IEC 61496-3 Demystified — What Makes a Laser Scanner Safety-Rated

We get the question several times a quarter. An integrator has an autonomous vehicle, or a robot cell, or an AGV docking station, and somewhere in the bill of materials there is a laser scanner. The question, dressed up in different ways, is always the same: is the cheap one good enough? The honest engineering answer is that “good enough” is not the right axis. Either the device is certified to IEC 61496-3 and is allowed to authorise motion in the presence of a person, or it is not. The standard is the line.

This article is the long version of that conversation: what the IEC 61496 family actually says, what the Type test actually tests, why dual OSSD and self-monitoring matter, what detection capability really means on a datasheet, and why a navigation LiDAR — even a very good one — sits the wrong side of the line.

The IEC 61496 family in one paragraph

IEC 61496 is a multi-part standard for non-contact electro-sensitive protective equipment — ESPE for short. Part 1 is the umbrella: general requirements and the type tests every ESPE has to pass regardless of technology. The particular parts each cover one device family. IEC 61496-2 is for AOPDs — active opto-electronic protective devices, which is the official name for safety light curtains and light beams. IEC 61496-3 is for AOPDDRs — the diffuse-reflection variant, which is the official name for safety laser scanners. IEC 61496-4 is for VBPDs — vision-based protective devices, the safety-rated camera systems. The current Part 1 edition is the 2020 fourth edition; the current Part 3 edition is 2025 (a technical revision of the 2018 third edition), which is the document we will mostly mean by “Part 3” below.

Type 2, Type 3, Type 4: what the classes really mean

The Type classification in IEC 61496-1 is the single most misunderstood thing in this corner of machine safety. It is not a quality grade and it is not a marketing rank. It is a description of how the device behaves under a single fault and how thoroughly it monitors itself.

• Type 2. Relies on a periodic test — typically initiated by external logic at machine cycle boundaries — to detect a dangerous fault. Between tests, a single fault could go undetected. Suitable up to PL c / SIL 1 in a complete safety function.
• Type 3. Detects faults continuously through a dual-channel internal architecture with cross-monitoring. A single fault either causes a safe state or is detected and announced. Suitable up to PL d / SIL 2. Safety laser scanners are the canonical Type 3 device.
• Type 4. The most demanding fault-detection requirements in the standard. A single fault must never lead to a loss of the safety function. Suitable up to PL e / SIL 3. Type 4 light curtains are common; Type 4 laser scanners are not, and that is a real and frequently misunderstood ceiling for area scanning.

The two practical points to hold on to: first, a Type-3 scanner can carry a safety function up to PL d / SIL 2 but no further, regardless of how the rest of the chain is built. Second, the Type rating is for the device alone — the achieved PL or SIL of the full safety function depends on the logic and the actuator as well. We unpack the second point in our companion piece on Performance Level vs SIL.

What the type test actually tests

People talk about a scanner being “tested to IEC 61496-3” as if that were a single test. It is not. The type test is a multi-week laboratory exercise built from the general requirements in Part 1 and the particular requirements in Part 3, and it has four families of content.

1. Functional behaviour

The lab verifies that every declared safety function does what the manual says it does. Does the protective field actually stop the OSSDs when a defined object enters it, across the declared working range, against backgrounds of declared reflectivity? Is the response time at or under the declared figure under worst-case scanning geometry? Does each declared option — switchable field sets, encoder inputs, reference-boundary monitoring — meet its specification?

2. Detection capability

IEC 61496-3 covers AOPDDRs with a minimum detectable object size in the 30–200 mm range. A scanner’s certificate states the diameter of the cylindrical test piece it has been demonstrated to detect — typically 30, 40, 50 or 70 mm for two-dimensional scanners. Those figures map to real applications: 30–40 mm is the small-object band used for foot or arm detection at a point of operation; 70 mm is the leg-detection band used on horizontal floor zones with the beam at the standard 150 mm height; values up to 200 mm are used in coarser body-detection arrangements. The detection capability also dictates the mounting height permitted by IEC 62046 and the resulting safety distance under ISO 13855.

3. Single-fault behaviour

For a Type-3 scanner, this is the heart of the standard. The lab injects single faults — an open circuit on an OSSD, a stuck output, a partial loss of the laser pulse, an internal memory corruption — and verifies that the device either goes to a safe state or detects and announces the fault before the next demand. This is the test that, more than any other, separates a safety device from an ordinary sensor. An uncertified scanner is not architecturally incapable of being safe; it has simply never had to prove that it is.

4. Environmental immunity

The lab subjects the device to the full Part 1 environmental suite: temperature extremes across the declared operating range, humidity, mechanical shock and vibration to industrial levels, electrostatic discharge, fast electrical transients, surges on every port, conducted and radiated emissions and immunity to EMC limits, and optical interference from ambient light, sunlight and other scanners of the same family. Each test is followed by a functional check — the device has to still work, and still work safely, after the stress is applied. This is the part of the test most often underestimated by people who have never run it. It is also the part that an uncertified device almost never passes cleanly the first time.

