iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Category 3 is a redundant safety architecture, not a performance-level rating by itself. Under ISO 13849-1:2023, a single fault in a Category 3 subsystem must not cause loss of the safety sub-function. The design normally uses two channels, diagnostics where reasonably practicable, measures against common-cause failure, and final validation of mean time to dangerous failure (MTTFd), diagnostic coverage (DCavg), and the probability of dangerous failure per hour (PFHd). With suitable components and calculations, Category 3 is commonly used for PL d designs; a category label alone never proves PL d. Category 4 adds higher diagnostic coverage, high MTTFd for every channel, and tighter treatment of accumulated undetected faults, and is used when the risk assessment requires the higher performance level.
This guide explains the architecture, shows a conceptual emergency-stop circuit, identifies the faults that must be considered, and gives a practical selection and validation process.
What does ISO 13849 Category 3 mean?
Category 3 describes how the safety-related parts of a control system are arranged. The essential requirement in ISO 13849-1:2023 is that a single fault must not lead to loss of the safety sub-function. The standard also expects the fault to be detected whenever reasonably practicable, requires at least low diagnostic coverage for the total subsystem, and requires measures to control common-cause failures.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
A Category 3 circuit therefore has redundancy from the initiating device through the logic to the final switching elements. Two independent signal paths are processed, and the outputs are arranged so that one failed component does not leave the machine in a dangerous state. The architecture is only one input to the performance-level calculation. Required PL, component MTTFd, DCavg, CCF measures, software or systematic-safety evidence, and validation all matter.
#1 Best Overall
- Designed for reliable operation in industrial automation systems.
- Compatible with various machinery to ensure safety and efficiency.
- Features advanced technology for quick response times and durability.
- Easy installation and integration into existing systems.
- Ideal for enhancing safety measures in industrial environments.
ISO 13849-1:2023 illustrates Category 3 reaching PL d when well-tried components and suitable quantitative and qualitative conditions are used. Category 3 can support other results in a complete calculation, so it is incorrect to treat “Cat 3” and “PL d” as interchangeable labels.
How does a dual-channel Category 3 circuit work?
A typical circuit carries two separate channels through the input device, safety logic, and output stage. The channels are monitored for disagreement or other detectable faults, while feedback from the final switching elements confirms that the machine can be safely reset.
Input: two independent contacts
An emergency-stop button commonly provides two normally closed (NC) contacts. A guard switch may provide two safety contacts in the same way. Each contact is wired to a separate input channel rather than placing both contacts in one undifferentiated series loop. Physical separation, appropriate conductor routing, and protection against shorting are part of the actual design, not assumptions supplied by the category number.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchLogic: a safety relay or safety controller
The safety logic checks both channels and controls restart. Depending on the certified device and its wiring, it may check whether the channels change state within an allowed time, detect a short or cross fault, supervise the reset circuit, and run internal diagnostics. A certified safety relay may contain a different internal architecture from the simple two-block drawing used in training material; the device documentation and its specified wiring are controlling.
Output: redundant final switching elements
Two force-guided relay outputs may drive two separate contactors, or an equivalent pair of final switching elements. The outputs must be capable of removing the hazardous energy identified by the risk assessment. Merely fitting two ordinary relays without evaluating their failure modes does not establish Category 3.
Feedback: the EDM loop
An external device monitoring (EDM) loop returns auxiliary NC contacts from both contactors to the safety relay or controller. If a contactor welds or remains stuck, its auxiliary contact does not return to the expected state, so the safety logic inhibits reset. EDM is especially important where a welded output could defeat the intended redundancy.
