Machine Safety Systems
Risk assessment, performance levels and safety integrity, emergency stops and stop categories, safety circuits, and validation.
On this page
- Why and what the law expects
- Risk assessment
- The required performance level
- Achieving the performance level
- Two channels, diagnostics and common cause
- Emergency stop and stop categories
- Safety circuits: relay or safety PLC
- Guards, light curtains and other devices
- Safety distances and stopping time
- Verification, validation and records
- FAQ
Why and what the law expects
Safety is designed in, not added at the end. The EU Machinery Directive (soon the Machinery Regulation), the UK, US (OSHA) and other regimes require a machine to be safe, and the standards describe how to show it. The machine builder carries out a documented risk assessment, chooses protective measures matched to the risk, validates them, and provides information for use. In outline: eliminate the hazard by design; where that is impossible, guard it or use protective devices; only then warn, train and rely on procedure.
| Standard | Role |
|---|---|
| ISO 12100 | General principles of risk assessment and risk reduction for machinery |
| ISO 13849-1 / -2 | Design and validation of safety-related control systems: performance levels PL a to e |
| IEC 62061 and IEC 61508 | The alternative and the basis: safety integrity levels SIL 1 to 3 |
| IEC 60204-1 | Electrical equipment of machines: stop categories, emergency stop, isolation |
| ISO 13850 | Emergency stop function |
| ISO 14119, ISO 14120 | Interlocking devices associated with guards; guards |
| ISO 13855, ISO 13857 | Positioning of safeguards; safety distances for reaching |
| IEC 61496 | Light curtains and laser scanners (electro-sensitive protective equipment) |
| Type C standards | Machine-specific standards (robots, presses, packaging, machine tools): use them first when they exist |
Risk assessment
- Define the limits of the machine: intended use, foreseeable misuse, the people (operators, maintenance, cleaners, visitors), the life cycle phases (transport, installation, operation, setting, cleaning, fault finding, maintenance, decommissioning).
- Identify the hazards in each phase and task: crushing, shearing, entanglement, impact, ejection, electrical, thermal, noise, radiation, substances, ergonomics, and the unexpected start.
- Estimate the risk of each: the severity of the harm and the probability of it (exposure, the likelihood of the event, the chance to avoid it).
- Evaluate and reduce it, in the order of design, guarding, protective devices, information; repeat until the remaining risk is acceptable.
- Document it: the hazards, the measures, the standards used, and the residual risks that the user must be told about.
- Repeat it whenever the machine changes. See the application of this method to robot cells in Industrial Robotics: Safety.
The required performance level
Where a risk is reduced by a control function (an emergency stop, a guard interlock, a light curtain, safe torque off), the function needs a certain reliability: the required performance level (PLr), a to e. ISO 13849-1 gives a risk graph from three questions: the severity of injury (S1 slight, S2 serious or fatal), the frequency or exposure (F1 seldom, F2 frequent to continuous), and the possibility of avoiding the hazard (P1 possible, P2 hardly possible).
Worked example: the risk graph
| Severity | Frequency | Avoidance | Required level |
|---|---|---|---|
| S1 | F1 | P1 | PL r = a |
| S1 | F1 | P2 | PL r = b |
| S1 | F2 | P1 | PL r = b |
| S1 | F2 | P2 | PL r = c |
| S2 | F1 | P1 | PL r = c |
| S2 | F1 | P2 | PL r = d |
| S2 | F2 | P1 | PL r = d |
| S2 | F2 | P2 | PL r = e |
- A machine where a person reaches in to load a part every minute and the press could cause a serious injury, with little chance to escape: S2, F2, P2: PL r = e. A rarely visited, slow machine with a slight injury and an easy escape: S1, F1, P1: PL r = a.
- Be honest about the answers: each question is a judgment; record the reasons. The type C standard for the machine often fixes the required level, which overrides the graph.
