Two-hand control is a dedicated safety logic function, not a flavour of generic safety relay: a two-hand control module enforces synchronous dual-palm actuation within a fixed synchronisation window (typically 0.5 s per ISO 13851 Type III logic) before releasing a machine stop or hold-to-run output, while a generic safety relay monitors single-channel or dual-channel E-stop / guard-door circuits for the same machinery.
Selection depends on the hazard category of the operator task. Press operators using mechanical power presses, shears, and some press brakes fall under ISO 13851 / EN 574 Type III C logic, which mandates the relay module itself to be PL e / Cat 4 / SIL 3. E-stop and interlock door monitoring fall under ISO 13849-1 or IEC 62061 with target PL/SIL chosen per risk graph, and is solved with standard safety-monitoring relays in the same PILZ PNOZ or Banner ES-FA / AT-FM families. Mixing the two on a single machine — for example, using a two-hand module to monitor a door switch — is a specification error and an audit finding on the next CE / OSHA review.
Two-Hand Control Module: Synchronisation Logic and 24 V DC Rail
A two-hand control module is purpose-built for synchronous actuation. PILZ's P2HZ X3 in the m6 product feed is a panel-mount, 24 V DC-supply module that only releases its safety output when both operator pushbuttons close within the synchronisation window and stay closed [S1]. The module is classified for two-hand control device applications — it does not advertise itself as a generic safety stop relay. Banner's AT-FM-10K is functionally in the same family: a Duo-Touch two-hand control module, 2 N/O safety output contacts, 24 V AC/DC supply, designed for press-operator hand controls [S2].
The synchronisation window is the defining spec. ISO 13851 Type III logic (a common spec for new mechanical press builds) requires both inputs to actuate within 0.5 s, and the safety output must drop out automatically if either pushbutton is released — a behaviour that ordinary E-stop relays do not implement. Modules that meet Type III C — the highest fault-tolerance tier — must also tolerate a single internal fault without losing the safety function, which is why these parts are usually rated PL e / Cat 4 / SIL 3 on their own, not achieved by stacking auxiliary relays.
Standard Safety Relay: E-Stop, Guard Door and OSSD Monitoring
A general safety relay, in contrast, monitors a single or dual-channel safety circuit — mechanical E-stop, interlock switch, or light curtain OSSD — and trips the safety contactors when any input opens or short-circuits. Banner's GM-FA-10J is a 24 V DC monitor relay with a red LED status indicator, UL Listed, and is positioned for E-stop / guard monitoring rather than two-hand timing logic [S3].
Standard safety relays are sold in three architectural tiers: single-channel (low-cost, PL c / Cat 1, suitable for low-risk manual reset stations), dual-channel without cross-fault monitoring (PL d / Cat 3), and dual-channel with cross-fault monitoring (PL e / Cat 4, SIL 3). The user's choice of relay is driven by the risk-assessment result, not by the input device brand. A safety interlock switch on a guard door typically lands in the PL d / Cat 3 band; the matching relay is the standard dual-channel monitor, not a two-hand module.
Decision Criteria: When to Spec a Two-Hand Module vs a Standard Safety Relay
The branch decision comes down to four criteria, and a side-by-side comparison line helps frame the spec. <strong>(1) Operator task:</strong> two-hand synchronous palm actuation on a hazardous motion = two-hand control module; single operator e-stop or guard-door monitoring = standard safety relay. <strong>(2) Logic type:</strong> Type III C (ISO 13851) is the only spec tier a two-hand module satisfies; standard safety relays cover Type 0/1/2 logic in IEC 61508 / IEC 62061 terminology. <strong>(3) Safety integrity:</strong> two-hand modules ship rated PL e / Cat 4 / SIL 3 as a baseline; standard relays span PL c through PL e depending on channel architecture. <strong>(4) Output behaviour:</strong> two-hand modules drop the safety output on either-button release (hold-to-run semantics); standard safety relays latch or auto-reset per the wiring, but do not require the second input to close first. [S1]
Mechanically, a two-hand module is the right call when the operator's hands must be confirmed outside the crush zone during a stroke — power presses, hydraulic shears, and certain press brakes. Standard safety relays are the right call for robot cells with perimeter guarding, conveyor E-stop pull-cords, and control cabinet door interlocks. Press operators should also confirm the control valve stack on the hydraulic press is dual-solenoid and monitored — a two-hand module alone does not supervise downstream valve faults.
