Selecting Pilz Safety Relays and Guard Switches: Risk Assessment Inputs
A machine-level checklist for defining the safety function, guard behavior, relay inputs, reset, feedback, outputs, PL or SIL target, and validation evidence.
A safety relay or guard switch cannot be selected from the machine type or a claimed maximum PL or SIL alone. Selection starts with a documented, machine-specific risk assessment, the safety function that will reduce each identified risk, the required performance for that function, and the full sensor-logic-actuator architecture. A qualified person must then calculate, design, verify, and validate the complete function using the applicable standards, local law, exact component manuals, and current reliability data.
This article is an input checklist, not a safety design or certificate. It cannot determine the required Performance Level, Safety Integrity Level, category, fault exclusions, or validation plan for a real machine. The responsible team must document the evidence behind those decisions.
Start with the machine and the hazardous task
ISO 12100 provides a process for defining machine limits, identifying hazards through the life cycle, estimating and evaluating risk, and applying risk reduction. A guard switch is considered only after the designer has examined inherently safe design measures and the need for safeguards. The assessment must cover production, setup, cleaning, jam clearing, fault finding, maintenance, and foreseeable misuse.
Factory and line | Machine and access | Hazard to assess | Safety-function question |
|---|---|---|---|
Food, beverage, or pharmaceutical packaging | Cartoner, filler, capper, or labeler with movable guard | Crushing, cutting, entanglement, hot parts, or unexpected motion during access | What hazardous motion or energy must stop or remain prevented when the guard is opened? |
Automotive or component assembly | Robot cell, welding fixture, press station, or transfer line | Robot motion, clamping, stored pneumatic energy, weld process, or adjacent-machine movement | Does opening one gate require a local stop, a coordinated cell stop, energy isolation, or a controlled access mode? |
Intralogistics | Palletizer, conveyor merge, lift, shuttle, or wrapping machine | Trapping, falling load, conveyor restart, or entry into an automated zone | Where is the safeguarded space, and how is a person detected or prevented from being inside at restart? |
General manufacturing | CNC cell, saw, mixer, winder, or automated test stand | Run-down time, rotating tool, pressure, ejection, or electrical test energy | Is simple interlocking enough, or must guard locking hold access closed until the hazard has ended? |
The answer must be written as required behavior, not as a product name. For example: opening guard G1 during automatic operation shall initiate a defined stop of named hazardous movements and prevent restart until the guard is closed, the protected area is clear, and a deliberate reset is completed from a specified location. That statement still needs timing, mode, fault, and performance requirements.
Define the complete safety-function boundary
A useful functional boundary has three parts. The sensor part may include guard switches, locking devices, emergency-stop devices, or presence sensors. The logic part may be a safety relay or safety controller. The actuator part may include contactors, drive safety functions, pneumatic isolation elements, and the mechanisms they control.
Draw the boundary on the circuit diagram and assign every component to it. Record what happens when the guard opens, a channel faults, supply power returns, a contactor welds, or a parameter is lost. Include shared outputs. A relay cannot compensate for missing fault tolerance or diagnostics in the actuator architecture.
Required input | Question to answer before product selection | Evidence owner |
|---|---|---|
Machine limits and modes | Who uses the machine, for which tasks, at what speed, and during which life-cycle phases? | Machine manufacturer or responsible integrator |
Hazard and risk estimate | What harm is possible, how often and how long is exposure, and how avoidable is it? | Qualified risk-assessment team |
Safety-function specification | What initiates the function, what outputs change, how quickly, and what safe state must persist? | Safety designer with process and mechanical input |
Required PLr or SIL | Which applicable method and machine-specific evidence establish the required risk reduction? | Qualified functional-safety designer |
Architecture and diagnostics | How are channels, test pulses, discrepancy, feedback, faults, and common cause failures handled? | Electrical and safety-control designer |
Validation | Which normal, abnormal, mode, timing, and fault tests prove the specified behavior? | Competent validator with suitable independence |
Choose the guard principle before the exact switch
The risk assessment determines whether a movable guard needs interlocking only or guard locking as well. If the hazard remains after the stop command because of run-down time, pressure, gravity, heat, or another energy, access may need to remain locked until a safe release condition is reached. Escape release, emergency release, restart prevention, and trapped-person risk must be considered for the actual enclosure.
