Safety Circuit Categories, Help Me Understand Them

L D[AR2 said:

Example 1 - Wire 606 is the 24v supply so shorting it to 24v does not make sense as a fault. What controls the R601 contact?

Click to expand...

ASF said:

Cat B: designed using basic safety principles. A fault can lead to the loss of the safety function.

Cat 1: As per Cat B, plus there is a requirement to use "well tried components". A fault can still lead to the loss of the safety function, but faults are less likely due to superior component selection.

Cat 2: As per Cat 1, but also periodic checks of the safety function are required. These checks have a list of requirements and stipulations as long as my arm. Cat 2 is the devil, it's almost never ever worth it. If Cat 1 isn't enough, go straight for Cat 3 and save yourself the headache.

Cat 3: as per Cat 1, plus, any single fault does not lead to the loss of the safety function. Some (but not necessarily all) faults shall be detected at or before the next demand on the safety function. An accumulation of undetected faults can lead to the loss of the safety function.

Cat 4: as per Cat 3, except all faults shall be detected at or before the next demand on the safety system, or if this detection is not possible, an

Click to expand...

ASF said:

Your best bet is to get hold of a copy of ISO13849-1. That goes through the requirements of each safety category in detail. In (very) brief:


Cat B: designed using basic safety principles. A fault can lead to the loss of the safety function.

Cat 1: As per Cat B, plus there is a requirement to use "well tried components". A fault can still lead to the loss of the safety function, but faults are less likely due to superior component selection.

Cat 2: As per Cat 1, but also periodic checks of the safety function are required. These checks have a list of requirements and stipulations as long as my arm. Cat 2 is the devil, it's almost never ever worth it. If Cat 1 isn't enough, go straight for Cat 3 and save yourself the headache.

Cat 3: as per Cat 1, plus, any single fault does not lead to the loss of the safety function. Some (but not necessarily all) faults shall be detected at or before the next demand on the safety function. An accumulation of undetected faults can lead to the loss of the safety function.

Cat 4: as per Cat 3, except all faults shall be detected at or before the next demand on the safety system, or if this detection is not possible, an accumulation of faults will still not lead to a loss of the safety function.


It's not just a matter of "dual channel = Cat 3" or similar, you have to consider the safety function as a whole. It's about diagnostic coverage and fault tolerance and detection.


FYI, safety categories are starting to be superseded by PL (protection level). Categories will still exist, but as a broader part of an assessment. You might have one system that has Cat 3 architecture and uses oversized safety contactors and other methods to ensure a higher MTTFd (mean time to dangerous failure), so overall it reaches PLd. While next to it you have a system with category 4 architecture, but cheap nasty no-brand components and low diagnostic coverage, and so despite having a higher safety category, can only achieve a lower PL rating of PLc.

Click to expand...

LadderLogic said:

This is the text of the standard but it is too general for practical use.

Click to expand...

kekrahulik said:

For all of your questions (where you say "right,?"). The answer is yes. Guessing that doesn't help you. Guessing that all of the regulation jargon isn't helping too much either.

In broad generalizations.... yes, more redundancy is safer than less redundancy. So using a button with 99 redundant contact means that 99 contacts need to fail before your button will fail to protect some one. Yes, this is still Cat 1 because once 98 contacts have failed (and you don't know it), you are ignorantly back to a single contact failure. Is this realistic? Yes, it actually is. In most of our worlds, if the machine seems to work normally, we assume all is good. So as each contact fails and things still seem to be normal, no one goes looking for a failed contact. So yes, it is realistic that multiple things will continue to fail unnoticed.

So Cat 3 says that you need to detect failures. This is generally done by having the safety controller watch paired(redundant) contacts. If both redundant contacts on a button come on, and go off at the same time (with a very small discrepancy allowance), the button is determined to be operating normally, without a fault. However, if the controller ever sees one contact change state differently from the other, the controller determines that a fault occurred. In this case, the controller will not let you reset the estop circuit until you fix the issue with the button. To clear a fault, controllers typically need to see both contacts operate correctly from the on to off state before the controller fault can be cleared. So you need to fix the problem with the button and then exercise the button on and off to prove the contacts are working together again.

I'm sure I've butchered the example in some ways. Those who I have offended are free to respond.

Does that help?

Click to expand...

Rson said:

Generally speaking, your first example would be a waste of a safety relay if all you need is a category B.

I've attached a general guideline.

Think of category B as 'no safety'. It isn't necessarily true, but it helps to think of it that way.
Category 1 is very basic - just category B with some better ideas and components.
Category 2 is usually a single-channel circuit with feedback
Category 3 is usually a dual-channel circuit with feedback
Category 4 is possible to reach, but in my experience is thought of as a goal and not a standard. You need to monitor every single fault, which is usually cost prohibitive (think: safety relay for each e-stop, light curtain, gate switch, etc).

Click to expand...

theColonel26 said:

Thank you that is helpful, the example is too.

For Cat 4 you could also use programmable safety controller with multiple configurable IO so you could have multiple E-Stops in parallel, to separate inputs. But you could not have the E-Stops in series, because you could not monitor their individual state, correct?

Click to expand...

kekrahulik said:

Is this realistic? Yes, it actually is. In most of our worlds, if the machine seems to work normally, we assume all is good. So as each contact fails and things still seem to be normal, no one goes looking for a failed contact. So yes, it is realistic that multiple things will continue to fail unnoticed.

Click to expand...

Rson said:

It has been a while since I have done something really safety intensive, but yes I believe you are correct.

An ethernet safety controller could provide that level with monitoring to the PLC the status of all the safety devices.

Click to expand...