The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
ISO 13849 Category 3 is a redundant safety architecture: two channels carry the safety function through the input, logic and output stages, so one fault must not remove that safety sub-function. A Category 3 design can achieve Performance Level (PL) d—and, with suitable component reliability, diagnostics and common-cause controls, potentially a higher PL—but the category label alone is not a PL claim.
In practice, a dual-channel emergency stop or guard circuit uses a safety relay or controller, monitored final switching devices and an external device-monitoring (EDM) feedback loop. The complete function must then be calculated and validated for MTTFD, diagnostic coverage, common-cause failure (CCF), PFHD and the required PL. This guide explains the architecture, fault handling, Cat 3 versus Cat 4, design steps and validation limits under ISO 13849-1:2023.
As an Amazon Associate I earn from qualifying purchases.
What does ISO 13849 Category 3 mean?
Category 3 means the safety-related control system uses redundant channels so that a single fault does not lead to loss of the safety sub-function. ISO 13849-1:2023 also expects that the fault be detected whenever reasonably practicable, while allowing that some faults can remain undetected for a period. The subsystem must have at least low diagnostic coverage overall, channel MTTFD appropriate to the required PL, and measures against common-cause failures.
The category describes architecture, not the final performance level. PL is determined from the architecture together with component reliability, diagnostics, CCF controls and systematic-safety evidence. A Cat 3 circuit built from poorly specified components or wired without fault exclusions may fail to achieve PL d. Conversely, a carefully engineered Cat 3 architecture can sometimes support a PL above d when the quantitative and qualitative requirements are met. The Cat 3/PL d association shown in ISO 13849-1:2023 Table 8 is an illustration for suitable, well-tried components—not a certificate for every device marked “Category 3.”
#1 Best Overall
- Notifier FRM-1 - Control Relay Module
- #1 Supplier for Fire Safety Equipment in North America. Our company is dedicated to help and supply your fire equipment needs with the best prices Worldwide.
- We have the most dedicated customer service team to help you with any question regarding our products and your orders.
What “single fault” covers
Designers consider faults such as a broken conductor, a short between channels, a short to another potential, a stuck reset contact, a welded contactor and an internal failure in the logic device. A single fault must not defeat the safety sub-function. If a fault is not detected immediately, the circuit still has to remain safe until the required diagnostic action or a second fault is considered under the applicable category rules.
Why category and PL are separate labels
Category is a structural concept. PL is a probabilistic and qualitative result for a defined safety function, expressed from PL a through PL e. The required PL comes from the machine risk assessment; the achieved PL comes from the validated input, logic, output and interconnection chain. “Cat 3 relay” therefore describes a component or architecture, while “PL d for the emergency-stop safety function” is a claim about the complete application.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →How does a dual-channel Category 3 safety circuit work?
A typical circuit has two independent input paths, safety logic that monitors them, two safety outputs and feedback from the final switching devices. The exact internal circuit of a certified relay or controller may differ from a simple block diagram, but the safety function must still be analysed as a complete chain.
1. Two-channel input
An emergency-stop button commonly provides two normally closed (NC) contacts. A guard switch may provide two independent contacts or two coded channels. The channels should be physically and electrically independent enough that one conductor fault does not bridge both channels. The input device, terminal arrangement and any fault exclusions used in the calculation must be documented.
2. Safety logic
A safety relay or safety controller checks the two channels and applies its internal diagnostics. Depending on the exact model, this can include simultaneity monitoring, cross-fault or short-circuit detection, reset supervision and internal self-tests. The device must be selected for the input type, supply voltage, response time, reset mode and required PL; a generic control relay is not automatically a safety relay.
3. Redundant output
Two force-guided relay outputs or equivalent semiconductor outputs control separate final switching elements. In a motor circuit, these are often two contactors arranged so that one welded contact cannot keep hazardous energy applied after a stop command. Output ratings, utilization category, switching frequency and the load’s stopping time belong in the validation file.
