Safety Relay

What is a safety relay?

A safety relay is a certified switching unit that monitors the signals of safety devices such as an emergency stop, a door switch or a light curtain over two channels, checks itself and its wiring for faults, and reliably removes energy from hazardous movements when a hazard or a detected fault occurs. Whereas an ordinary relay simply switches, a safety relay is built so that a single internal or external fault cannot disable the safety function. That makes it a core component of the functional safety of machinery. It is designed and assessed under NEN-EN-ISO 13849 (Performance Level) and IEC 62061 (SIL), within the framework of the Machinery Directive.

The first safety relay, the PNOZ from the German company Pilz, came onto the market in 1987. Before that, machine builders in industrial automation built the same monitoring from separate relays and a combination of three contactors. The principle has stayed the same ever since, although electronic and freely configurable variants now exist as well.

🧠 How does a safety relay work?

A classic safety relay consists of two redundant output relays (often called K1 and K2) with force-guided contacts, a two-channel input circuit and a start or reset circuit. A safety function runs through four steps:

1. Monitor the inputs - the emergency stop, an interlock on a guard door or the OSSD outputs of a light curtain are wired over two channels. If either channel opens, both output relays drop out.
2. Detect wiring faults - the relay compares both channels. Many types send test pulses over the inputs, so a short between the channels (cross-circuit), a short to 24 V or a broken wire is also recognised.
3. Shut down safely - the normally open safety contacts open and de-energise the coils of two contactors, or send an STO signal to the drive. In most cases the safety relay does not switch the motor current itself; it controls the actuators that do.
4. Feedback and reset - the normally closed auxiliary contacts of the contactors are wired in series in the feedback loop (labelled Y1/Y2 on Pilz devices). A welded contactor keeps that loop open, so the relay refuses a new start. A restart is only possible after a deliberate reset action.

🔩 What are force-guided contacts?

Force-guided contacts (also called mechanically linked contacts) are relay contacts joined by a rigid mechanism, so that a normally open and a normally closed contact can never be closed at the same time. If a normally open contact welds, the normally closed contacts stay open with a contact gap of at least 0.5 mm. The requirements used to be in EN 50205 and are now covered by IEC 61810-3.

The benefit is that the state of a safety contact becomes verifiable: the relay checks the normally closed contact and therefore knows whether the normally open contact has really opened. Force-guided contacts do not make a contact infallible, but they do make a welded contact visible. Contactors apply the same idea through mirror contacts under IEC 60947-4-1.

🔄 How does a safety relay differ from a standard relay and a safety PLC?

A practical rule of thumb: up to about three or four safety functions, a set of safety relays stays clear and inexpensive. Beyond that, the wiring and the interconnections become hard to follow, and a configurable relay or a safety PLC is the better choice.

🧩 What types of safety relay are there?

Configurable safety relays bridge the gap to the safety PLC. Pilz launched the freely configurable PNOZmulti in 2002; other manufacturers, including Phoenix Contact, Siemens and Sick, followed with comparable products.

📏 Which standards and laws apply to safety relays?

• ISO 13849-1 - sets the required PLr through the risk assessment and the achieved PL through category, MTTFd, diagnostic coverage and CCF; part 2 covers validation
• IEC 62061 - the same question in SIL terms, based on IEC 61508
• IEC 60204-1 - electrical equipment of machines, with stop category 0 (immediate removal of power), 1 (controlled stop, then power removed) and 2 (stop with power maintained)
• NEN-EN-ISO 13850 - the emergency stop must work in stop category 0 or 1 and must not restart by itself when released
• ISO 14119 - requirements for interlocking devices and for preventing defeat
• Machinery Directive 2006/42/EC - lists logic units to ensure safety functions in Annex IV, as a product subject to specific conformity assessment procedures; from 20 January 2027 the Machinery Regulation (EU) 2023/1230 takes over, and it also lists logic units for safety functions as a high-risk product

In the Netherlands the Machinery Directive is transposed in the Warenwetbesluit machines. Users also fall under the Dutch Working Conditions Act (Arbowet): article 7.4a of the Arbobesluit requires periodic inspection of work equipment exposed to conditions that can cause deterioration leading to dangerous situations.

🔧 How do you design and test a circuit with a safety relay?

