What Is a Safety Relay? How It Works and How to Wire One
A safety relay explained — how it differs from a normal relay, dual-channel monitoring, reset types, and how it wires an E-stop or guard to stop a machine safely.
A safety relay is a safety-rated logic device used in a defined safety function, typically between an E-stop, guard switch, or light curtain and the machine's final switching devices. Depending on its certified architecture, wiring, configuration, and connected feedback circuit, it can detect specified faults and prevent or remove an enable command. It does not automatically make a circuit safe or detect every possible wiring and component failure.
That sentence captures the key distinction from the start: a safety relay does not just respond to an input changing state. It monitors the input circuit itself for faults that a standard control relay would never detect.
What a Safety Relay Is
A safety relay is a self-contained DIN-rail module designed to satisfy the requirements of machine safety standards — primarily ISO 13849 and IEC 62061. It typically provides:
- Two or more safety output contacts (normally open, force guided) that switch power to hazardous actuators
- One or more auxiliary contacts (normally closed) fed back into the machine PLC for status monitoring
- Internal redundant relay channels so that a single component failure cannot result in a loss of the safety function
- A self-test or cross-monitoring circuit that verifies the internal relays have moved to the correct position on every cycle
Common safety relays are produced by Pilz (PNOZ family), Schmersal (SRB series), SICK, Rockwell (MSR series), and Siemens (3SK). Despite brand differences, the internal logic follows the same principles defined in the relevant standards.
A safety relay module alone does not make a machine safe. It is one layer in a functional safety architecture. Proper hazard analysis, risk assessment, and correct wiring of the entire safety function are still required.
How a Safety Relay Differs from a Standard Relay
This is where most questions start. A standard control relay — the type found throughout a PLC I/O panel — closes or opens a set of contacts when its coil is energised. That is its entire job. It has no knowledge of whether the contact mechanism is healthy, whether it has welded, or whether a second channel agrees with it.
A safety relay adds three fundamental properties that a standard relay cannot provide.
Force-Guided Contacts
In a standard relay, a mechanically failed NO contact (welded closed) is invisible to the rest of the circuit. The relay coil can de-energise, the coil current drops to zero, the circuit reads "open," but the welded contact is still passing current.
Force-guided contacts (also called positively guided or mirror contacts) are mechanically linked so that NO and NC contacts cannot both be closed at the same time. If a NO contact welds, the NC contact is physically blocked from closing. This mechanical constraint means you can use the NC contact as a feedback monitor — if the NC contact is open when the relay is de-energised, you know a NO contact has welded, and the module refuses to reset.
This is the physical basis of the entire safety relay architecture. Without force-guided contacts, self-monitoring is not possible.
Internal Redundancy
A safety relay module contains at least two internal relay channels wired in series on the output path. To switch the safety output ON, both internal channels must close. A single relay failure — one coil that fails to pull in, one contact that sticks open — means the output remains off. The machine stays in a safe state rather than failing into a dangerous condition.
This is described as a redundant channel architecture and is what allows safety relays to achieve Category 3 or Category 4 per ISO 13849, depending on the module and how it is wired.
Self-Monitoring
On every reset cycle, the safety relay module drives its internal relays through a test sequence and reads back the contact states through the NC feedback path. If the read-back does not match the expected state, the module latches off and raises a fault. This self-test catches:
- Welded output contacts (stuck closed)
- Open-circuit feedback loops
- Internal relay failures
- Cross-faults between channels
A standard relay has none of this logic. It will happily operate with a welded contact, a broken coil, or a wiring short — and the standard PLC program will never know.
Dual-Channel Monitoring and Cross-Fault Detection
The majority of safety relay applications use dual-channel wiring for the input device. Instead of connecting one wire from the E-stop NC contact to the safety relay input, you run two separate wires from two separate NC contacts in the E-stop button, each on its own channel (A1/S11 and S12, and A1/S21 and S22, in typical Pilz PNOZ X notation).
Dual-channel wiring gives the safety relay the ability to detect faults that single-channel wiring cannot.
| Fault type | Single-channel detects? | Dual-channel detects? |
|---|---|---|
| E-stop button opened (normal actuation) | Yes | Yes |
| Single channel open-circuit (broken wire) | No — looks like E-stop pressed | Yes — other channel still active; relay detects mismatch |
| Cross-fault (two channels shorted together) | No | Yes — both channels read same state simultaneously |
| Welded contact on output relay | Via feedback loop | Via feedback loop |
| Single input contact welded closed | No | Yes — relay detects discrepancy between channels |
Cross-fault detection is the specific capability to detect a short circuit between the two input channels. This matters because the two wires run inside the same cable harness from the E-stop back to the control panel. If insulation damage causes the two channels to short together, pressing the E-stop button opens one channel — but the short means the voltage from the still-closed channel is back-feeding the open channel. A single-channel relay sees both channels as closed and would allow the machine to run. The dual-channel safety relay detects the simultaneous transition and locks out.
