Wiring 8 — Dual-Channel E-Stop with Safety Relay (Cat 3)

Dual-Channel E-Stop with Safety Relay (Cat 3)

Why Category 3?

EN ISO 13849-1 defines Performance Levels (PL a–e) for safety functions. Category 3 mandates single-fault tolerance: a single failure anywhere in the safety function — a welded contact, a broken wire, a stuck contactor — must not cause the loss of the safety function. The machine must either stop safely or the fault must be detected before the next demand. Cat 3 achieves this through redundancy: duplicate channels that independently execute the same safety action, combined with monitoring: the system detects when a fault has occurred and prevents restart until it is resolved.

Dual-Channel E-Stop

The emergency stop button in this circuit is a dual-channel device. It contains two independent NC contacts — channel 1 and channel 2 — that are mechanically linked to the same mushroom head but electrically separate. Each channel feeds a different input pair on the safety relay (S11/S12 for channel 1, S21/S22 for channel 2).

If the button is pressed, both channels open simultaneously. If one channel fails welded (stuck closed), the other still opens — the safety relay detects the discrepancy because only one channel responded, and it locks out rather than allowing restart. If one channel develops an open fault (wire break), the relay detects the immediate loss of that channel and de-energises. Either way, a single fault does not allow the machine to run unsafely.

The Safety Relay's Role

The safety relay monitors both input channels continuously. When both channels are healthy and closed, and a valid hardware reset has been issued, the relay energises its two independent output contacts (13/14 and 23/24). Each output contact drives one contactor coil completely independently. If either output contact welds shut, the other remains fully functional and will still open on the next E-stop demand — the fault tolerance extends through the relay's own output stage.

Two Independent Relay Outputs — Strict Cat 3

Output contact 1 (terminals 13/14) drives KM1's coil directly. Output contact 2 (terminals 23/24) drives KM2's coil directly. These are two electrically separate contacts inside the relay — not one contact feeding two coils in parallel or series. This means:

• If contact 1 welds: Contact 2 still opens; KM2 drops out; the series power path is broken. The motor stops.
• If contact 2 welds: Contact 1 still opens; KM1 drops out; the series power path is broken. The motor stops.
• If both weld simultaneously: This is a double fault — Cat 3 does not require coverage of simultaneous independent failures. The fault is detected by the EDM loop before the next restart attempt.

Series Contactors — Redundant Interruption

Both KM1 and KM2 contactors sit in series on the motor power circuit. Mains enters KM1's line side; KM1's load side feeds KM2's line side; KM2's load side feeds the motor. For the motor to run, BOTH sets of main contacts must be closed. If one contactor's main contacts weld shut, the other still opens on the next E-stop — power is interrupted. A single contact failure cannot leave the motor live.

Hardware EDM Loop via S33/S34

The relay's External Device Monitoring (EDM) loop uses terminals S33 and S34. S33 receives a permanent +24V supply. S34 connects to the start of a series chain: reset push-button NO contact, then KM1's NC auxiliary contact (21/22), then KM2's NC auxiliary contact (21/22), returning to 0V. The relay only re-arms when this entire loop is conducting — which requires all three conditions to be true simultaneously:

1. The operator has pressed and held the reset push-button.
2. KM1's NC aux is closed — confirming KM1 has dropped out (not welded).
3. KM2's NC aux is closed — confirming KM2 has dropped out (not welded).

If either contactor sticks energised, its NC aux remains open, the EDM loop stays broken, and the relay refuses to re-arm regardless of how many times the operator presses Reset. The fault must be resolved before the machine can restart. This is a hardware-only interlock — no PLC is involved in the safety function, so a PLC failure, program error, or power loss to the PLC cannot bypass the EDM check.

This combination — dual-channel input monitoring, two independent output contacts, and a hardware EDM loop — is the complete strict Cat 3 implementation per EN ISO 13849-1.

Wire Discipline

Safety circuits must be wired with care for identification and fault tracing. In real cabinets, safety wiring uses a distinct colour (yellow or orange in some markets) and is routed in a separate duct from standard control wiring. Every safety wire should be individually ferrule-numbered to match the wiring schedule.