Safety Sensors and Devices
Light curtains, interlock switches, safety mats and scanners, safety distance, performance level and how a safety circuit is built.
On this page
- Why safety sensors are different
- Risk assessment and required performance level
- The safety devices
- Light curtains and the safety distance
- Interlock switches and guard locking
- Scanners, mats, edges and other devices
- The safety circuit
- Performance level and PFHd
- Reset, muting and bypassing
- Validation and periodic testing
- FAQ
Why safety sensors are different
A standard sensor is built to be cheap and reliable on average. If it fails, the machine usually stops working, but sometimes it fails in the dangerous way: an output stuck on, a lens that no longer detects, a contact welded. A safety device is designed so that a single fault cannot cause loss of the safety function (or is detected before the next demand), is tested and certified by a notified body, and is documented with data for the calculation of its reliability. It carries a rating (PL, SIL) and a mark showing the standard it meets (for example IEC 61496 for light curtains, IEC 60947-5-3 for non-contact interlocks).
- Never use a standard proximity switch, a photoelectric sensor or a normal limit switch for personal protection. Not because they are unreliable, but because nobody has shown that they fail safely.
- Safety is a system property: the sensor, the logic and the stopping device together must achieve the required level (see Installing and Troubleshooting Sensors for good practice, and the logic and brake side in PLC Troubleshooting, Safety and Documentation and Braking, Safe Stopping and Troubleshooting).
- This page is an introduction. Real safety design requires the standards, a risk assessment and a qualified person.
Risk assessment and required performance level
Safety starts with a risk assessment (ISO 12100): find each hazard, how severe the injury could be, how often and how long people are exposed, and whether they can avoid it. ISO 13849-1 turns this into a required performance level, PLr, from a to e, with a risk graph:
| Factor | Low | High |
|---|---|---|
| S: severity of the injury | S1: slight (reversible) | S2: serious (irreversible, death) |
| F: frequency and duration of exposure | F1: seldom to quite often, short | F2: frequent to continuous, long |
| P: possibility of avoiding the hazard | P1: possible under specific conditions | P2: scarcely possible |
A serious injury (S2) with frequent exposure (F2) and no possibility of avoidance (P2) needs PLr = e, the highest; a slight injury (S1), seldom exposed (F1), avoidable (P1) needs only a. The result tells you what the safety function must achieve; the rest of this page shows what the devices and the arithmetic look like.
The safety devices
| Device | Standard | What it does |
|---|---|---|
| Emergency stop | ISO 13850, IEC 60947-5-5 | A red mushroom button on a yellow background; latching; positive-opening (direct-opening) contacts; a complementary measure to stop the machine quickly |
| Interlock switch | ISO 14119, IEC 60947-5-1/-3 | Detects that a guard is closed (tongue, hinge, magnetic, RFID-coded); guard-locking types hold it shut until it is safe |
| Light curtain (ESPE) | IEC 61496-1/-2 | A row of beams creates a detection field that stops the machine when a person breaks it |
| Laser scanner | IEC 61496-3 | Scans a plane; separate protective and warning zones; area protection for robots and AGVs |
| Safety mat, edge, bumper | ISO 13856 | Pressure-sensitive floor mats and edges that detect a person’s presence or contact |
| Two-hand control | ISO 13851 | Requires both hands on the buttons, at the same time, to run a hazardous movement |
| Enabling switch | IEC 60947-5-8 | A three-position device: stop when released or squeezed hard; for set-up with guards open |
| Safety relay, safety PLC | IEC 62061, ISO 13849-1 | Monitors the inputs, evaluates the logic and switches the outputs safely |
| Safe drive functions | IEC 61800-5-2 | STO, SS1, SLS and other functions inside a drive (see Braking, Safe Stopping and Troubleshooting) |
Light curtains and the safety distance
A safety light curtain consists of a transmitter and a receiver with a number of beams. Its resolution (or detection capability) is the size of the smallest object always detected: 14 mm (finger), 20 to 30 mm (hand), 40 mm (hand, shorter), 90 mm (body). The type (2 or 4) says how well the device itself is protected against a fault; Type 4 is needed for PL e and Category 4, Type 2 is limited to lower risks. The output is a pair of safety outputs (OSSD, output signal switching devices) that go off when the field is broken or a fault is found.
The curtain must stand far enough from the hazard that a person who triggers it cannot reach the danger before the machine has stopped (ISO 13855): S = K × T + C, with K the approach speed (2 000 mm/s for walking toward a hazard, with 1 600 mm/s allowed for distances above 500 mm), T the total stopping time (the response time of the curtain, the logic and the output devices plus the stopping time of the machine), and C the allowance for reaching into the field before detection, C = 8 × (d − 14) mm for a resolution d up to 40 mm.
