNP that the relay just happens to monitor.
Second, verify the rated operating distance (sn), the assured switch-on distance (sao) and the assured switch-off distance (sar) for the actual target material and mounting. PDDB sensors specify these in the datasheet, and a vibration-tolerant guard typically needs sar to comfortably clear the maximum expected door deflection in the open state. Third, check the enable-zone dwell-time window: the sensor declares a minimum target residence time, and a fast-flickering guard that violates it forces a safe trip, which is a feature on machine-tool doors with hydraulic damping [S1].
Fourth, plan the wiring topology. Fail-safe inductive sensors can be daisy-chained with electromechanical safety contacts in series, fed with standard unshielded 4-pole cable, and terminated into a safety PLC, an AS-i Safety at Work master, PROFIsafe, or Interbus Safety, with the I/O conforming to DIN EN 61131-2 type 1/3 thresholds [S1]. For an existing cabinet that has only relay-based safety logic, look for variants with a tested compatibility list rather than assuming any OSSD-input relay will work, since EDM (external device monitoring) pulse timing and cross-fault behaviour differ between PDDB and standard solid-state outputs [S1][S2].
How fail-safe inductive compares with coded magnetic and interlock switches
Against the three common guard-monitoring technologies, the engineering trade-off is direct detection versus tamper resistance. Fail-safe inductive sensors see any metal inside the enable zone, so they cannot tell whether the operator has fitted a substitute target; coded magnetic switches require a uniquely coded magnet so a jumper magnet is rejected [S5]. A proximity sensor without PDDB certification gives no fault contract, which generally disqualifies it from any SIL/PL safety function.
Electromechanical safety switches with forced-guided contacts are still the cheapest route for hinged guards that have positive mechanical drive. Schneider's XCS catalogue example shows two interlock switches plus one safety control unit reaching PL e / Category 4 to EN ISO 13849-1, the same level typically claimed by a single PDDB sensor pair [S9]. Where the fail-safe inductive variant wins is on hygienic or washdown guards, where a coded magnet pocket would trap product, and on rotary tables, where a coded magnet's orientation tolerance is harder to maintain than a metal flag's.
Two practical rules follow. Where tamper resistance is the dominant concern, choose coded magnetic; where direct metal detection, oil resistance, and high IP67/IP69K sealing are the dominant concern, choose fail-safe inductive. Avoid mixing inductive and magnetic OSSD outputs in a single EDM loop without re-validating the safety calculation, because the pulse timing and short-circuit detection differ between the two PDDB profiles [S1][S5].
Integration with safety relays, AS-i Safety, PROFIsafe
Fail-safe inductive sensors that present a 2 x PNP OSSD pair can wire directly into a two-channel safety relay suitable for plus-switching non-contact guards, with no shielded cable, no dedicated earth, and no cross-monitoring required inside the relay, because the PDDB sensor does its own internal cross-fault detection [S1]. Where the cabinet logic is already a safety PLC, the same 2 x PNP outputs feed a safe input module parameterised to expect an OSSD test pulse from the sensor, and the I/O levels conform to DIN EN 61131-2 so no resistor network is needed [S1].
For AS-i Safety at Work, PROFIsafe, and Interbus Safety networks, the sensor is wired through a safety bus gateway, and ifm specifies that "dynamic pulse" variants require the corresponding software module in the safety controller, which is a model-code suffix buyers need to confirm before order [S1]. Pepperl+Fuchs takes a different route, certifying a NAMUR interface variant to EN 60947-5-6 for hazardous-area use, where the safety function rides on the same two-wire intrinsically safe loop and the failure rates are documented in the manufacturer's declaration of conformity [S7]. That NAMUR path is the one to follow when the guard sits in an Ex zone, not the standard 24 V PNP OSSD variant.
Mounting, environment, and the failure modes to design out
PDDB inductive sensors for guard monitoring ship in M8 through M30 threaded barrels, with stainless steel 1.4427 SO housings for washdown (Turck's magnetic-inductive M8 variant, ident no. 1074000, is a representative spec) and plastic-bodied versions for less aggressive lines [S8]. Mounting clearance around the enable zone matters: at least the sensor's rated operating distance must remain free of stationary metal, or the target discrimination is lost and the sensor will refuse to enable even with the door closed.
Common failure modes to design out on the panel: (a) a single-wire short to 24 V on a non-OSSD PNP output that the upstream relay cannot detect, fixed by choosing a true OSSD sensor and a relay with pulse-cross-fault detection; (b) door sag increasing the air gap past sar, fixed by re-aiming the target and re-verifying sao with a feeler gauge; (c) coolant ingress on an IP67 sensor that is not IP69K, fixed by selecting the higher-rated variant on food and beverage lines. The datasheet's MTTFd, B10d, and DCavg values feed straight into the EN ISO 13849-1 PL calculation, so they should be requested as part of the supplier's functional safety data sheet rather than estimated from generic catalogue numbers [S1][S6].
Standards map and what to look for on the datasheet
The governing document is EN IEC 60947-5-3 PDDB, currently in CENELEC parallel voting as 121A/640/CDV with circulation 2025-02-07, voting close 2025-05-02, and proposed stability to 2028 [S4]. Guard-door applications generally also pull in EN ISO 13849-1 (PL e / Cat 4 target), EN 60204-1 for the machine's electrical equipment, and, on Ex lines, the IEC 60079 series plus EN 60947-5-6 for the NAMUR interface [S1][S7].
A datasheet worth signing off on lists: PDDB marking, rated operating distance sn plus the assured sao and sar values for the test target material, MTTFd or B10d for the safety function, category and PL achievable per EN ISO 13849-1 when used with a reference safety relay, IP rating, ambient temperature range, and the specific OSSD test-pulse width the device emits. The measurement and test workflow on the bench then becomes: bench-verify sao and sar with the actual target, exercise the door at maximum expected deflection, then exercise the cross-fault modes listed in the supplier's manual.
Next signal to track: the FDIS (Final Draft International Standard) publication of IEC 60947-5-3 ED3 out of SC 121A, which will convert the current CDV language into the binding 2026 text and trigger a refresh of supplier declarations of conformity through 2026 and 2027. Until that lands, treat the 121A/640/CDV wording as informative and require the device to be marked to the published edition of EN IEC 60947-5-3 in force in the country of installation, including any national amendments.
Background reading: S/FTP vs F/UTP vs U/FTP: decoding the shielded twisted-pair designation.