Most safety relay modules require the two channels to open within a discrepancy time (typically 100–300 ms) of each other. If channel 1 opens but channel 2 remains closed for longer than the discrepancy window, the module treats this as a wiring fault rather than a normal actuation.
Manual vs Automatic Reset
After a safety relay drops out — E-stop pressed, guard opened, fault detected — the machine cannot restart until the safety relay resets. There are two reset modes, and the choice between them has direct safety and standards implications.
Automatic Reset
When the safety input is restored (E-stop button released, guard door closed), the safety relay output automatically re-enables. The machine can restart as soon as the enabling signal returns.
Automatic reset is acceptable only for low-risk applications where re-energisation cannot cause injury — for example, a light curtain monitoring access to a conveyor that travels at very low speed, where re-entry is expected during normal operation. ISO 13849 and the specific risk assessment must support automatic reset for the given application.
Never use automatic reset on an E-stop circuit in a medium or high-risk application. If an operator presses the E-stop because they are in a dangerous position, releasing the button must not restart the machine.
Manual Reset
After the safety input is restored, the operator must press a separate reset pushbutton wired to the safety relay's reset input. The safety relay confirms:
- The safety input channels are both healthy (both NC contacts closed)
- The reset button is momentarily pressed (typically a NO pushbutton)
- The feedback loop from the output contactors is closed (confirming the output contactors de-energised correctly)
Only when all three conditions are satisfied does the safety relay re-enable its outputs. This sequence ensures that a person cannot reset the machine from within the hazard zone (the reset button is mounted at a supervised location with clear view of the hazardous area), and that the output contactors have proven they can open and close correctly.
Manual reset is the standard requirement for most E-stop circuits, guard door interlocks, and any safety function protecting a Category 3 or Category 4 risk.
Typical Wiring: E-Stop, Guard Switch, Light Curtain, and OSSD
The following describes the signal flow for a typical dual-channel E-stop wiring into a safety relay, with feedback loop monitoring of output contactors.
Dual-Channel E-Stop Wiring
- Safety relay supply: Connect 24 V DC to A1 and 0 V to A2 on the safety relay module.
- Channel 1 input: Wire from the +24 V supply → through the first NC contact of the E-stop button → to the S11/S12 input of the safety relay.
- Channel 2 input: Wire from the +24 V supply → through the second NC contact of the E-stop button → to the S21/S22 input of the safety relay.
- Reset input: Wire a momentary NO reset pushbutton from +24 V to the reset terminal (S33/S34 on many PNOZ modules).
- Feedback loop: Wire the NC auxiliary contacts of both output contactors (K1 and K2) in series into the feedback/monitoring input (Y1/Y2 or equivalent). This proves the output contactors de-energised before allowing a reset.
When the E-stop button is released and the reset pushbutton is pressed:
- Both channels read closed
- The feedback loop from the contactors reads closed (contactors have dropped out)
- The safety relay pulls in both internal relay channels
- Output contacts 13/14 and 23/24 close, supplying power to K1 and K2
Guard Door Interlock Wiring
Guard door switches typically provide two NC contacts, wired identically to the dual-channel E-stop arrangement above. Tongue-release safety switches (e.g., Schmersal AZM series, Siemens 3SE5 series) provide the same dual-channel NC output structure.
Light Curtain OSSD Inputs
A light curtain with OSSD (Output Signal Switching Device) outputs provides two PNP transistor outputs — OSSD1 and OSSD2 — rather than passive NC contacts. These outputs switch high (+24 V) when the light curtain is unobstructed and switch low (0 V) when interrupted.
Many safety relays have dedicated OSSD input terminals. The OSSD inputs expect test pulses: the light curtain's OSSD outputs briefly switch off periodically to test the wiring for short circuits to +24 V. An OSSD-compatible safety relay input accepts these test pulses without falsely tripping. Connecting OSSD outputs to standard contact-input terminals may cause nuisance tripping from the test pulses.
Check the safety relay datasheet to confirm whether the input terminals are OSSD-compatible or contact-only before wiring light curtains or safety laser scanners.
Output Wiring to Contactors
The safety relay output contacts (normally open, force guided) are typically wired to energise two output contactors (K1 and K2) in series in the power circuit to the motor drive or actuator. Series contactors ensure that both must close before power reaches the hazard, and that either one opening is sufficient to cut power — providing the required redundancy on the power switching side.
