A Normal Sensor Is Not a Safety Device, and That Distinction Is Legal

A machine has a hazardous area. Somebody proposes fitting a photoelectric sensor across the opening, wiring it to the PLC, and having the program stop the machine when the beam breaks.It will work. Demonstrate it to anyone and it stops every time.It is also not a safety function, and the difference isn't paperwork. It's a set of specific failure modes that the arrangement cannot detect.

What's wrong with it

A standard sensor can fail energised. A shorted output transistor, a damaged cable pressing a conductor against supply, water in a connector — several ordinary faults leave the output permanently indicating clear. The sensor is broken, the beam is blocked, and the machine keeps running. Nothing anywhere in that system knows.A standard PLC is not trustworthy for this. A general-purpose controller runs a program on hardware without the diagnostic coverage a safety controller has. A corrupted memory location, a scan overrun, an input card fault — these are rare, and "rare" is not the standard applied to something that stops a machine from removing a hand.There's no redundancy and no self-test. One channel, one path, no comparison, no proof test. A safety device has two independent channels cross-monitored, and it tests its own ability to switch continuously.Nobody can tell it's broken. This is the real problem. The failure is silent. The guard has been non-functional for six weeks and everything looks normal, because looking normal is exactly what the failure produces.

How the standards frame it

Machine safety is built around the idea that you determine how much risk reduction a function needs, and then build the function to a level that delivers it.ISO 13849-1 expresses this as Performance Level, PL a through PL e. You assess severity of injury, frequency of exposure and possibility of avoidance, arrive at a required level, and then design a system whose architecture, component reliability and diagnostic coverage achieve it.IEC 62061 covers the same ground in SIL terms, SIL 1 to SIL 3, from the process-industry tradition. The two coexist and there are mapping tables between them.IEC 61496 covers electro-sensitive protective equipment specifically, and defines Type 2 and Type 4 for light curtains. Type 4 has higher diagnostic coverage and detects a single fault before or at the next demand. Type 2 relies on periodic testing and is only suitable for lower required performance levels.A sensor without a rating under these standards has no assessed position in this framework. It isn't a lower-rated safety device — it's outside the scheme, and no risk assessment can be closed with one in the safety function.

The three parts, all of which must qualify

A safety function is a chain — detect, evaluate, act — and its performance level is limited by its weakest element.Detection is the safety-rated device: light curtain, safety switch, safety mat, scanner. Dual outputs, self-testing.Evaluation is a safety relay or safety controller. Redundant processing, cross-monitoring, defined safe state.Actuation is the contactor or valve that removes energy, usually with mechanically linked contacts so its actual state can be read back.Fit a Type 4 curtain and wire it into a standard PLC and standard contactor, and you have a Type 4 sensor in a system that is not. This happens frequently and it is exactly the kind of thing an inspection finds.

Where the legal weight sits

In the EU, machinery placed on the market must meet the essential health and safety requirements of the applicable machinery legislation, and employers have separate duties for equipment in use. Harmonised standards are the practical route to demonstrating compliance. In the US, OSHA regulations apply to machine guarding with ANSI standards providing the technical detail.Under any of these, "it worked when we tested it" is not a defence. What's required is a documented risk assessment, a specified performance level, components selected against that specification, and validation that the installed function achieves it.

The pragmatic advice

Use safety-rated devices for safety functions and standard devices for everything else, and don't let the two blur. Standard sensors are excellent at process control, part presence, position feedback and interlock indication — that's most of the sensors on any machine, and suppliers like GTRIC, an industrial automation supplier serve that entire range.The distinction to hold onto is that a device's rating is a statement about its assessed behaviour under fault conditions, not about how well it works. Both categories work. Only one of them is designed around what happens when it stops working, and only that one belongs in a function that exists to prevent an injury.When in doubt, the risk assessment is the document that decides — not the sensor catalogue, and not what stopped the machine successfully during the demo.