Dual OSSD, and why it matters

Almost every certified scanner has the same output topology: two short-circuit-proof solid-state safety outputs — OSSDs — both of which must be active to authorise motion. The reason is exactly what you would expect. If one OSSD welds short or is shorted to 24 V by a damaged cable, the second one still drops, the safety logic sees the discrepancy, and the function still goes safe. The device also pulses each OSSD individually with brief test signals so that a downstream safety relay or PLC can detect a missing channel even when the protective field is clear. None of this is optional. A single-channel output, or a relay output without test-pulse provision, is enough on its own to disqualify a device from Type-3 certification.

Self-monitoring: optical, electrical, microprocessor

A certified AOPDDR runs three concurrent self-checks. Optical self-monitoring continuously verifies that the laser pulse energy and the receiver sensitivity are in band — if dirt accumulates on the window or the emitter degrades, the device announces a fault before it can quietly under-detect. Electrical self-monitoring watches the power supply, the OSSDs and the internal rails. Microprocessor self-monitoring uses dual-channel logic (and on many designs a redundant processor pair) to run safety-critical computations twice and compare the results. The standard does not prescribe the implementation; it prescribes the outcome. The certificate is the evidence that the outcome was actually demonstrated.

The application standard: IEC 62046 and ISO 13855

The device standard tells you what makes a scanner safe. The application standard tells you how to use it. IEC 62046:2018 covers the selection, positioning, configuration and commissioning of ESPE — including AOPDDRs — for the protection of persons in machinery applications. It works alongside ISO 13855, which gives the safety-distance calculation. The two together tell you how high to mount the scanner, how far the protective field has to extend in front of the hazard, what reach-over and reach-under cases you have to consider, and how to verify that the resulting installation actually stops the machine before a person can reach the danger zone. A scanner that meets Part 3 is necessary; the right installation under Part 62046 and ISO 13855 is what makes the function actually safe.

Why navigation LiDAR cannot be certified

This is the part of the conversation where someone usually objects: “but the navigation LiDAR we are using has centimetre accuracy and a long range — surely it is…” No, and the reasons are structural.

A navigation LiDAR is single-channel. It has one output stream, typically an Ethernet point cloud, with no short-circuit-proof safety output, no test pulses, no discrepancy monitoring. It has no diagnostic coverage that matches the level Part 1 requires — if its receiver degrades or a fan-out driver fails, the point cloud may quietly thin out without the device announcing a fault. It has never been subjected to the Part 1 environmental immunity suite. Even where it is built to commercial EMC and shock standards, it has not been tested with a functional check after each stress. And, most decisive of all, it has never had its single-fault behaviour audited by a recognised test lab. There is no certificate, because there is no certifying body that has ever signed off on its safety integrity.

None of this makes a navigation LiDAR a bad product. It is built for a different job — mapping, localisation, path planning — and is generally excellent at it. The error is the substitution: pointing at a navigation point cloud and treating it as a safety device, because it looks like the same hardware and is cheaper. It is not the same device, and the people who write IEC 61496-3 know it.

Type 2 vs Type 3 vs Type 4 — at a glance

The table is a guide, not a substitute for the standard. The ceilings are about what a single device can support; what the full safety function actually achieves still depends on the whole chain.

The certification process — the practical view

A clean run from a mature laser-scanner design to an issued IEC 61496-3 certificate is roughly a year of work. The manufacturer prepares a design dossier (architecture, fault analyses, software life-cycle evidence, environmental design rationales) and submits it together with production samples to a recognised test laboratory. In the European market the accepted route is a notified body issuing an EC type- examination certificate; in North America the route is typically through an OSHA-recognised Nationally Recognized Testing Laboratory; the major laboratories work in both markets. We refer to them generically here because the choice of lab is a commercial decision and the underlying tests are the same.

Cost is usually in the high five to low six figures by the time you account for lab fees, the engineering rework that almost always falls out of the first environmental round, and the documentation effort. Most projects take at least one re-test on either the EMC suite or the single-fault audit. This is part of why there are not many safety-laser-scanner brands in the world: the standard is a real barrier, and that is exactly the point. A certificate is the buyer’s assurance that someone independent has done the work.

Where DAIDISIKE sits

For completeness on our own side: the DAIDISIKE safety LiDAR family is built to IEC 61496-3, Type 3 AOPDDR. The DLD05A3 and SDLD-05A cover short-range onboard mobile-robot and AGV protection; the DLD20A5 handles area scanning in the 20 m class; the DLD30T-5N extends to perimeter use in the 30–40 m class. All carry dual OSSD, continuous self-monitoring and the environmental immunity profile the standard requires. We mention this because the article is on our site and the question would otherwise be the elephant in the room — but the cluster article you are reading is meant as an engineer’s reference to the standard itself, and that is what the rest of the page is about.

The bottom line

A laser scanner becomes a safety device when an independent laboratory has tested it against the full content of IEC 61496-1 and IEC 61496-3, found it compliant, and issued a certificate. Everything that matters — the dual OSSD, the self-monitoring, the declared detection capability, the environmental immunity, the type test — flows from those two documents. A device without that certificate is a sensor. Useful, sometimes excellent, but not a safety device, and not the right thing to put in front of a moving machine and a person.