Real Use Cases: Mechanical Press, Shear, Robot Cell, Conveyor
On a 200-ton mechanical power press, the press-control panel typically combines a PILZ P2HZ X3 or Banner AT-FM-10K for the operator palm buttons with a separate standard safety relay (PILZ PNOZ s5 / s4 class) for the press's perimeter light curtain and the fire alarm control panel-linked E-stop chain [S1][S2]. The two functions live in the same panel and draw from the same 24 V DC rail, but the wiring and timing logic are kept separate to preserve the ISO 13851 Type III C fault-tolerance envelope.
On a robot welding cell, the standard safety relay is the correct spec for monitoring the cell's perimeter interlock switches and laser scanner OSSD outputs. A two-hand module would be a misapplication — the operator's hands are not inside the cell during a cycle, so the synchronisation window adds no safety value and would only complicate the maintenance bypass. For conveyor E-stop pull-cords, a single-channel or dual-channel standard safety relay handles the trip; two-hand logic is not used because the operator typically uses a single hand to pull the cord.
Limitations, Constraints and Common Spec Errors
Three failure modes recur on real builds. <strong>(1) Wrong module for the task:</strong> spec'ing a two-hand module to monitor a guard-door switch — the synchronisation window makes no sense, and the module may not detect a single-channel fault that a standard dual-channel monitor would catch. <strong>(2) Mixing inputs:</strong> wiring a mechanical E-stop pushbutton into a two-hand module's input terminals. ISO 13851 does not recognise an E-stop as a valid two-hand actuator; the logic is rejected by the type-test. <strong>(3) Daisy-chaining:</strong> using a two-hand module's safety output to drive a standard safety relay's reset input, on the assumption that the two will combine to higher PL. In practice, the relay chain's PL is the lower of the two modules, and most safety controllers do not credit this configuration. [S2]
Other constraints worth tracking: synchronisation time tolerance (modules that drift out of 0.5 s in field service must be replaced, not recalibrated), mechanical button spacing (ISO 13851 specifies a minimum 550 mm / 600 mm centre-to-centre distance to prevent single-hand actuation), and contactor cross-monitoring (the two-hand module's safety outputs should drive a dual-contactor pair with mirrored auxiliary feedback — single-contactor wiring is a common audit finding).
Standards, Sourcing and the 2026 Module Market
Three standard references govern the two-hand module spec: ISO 13851 (the core two-hand control standard, defining Type I / II / III logic and synchronisation timing), ISO 13849-1 (the PL / Category rating system applied to the module and the full safety chain), and IEC 62061 (the SIL-based alternative used in process industries). For standard safety relays, the governing references are IEC 61508 (functional safety baseline), IEC 60947-5-1 (electromechanical contactor and relay performance), and ISO 13849-1 / IEC 62061 for the achieved PL / SIL. The module itself does not lift a machine to PL e — the safety function (sensor + logic + actuator) does, which is why the choice of module is only one input to the safety validation file. [S3]
For sourcing, PILZ (Germany) and Banner Engineering / Banner Engineering Corp (US) dominate the brand-name two-hand module market; the m6 product feed shows P2HZ X3 in panel-mount DC from PILZ and the Duo-Touch AT-FM-10K from Banner live on distributor stock at 2026-01 [S1][S2]. Distributors including eBay's industrial-relay sellers, DirectIndustry, and regional stockists (e.g. ChuangWei Electronics for the Banner GM-FA-10J) carry these parts in single-piece MOQ [S3]. Lead time is generally 2-6 weeks depending on region and whether the part is a current-production SKU or a legacy variant.
For readers sizing the broader safety chain on a new press build, the safety interlock switch selection guide lays out the PL / SIL / Type and holding-force decision matrix for the guard doors, while the safety interlock switch price and cost guide gives a 2026 reference for the matching guard-side hardware budgets. These two resources, used in parallel with the two-hand module spec, cover the full ISO 13849 safety chain on a typical press or shear installation.