Worked example: the safety distance of a press guard
- The light curtain and relay respond in 20 ms and the machine takes 120 ms to stop: T = 140 ms. With K = 2 000 mm/s: K × T = 280 mm.
- For a 30 mm resolution curtain C = 8 × (30 − 14) = 128 mm, so S = 280 + 128 = 408 mm. The curtain must be at least 408 mm from the hazard.
- The resolution matters. A finer curtain is closer: for 14 mm, C = 0 and S = 280 mm; for 20 mm, S = 328 mm; for 40 mm, S = 488 mm.
- The stopping time is the big lever. If the machine takes 300 ms to stop (a slow brake), S with K = 2 000 mm/s is 728 mm, which is above 500 mm, so K = 1 600 mm/s may be used: S = 1 600 × 0.300 + 128 = 608 mm. A better brake that gets back to 120 ms cuts the distance to 408 mm: 200 mm less floor space. Measure the real stopping time with a stopping-performance monitor, and re-check it after brake wear.
| Resolution d (mm) | C = 8 (d − 14) (mm) | S for T = 140 ms, K = 2 000 mm/s (mm) |
|---|---|---|
| 14 | 0 | 280 |
| 20 | 48 | 328 |
| 30 | 128 | 408 |
| 40 | 208 | 488 |
- Mount the curtain so that nobody can reach around, over or under it (ISO 13855 gives the heights and distances), and so that no one can stand between the curtain and the hazard without being detected (use a reset outside the zone, with a view of the whole area).
- Reflective surfaces and nearby sensors can disturb the beams: follow the minimum distance from reflective surfaces in the manual.
- Test it at least daily or at every shift with the test rod of the right size (the one from the data sheet) in several places.
Interlock switches and guard locking
- Mechanical tongue switches use a coded actuator and positive-opening contacts that must open when the guard opens, even if a contact welds. Their weakness is that they can be defeated with a spare actuator.
- Non-contact switches (coded magnet or RFID) have no wear and are easy to align. A coded, uniquely coded device resists bypassing (ISO 14119 requires measures against defeat).
- Guard-locking switches keep the guard locked until the hazardous motion has stopped (spring-locked, released by power, or power-locked, released by a signal). Use them when the machine takes time to stop, so that the guard cannot be opened while it is still dangerous (see the stopping times in Braking, Safe Stopping and Troubleshooting).
- Monitor both channels. A safety interlock usually has two independent contacts or outputs that the safety logic compares: a difference means a fault.
- Series connection of several interlocks to a single input saves wiring but reduces the diagnostic coverage and masks faults (the “fault masking” limit); some units allow it up to a given PL.
Scanners, mats, edges and other devices
- Laser scanners protect an area (such as around a robot or an AGV): they have a protective field and an outer warning field, and fields that switch with the robot’s mode or the vehicle’s speed.
- Safety mats and edges give a contact signal when stepped on or touched; the mat works as a floor-level presence detector for a zone, and the edge as a contact bumper on moving doors or machines. They need a safe interface and a periodic check.
- Two-hand controls protect only the operator, not others, and must prevent the hands being tied or defeated.
- Enabling and hold-to-run devices allow work with the guard open at a reduced speed, with a three-position switch and a restricted speed (see the safely limited speed functions in the drive).
- Safe speed and position monitors (safety encoders, standstill monitors) let a guard open safely when the motion is stopped, or limit the speed for set-up: see Encoders, Resolvers and Feedback for the encoder and Braking, Safe Stopping and Troubleshooting for the drive functions.
The safety circuit
- Safety relays are dedicated, certified modules that evaluate a few inputs and switch force-guided contacts: simple, robust and easy to validate for a single function.
- Safety PLCs and safety I/O handle many inputs, complex logic and networked devices, with safe communication (PROFIsafe, CIP Safety, FSoE) over the normal network. The safety program is separate from the standard program and has its own signature.
- Outputs: the safety function must remove the energy: contactors with mirror contacts in the motor supply, or the safe torque off input of a drive. A normal PLC output is not enough.
- Two channels and diagnostics: use dual-channel wiring with cross-short detection (pulsed test signals) so a short between channels is found.
- Wiring safety: use separate cable or protected routing for the two channels, and observe the cable and cabinet rules for the stated category.
