• Identification andAccess Management – I.A.M.
From access management, through safe operating mode selection,
up to maintenance safeguarding and protection of data and networks.
Discover safety and security in one system!

Identification and Access Management

Identification andAccess Management – I.A.M.
Comprehensive protection of your employees and the best possible safeguarding of your machinery requirea holistic safety concept that takes into account safety and security aspects. Because now more than ever:safety cannot be guaranteed without also taking security into account.
More information
on Identification
and Access
Management

The “Identification and Access Management” portfolio offers you products and individual solutions for a number oftasks relating to the challenges with regard to employee protection, liability protection, maximum ­productivity
and the protection of your data.

Liability protection

Employee protection

Employers and managers can be held

Work must be organised in such a way

responsible for their action or inaction as itthat hazards to physical and mental healthrelates to the safety of their employees! It is

are avoided. A hazard assessment is also

therefore essential that appropriate measures be taken

necessary to check which hazard levels are present atand their effectiveness checked at regular intervals. For

which machines and how machinery (access) must be

example, employees are to be selected, qualified andsecured. In addition to appropriate access permissions

equipped with the necessary tools according to theiron safety gates and suitably qualified personnel, the use

tasks. In addition to organisational measures, technicalof operating modes is an adequate measure. Operating

solutions such as access management with PITreader

mode selection can be safely implemented with PITmodeare also used. That way it is always possible to assign

products ensuring that each employee can only perform

traceable, individual permissions for specific machines

the work for which they are qualified.

or processes.

Maintaining productivity

Data protection

All considerations regarding safety must not

Data protection and network security

however compromise productivity. Machine

are also increasingly becoming key topics.

downtimes – in the worst case with injured

Safety without security is no longer possible;

persons or damage to the machine – frequently occur due

they are inextricably linked. In future, the Machineryto manipulation, incorrect operation or a lack of (access)Regulation, which comes into force in the EU in 2027, willcontrols. With clear responsibilities, corresponding permis-

take this into account. However, your data, know-how andsions and recording of actions, you prevent errors andoperating processes need protecting from unauthorised

ensure traceability. PITreader with its functions for accesspersons today. Clever products such as the industrial

management offers the ideal solution for the safeguarding

firewall SecurityBridge or the switchable USB interfaceof the productivity of your plant.

PIT oe USB offer security against “external” or even“inside” attacks.

2

Identification and Access Management

Application examples for
Identification and Access Management
Find out more about practical application examples and how to implement safety and security with one system.
The options range from simple authentication to complex access permissions and access management throughto safe operating mode selection, maintenance safeguarding and protection of data and networks.
More information
on application
examplesAccess permissions and access management
Selective access to hazardous machines, with user
authentication, protects your staff from injury and yourmachines from improper use and damage. A number oftasks relating to access permissions can be performed
with the access permission system PITreader. The options
range from a simple enable to replace a password, toauthentication for specific machine subfunctions, all theway to a complex hierarchical permission matrix andcompany-­specific coding for additional protection
against manipulation.
The access permission system PITreader offers anadditional safety feature for safety gate guarding. It is
possible to release a guard locking device only after
authentication. The same applies to control units such as
the pushbutton unit PITgatebox. With integrated PITreader
this is the ideal solution for authentication and operationin one device and ensures that only authorised staff areallowed to carry out certain commands on the plant.

Safety gate guarding with authentication
via PITreader on hazardous plants.

3

Identification and Access Management

Application examples for Identification and Access
Functionally safe operating mode selection
Operating mode selection is part of the functional safety if

More information
on application
examples

AU
TO

SE

switching over between different safety levels and safety

RV

ICE

functions is required. This is frequently the case if a toolchange is pending or a machine is to be reconfigured.
One or more safety devices, such as safety gates or
enabling switches for example, can be switched on oroff, depending on the selected operating mode. The
associated increased risk of damage to the plant andrisk of injury to personnel must be minimised. In order
to exclude the possibility of misuse and manipulation to
the greatest possible extent, access to operating mode
selection must be restricted to appropriately qualified staff
and must be designed to be as simple and convenient
for the user as possible.
The operating mode selection and access permission
system PITmode offers not only functionally safe switchingof operating mode through self-monitoring up to PL  dCat. 3 of EN ISO 13849-1 or SIL CL 2 of EN 62061, butalso controls access rights. As such it is the ideal solution
for your machinery. With its electronic keys, it provides
significantly more security than classic keys. That's
because, all too often, they are inserted in the machine
and thus offer just as little security as password protection,
as the password is often commonly known.

Functionally safe switching of the operating mode
via touch input with PITmode flex visu.

Data protection and network security
Data protection and network security are becoming ever more relevant around industrial installations. The best safety
gate guarding is worthless if your data, know-how and operations are not sufficiently secured against unauthorised
access and manipulation and an external attacker is able to penetrate your control system.
The industrial firewall SecurityBridge monitors data traffic between PC and controller and protects against “external”
threats such as hacker attacks and manipulation. The activatable USB interface PIT oe USB protects against hazards
from “within”, whether due to carelessness or intent. In combination with PITreader, the USB port is only activated forauthorised persons and is only enabled for such persons to use USB devices.

