What is the difference between Category 3 and Category 4?

Both are dual channel and survive a single fault. Category 3 tolerates an undetected fault accumulating with a second one; Category 4 requires faults to be detected at or before the next demand, so two faults cannot quietly stack up. In practice Category 4 needs higher diagnostic coverage and usually cross monitoring.

Is a single guard switch ever acceptable?

Yes, where the risk assessment lands on PL a, b or sometimes c and the architecture is Category 1 with well tried components. It is not acceptable at PL d or e, where a single fault must not lose the safety function.

What is fault exclusion?

A documented argument that a particular failure mode is so unlikely that it need not be considered, for example a short circuit inside a correctly sized and protected enclosure. It is allowed, it must be justified in writing, and leaning on it to reach a rating is a decision an assessor will ask about.

← Resources

Safety·7 min read·August 25, 2026

Categories B, 1, 2, 3 and 4, in plain terms

Five architectures, what a single fault does to each, and the practical wiring that goes with them.

Short answer

Category B is a single channel built to good practice: a fault loses the safety function. Category 1 is the same with better components. Category 2 adds a periodic test. Category 3 is dual channel, so a single fault does not lose the function and most faults are detected. Category 4 is dual channel with a fault detected at or before the next demand, so faults cannot accumulate.

The categories describe structure. They answer one question: when a component in this safety function fails, what happens?

Category B

One channel, built to the relevant standards, using components rated for the environment. That is the whole requirement.

A fault loses the safety function. Not might: does. Category B is the floor, and it is only acceptable where the risk assessment says a lost safety function is survivable.

Category 1

Category B, with well tried components and well tried safety principles. A positively driven contact rather than a reed switch. A mechanically linked contactor rather than a solid state relay.

Still single channel. A fault still loses the function. The difference is that a fault is much less likely, which shows up as a higher MTTFd rather than as a structural change.

This is the distinction that catches people out. Category 1 is not safer because it is cleverer. It is safer because the parts last longer.

Category 2

Single channel with a test. The safety function is checked at intervals, at startup and periodically, by something that can act on the result.

The test rate matters enormously. A test that runs once a shift protects you far less than one that runs before every demand, and the standard's arithmetic reflects that.

Category 3

Two channels. A single fault does not lose the safety function, and most single faults are detected.

This is the workhorse. In practice it means two contacts on the guard switch, two channels into the safety relay or safety PLC, cross monitoring between them, and two contactors in series with feedback from their mechanically linked auxiliary contacts.

The feedback loop is the part most often skipped and it is what turns two contactors into a monitored pair. Without it, a welded contactor is invisible and the second one carries on alone.

Category 4

Category 3, plus faults are detected at or before the next demand on the safety function, so faults cannot accumulate.

The practical difference is diagnostic coverage. Category 3 accepts medium coverage; Category 4 needs high, which usually means dynamic testing rather than static comparison, and rules out some component choices entirely.

Choosing one

You do not choose a category in isolation either. The required Performance Level from the risk assessment, the MTTFd of the parts available, and the diagnostic coverage you can achieve together decide which categories can reach the target.

PL a or b: Category B or 1 is usually enough.
PL c: Category 1 with good components, or Category 2.
PL d: Category 3, in almost every real case.
PL e: Category 3 with high coverage, or Category 4.

Where it goes wrong on site

Three failures account for most of what gets found during validation.

One contactor instead of two, because the panel was designed before the risk assessment was finished.
No feedback from the contactor auxiliaries, so a weld is never detected.
Both channels of the guard switch run in the same cable with no separation, so one crushed conduit takes out both channels at once. That is a common cause failure, and the standard scores it.

Common questions

What is the difference between Category 3 and Category 4?: Both are dual channel and survive a single fault. Category 3 tolerates an undetected fault accumulating with a second one; Category 4 requires faults to be detected at or before the next demand, so two faults cannot quietly stack up. In practice Category 4 needs higher diagnostic coverage and usually cross monitoring.
Is a single guard switch ever acceptable?: Yes, where the risk assessment lands on PL a, b or sometimes c and the architecture is Category 1 with well tried components. It is not acceptable at PL d or e, where a single fault must not lose the safety function.
What is fault exclusion?: A documented argument that a particular failure mode is so unlikely that it need not be considered, for example a short circuit inside a correctly sized and protected enclosure. It is allowed, it must be justified in writing, and leaning on it to reach a rating is a decision an assessor will ask about.