Achieving the performance level
The achieved performance level comes from the whole chain from the sensor to the actuator, as the probability of a dangerous failure per hour (PFHd). The bands are: PL e below 10⁻⁷ per hour, PL d 10⁻⁷ to 10⁻⁶, PL c 10⁻⁶ to 3 × 10⁻⁶, PL b 3 × 10⁻⁶ to 10⁻⁵, PL a 10⁻⁵ to 10⁻⁴. The category (B, 1, 2, 3, 4), the diagnostic coverage and the mean time to dangerous failure (MTTFd) set the PFHd of each part; the parts of a function add.
Worked example: a gate-interlock function
| Part of the safety function | PFHd (from the manufacturer’s data) |
|---|---|
| Door switch (two channels) | 1.2e-8 per hour |
| Safety relay | 2.0e-8 per hour |
| Contactors (two, monitored) | 3.5e-8 per hour |
| Wiring and others | 5.0e-9 per hour |
| Total PFHd | 7.2e-8 per hour |
- The parts add: 1.2e-8 + 2.0e-8 + 3.5e-8 + 5.0e-9 = 7.2e-8 per hour, which lies in the PL e band. (The final level also needs the right category and diagnostic coverage: to claim PL e you need category 4, or use the numbers carefully; for PL d, category 3.)
- Use certified components with their PFHd, B10d or MTTFd published by the manufacturer (SISTEMA, a free tool from the German IFA, calculates the result from such data).
- Check the whole function, including the wiring, the cable length, the reset and the monitoring of the contactors’ feedback.
Worked example: B10d and MTTFd of a contactor
- A contactor with a B10d of 2 000 000 operations (10 % of the units fail dangerously by then) switching once a minute for 16 hours a day on 250 days a year does nop = 1 × 60 × 16 × 250 = 240 000 operations a year.
- MTTFd = B10d ÷ (0.1 × nop) = 2 000 000 ÷ (0.1 × 240 000) = 83 years: high (high is 30 to 100 years; the standard caps the value at 100).
- If the same contactor switched 12 times a minute around the clock (6 307 200 operations a year), the MTTFd would be only 3.2 years: the duty cycle, not just the part, decides the number, and the contactor needs a service life: replace it after about 3.8 months at that rate (the B10d is then reached), or choose a part with a much higher B10d.
- The mission time of a safety function is taken as 20 years: replace parts that do not last that long on a schedule, and write it into the maintenance plan.
Two channels, diagnostics and common cause
To make a function more reliable than its parts, use two channels (redundancy) and monitor them (diagnostics): a fault in one is detected before the second also fails. Categories 3 and 4 require this. But two identical channels fail together for common reasons (a shared power supply, the same environment, the same design fault), and that common-cause part usually dominates.
Worked example: why the common-cause factor matters
Take a channel with a dangerous failure rate of λ = 10−6 per hour, and a proof test once a year (T = 8 760 h). A simple estimate for two channels without diagnostics, with a common-cause fraction β, is PFHd ≈ (1 − β)² λ² T + β λ:
| β | (1 − β)² λ² T | β λ | Total PFHd | Level |
|---|---|---|---|---|
| 2 % | 8.4e-9 | 2.0e-8 | 2.8e-8 | PL e |
| 5 % | 7.9e-9 | 5.0e-8 | 5.8e-8 | PL e |
| 10 % | 7.1e-9 | 1.0e-7 | 1.1e-7 | PL d |
- A single channel would be 1.0e-6 per hour. Two channels cut the failure rate by only about 10 to 40 times, not by a million, because the common-cause term β λ dominates. Reducing β (separate wiring routes, diverse components, protection against overvoltage and temperature, a measured score on the standard’s checklist) matters more than adding more channels.
- Test the safety function at least as often as assumed: a hidden fault in one channel only protects you if it is found (a proof test, or automatic diagnostics at each start).
