ISO 14119:2024 (Type-B2) and ISO 13849-1 cap a single guard-locking switch at Category 3 / PLd for the lock-monitoring safety function; reaching PLe needs either two independent devices, a redundant second channel, or a documented fault exclusion on the mechanical actuator [S1][S2][S3].
The ceiling is set by three concrete rules: a single electromechanical interlock uses one fault path, ISO 14119:2024 treats the mechanical lock element as a wear part, and the coding level (low, high, unique) only affects defeat resistance, not the achievable PL on its own [S1][S3].
What the standards actually cap on a single device
ISO 14119:2024 defines the interlocking device and the guard-locking device, and explicitly lists the force a guard-locking device must withstand without damage as a type-test requirement on the device itself, not as a safety-function performance claim [S1]. A common OEM datasheet value for that type-test force is in the 1000 N to 3000 N range, with the lock nut and bolt-on retention method also tested under the same clause.
Under ISO 13849-1, a single-channel electromechanical device with its own monitoring contacts tops out at Category 3 / PLd. ReeR's safety guide states this directly: "with this method, using only one device, it is possible to reach Cat. 3 / PLd (PLe does not plan to use the fault exclusion)" [S2]. PLe requires Category 4 architecture, which means either two devices, a redundant second channel wired into the safety logic, or a justified fault exclusion on the single mechanical element [S2][S3].
Why the lock channel is treated as the weak path
On a guard-locking switch there are two distinct signals: the position signal (door closed, contact open or closed) and the lock signal (bolt engaged, contact open or closed). Machinery Safety 101 frames the rule simply: the machine control system must explicitly decide when unlocking is safe, and if power fails during high-inertia motion, the guard must remain locked [S3]. That is a safety-function demand, so both signals sit inside the PL calculation.
Three physical facts drive the PLd ceiling. First, the mechanical bolt is a wear surface: holding force decays with cycles, and ISO 14119:2024 type-tests the retention force, not its long-term endurance [S1]. Second, a single force-guided contact pair has one fault path, so a single short or contact-weld failure can defeat the channel. Third, the locking assembly holding the bolt can vibrate loose over years, so even with a perfect switch the mechanical subsystem needs a second barrier or a fault exclusion to justify Category 4.
When PLe on a single device is plausible
PLe on a single device is only credible with two specific tools. The first is a justified fault exclusion on the mechanical actuator, written into the SISTEMA or PAScal file and signed by the safety engineer; the second is a high-level or unique-coded RFID interlock (Type 4 per ISO 14119) where the manufacturer has already pre-qualified the mechanical wear path [S1][S3]. Even then, a single RFID interlock like the IDEM KLM-Z-4ST publishes CAT4, SIL3, PLe, but only because its datasheet bundles a 3000 N holding force, four-position RFID coding, and a dual-channel OSSD architecture into one housing, which is functionally a Category 4 structure, not a Category 3 one with a marketing label [S8].
PLCtalk reinforces the same boundary from the application side: signals that are not part of the safety function are not subject to the required SIL or PL and can be implemented as a control function, so engineers sometimes over-specify the lock by treating a non-safety signal as safety [S5]. The fix is to redraw the safety function block diagram and assign PL only to the channels that actually close into the safety relay or safety PLC input.
Comparison: single device vs dual device vs dual-channel RFID
On a 1.5 m robot-cell door with 250 ms stop time, the three options line up as follows against four decision criteria. Achievable PL on lock monitoring: single electromechanical interlock = PLd; dual electromechanical interlocks wired in series with cross-monitoring = PLe; single Type 4 RFID interlock with dual OSSD = PLe (only if the datasheet lists dual OSSD, otherwise PLd). Wiring cost: one switch and one safety input; two switches, two inputs; one switch, one dual-OSS input. Tamper resistance: low-coded actuator defeat possible in seconds; same actuator or two independent actuators force attacker to defeat both; high or unique RFID coding raises the defeat bar. Mechanical retention: single 1000 N to 3000 N bolt; bolt failure on one switch still allows the other to hold; single 3000 N bolt plus electronic retention check [S1][S2][S3][S8].
