How do I make interfaces between installations from different suppliers safe?
Through a zone matrix that defines, for every safety zone, which event triggers which reaction in which other zone. The matrix is maintained by the manufacturer of the whole installation, not by the individual suppliers, because none of them knows how the neighbouring installation behaves. It is the basis for safe communication across machine boundaries.
Why is the interface the critical point?
Every supplier assesses their own scope of supply and works from assumptions about the surroundings. The conveyor supplier assumes that nobody is standing at the transfer point. The robot supplier assumes that the feeding conveyor stops on an emergency stop.
Both assumptions can be correct, but they only are if somebody reconciles them. In many projects nobody does, because it lies outside every individual scope of supply.
The typical consequences: a transfer point with a crushing hazard because each side attributes the area to the other. An emergency stop that halts one installation while the neighbouring one keeps conveying material. A restart that starts one installation although work is still going on in the neighbouring zone.
What belongs in a zone matrix?
| Column | Content | Example |
|---|---|---|
| Zone | Clearly named, spatially delimited area | Z3: palletiser |
| Triggering event | Guard door, emergency stop, light curtain, fault | Guard door Z3 opened |
| Reaction in the zone | Required stop category and state | Stop category 1, energy switched off |
| Reaction in neighbouring zones | What has to happen there | Z2 stops feeding, Z4 keeps running |
| Required performance level | PLr per safety function | PL d, category 3 |
| Signal path | Transmission medium and protocol | PROFIsafe over the network |
| Restart | Condition and reset point | Manual reset at the operator station in Z3 |
| Responsible party | Supplier or integrator | Integrator |
Which points do I have to settle per trade?
Central or distributed safety control?
| Central safety PLC | Distributed safety PLC | |
|---|---|---|
| Principle | One controller evaluates all safety signals of the installation | Each sub-installation keeps its controller, safe signals are exchanged |
| Advantage | Safety logic in one place, easier to follow | Sub-installations remain individually deliverable and testable |
| Disadvantage | Intervention in the suppliers' installations, responsibility moves entirely to the integrator | Response times and performance level evidence across the communication link are more demanding |
| Typical for | New installations from a single source | Linked lines with several suppliers, extended step by step |
In intralogistics the distributed variant predominates because installations grow step by step. That makes the zone matrix all the more important.
Sources and standards
- EN ISO 13849-1: safety-related parts of control systems
- EN 60204-1: electrical equipment of machines
- EN ISO 13857: safety distances to prevent hazard zones being reached
- Machinery Regulation (EU) 2023/1230, Annex III No. 1.1.9: protection against corruption
- Interpretation paper on assemblies of machinery (BMAS, BAuA, DGUV, VDMA, 2011)
Editions of standards and their harmonised status change continuously. Check standard numbers and editions against the current list in the Official Journal of the EU before applying them. This article is a technical classification and does not replace legal advice.
Frequently asked questions
Who produces the zone matrix?
The manufacturer of the whole installation, usually the system integrator or main contractor. The individual suppliers contribute, but they do not know how the neighbouring installations behave and therefore cannot be responsible for the matrix.
Is it enough to wire all emergency stop circuits together?
No. A continuous emergency stop circuit covers only one of many cases. Guard doors, light curtains, faults and partial operation each need their own differentiated reactions. A shared emergency stop also does not yet create an assembly of machinery.
How do I demonstrate the performance level across several installations?
Across the complete safety function from sensor to actuator, including the communication link. The PFHd values of the subsystems are added up; the weakest link limits the performance level achievable for the whole chain.
What about installations that are extended step by step?
Keep the zone matrix as a living document. Every extension is checked against the existing matrix, which is at the same time the simplest test of whether the extension amounts to a substantial modification.
Has been guiding CE projects in machinery, plant and special purpose engineering for years. That work led to Kaidoc.app, a software for standards-based CE documentation. Through Knutec.de the same work is available as a personal service.
Write me a few lines about your project. You get a first assessment back, free of charge and without obligation.
This article was produced with AI assistance and reviewed for technical accuracy before publication. Editorial responsibility within the meaning of Art. 50(4) of the AI Act (EU) 2024/1689 lies with Heinrich Knutas.
No credit card required. A complete project to try out.