Performance level and PFHd
The performance level (ISO 13849-1) depends on the structure (category B, 1, 2, 3 or 4), the diagnostic coverage, the mean time to dangerous failure of the components and the resistance to common-cause failures. The result is expressed as the probability of dangerous failure per hour (PFHd) of the whole safety function:
| PL | PFHd (per hour) | Equivalent SIL (IEC 62061) |
|---|---|---|
| a | 10-5 to 10-4 | – |
| b | 3 × 10-6 to 10-5 | SIL 1 |
| c | 10-6 to 3 × 10-6 | SIL 1 |
| d | 10-7 to 10-6 | SIL 2 |
| e | 10-8 to 10-7 | SIL 3 |
Worked example: adding up a safety function
For a simple guard with a Type 4 light curtain, a safety relay and two contactors, the data sheets give (illustrative values) PFHd of 8.0 × 10-9 for the curtain, 5.0 × 10-9 for the relay and 2.0 × 10-8 for the contactor pair. The failures add: 8.0 × 10-9 + 5.0 × 10-9 + 2.0 × 10-8 = 3.3 × 10-8 per hour, which is in the range for PL e. The calculation also needs the structure (Category 3 or 4 for PL e), the diagnostic coverage and the common-cause check: the numbers alone are not enough. The weakest element (here the contactors) sets the result: replacing them with a drive’s safe torque off would improve it.
Reset, muting and bypassing
- Restart interlock: after a guard is closed or a light curtain is cleared the machine must not restart by itself: a deliberate reset (a button outside the danger zone, with a view of it) is needed.
- Muting temporarily ignores a light curtain so that material can pass through (a pallet on a conveyor) without stopping. It must use two or more independent muting sensors in a defined sequence and time, so that a person cannot be mistaken for a pallet.
- Blanking (fixed or floating) switches off some beams to allow a part of a known size through; the resolution in that area is reduced, so the safety distance changes.
- Bypassing a safety device is dangerous and a leading cause of accidents. Make it difficult (a unique actuator, tamper-proof mounting) and give a legitimate way: an enabling device and a reduced speed, a key-selector in a controlled mode.
- Safe state on failure: a broken wire or a power loss must give a stop, not a run (the safety function is “de-energize to stop”).
Validation and periodic testing
- Validate every safety function against its specification: does each device stop the machine as designed, in the time assumed in the calculation, and can the safety distance be confirmed?
- Measure the stopping time and compare it with the one used for the safety distance. Repeat at the intervals the brake and the drive require.
- Test fault behavior: open a wire, short channels, remove power, and confirm that a dangerous failure does not occur.
- Document everything: the risk assessment, the PL and the calculation, the data sheets, the drawings, the software signature, the validation results and the test schedule. This is a legal requirement for CE marking in many cases.
- Maintain and test periodically as the manufacturers say (daily check of a light curtain, interlock checks per shift or per month, brake tests), and keep a log.
- Train the people who operate, set up and maintain the machine, and make sure nobody removes or bypasses a device.
- Change control: any change to the machine, the speeds, the stopping times or the guarding needs a new assessment.
Related
- Sensors and Field Devices: the overview of this guide.
- Braking, Safe Stopping and Troubleshooting: safe torque off, stopping functions and brake sizing.
- PLC Troubleshooting, Safety and Documentation: the control system side.
- Workshop Safety: general safety in a workshop.
- Installing and Troubleshooting Sensors: standard sensors and wiring practice.
FAQ
Can I use a normal proximity sensor as a guard switch?
No. A guard interlock must be a certified safety device with a coded actuator and a monitored dual-channel output. A standard sensor can be defeated or can fail without detection.
What is the difference between Type 2 and Type 4 light curtains?
Type 4 detects its own faults continuously and is acceptable for the highest risks (PL e, Category 4). Type 2 is tested periodically and is for lower risks (up to PL c or d with enough testing).
Why does the safety distance change when I change the brake?
Because it includes the time the machine takes to stop: S = K × T + C. A slower stop needs a bigger distance. The stopping time must be measured on the real machine.
Do I need a safety PLC?
Not always. A safety relay does one simple function reliably and cheaply. A safety PLC is better when there are many devices, zones, modes and diagnostics, or safety-over-network devices.
References
- ISO 13849-1 and ISO 13849-2 (safety-related parts of control systems); IEC 62061 (functional safety of machinery); ISO 12100 (risk assessment).
- IEC 61496 (electro-sensitive protective equipment); ISO 13855 (positioning of safeguards with respect to approach speeds); ISO 14119 (interlocking devices); ISO 13850 (emergency stop).
- Sick, Pilz, Omron, Rockwell and Siemens safety application guides; IFA SISTEMA software and library (PL calculation).
Last reviewed: October 2026. This is an introduction with illustrative numbers. Design, validation and certification of safety functions must follow the current standards and be performed by a qualified person.