For a stamping press with 500 ms hazardous-stop time and a 1500 N retention requirement, the comparison shifts. The mechanical risk dominates, so two single-channel switches often win on lifecycle cost, even though a Type 4 RFID device is cleaner to wire, because replacement is per-switch and the RFID electronics are a board-level repair. For a packaging line with 50 ms stop and low inertia, the RFID device usually wins on footprint and on defeat resistance, since unique coding blocks the bypass-Actuator failure mode the standards were written to stop [S3].
Selection criteria and the failure modes that break the design
Five selection criteria drive the call. First, the required PL from the risk graph (ISO 13849-1): if PLd suffices, a single device is acceptable; if PLe is required, dual or dual-channel only. Second, stop time: under 100 ms, process-protection locking alone often covers it; over 250 ms, guard locking is mandatory because an operator can reach the hazard before motion stops [S3]. Third, defeat exposure: a publicly accessible door needs high or unique coding, which pushes selection toward RFID Type 4 [S1]. Fourth, environment: washdown or hot zones favor stainless 316L housings and 3000 N retention; cold storage below -25 deg C rules out most plastic-bodied electromechanical switches. Fifth, integration: legacy safety relay with one free input channel forces dual-switch wiring; a modern safety PLC with OSSD inputs accepts the RFID device directly [S5].
Three failure modes account for most field incidents. Operator bypass: the operator tapes the actuator closed or holds the door, defeating low-coded devices; ISO 14119:2024 addresses this by mandating tamper-resistant mounting and coding-level selection [S1][S3]. Contact welding on a single-channel switch: a welded closed contact reads as "door closed and locked" even when the bolt has retracted, which is why Category 3 monitoring requires a force-guided, positively-driven contact pair. Mechanical bolt wear: holding force drops below 1000 N after millions of cycles, and ISO 14119:2024 type-tests the as-new force, not the EOL force, so maintenance intervals must be set against the cycle count rather than the calibration sticker [S1].
Use cases and a process-protection versus personnel-protection split
For personnel protection on a high-inertia machine, the standards treat guard locking as a safety function, so PLd or PLe applies and the single girder crane analogy in machinery-safety literature is often used: the lock must hold even if power is lost mid-cycle, which is the principle the OMRON D4JL-style switches are designed around [S3]. For process protection on a fast-stop packaging line, the lock is sometimes specified as a control function, not a safety function, which means a standard PLC output and a non-safety interlock are acceptable, and the condition monitoring system on the line is the actual safety barrier [S5].
For a robotic weld cell with 300 ms stop time, dual electromechanical interlocks on the same door are the conservative pick: two independent actuators, two safety inputs, cross-monitored in the safety PLC, PLe with no fault exclusion needed [S2][S3]. For a cleanroom conveyor with 80 ms stop time and frequent access, a single Type 4 RFID interlock with dual OSSD outputs, 3000 N holding force, and unique coding is the common build, because the wiring cost is half the dual-switch route and the unique coding addresses the defeat-resistance criterion in one step [S3][S8].
Documentation and signals worth tracking
Two signals are worth tracking through 2026. First, the SISTEMA library updates for ISO 14119:2024 versus the older 2013 edition, since the 2024 version is the current reference cited by integrators and notified bodies, and library blocks for the 2024 edition are still being added [S1]. Second, manufacturer datasheet revisions that publish dual-OSSD verification on single-housing RFID interlocks, since this is the technical path that lets a single device reach PLe without a mechanical fault exclusion, and the recent KLM-Z-4ST datasheet is one of the first to publish the full CAT4 / SIL3 / PLe claim against a 3000 N retention number [S8].
For related coverage, see ASTM D1238 MFI for Polyolefins: Film Extrusion vs Injection Molding Grade Selection.