The monitored logic behind stopping hazardous motion

A safety relay is a control module that monitors devices such as emergency stop buttons, guard interlocks or compatible light curtains and initiates a defined safe state. Its role extends beyond switching an output: it detects faults covered by its design and prevents re-enabling when the required conditions are not met. Typical applications include packaging machines, conveyors, presses and robot cells.

A safety function includes input devices, evaluation logic and final switching elements. The relay provides the logic stage. Rather than disconnecting motor power directly, it often controls external contactors or a drive’s safety inputs. The required safe state depends on the machine’s hazards; simply removing power may not be sufficient for every application.

How it differs from an ordinary relay or standard PLC

An ordinary relay changes its contacts in response to its coil command. Depending on the model, a safety relay incorporates redundancy, internal diagnostics, input consistency checks and feedback monitoring. Being able to program a stop sequence in a smart relay or standard PLC does not automatically make that device a safety controller. A safety function requires suitable hardware, software and a validated architecture.

What does dual-channel monitoring check?

Two separate contacts of a suitable emergency stop button can be connected to a dual-channel input. The module checks whether both channels change state as expected. Detection of channel discrepancies, broken wires or cross-circuits depends on the product, wiring and configuration. Using two wires or two contacts does not, by itself, establish a particular safety level.

A dry-contact input and a light curtain’s OSSD safety outputs are different electrical interfaces; the module must support the connected device. Likewise, a general-purpose limit switch does not become a safety interlock simply because it detects a guard. A normal stop button provides an operational stop, whereas the emergency stop function is a separate safety function used alongside other protective measures.

Why monitor the external contactors?

If a main contact in an external contactor welds closed, switching off the safety relay output alone does not prove that the load has been disconnected. External device monitoring, or EDM, can check the return state through suitable contactors’ normally closed auxiliary contacts with a documented mirror-contact relationship. In the designed circuit, failure to return to the expected state prevents re-enabling. An arbitrary normally closed auxiliary contact is not sufficient evidence of suitability.

For example, opening a conveyor guard causes the safety outputs to initiate the stopping sequence. Even after the guard closes, the EDM loop remains incomplete if a monitored contactor has not returned. Pressing reset does not remove that fault. A status or alarm output sent to the PLC must not replace a safety output unless the manufacturer explicitly specifies it for that safety use.

Reset is different from starting the machine

Manual reset restores the safety system to a ready condition once the required conditions have been met; it must not automatically start the machine. Releasing an emergency stop or closing a guard is not, by itself, a restart command either. A separate starting action is required. Depending on the module, monitored reset can also detect a reset button held or stuck in its operated state. Automatic reset is a design choice governed by the risk assessment and the complete machine control system; its availability in a menu does not make it suitable for every application.

PL and SIL apply to the complete safety function

The required performance level, PLr, or required safety integrity level is established through risk assessment. EN ISO 13849 and IEC 62061 for machinery provide frameworks for assessing safety-related control systems. A SIL assessment also extends beyond the logic module: sensors, final elements and their connections must be considered together.

A product described as suitable for applications “up to PL e” or “SIL 3” does not automatically give the connected machine that rating. Architecture, component failure data, diagnostic coverage, common cause failures and the applicable standard’s fault tolerance requirements must be assessed together. The result needs supporting calculations and functional validation.

Which specifications matter when selecting a module?

Supply voltage, input type, safety output count, load switching characteristics, reset mode, EDM support and response time must match the application. Relay response time is different from total machine stopping time; sensor, contactor, drive, brake and mechanical stopping times also contribute. If a controlled stop requires a delay, use an appropriate safety-rated timing function. An ordinary timer relay does not automatically fulfil the same safety function.

When a drive’s Safe Torque Off function is used, torque generation is disabled, but a moving load may coast before stopping. STO does not provide electrical isolation or hold a vertical load on its own. Selecting a safety relay therefore requires considering the stopping method and the machine’s actual stopping behaviour together.

Related products and information

For a comparison of general switching components, see relays and sockets. For a safety application, use the selected manufacturer’s wiring diagrams, safety data and permitted operating conditions.