Rank #2
- Dual Voltage Capacity & High Switching Power: Rated for 60VDC 6A and 250VAC** operations, handling both low-voltage DC circuits (e.g., automotive 12V/24V systems) and high-voltage AC loads like motors or lighting fixtures without performance loss
- Industrial-Grade Durability: Engineered for 100,000+ electrical cycles and 10 million+ mechanical operations, resistant to vibration, surges, and temperature extremes (-40°C to +70°C) for reliable use in harsh environments
- Universal 5-Pin Versatility: SPDT (Single Pole Double Throw) contact configuration supports NO/NC (Normally Open/Normally Closed) wiring modes, compatible with PLC control panels, automation cabinets, and DIY projects requiring flexible circuit switching
- Quick DIN Rail Installation: Integrated 35mm DIN rail clip enables tool-free mounting in control panels, compatible with standard industrial enclosures to streamline setup and maintenance
- Safety-Certified Design: Meets UL/CSA insulation standards (tested at 5,000V AC coil-to-contact isolation), featuring flame-retardant housing and arc suppression for overload protection in commercial/industrial systems
Which faults must a Category 3 design address?
Category 3 does not mean that every possible fault is detected instantly. It means a single fault must not cause loss of the safety sub-function, and faults should be detected when reasonably practicable. The design team must analyze the complete input, logic, output, wiring, power, and mechanical arrangement.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problems| Fault or condition | Typical consequence | Design response to evaluate |
|---|---|---|
| Open conductor or broken contact | One channel may remain permanently inactive or disagree with the other. | Channel monitoring, suitable diagnostics, and a reset sequence that cannot bypass the fault. |
| Short circuit between channels | A fault could make both channels appear to be in the same state. | Separate routing, appropriate test pulses or short-circuit monitoring where the device supports it, and documented fault exclusions only when justified. |
| Short to another voltage | An input may be forced to an unsafe state. | Protected wiring, compatible input technology, and the safety device’s specified diagnostic method. |
| Welded or stuck contactor | Hazardous energy may remain after a stop command. | Two output elements plus EDM feedback from both elements. |
| Reset-button failure or bypass | The machine could restart without a deliberate, safe reset. | Monitored manual reset, correct reset location, and validation of restart behavior. |
| Common-cause failure | One environmental or design problem defeats both channels at once. | Measures for wiring separation, temperature, contamination, electromagnetic effects, voltage supply, maintenance, and other CCF factors relevant to the installation. |
| Failure inside the safety logic | Input information may be processed incorrectly. | Use a device with the required safety certification and follow its approved circuit and diagnostic instructions. |
A fault that is not reasonably detectable may remain latent, but the permitted accumulation and resulting PFHd still have to be evaluated. A Category 3 claim cannot be based on counting components alone.
How do you design and validate a Category 3 PL d safety function?
Use the following workflow for each safety function, such as “opening a guard removes drive power” or “pressing the emergency stop removes hazardous motion.” The result must be a documented calculation and validation, not just a wiring sketch.
- Define the safety function. State the initiating event, the hazardous motion or energy to be controlled, the safe state, the required stop behavior, and the conditions for restart. Separate functions may have different required PLr values.
- Determine the required performance level (PLr). Use the machine risk assessment and any applicable type-C product standard. Do not select Category 3 simply because it is a familiar circuit.
- Partition the function. Identify the input subsystem, logic subsystem, output subsystem, interconnections, and any software or parameter elements. Include the emergency-stop or guard device, safety relay/controller, contactors, valves, drives, and feedback contacts that actually contribute to the stop.
- Choose a suitable architecture. A Category 3 arrangement normally has two channels and redundancy in the output. Check whether the selected safety relay or controller’s manual shows the exact input type, reset mode, EDM wiring, and output arrangement you intend to use.
- Collect component reliability data. Obtain MTTFd or B10d data, mission-time assumptions, duty cycles, switching frequency, and diagnostic information for every relevant component. Channel MTTFd must be appropriate for the required PL; it is not automatically “high” because a component is marketed as a safety device.
- Evaluate diagnostics. Determine DCavg for the complete subsystem. Include detection of channel disagreement, cross faults, output contactor faults, reset faults, and internal device failures where applicable. Category 3 requires at least low diagnostic coverage for the total subsystem; higher coverage may be needed to achieve the target PL.
