A safety controller is the device that decides whether an e-stop button press, a light curtain interruption, or a safety gate opening actually shuts down the machine — and how. It reads the safety inputs, executes the safety logic (the interlock conditions, the muting sequences, the safe speed monitoring, the stop category assignment), and drives the safety outputs that remove power from the hazardous motion. The architecture choice — standalone fixed-I/O controller versus expandable modular safety PLC — determines not just the hardware budget but who can program it, how safety validation is documented, and whether the machine can be reconfigured for a new product three years later without re-validating the entire safety system from scratch.
Standalone Safety Controllers: Fixed I/O, Fixed Cost, Simple Validation
A standalone safety controller — sometimes called a configurable safety relay or a compact safety controller — has a fixed number of safety inputs (typically 8–24) and safety outputs (typically 2–8) in a single housing. There is no expansion bus, no plug-in I/O modules, and no firmware upgrade path to add more inputs. The safety logic is configured through a graphical software tool using drag-and-drop function blocks — AND, OR, muting, two-hand control, safe speed monitoring — and the configuration is compiled into a checksum-protected binary that is loaded into the controller.
The advantage for a machine builder shipping 50 identical machines per year is threefold. First, the controller cost is predictable — there are no I/O modules to add later because there is no expansion capability. Second, safety validation is a once-per-machine-type activity, not a once-per-machine instance activity — the fixed I/O count means the validation document never changes after the first machine is commissioned. Third, the configuration software for standalone controllers is typically simpler and has fewer parameters than the software for a modular safety PLC — configuring a standalone controller for a single safety zone with one e-stop, one light curtain with muting, and a Category 2 stop takes 2–4 hours, versus 8–16 hours for the same function on a full safety PLC with its more complex architecture and communications setup.
Expandable Modular Safety PLCs: Pay for What You Need Today, Keep Room for Tomorrow
An expandable safety PLC consists of a CPU module, a power supply module, and one or more safety I/O modules connected via a backplane bus or plug-in expansion connectors. A typical modular system scales from 8 inputs to 272 inputs by adding I/O modules in 4- or 8-channel increments. The CPU runs a safety-certified real-time operating system with a cycle time of 5–20 ms, and it communicates with the standard PLC (the non-safe machine controller) via a safety fieldbus protocol — PROFIsafe over PROFINET, CIP Safety over EtherNet/IP, or FSoE (FailSafe over EtherCAT) — that adds a safety layer (CRC, timestamp, sequence number) on top of the standard industrial Ethernet protocol.
The Schmersal PSC1 modular programmable safety controller exemplifies this architecture: it scales from a compact base unit with 14 safe inputs and 4 safe outputs up to 272 I/O points via expansion modules, supports PROFIsafe, CIP Safety, and FSoE on a single CPU, and is certified to SIL 3 / PL e / Category 4. The PSC1's programming environment supports both graphical function block programming (accessible to a machine builder's controls engineer) and structured text (accessible to a safety-certified engineer), allowing different parts of the safety program to be authored by different roles depending on complexity and liability.
Who Owns the Safety Validation? The Decision That Trumps I/O Count
The most overlooked factor in the standalone-vs-expandable decision is not hardware cost — it is who takes legal responsibility for the safety validation after the machine is modified. A machine builder who ships a machine with a standalone safety controller and a validated configuration owns the safety design for the life of the machine. If the end user adds a light curtain three years later, they cannot modify the fixed-I/O controller — they must add a separate safety relay or replace the controller entirely, and in either case, the modification triggers a new safety validation that the end user performs and signs off on. The machine builder's original validation is unaffected.
If the same machine ships with an expandable safety PLC with spare I/O capacity, the end user can add that light curtain to an unused input module, modify the safety logic, and commission the change without replacing hardware — but the end user now owns the safety validation for the modified system. Some end users want this flexibility. Others explicitly do not — their maintenance teams are qualified to replace a contactor, not to modify a safety PLC program and defend the validation to OSHA or a notified body. This organizational dimension — not the hardware catalog — is often the deciding factor.
How many safety I/O points should I plan for when specifying an expandable controller?
Count the current I/O requirement — every e-stop button, light curtain OSSD pair, safety gate switch, and enabling switch is a safety input; every safety contactor coil, safe torque off (STO) drive input, and safety relay is a safety output. Then add 30–50% spare capacity for future machine modifications — adding a conveyor infeed, a second operator station, or a robot cell interlock. And then add one more expansion module slot beyond the I/O count because the future modification that requires more I/O is also the modification most likely to need a different type of I/O — a relay output module instead of a transistor output module — which consumes a slot even if the total I/O count does not increase. If the expandable controller you are evaluating cannot accommodate I/O count + 30% spare + one spare slot, either size up to the next CPU model or accept that the machine will outgrow the safety controller within its service life. Browse our safety relay and safety gate switch categories for complementary safety hardware.
For general automation controllers that integrate with safety PLCs over fieldbus, see our PLC catalog.