4. EDM feedback
Auxiliary NC contacts from each contactor return to an external device-monitoring loop. If a contactor welds or remains energized, the feedback state does not agree with the commanded state and the safety relay inhibits reset. EDM detects many output faults, but it does not replace correct channel separation or the logic device’s own diagnostics.
5. Reset and restart behavior
Manual reset should require a deliberate action from outside the hazard zone and should not itself create an unexpected start. Automatic restart can be appropriate only where the risk assessment and machine standard permit it. A reset circuit stuck closed, a reset button shorted, or a reset location with poor visibility must be treated as safety-relevant faults.
How are faults detected in a Category 3 circuit?
Category 3 requires detection whenever reasonably practicable, but it does not demand the near-complete diagnostic coverage and fault-timing constraints associated with Category 4. Detection is distributed among the input device, wiring, safety logic and feedback loop.
| Potential fault | Typical detection or control | Important limitation |
|---|---|---|
| Welded contactor | EDM uses force-guided auxiliary contacts to block reset | Feedback must be wired to the safety device and its contacts rated and validated |
| Short or cross-fault between input channels | Safety relay/controller cross-fault monitoring, separated wiring and suitable test pulses | Not every device detects every short; confirm the exact model documentation |
| Broken conductor | NC input logic usually appears as an open channel and prevents reset | A fault exclusion cannot be assumed without installation evidence |
| Stuck or bypassed reset | Manual reset supervision, location outside the hazard and restart interlocking | Reset supervision does not compensate for an unsafe operating procedure |
| Internal logic failure | Certified safety relay/controller architecture and internal diagnostics | The component certificate does not validate the machine’s complete function |
| Common-cause environmental failure | Separation, protected routing, appropriate voltage supplies, EMC and environmental controls | Two identical channels can fail together if CCF measures are ignored |
When a fault cannot be detected immediately, the validation must show why the safety function remains available and how the fault is eventually revealed. Category 3 is not permission to leave one channel unmonitored; it is a defined balance between redundancy and diagnostic coverage.
Rank #2
- Edwards SIGA-CR Control Relay Module
- #1 Supplier for Fire Safety Equipment in North America. Our company is dedicated to help and supply your fire equipment needs with the best prices Worldwide.
- We have the most dedicated customer service team to help you with any question regarding our products and your orders.
What is the difference between Category 3 and Category 4?
Both categories use redundancy, but Category 4 demands stronger diagnostics, higher channel reliability and tighter control of fault accumulation. The required category follows the risk assessment and the target PL, not a preference for a particular relay.
| Axis | Category 3 | Category 4 |
|---|---|---|
| Effect of a single fault | A single fault must not cause loss of the safety sub-function | A single fault must not cause loss of the safety function |
| Fault detection | Detect faults whenever reasonably practicable; some can remain temporarily undetected | Faults must be detected in time to prevent loss of the safety function |
| Diagnostic coverage | At least low diagnostic coverage for the total subsystem; partial monitoring is typical | Higher diagnostic coverage, commonly described as full monitoring |
| Channel MTTFD | Can range from low to high, depending on the required PL and calculation | Each redundant channel requires high MTTFD |
| Undetected-fault accumulation | A later fault can eventually cause loss of function; the analysis must account for this possibility | Fault accumulation is explicitly considered and tightly constrained |
| Typical design target | PL d in many machine-risk designs when the calculation supports it | PL e designs when the risk assessment requires the higher level |
| Engineering burden | Redundancy, low-or-better DC, CCF controls and validation | All Category 3 controls plus stronger diagnostics, high channel MTTFD and fault-detection timing |
Festo’s illustrated architecture examples describe Category 3 as dual-channel with partial monitoring and Category 4 as dual-channel with full monitoring. That illustration is useful for understanding the distinction, but the actual design still needs a calculation for the specific safety function. Upgrading a relay to a Cat 4-labelled model does not make an otherwise inadequate machine Cat 4.