- Address common-cause failures. Apply the standard’s CCF measures to power, wiring, environment, layout, maintenance, and component technology. Two channels sharing one unprotected conductor or one vulnerable supply may not be independent in practice.
- Calculate and validate. Calculate PFHd for the complete safety function, compare the achieved PL with PLr, and perform fault insertion or other validation described by the device and machine documentation. Record assumptions, fault exclusions, response time, reset behavior, and test results.
Validation must cover the installed machine, including interconnections and the way operators use the reset. A certified relay can simplify the logic calculation, but it does not validate the contactors, wiring, actuator, stopping distance, or the complete application on its own.
What do MTTFd, DCavg, CCF and PFHd contribute to PL d?
Performance level is a result of several factors rather than a single component rating.
Recommended Free Tools
- MTTFd is the mean time to dangerous failure used for the safety-related channels. Category 3 allows channel MTTFd ranging from low to high depending on the required PL and the resulting calculation. Category 4 requires high MTTFd for each redundant channel.
- DCavg is the average diagnostic coverage of dangerous failures in the subsystem. Diagnostics can identify channel disagreement, stuck outputs, or internal faults, but only if the circuit and device actually implement and test those functions.
- CCF means common-cause failure. Environmental stress, shared wiring, a common power fault, poor separation, or an identical design weakness can defeat both channels simultaneously.
- PFHd is the probability of dangerous failure per hour for the safety function. It combines the input, logic, output, and interconnection contributions and is compared with the target PL band.
- Systematic safety covers design, configuration, software, documentation, and validation practices that prevent or control systematic errors. Good component data cannot compensate for an unvalidated reset or an incorrect device configuration.
For that reason, “PL d relay” is useful shorthand for a device capability under stated conditions, not proof that every machine using it achieves PL d.
Rank #3
- 10A; COIL VOLTAGE:120VAC; CONTACT CONFIGURATION:SPDT; PRODUCT RANGE:SFP SERIES; RELAY MOUNTING:SOCKET; CONTACT CURRENT:10A; RELAY TERMINALS:QUICK CONNECT; CONTACT VOLTAGE AC NOM:240V; CONTACT MATERIAL:- ROHS COMPLIANT: YES
- 240VAC
- RELAY
- SAFETY
- SPDT
What is the difference between Category 3 and Category 4?
Both categories use redundant channels. Category 4 raises the diagnostic and reliability expectations and explicitly constrains the effect of accumulated undetected faults. Many higher-risk designs target PL e with Category 4, but the risk assessment and calculation determine what is required.
| Comparison point | Category 3 | Category 4 |
|---|---|---|
| Effect of a single fault | A single fault must not cause loss of the safety sub-function. | A single fault must not cause loss of the safety function. |
| Fault detection | Detect the fault whenever reasonably practicable; some faults may remain undetected. | Use higher diagnostic coverage and detect faults in time to prevent loss of the safety function. |
| Channel MTTFd | Low, medium, or high depending on the required PL and calculation. | High for each redundant channel. |
| Undetected-fault accumulation | Can eventually lead to loss of function and must be included in the evaluation. | Accumulation is explicitly taken into account and tightly constrained. |
| Typical design target | PL d in many machine-risk designs when the calculation supports it. | PL e where the risk assessment requires the higher level. |
| Engineering burden | Redundancy, low-or-better DCavg, CCF controls, calculation, and validation. | All Category 3 controls plus stronger diagnostics, high MTTFd in each channel, and fault-detection timing that prevents loss. |
Festo’s illustrated architecture examples describe Category 3 as dual-channel with partial monitoring and Category 4 as dual-channel with full monitoring. Treat that as an architectural explanation, not as a substitute for calculating the complete safety function.
Do you need a safety relay for a Category 3 emergency stop?
You need safety-rated logic that performs the required monitoring and achieves the target PL; that logic may be a certified safety relay or a safety controller. A standard control relay, ordinary PLC input, or pair of contacts wired directly to a machine starter does not become Category 3 merely because two wires or two contacts are present.