Then check the exact Pilz guard-device manual for operating principle, actuator pairing, alignment, mounting, anti-manipulation measures, environment, diagnostics, series connection, cable, response time, and safety data. Do not transfer features between PSEN families. Positive opening, coding, misalignment tolerance, and guard-locking force need the current model document.
Mounting is part of the safety function. The actuator must not serve as a mechanical stop unless the manual permits it. Brackets, guard sag, vibration, contamination, and foreseeable defeat affect the design. The machine builder must justify and document each fault exclusion.
Match the safety relay to the circuit, not the label
Pilz lists PNOZ relays for several safety functions, but the exact operating manual controls the application. Confirm input type, channels, test-pulse and short-circuit behavior, series connection, supply, reset and start mode, feedback, output and load, contact protection, reaction time, environment, mission time, and safety data.
Reset logic needs a written decision. Automatic reset can create an unexpected restart. Manual or monitored reset has requirements for button location, view of the danger zone, edge detection, and separation from normal start. Closing a guard or releasing an emergency stop is not permission for hazardous motion.
Feedback must match the final switching elements and detect the specified failures. Check output protection and load against the relay manual and connected devices. Response time includes sensor, logic, outputs, final elements, machine stopping, and communication or filtering delays. A family maximum is not enough.
PL, SIL, and category belong to the complete function
ISO 13849-1 provides a methodology for safety-related control-system parts and does not prescribe the required PLr for a specific machine. IEC 62061 covers design, integration, and validation of safety-related control systems for machinery. Which route applies, and how local or machine-specific standards affect it, must be decided by the responsible engineer.
Under ISO 13849, the result can depend on category, MTTFd, diagnostic coverage, common cause measures, mission time, software, systematic behavior, and validation. Wear components can require B10D and cycle data. IEC 62061 also considers subsystem architecture, failure rates, diagnostics, common cause, systematic integrity, integration, and validation. Use current data for the exact order code and revision, including a current SISTEMA library where applicable.
A product page stating that a family can reach a high PL or SIL does not mean every circuit with that product reaches it. Nor does a dual-channel input, by itself, prove a category or diagnostic coverage. The calculation must include the sensor, logic, actuator, wiring assumptions, operating frequency, and every justified fault exclusion. The achieved value is compared with the required value for each defined safety function.
Validate behavior, faults, and every operating mode
Verification checks that the design and calculations meet the specification. Validation checks the implemented function on the real machine. ISO 13849-2 or the validation requirements of the chosen standard and applicable machine standards may be relevant. The validation plan should be written before final commissioning and executed by competent people with the required independence.
Tests normally cover each guard and mode, stop and restart prevention, reset, feedback, power interruption, designed wiring faults, channel discrepancy, diagnostics, stopping time, release timing, and neighboring zones. Exact cases depend on risk and architecture. Fault simulation requires a controlled method that does not expose personnel.
Record the instrument used, circuit revision, software and parameter versions, test conditions, expected result, actual result, faults found, corrections, and final approval. Any later change to a switch, relay, actuator, program, parameter, wiring, guard, stopping time, production mode, or adjacent machine can trigger review and revalidation.
Information needed for an engineering or RFQ review
Provide the machine description, jurisdiction and destination market, risk-assessment revision, applicable type-C standard if one exists, list of hazards and tasks, safety-function specification, PLr or SIL target with its method, circuit and pneumatic diagrams, guard type and access geometry, stopping time, operating modes, reset and restart concept, sensor and final-element part numbers, supply and loads, output architecture, diagnostic and feedback needs, environment, cycle demand, current calculations, exact Pilz manuals, software versions, and validation plan.
If these inputs are missing, request document support or a qualified machine-safety review before choosing a model. WarriorZ can help identify and source components against a completed specification. WarriorZ is an independent supplier and does not claim to be Pilz or an official or authorized Pilz representative. Component sourcing does not transfer responsibility for the risk assessment, safety design, calculation, legal compliance, commissioning, or validation.
Related WarriorZ resources
Use these pages to continue the model, component, or machine-level check:
Sources and verification basis
These references support the documented facts, calculations, or engineering boundaries used in this article.
- ISO 12100:2010, Safety of machinery, risk assessment and risk reduction
- ISO 13849-1:2023, Safety-related parts of control systems
- ISO 13849-2:2012, Validation of safety-related parts of control systems
- IEC 62061:2021, Functional safety of safety-related control systems
- Pilz: Standards for functional safety and risk assessment
- Pilz: PNOZ safety relay product overview