- Use cross-fault detection (test pulses, monitored outputs) so that a short between channels is noticed.
Emergency stop and stop categories
| Stop category (IEC 60204-1) | What happens | Remarks |
|---|---|---|
| 0 | Power is removed at once; the machine coasts or is braked mechanically | Fast to implement; may be rough, long on high inertia |
| 1 | A controlled stop with power kept until the machine has stopped, then power removed | Smoother, shorter, needs a timed relay or STO after a ramp |
| 2 | A controlled stop with power kept on the actuators afterwards | For a resumable stop; not for an emergency stop alone |
- An emergency stop (ISO 13850) is a complementary measure, not a replacement for guarding. It is latching, red on a yellow background, within reach at the operator stations, and it stops the machine in category 0 or 1. Resetting it must not restart the machine.
- Wire it into the safety circuit, not the PLC. A PLC input that “reads” the emergency stop is for display; the function itself works if the PLC is dead.
- Choose category 1 (a controlled stop then removal of power) where the machine would be damaged or dangerous if coasted down: robots, heavy rotating loads, a drive with a brake. Use safe torque off after the ramp, timed by a delay relay or a safety controller.
- Wireless and teach-pendant e-stops need monitored communication and a defined behavior on loss of link.
- An emergency-stop on a network (PROFIsafe, CIP Safety, FSoE) is possible with certified devices, with its own addresses and watchdogs (see Industrial Communication).
Safety circuits: relay or safety PLC
| Choice | Strengths | Limits |
|---|---|---|
| Safety relay (fixed function) | Simple, cheap, certified, easy to understand and to test; no software | Fixed logic; grows into a tangle with many zones and functions |
| Configurable safety controller | Several functions in one device, with diagnostics and a programming tool; reduces wiring | A program to validate and to keep under change control |
| Safety PLC, integrated with the standard PLC | Flexible; safety over the network; extensive diagnostics | Higher cost; strict rules for the safety program (separation, signature, passwords) |
| Safe functions in drives and devices (STO, SS1, SLS) | Fast, local, no external relays | Certified, parameterized, tested; the drive’s manual defines the use |
- Keep the safety program separate from the standard program; use the vendor’s safety library; keep a checksum or signature of the validated version, and protect it with a password.
- Monitor the feedback (the contactors’ mirror contacts or the drive’s STO status) so that a welded contactor is noticed.
- Define the reset: a deliberate manual reset, placed so that the operator can see the danger zone, with the machine in a state where the restart is safe.
- Power the safety devices from a protected supply (see Power Distribution and the Control Supply) and keep the wiring away from noise (see Grounding, Shielding and Noise).
- Muting and bypass need their own measures: a muted light curtain for a pallet must still detect a person.
Guards, light curtains and other devices
| Device | Use | Watch out for |
|---|---|---|
| Fixed guards | Permanent barriers where access is not needed | The simplest and best; fastened so that tools are needed to remove them |
| Interlocked guards | Doors that stop the machine when opened | Coded switches that cannot be defeated with a magnet or a screwdriver; guard locking where the machine runs down slowly |
| Light curtains and scanners | Access for loading without a door | Distance from the hazard; reach over and under; reflective surfaces |
| Two-hand controls | A single operator at a press | Both hands must be on controls; they cannot be bridged |
| Enabling devices | Moving a machine under manual control | Three-position switch: moving only in the middle position |
| Pressure mats and edges | Detecting a person or contact | Less used; can be bridged |
| Safe speed and position limits | Restricting motion in a drive or robot | Certified safe-limited functions only |
Safety distances and stopping time
A protective device must be far enough from the hazard that the machine has stopped before a person reaches it. ISO 13855 gives S = K × T + C, with K the approach speed (1 600 mm/s for the hand to a gate or a light curtain, often), T the total stopping time and C an allowance for reaching in before detection.