4

Identification and Access Management

Management
Maintenance safeguarding system “key in pocket”
Protect your personnel from hazards in maintenancesituations! Use the “key-in-pocket” solution from Pilz toprevent the unplanned restart of machinery as long as
people remain in the danger zone. In comparison withconventional lockout/tagout (LOTO) systems, maintenanceID

safeguarding is implemented purely electronically via

482

RFID keys with corresponding permissions. Mechanicalinterlocking ­devices and warning tags are thus not
required.
To enter the plant, one or more operators authenticate
themselves with their personal transponder key at the
PITreader on the safety gate. The security IDs of the users
are stored in a safe list in the Pilz controller (PNOZmulti  2
or PSS  4000). The machine can now be switched off andentered safely. The operator retains the transponder key
during this period. To put the plant back into operation, all

SIG
N
IN

SIG
OUN
T

ID

482

people must log out with their personal transponder key
after leaving the plant. The safe list is then cleared and themachine is released again. Where plants have no overall
view, an additional “blind spot check” in accordance withEN ISO 13849-1 5.2.2 is performed. This requires a visualinspection of the plant in areas that are difficult to see.

Sign in –entry in safe list of
the Pilz controller.

Work inthe machine –users have the“key” with them.

Sign out –entry in safe list of
the Pilz controller
is removed.

Process steps for “key-in-pocket” maintenance safeguarding.

Enable of the USB interface PIT oe USB
with authentication via PITreader.

5

Identification and Access Management

PITreader and PITmode product overview
With the “Identification and Access Management” portfolio, we offer you a comprehensive range of
products, solutions and software for the implementation of safety and security tasks from one source.

More information
on PITreader and
PITmodeEntry and access permission
PITreader and PITreader S
With the access permission system PITreader you can implement various tasks
regarding access permissions for plant and machinery. These range from a simple
enable through to authentication and up to a complex permission matrix andcompany-specific coding. The RFID transponder keys are available in a freely
writable version or with predefined permissions. The appropriate software tools
are naturally also available for uncomplicated programming of the PITreader andthe transponder keys. PITreader S also offers the integration of the OPC UA
standard. On the one hand, this increases the security of communication between
server and client. On the other hand, PITreader S expands the connection options
to systems from other manufacturers that also use OPC UA.

PITreader (S) card
The access permission system PITreader (S) card offers the same functions
as the versions described above. With PITreader card and PITreader sticker,
however, transponders in card or sticker format are used. The PITreader cards
have a transparent window so that the LED status indicator on the PITreader
remains visible when the card is held up to it. If you already use RFID-capablecards at your company, these can also be used for authentication. The use offamiliar PITreader keys is also possible.

Pushbutton unit PITgatebox with PITreader
For optimum safety gate guarding with authentication, PITreader S is alsoavailable in the pushbutton unit PITgatebox. The operating unit with accesspermission system ensures that only authorised staff have access to the plantand can implement commands such as activate, stop or reset the machine.

6

Identification and Access Management

Operating mode selection system switch and access permission
PITmode fusion
PITmode fusion is the modular version of the operating mode selection
system and is the solution when a third-party safety controller is used.
The system comprises the reader unit PITreader and the evaluation unit
(Safe Evaluation Unit – SEU), which evaluates the selected operating modeand provides functionally safe switching. The selection can be made using
existing buttons or via the operation element PIT oe 4s. The full scope of the
PITreader’s functions with regard to access permissions can also be used.

PITmode flex
PITmode flex is the solution for all users of small
controller PNOZmulti 2 or automation system PSS 4000.
Here too, PITreader is used as the reader unit. Safe
evaluation of the operating mode is performed via asoftware block already integrated into PNOZmulti 2
and PSS 4000. A separate evaluation unit is therefore
not necessary. The operating mode can be selected
via the operation element PIT oe 4S or any buttons.

PITmode flex visu
PITmode flex visu essentially offers
the same function range as ­PITmodeflex, however it differs with regard to
the way in which the operating modeis selected. Instead of using buttons,
this is performed via touch operation
on a PMIvisu panel with PASvisu.

9Identification and Access Management

Overview of PITmode and PITreader products andOverview of operating mode selection and access permission system PITmode

More information
on PITreader and
PITmodePITmode3.xx

PITmodefusionPITmodeflex

Application• Access permission
system• Functionally safe
operating mode
selection up to PL d

• Access permission system• Functionally safe operating
mode selection up to PL d

• Access permission system• Functionally safe
operating mode selection up to PL dType

Compact

Modular with buttons

Integrated & flexible with buttons

Main function

Operating mode
selection with:• 5 operating modes• 1 workspace

Operating mode selection with:• 5 operating modes• 1 workspace

Operating mode selection with:• 8 operating modes• 10 workspaces

Usage

Operation with Pilz
or 3rd party
FS controller for operating mode selection andaccess permission

Operation with Pilz
or 3rd party FS controller
for operating mode selection
and access permission

