IEC 60947-5-3: Illuminated Actuators

IEC 60947-5-3

What is IEC 60947-5-3?

Defining fault behaviour in proximity sensing

IEC 60947-5-3 is the part of the IEC 60947 series that addresses proximity devices with defined behaviour under fault conditions, abbreviated PDDB. Its concern goes beyond whether a sensor detects a target: it addresses the conditions under which its output behaviour and fault response can be relied upon in a safety-related application.

IEC 60947-5-3:2026, the third edition, was published on 19 August 2026 and replaces the 2013 edition. The abbreviation PDF in older documents is an earlier designation for this device family; in that context, it does not refer to a file format or download link.

How does it differ from an ordinary proximity switch?

IEC 60947-5-2 covers general product requirements for proximity switches. IEC 60947-5-3 adds requirements concerning fault behaviour; the 2026 edition also relates to reed contact magnetic switches covered by IEC 60947-5-1. An ordinary inductive sensor therefore does not become a safety sensor simply because it detects metal. When reviewing inductive sensor standards, distinguish normal switching performance from functional safety.

Safety-related inductive sensing can use a metal target, while a coded non-contact guard sensor relies on recognising a suitable actuator. Sensing technology, coding level and safety capability are separate characteristics. PDDB products do not all use the same targets, connections or diagnostic methods.

What should happen under fault conditions?

The purpose is not to keep production running despite a fault. The device's safety-related behaviour is defined; the 2026 edition generally identifies the safe state as the OFF state. Read the product documentation to establish how the output responds to target position, the selected operating mode and specified faults. A sensor switching OFF does not physically stop every machine movement by itself.

A broken wire, a short circuit between outputs, a supply problem or an output failing to change state may require assessment of the device and its evaluation unit together. The manufacturer specifies the faults detected, response times and measures required in the external circuit. Do not assume that every possible fault is detected unconditionally or that the system remains operational after every failure.

Evaluating OSSD outputs

OSSD means Output Signal Switching Device and identifies a safety switching output. Many electronic safety sensors provide two monitored OSSD outputs. These may generate short test pulses, so the connected safety input must tolerate those pulses and meet the manufacturer's channel-monitoring requirements. An ordinary PLC being able to read the signal does not demonstrate adequate safety evaluation.

PNP or NPN describes the electrical output arrangement. Having two PNP outputs does not, by itself, establish OSSD capability or a particular PL or SIL. Compare cable length limits, input filtering, test pulses and permission for series connection against the sensor and safety controller documentation. A single wiring arrangement cannot be applied to every product.

Editor's note: An illuminated sensor LED or a changing diagnostic output does not prove that the safety function is working correctly. Treat diagnostic information and safety outputs separately. Do not substitute an auxiliary output for a safety output unless the manufacturer explicitly specifies it for that safety-related purpose.

A guard example and the limits of the scope

On a packaging machine, a suitable non-contact safety sensor can monitor whether a guard is closed. Opening the guard causes the safety control system to initiate its defined stopping function. However, detecting guard position and keeping the guard locked are different tasks. If someone can reach a hazard before dangerous movement stops, the risk assessment may require guard locking or other measures. Installing a sensor alone does not automatically resolve the access risk.

ISO 14119 is also relevant to interlocking devices associated with guards. IEC 60947-5-3 is not the product standard for light curtains or safety scanners that directly detect people; those protective devices fall under IEC 61496 and other applicable standards. Requirements specific to analogue outputs and explosive atmospheres are also outside this part's scope.

Device compliance and safety of the complete system

A PDDB serves as the sensing subsystem of a safety-related control system. The machine's function is assessed under ISO 13849 or IEC 62061, as applicable; product development also relates to IEC 61508 principles. A sensor's SIL or PL information does not automatically apply to the entire connected machine.

Assess sensing, logic and the final switching element together. A general-purpose relay and a safety evaluation module must not be treated as equivalent. Define the monitoring of any contactors, the supply arrangements and restart behaviour. Suitability of the power supply, wiring and common cause failures also forms part of the assessment.

Commissioning includes validation of targets and mounting distances, channel behaviour, stopping time and restart conditions. The sensor's safety response time is not the machine's total stopping time; controller and final-element delays must also be considered. Determine inspection and maintenance intervals from the product instructions and risk assessment, and reassess equipment changes.