How is PL d calculated for a Category 3 safety function?
PL d is established from the entire safety function, not from the emergency-stop button or relay alone. The calculation combines category architecture, MTTFD, average diagnostic coverage (DCavg), CCF measures and the resulting PFHD, then compares the result with the PL required by the risk assessment.
Define the safety function first
Write what must happen and under which conditions. For example: “When either emergency-stop channel opens, hazardous motor torque is removed, contactors drop out, and restart is inhibited until the fault is cleared and a deliberate reset is completed.” Include the response time and the safe state. A vague function produces an unreliable calculation.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesSplit the function into subsystems
Analyse input, logic and output subsystems, including wiring and interfaces. The input may include the emergency-stop contacts and terminals; the logic may be a safety relay; the output may include relay contacts, contactors, EDM contacts and the power switching path. The weakest subsystem can limit the achieved PL.
Establish MTTFD
MTTFD represents the mean time to dangerous failure of the safety-related channels. Use manufacturer data, recognized component values and the actual duty cycle. Category 3 does not automatically require high MTTFD for every channel, but the required PL may make higher values necessary. Do not substitute a marketing label for documented reliability data.
Determine DCavg
DCavg expresses how effectively dangerous failures are detected. EDM, cross-fault monitoring, test pulses and discrepancy checks can contribute, provided their coverage is documented. Category 3 needs at least low diagnostic coverage for the total subsystem; Category 4 requires a higher level and detection in time to prevent loss.
Check CCF controls
Redundancy fails if both channels are exposed to the same cause. Evaluate physical separation, different routing where appropriate, protection against overvoltage and contamination, electromagnetic compatibility, thermal stress, common power-supply failures and design or software errors. Record the measures and the evidence supporting them.
Recommended Free Tools
Calculate PFHD and compare with the required PL
PFHD is the average probability of a dangerous failure per hour for the safety function. Combine the subsystem results using the method required by ISO 13849 and the validated component data. The final PL is the lower result imposed by the architecture, MTTFD, DCavg, PFHD and systematic-safety requirements. A component certificate cannot replace this application calculation.
What does a conceptual Cat 3 emergency-stop circuit look like?
The following pattern illustrates the logic without certifying any particular machine or wiring arrangement.
Rank #3
- Digital display DC voltage detection, control the relay output.
- DC 6~80V relay interface board with 2 buttons for easy operation. With clear LED display, convenient to check the value.
- Adjustable Voltage Detection Range: DC 0~99.9V.
- When the measured voltage is lower than the lower limit or higher than upper limit value, the relay works. Can be used for voltage detection switch, battery over/under voltage protector or discharge meter. Comes with a cover for protection.
- Input: Two independent NC contacts from an emergency-stop button enter the two safety inputs of a safety relay or controller.
- Logic: The device checks channel state, reset conditions and the diagnostic features supported by that model, such as simultaneity or cross-fault monitoring.
- Output: Two safety outputs drive separate contactors or equivalent final switching elements that remove hazardous energy.
- Feedback: Auxiliary NC contacts from both contactors form the EDM loop. A welded or stuck contactor prevents reset.
- Validation: The designer evaluates the complete chain for MTTFD, DCavg, CCF, PFHD, response time and the required PL, then documents assumptions and any justified fault exclusions.
This arrangement is a conceptual Cat 3 pattern. It is not a wiring certificate, and it does not guarantee PL d without the component data, installation details and validation records.
Do I need a safety relay for a Category 3 emergency stop?
Usually, a dedicated safety relay or safety controller is the practical way to implement the monitored, redundant logic, but ISO 13849 does not require one particular product form. A safety PLC, configurable safety controller or another validated architecture can perform the logic if it provides the required diagnostics and evidence.
Free tools Windows power users keep installed
One-click scans. No signup required.
A conventional control relay is unsuitable when it cannot detect relevant faults, provide force-guided contacts or supply the required safety data. The final choice depends on input type, channel arrangement, reset mode, output load, response time, supply voltage, environmental conditions, short-circuit monitoring and certification. The emergency-stop device, relay, contactors and wiring must be assessed together.