1. Determine the PLr for each safety function in the risk assessment. For an emergency stop on a machine that can cause serious injury, this often comes out at PL d or PL e.
2. Choose the architecture. PL d usually calls for category 3 (dual channel: a single fault does not lead to loss of the safety function and is detected where practicable). PL e calls for category 4, or category 3 with a high MTTFd and medium diagnostic coverage. Choose a safety relay that achieves at least that level.
3. Calculate the electromechanical parts. For contactors and switches MTTFd = B10d / (0.1 × n_op). Example: a guard door opened 50 times a day on 300 working days gives n_op = 15,000. With a B10d of 1,000,000 the MTTFd is about 667 years (class high) and T10d = B10d / n_op is just over 66 years, so longer than the 20-year mission time.
4. Calculate the whole chain. Take the PFHd value of the relay from the manufacturer’s documentation and enter sensor, logic and actuator, for example in SISTEMA, the free software from the German IFA.
5. Wire according to the manual. Separate channels, a feedback loop via the auxiliary contacts, and the reset button outside the hazard zone with a view of that zone.
6. Validate with fault simulation. Open each channel, create a deliberate cross-circuit, simulate a welded contactor and measure the stopping time.
7. Document and inspect. Record the design in the technical file, test the function periodically and include changes in the audit or the RI&E.

Typical values for a standard safety relay: 24 V DC supply, a housing about 22.5 mm wide on DIN rail in the control cabinet or the MCC, two to three normally open safety contacts plus a signalling contact, and a drop-out time in the order of tens of milliseconds. That response time counts towards the safety distance of a light curtain under ISO 13855.

🔐 What does IT/OT convergence mean for a safety relay?

A hard-wired safety relay has no firmware updates, no network port and no password, which makes it almost impossible to attack remotely. That is one reason it is still widely used in an age of networked machinery. Configurable relays change that picture: their logic is created in software on a PC and loaded over USB or Ethernet, and many types deliver diagnostics to a PLC or a gateway.

• Protect the configuration - password-protect the project, record the checksum and route changes through change management
• Read-only diagnostics - the standard control system may read the status, but must never influence the safety logic
• Prevent physical tampering - seal the cabinet and check for bridged inputs; in practice, bypassing is a bigger risk than hacking
• Legislation - from 2027 the Machinery Regulation requires protection against corruption of safety-relevant hardware and software (Annex III, point 1.1.9)

A safety relay is not an isolating device. Maintenance still requires Lock-out Tag-out with a lockable isolator, plus a work permit where the job calls for one.

❓ Frequently asked questions

What is the difference between a safety relay and an ordinary relay?

A safety relay monitors its inputs over two channels, detects faults such as broken wires, cross-circuits and welded contacts, and then refuses to restart. An ordinary relay only switches and does not notice when a contact has welded. That is why an ordinary relay may not be used in a safety function with a high Performance Level without additional measures.

What Performance Level does a safety relay achieve?

Many safety relays are certified up to PL e, category 4 under ISO 13849-1 and SIL 3 under IEC 62061. The level of the complete safety function, however, also depends on the sensors, contactors and wiring. A PL e safety relay with a single contactor therefore does not achieve PL e.

When should you choose a safety PLC instead of a safety relay?

A safety PLC makes sense with more than a few safety functions, with zones that depend on each other, or when safety signals have to travel over a network such as PROFIsafe. A safety relay is cheaper and simpler for a single emergency stop circuit or guard monitoring. Configurable safety relays fill the space in between.

May a safety relay reset automatically?

An automatic reset is only permitted if nobody can be in the hazard zone without a safety device detecting it. After an emergency stop a deliberate manual reset is always required, and even then the machine must not start by itself. Modern safety relays monitor the reset and only accept the signal when the button is released.

How often should a safety relay be tested?

Test every safety function that uses a safety relay at commissioning, after every change and periodically in line with the manufacturer’s manual and your risk assessment. With electromechanical contacts some faults are only revealed when the function is demanded, so a PL e safety function must be demanded regularly. In the Netherlands the Arbobesluit also requires periodic inspection of work equipment.

Is a safety relay vulnerable to cyberattacks?

A classic hard-wired safety relay has no network connection or firmware that can be changed remotely, so it is very hard to attack. Configurable safety relays with software and an Ethernet port do need protection of their configuration and access. The Machinery Regulation makes that protection a legal requirement from 20 January 2027.

📌 In summary

A safety relay monitors emergency stops, guard doors and light curtains over two channels, detects faults in itself and in its wiring, and shuts down reliably via contactors or STO. Force-guided contacts and a feedback loop make welded contacts visible. For compliance, the design follows ISO 13849-1 or IEC 62061, validation is done through fault simulation, and from 2027 the Machinery Regulation applies.

A safety relay is the simplest certified way to build a safety function up to PL e or SIL 3, provided the sensors, contactors and wiring achieve the same level.