Operation with Pilz FS controller
for access permission andoperating mode selection

Safe
evaluation unit

Integrated

As independent“SEU” component

Software block integrated
in Pilz FS controller(PNOZ m B1 & PSSu PLC)

Input via

2 or 4 integrated buttons• PIT oe 4S• 3rd party pushbutton• PIT oe 4S• 3rd party pushbutton

Componentsthat make up
the solution

Software for PITreader
PITreader web server

PIT Transponder Manager (PTM)

The integrated web server enables simple programming

Easily manage PITreader keys with userof the PITreader key transponder key with user data andsettings, block lists and your user data

permissions as well as all additional important PITreader

via the graphical interface in the PIT Transponder

settings directly at the device. Commissioning of theManager. In just a few steps, you can assign individual

PITreader, configuration of interfaces and, whereuser permissions using pre-configured templates.

­applicable, connection with the OPC UA server are

You can select whether to create users individually orthus completed quickly.

using the import function. Benefit from the ability toread information directly into the integrated database.

7

Identification and Access Management

solutions
PITmodeflex visu

PITreaderstand alone

Key-in-pocket• Access permission system• Functionally safe
operating mode selection up to PL d

• Access permission system• Access permission system• Maintenance safeguarding
system “key in pocket”

Integrated & flexible with visualisation

Compact

Compact

Operating mode selection with:• 8 operating modes• 10 workspaces

Security for access permissionfor HMI, process and door
­safeguards

Maintenance safeguarding with protection
against unauthorised restart

Operation with Pilz FS controller
for access permission andoperating mode selection

Connection to
PLC and HMI systems

Operation with Pilz FS controller
for maintenance safeguarding

Software block integrated
in Pilz FS controller(PNOZ m B1 & PSSu PLC)--

Touch-operated input tile in PASvisu-

Buttons

User Authentication Service (UAS)The User Authentication Service (UAS) safely connects the accesspermission system PITreader with the management system foraccess data and permissions, PIT Transponder Manager (PTM), via HTTPS.
The organisational service manages all permissions and evaluates them via
a central authorisation database for all transponder key users. The databaseis supplied by importing from the PTM. The UAS distributes functions such asa block list to all networked PITreaders. Diagnostic information is also madeavailable centrally.

8

Americas

Australia and Oceania

Scandinavia

BrazilAustralia+45 74436332+55 11 97569-2804+61 3 95600621

Spain

CanadaNew Zealand+34 938497433+1 888 315 7459

+64 9 6345350

Switzerland+41 62 88979-32

Mexico+52 55 5572 1300

EuropeThe Netherlands

USA (toll-free)

Austria+31 347 320477+1 877-PILZUSA (745-9872)+43 1 7986263-444

TurkeyBelgium, Luxembourg+90 216 5775552

Asia+32 9 3217570

United Kingdom

China

France+44 1536 462203+86 400-088-3566+33 3 88104003

Japan

Germany

You can reach our+81 45 471-2281+49 711 3409-444

international hotline on:

South Korea

Ireland+49 711 3409-222+82 31 778 3300

+353 21 4804983

support@pilz.com

Italy, Malta+39 0362 1826711

Pilz develops environmentally-friendly products using
ecological materials and energy-saving technologies.
Offices and production facilities are ecologically designed,
environmentally-aware and energy-saving. So Pilz offers
sustainability, plus the security of using energy-efficient
products and environmentally-friendly solutions.

Presented by:

Pilz GmbH & Co. KG
Felix-Wankel-Straße 273760 Ostfildern, Germany
Tel.: +49 711 3409-0, Fax: +49 711 3409-133
E-Mail: info@pilz.com, Internet: www.pilz.com

We are represented internationally. Please refer to our homepage www.pilz.com
for further details or contact our headquarters.
Headquarters: Pilz GmbH & Co. KG, Felix-Wankel-Straße 2, 73760 Ostfildern, Germany
Telephone: +49 711 3409-0, Telefax: +49 711 3409-133, E-Mail: info@pilz.com, Internet: www.pilz.com
Printed on 100 % recycled paper for the good of the environment.

12-3-en-3-004, 2023-03 Printed in Germany© Pilz GmbH & Co. KG, 2023

Technical support is available from Pilz round the clock.

CECE®, CHRE®, CMSE®, InduraNET p®, Leansafe®, Master of Safety®, Master of Security®, PAS4000®, PAScal®, PASconfig®, Pilz®, PIT®, PLID®, PMCprimo®, PMCprotego®, PMCtendo®,
PMD®, PMI®, PNOZ®, PRBT®, PRCM®, Primo®, PRTM®, PSEN®, PSS®, PVIS®, SafetyBUS p®, SafetyEYE®, SafetyNET p®, THE SPIRIT OF SAFETY® are registered and protected trademarksof Pilz GmbH & Co. KG in some countries. We would point out that product features may vary from the details stated in this document, depending on the status at the time of publicationand the scope of the equipment. We accept no responsibility for the validity, accuracy and entirety of the text and graphics presented in this information. Please contact our Technical Support
if you have any questions.

Support