Documented device examples
ReeR’s AD SRE3 is documented as a Category 3, PL d safety interface for emergency stops and safety switches. Its published features include guided-contact relays, EDM feedback, automatic or manual restart, two channels and two normally open safety outputs. Those features describe the device; the machine designer still has to validate the application.
Omron’s G9SB-3010 datasheet gives a two-channel limit-switch input example evaluated as PL d/Category 3 equivalent and explicitly states that the customer must evaluate PL in the actual application after confirming usage conditions. Confirm the exact model’s supply voltage, input type, reset behavior, output contact rating, response time, short-circuit monitoring and certification before specifying it.
Useful search terms when sourcing hardware
- “dual-channel safety relay”
- “Cat 3 PL d safety relay”
- “emergency-stop safety relay”
- “guard switch safety relay with EDM”
Use these phrases to find candidate devices, then read the model-specific manual and safety data rather than relying on the search result or a distributor description.
How do I design and validate a Cat 3 circuit?
Validation is a documented engineering activity, not a final checkbox. Follow the sequence below for each defined safety function.
- Complete the machine risk assessment. Determine the required PL and whether a safety function must reach PL d, PL e or another level.
- Define the safe state and timing. State what energy must be removed, how quickly it must be removed and what conditions permit a restart.
- Choose the architecture. Decide whether two channels, monitored outputs and EDM provide the needed category, or whether Category 4 diagnostics are required.
- Specify every device. Record part numbers, safety data, contact ratings, operating cycles, response times, environmental limits and certificates.
- Design channel independence. Route channels to avoid shorts and common damage, protect them from the environment and document any fault exclusions.
- Implement reset and restart controls. Place manual reset where the operator can see the hazard area, prevent automatic restart where the risk assessment forbids it and supervise the reset circuit.
- Calculate the result. Determine MTTFD, DCavg, CCF and PFHD for input, logic, output and interconnection subsystems.
- Verify the physical stop. Measure or establish stopping time, contactor drop-out behavior and the time needed to reach the safe state.
- Validate faults. Test open circuits, channel shorts where supported, welded contactors, reset faults, loss of supply and other reasonably foreseeable failures.
- Maintain the records. Keep schematics, calculations, assumptions, test results, software versions and operating instructions with the machine’s technical file.
What testing and proof-test interval does Category 3 require?
There is no single universal monthly, per-shift or annual proof-test interval for every Category 3 system. The applicable type-C machine standard, risk assessment, component instructions and validation documentation determine the interval.
DGUV/IFA guidance discusses example intervals for electromechanical outputs and emphasizes detection wherever reasonably possible, but those examples are not a blanket ISO 13849 rule. The maintenance plan should specify what is tested, the fault that the test is intended to reveal, the acceptance result and the action when the test fails.
Typical checks to define in the maintenance plan
- Operate each emergency-stop and guard device and verify that hazardous motion stops within the validated time.
- Confirm that a reset cannot restart the machine without the defined restart conditions.
- Check EDM behavior by verifying that a simulated or real contactor fault prevents reset, using the method permitted by the machine documentation.
- Inspect channel wiring, terminals, protective routing and signs of contamination, crushing or unauthorized bypasses.
- Record failed tests, remove the machine from service when the safety function is not reliable and investigate the root cause before returning it to operation.
What mistakes prevent a Cat 3 design from achieving PL d?
Most failures arise from treating a component label as the result or from overlooking the wiring and final switching devices.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #4
- The volume is small and the performance is stable and reliable, high receive sensitivity, Signal can pass through walls, floors and doors. Max range is up to 164ft/50m with no obstacle.
- DC 12V 1-Channel Wireless Remote Control Relay Switch .The receiving module provides high signal sensitivity at lower cost and resist interference for excellent stability.