The NC auxiliary contacts of K1 and K2 are wired in series back to the feedback input of the safety relay. This feedback loop is what prevents a reset if either contactor has a welded main contact: if K1 is welded, its NC auxiliary contact is open, the feedback loop is open, and the safety relay refuses to reset.
For a detailed ladder logic view of how the standard PLC interacts with this hardwired safety circuit, see the guide on E-stop safety circuits in PLC ladder logic.
Safety Relay vs Safety PLC: When to Use Which
This is the most common design decision on machine safety projects. Both devices can achieve the same safety integrity levels, but they serve different application profiles.
| Consideration | Safety Relay | Safety PLC |
|---|---|---|
| Number of safety functions | Often best for a small set of simple functions | Scales well across many interacting functions |
| Wiring approach | Hardwired, discrete | Programmed logic, I/O modules |
| Flexibility / reconfiguration | Low — rewire to change logic | High — reprogram |
| Validation effort | Validate the complete safety function and wiring | Validate hardware, software, configuration, and complete safety functions |
| Cost (low function count) | Lower | Higher |
| Cost (high function count) | Higher (many modules) | Lower (one CPU, many I/O) |
| Suitability for complex interdependencies | Low | High |
| Typical application | Single E-stop loop, guard door, two-hand control | Large machines, robots, AGVs, multi-zone guarding |
Use a safety relay when the safety logic is small, stable, and easy to express with the selected certified module, and when hardwired diagnostics and maintenance suit the machine. There is no universal function-count cutoff: module capability, zone interactions, lifecycle changes, diagnostics, wiring complexity, and validation effort drive the decision.
Use a safety PLC when the machine has many safety functions that interact with each other, when the safety logic requires sequences or timing, when integration with the standard machine PLC is needed, or when a single hardware platform needs to manage both the safety and standard control functions. The safety PLC vs standard PLC comparison covers this architectural decision in full detail.
A common hybrid approach: use a safety PLC for the main machine with complex interlocking, but retain a discrete safety relay for a simple, high-use E-stop circuit at a remote operator station — the safety relay gives a shorter diagnostic path and easier maintenance access at that station.
Note also the relationship to lockout/tagout: a safety relay manages operational safeguarding (dynamic machine guarding during normal production). Lockout/tagout is a separate administrative and hardware control applied during maintenance when energy isolation — not just motion inhibition — is required.
Safety Relay Validation Checklist
Validation proves that the installed safety function matches the risk-reduction design; it is more than checking that the E-stop turns an output off. Test every input device, channel, reset path, output-device feedback path, operating mode, loss and restoration of power, and safely simulated diagnostic fault that the design claims to detect. Measure the complete demand-to-safe-state time when that value is used in a safety-distance calculation.
The record should identify the exact device revisions, wiring drawing, settings, expected result, observed result, evidence, witness, and date. A passed generic checklist does not replace the validation plan required by the machine's risk assessment and applicable standards.
Download the editable safety-relay validation checklist (CSV). For the upstream safeguard selection, use the machine-guarding risk-review worksheet; for circuit behavior, see the E-stop safety-circuit tutorial.
Frequently Asked Questions
What is a safety relay? A safety relay is a certified logic device for safety functions such as E-stops, guard switches, and light curtains. Depending on its architecture and wiring, it may monitor redundant channels, reset behavior, output-device feedback, discrepancies, and certain short- or open-circuit faults. The manufacturer's safety manual defines which faults are detected and under what conditions.
How is a safety relay different from a normal relay? Three properties distinguish a safety relay from a standard relay: force-guided contacts (NO and NC contacts are mechanically linked so a weld on one blocks the other), internal redundancy (two relay channels in series so a single failure keeps the output off), and continuous self-monitoring (the module tests its own contact states on every cycle and latches off if anything is wrong). A standard relay has none of these properties.
What is dual-channel monitoring in a safety relay? Dual-channel monitoring means the safety relay receives two separate input signals from two separate contacts on the same input device — for example, both NC contacts of an E-stop button, each on its own wiring path. The safety relay verifies that both channels agree within a defined discrepancy time. This detects cross-faults (a short between the two channels) and single-contact faults that single-channel wiring cannot reveal.
When do you use a safety PLC instead of a safety relay? Use a safety PLC when safety functions interact across zones, require scalable diagnostics or validated program logic, or are expected to evolve beyond a practical relay architecture. Safety relays suit simple, stable functions where the hardwired design is easier to verify and maintain. The two approaches are not mutually exclusive on large machines.