Worked example: how far away must the gate be?
| Part of the stopping time | Time |
|---|---|
| Light curtain response | 0.020 s |
| Safety relay | 0.030 s |
| Contactor opening | 0.050 s |
| Machine run-down (measured) | 0.250 s |
| Total T | 0.350 s |
- For an interlocked gate (detection at the moment the door opens) the approach is taken at K = 1 600 mm/s: S = 1 600 × 0.350 = 560 mm from the door to the hazard if the machine has stopped before a person can reach it.
- With a light curtain of 30 mm detection capability (C = 128 mm), S = 1 600 × 0.350 + 128 = 688 mm.
- The stopping time is the lever: halving the machine’s run-down from 250 ms to 100 ms brings the total to 0.200 s and the gate distance to 320 mm. Where the run-down is long, use guard locking: the door cannot be opened until the machine has stopped.
- Measure the stopping time on the real machine at its worst case, and repeat it as brakes wear (see Testing, Commissioning and Acceptance). The same method with robots is in Industrial Robotics.
Verification, validation and records
- Verification checks the design against the specification (the PFHd calculation, the category, the architecture); validation checks by test that the safety functions do what the risk assessment needs.
- Test each safety function in every mode, including fault injection: open one channel, short two channels, pull a feedback contact; the machine must go to the safe state and not restart.
- Measure the stopping times and distances and compare with those used in the design (see Testing, Commissioning and Acceptance).
- Record everything: the risk assessment, the standards, the calculations, the test results, the versions of the safety programs and their checksums, signed and dated.
- A change to a safety function needs re-validation; keep the safety configuration under change control (see Documentation, Handover and Lifecycle).
- Provide the information for use: the instructions, warning signs, training, and the maintenance and testing intervals for the safety devices (a proof test every 12 months, for example, over a 20-year life: about 243 monthly checks).
- Mark and certify: the CE or UKCA marking and declaration of conformity (EU, UK), or listing and field evaluation elsewhere. The rules depend on the country.
This page is an introduction, not a design guide. Safety functions must be designed and validated by competent people against the current standards and the law where the machine is used.
Related
- System Integration: the overview of this guide.
- Power Distribution and the Control Supply: isolation and the supply of safety devices.
- Testing, Commissioning and Acceptance: validation tests of the safety functions.
- Industrial Robotics: Safety and Motion Control and Actuators (safe torque off).
FAQ
What is the difference between PL and SIL?
Both express how reliable a safety function must be. PL (ISO 13849-1) runs from a to e and is common in machinery; SIL (IEC 62061 and IEC 61508) runs from 1 to 3 for machinery. PL d is roughly SIL 2 and PL e is roughly SIL 3.
Can the PLC handle the emergency stop?
Not by itself. A standard PLC is not certified for safety. An emergency stop is wired into a safety relay, a safety controller or a safety PLC, so that it works if the standard PLC fails. The standard PLC can read the status for display.
Why does adding a second channel not give the failure rate of two independent parts?
Because of common-cause failure: a shared power supply, environment or design fault takes out both. The common-cause term usually dominates the result; reduce it with separation, diversity and the standard’s measures.
Who is responsible for machine safety?
The machine builder is responsible for the risk assessment, design and validation. An integrator who builds or changes a machine becomes responsible for that part. A safety function changed on site must be re-validated and documented.
References
- ISO 12100, ISO 13849-1 and -2, IEC 62061, IEC 61508, ISO 13850, ISO 14119, ISO 14120, ISO 13855, ISO 13857, IEC 61496 and IEC 60204-1.
- IFA (Germany), SISTEMA software and the Safety of machinery application guides; the HSE guide Safe use of work equipment; the EU Machinery Directive 2006/42/EC and Regulation (EU) 2023/1230.
- Manufacturers’ safety-component manuals and the machine-specific (type C) standards.
Last reviewed: October 2026. PFHd, B10d and times in the examples are illustrative: use the manufacturers’ certified data and the standards.