- The rf relay adopts non-directional wireless encoding technology, allowing independent control without mutual interference.
- The programmable rf transmitter and receivers can be flexibly configured in quantity and in operating modes.
- It is widely used in industrial control and security fields, such as light, motor, remote controller, wireless security alarm, wireless door alarm, wireless controller, etc.
- Using one contact: A single emergency-stop contact or one contactor does not create a redundant Cat 3 architecture.
- Ignoring EDM: Without feedback, a welded output contact may remain undetected and permit an unsafe reset.
- Assuming two wires are independent: Channels routed together or sharing vulnerable terminals can fail from one physical event.
- Choosing a relay by category alone: The device may not support the required supply, input type, load, response time or diagnostic method.
- Skipping the risk assessment: Cat 3 may be insufficient when the required PL is e or when fault-detection timing demands Category 4.
- Overlooking reset faults: A stuck reset button or hidden reset location can create an unexpected restart hazard.
- Failing to include the load: Contactors, valves, drives and their feedback contacts are part of the safety function.
- Claiming a universal test interval: Maintenance frequency must come from the applicable machine standard and validation evidence.
- Using undocumented fault exclusions: A claimed exclusion for a short, break or mechanical failure needs installation and component evidence.
When should a design use Category 4 instead?
Choose Category 4 when the risk assessment requires PL e or when a single undetected fault could allow loss of the safety function before detection. Category 4 adds higher diagnostic coverage, high MTTFD for each channel and explicit limits on fault accumulation.
Examples include applications where a second fault is credible before the next diagnostic opportunity, where the hazardous movement cannot be stopped safely after a latent fault, or where a type-C standard specifies the higher architecture. The decision should be made during risk assessment, not after a Cat 3 calculation fails.
What should the final technical file contain?
A defensible file lets another engineer understand what safety function was claimed and why the result is valid. Include:
- Machine risk assessment and required PL for each safety function.
- Functional descriptions showing inputs, logic, outputs, safe state and restart conditions.
- Electrical schematics identifying both channels, EDM wiring, reset circuits and protective devices.
- Part numbers, manufacturer safety data, certificates, manuals and software or configuration records.
- MTTFD, DCavg, CCF and PFHD calculations with assumptions and fault exclusions.
- Validation procedures, measured stopping times, fault-injection results and unresolved limitations.
- Inspection and proof-test instructions tied to the applicable machine standard and operating environment.
What is the practical verdict on Category 3 PL d?
Category 3 is the common redundant architecture for many emergency-stop and guard applications, and it can support PL d when the complete safety function has suitable reliability, diagnostics, CCF controls and validation. Two channels alone are not enough: the logic device, contactors, EDM loop, wiring, reset behavior and stopping performance all matter.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteUse Category 4 when the risk assessment demands higher diagnostics, high MTTFD in each channel or timely detection of every relevant fault. Treat manufacturer category markings as inputs to the calculation, never as a substitute for the application-specific PL determination required by ISO 13849-1:2023.
Frequently Asked Questions
Can a single emergency-stop button be used in a Category 3 circuit?
Yes, if the button provides two independent safety contacts and the rest of the safety function preserves the required redundancy and diagnostics. A single physical button is not the same as a single electrical channel; its contacts, wiring and mechanical failure modes still need to be included in the validation.
Does Category 3 automatically mean Performance Level d?
No. Category 3 is an architecture. PL d depends on MTTFD, diagnostic coverage, CCF controls, PFHD and systematic-safety evidence for the complete function.
Can a safety PLC replace a dual-channel safety relay?
It can, provided the safety PLC and its configuration are suitable for the required PL and the application is validated. The PLC’s inputs, logic, outputs, communications and final actuators remain part of the same safety-function calculation.
What happens if one channel fails open during operation?
With normally closed inputs, the safety logic should remove or maintain the safe state and prevent reset. The machine should remain unavailable until the fault is located and corrected; the exact diagnostic indication and recovery sequence depend on the selected safety device.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