A safety relay is often the simplest choice for one or a few emergency stops and guards. Check that its certified application includes two-channel input, the required reset mode, EDM or equivalent output monitoring, the contact ratings and utilization category, response time, supply voltage, and any short-circuit or cross-fault detection needed by the installation. A safety controller may be preferable when several guards, muting functions, safe motion signals, or detailed diagnostics must be coordinated.
The relay’s certificate applies under stated conditions. The machine builder still has to evaluate the actuator, wiring, contactors, stopping time, access to the hazard, and maintenance procedures.
What does a conceptual Category 3 emergency-stop circuit look like?
The following sequence illustrates the logic without serving as a wiring certificate:
Rank #4
- 【ZERO SWITCHING NOISE & HUM-FREE】 The biggest upgrade from standard contactors. Features an advanced internal mechanism that completely eliminates the loud "clack" during switching (turning ON/OFF) and the annoying electromagnetic hum while holding. Truly silent operation for noise-sensitive environments like bedrooms and smart home panels
- 【110V AC & DC DUAL-MODE COIL】 Versatile universal coil accepts both 110V/120V AC (50/60Hz) and 110V DC control power. Eliminates coil burnout caused by voltage fluctuation and gives you ultimate wiring flexibility for complex automation setups
- 【2NC NORMALLY CLOSED LOGIC】 Features 2 Normally Closed (2NC) contacts—circuits remain connected by default and safely open when the coil is energized. Ideal for safety interlocks, emergency cut-offs, and default-ON automation logic
- 【HEAVY-DUTY 25A & CE CERTIFIED】 CE certified for uncompromised electrical safety. Handles up to 25A loads (AC-7a: 25A) with premium flame-retardant housing to guarantee continuous, zero-hazard operation even in enclosed spaces
- 【EASY 35mm DIN RAIL MOUNT】 Standard TH35 DIN rail snap-on design for fast, tool-free installation. Compact 18mm module width saves space in crowded enclosures. Heavy-duty screw terminals ensure rock-solid cable connections
- Two NC contacts in the emergency-stop device feed separate input channels on a safety relay or safety controller.
- The safety device verifies that both channels are in the permitted state, supervises the reset circuit, and applies its internal diagnostics.
- Two safety outputs energize separate force-guided contactors or equivalent final switching elements.
- Auxiliary NC contacts from both contactors return through the EDM loop.
- When the emergency stop is pressed, both channels open and the outputs drop out. If either contactor remains welded, the EDM state prevents reset.
- After the emergency stop is released and the fault-free conditions are restored, a deliberate reset permits re-energization only as defined by the validated machine design.
Real circuits must also consider conductor breaks, cross faults, supply faults, reset-button faults, contact bounce, response time, and the machine’s actual stopping behavior. The conceptual pattern demonstrates Category 3 logic; it does not guarantee a particular PL.
Which safety-relay specifications should you check?
When comparing devices, use the application data rather than the headline category. The following checks prevent common mismatches:
- Input type: confirm two-channel emergency-stop or guard-switch wiring, contact logic, and any required test pulses.
- Reset: verify automatic versus monitored manual restart, reset-button supervision, and prevention of unexpected restart.
- EDM: confirm that the device supports feedback from the exact contactor arrangement or final switching element.
- Outputs: check the number and type of safety contacts, force guidance, contact ratings, switching category, and permitted load.
- Diagnostics: identify what cross faults, channel discrepancies, internal faults, and output failures are detected and within what time.
- Timing: include response time in the stopping-distance calculation and in any guard-opening assessment.
- Certification: verify the stated category, PL, SIL information where provided, and the conditions under which the certification applies.
- Environment and supply: check voltage range, temperature, contamination, vibration, EMC requirements, terminal layout, and separation rules.
Useful search terms include “dual-channel safety relay,” “Cat 3 PL d safety relay,” “emergency-stop safety relay,” and “guard switch safety relay with EDM.” Manufacturer examples are application-specific and should be checked against the exact model documentation.
Documented examples
ReeR’s AD SRE3 is documented as a Category 3, PL d safety interface for emergency stops and safety switches. Its listed features include guided-contact relays, EDM feedback, automatic or manual restart, two channels, and two normally open safety outputs. Omron’s G9SB-3010 datasheet gives a two-channel limit-switch input example evaluated as PL d/Category 3 equivalent and warns that the customer must evaluate PL in the actual application. These examples show the type of information to look for; they are not a blanket approval for every installation.
How should Category 3 systems be tested and maintained?
There is no single universal monthly, per-shift, or annual proof-test interval for every Category 3 system. The interval depends on the type-C machine standard, the risk assessment, the device’s validation documentation, duty cycle, and the failure-detection assumptions used in the PFHd calculation.
Free tools Windows power users keep installed
One-click scans. No signup required.
DGUV/IFA guidance discusses example intervals for electromechanical outputs and emphasizes detecting Category 3 faults wherever reasonably possible. Use those examples only in the context for which they were developed. The machine’s technical file should state the inspection method, responsible person, acceptance criteria, and response to a failed test.
A maintenance test commonly verifies that each initiating device removes the hazardous output, each channel is recognized, the EDM loop prevents reset after an output fault, and reset does not cause unexpected motion. Test results should be recorded, and a failed safety function should place the machine out of service until the fault is corrected and the validation requirement is met.
What are the most common Category 3 mistakes?
- Equating Cat 3 with PL d: the category is an architecture; PL requires MTTFd, DCavg, CCF, PFHd, and validation.
- Using two contacts on one undiagnosed path: physical duplication without independent monitoring may not provide the intended redundancy.
- Ignoring the output stage: a well-chosen safety relay cannot compensate for one unmonitored contactor or an unsuitable valve.
- Omitting EDM: without feedback, a welded final switching element may remain hidden until a second demand occurs.
- Sharing vulnerable wiring or power: a common-cause fault can defeat both channels despite separate input contacts.
- Assuming every fault is detected: Category 3 permits some undetected faults, but their effect and accumulation must be evaluated.
- Copying a generic diagram: device terminals, reset logic, pulse testing, contact ratings, and timing differ by model.
- Quoting a universal test interval: proof-test frequency must come from the applicable machine standard, risk assessment, and validation documents.
- Resetting from an unsafe location: the operator must be able to verify that nobody is in the hazard zone, unless the validated design provides another protective measure.
What should the technical file contain?
For a defensible PL claim, retain the risk assessment and required PLr, the safety-function definition, architecture drawing, component data and assumptions, MTTFd and DCavg calculations, CCF assessment, PFHd result, device certificates and manuals, wiring and parameter records, fault exclusions, response-time and stopping-distance evidence, validation tests, inspection intervals, and change-control records. This documentation lets another engineer understand exactly which conditions support the claimed category and PL.
Frequently Asked Questions
Can a Category 3 circuit be upgraded to Category 4 by adding another relay?
Not automatically. Category 4 requires higher diagnostic coverage, high MTTFd for each channel, and controls for the timing and accumulation of undetected faults; those properties must be designed and recalculated for the complete safety function.
Does releasing an emergency-stop button automatically allow a machine to restart?
It should not unless the validated design specifically permits automatic restart under the applicable risk assessment. Many applications use a monitored manual reset so releasing the device only restores readiness, while a separate deliberate action commands restart.
Are guard switches and emergency-stop buttons interchangeable in a Cat 3 circuit?
No. Their mechanical behavior, contact arrangement, actuation, defeat resistance, and required stopping response can differ. Select and validate each device for the specific safety function and follow the safety relay’s approved wiring.
Where is the Category 3 requirement written in ISO 13849-1:2023?
The single-fault requirement is stated in clause 6.1.3.2.5. The standard’s category comparison also distinguishes Category 3 from Category 4 by diagnostic coverage and channel MTTFd, but the complete performance-level result still requires calculation.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
