In brief · As of October 2026
Pilz safety technology in a plant consists of PNOZmulti 2 base modules with expansion modules on the internal bus, communication modules (PNOZ m ES PROFINET, EtherCAT, EtherNet/IP), PSS 4000 controllers with PSSuniversal I/O, PITreader and PITmode devices on the network and PASvisu on PCs. From the maintenance PC only the communication modules and the network devices provide an identity: PROFINET modules via I&M0 with order number, serial number and firmware, PIT devices via web identification; base and expansion modules are not seen by any scan. They get into the device list via the PNOZmulti Configurator or PAS4000 online, with order number and firmware per module. Pilz publishes as CSAF via CERT@VDE with the order number as model_numbers: 20 advisories, 3 new in 2026, two of them on PIT and PASvisu. We did not find an SBOM; for the plant you do not need one. The more common problem: safety technology is missing from many device lists entirely.
What hangs on a Pilz safety controller and what of it is visible on the network
A PNOZmulti 2 is a base module with up to twelve expansion modules on the internal bus (inputs/outputs, speed monitoring, relays) and a communication module for PROFINET, EtherCAT, EtherNet/IP or Modbus TCP. PSS 4000 works with PSSuniversal PLC and decentralised I/O modules via SafetyNET p. Added to this are PITreader access devices, PITmode operating mode selection, PSEN sensors and PASvisu visualisation on operator PCs.
- Visible via IP from the maintenance PC: PNOZ m ES PROFINET via DCP and I&M0 (OrderID = order number, serial number, firmware), EtherNet/IP modules via ListIdentity, Modbus modules via FC43 where implemented; PITreader and PSSuniversal PLC via web identification.
- Only via the controller: the base module and all expansion modules of the PNOZmulti as well as the PSSuniversal I/O behind a PSS 4000 controller. Only the base module or the controller knows their order number and firmware.
- Only from the engineering: safety relays without firmware (PNOZsigma, PNOZ X) and PSEN sensors without IO-Link. They are in the bill of materials, not in the plant SBOM.
How base and expansion modules get into the list: PNOZmulti Configurator and PAS4000
The PNOZmulti Configurator shows the hardware configuration of the base module online with order number, serial number and firmware per module; PAS4000 provides the same for PSS 4000 and PSSuniversal. That is the only route to the modules behind the communication module. From the network, the following are added:
- PNOZmulti Configurator (PNOZmulti 2) and PAS4000 (PSS 4000, PSSuniversal): project with device type and order number of the base and communication modules.
- PROFINET I&M0: the PNOZ m ES PROFINET modules are PI-certified (CC-C) and return OrderID, serial number, hardware and firmware version via DCP – the direct route on the network.
- EtherCAT, EtherNet/IP, Modbus TCP: depending on the communication module, via the master, the Identity Object or – where implemented – Modbus FC43. Background in the article on the network scan.
How Pilz publishes advisories and what matching runs on
Pilz announced CSAF publication in March 2026 in a dedicated notice; the documents are created with Secvisogram and sit on the CERT@VDE provider with ROLIE feed, index.txt and changes.csv. There is no provider under pilz.com and no entry in the BSI aggregator.
| Measurement (7 Oct 2026) | Result |
|---|
| CSAF advisories in total | 20 (2020–2026) |
| of which new in 2026 | 3 – PPSA-2026-001 (2 Feb), -002 (23 Apr), -003 (4 Aug) |
| New documents 2022 / 2023 / 2024 / 2025 | 6 / 3 / 2 / 4 |
| Documents with CPE | 1 (PPSA-2026-003 IndustrialPI, hardware and OS CPE) |
| Documents with PURL | 0 |
| CISA OT feed: entries mentioning Pilz | 1 (none from 2026) |
The order number is the norm at Pilz: product name plus model_numbers such as A1000002 or G1000020, together with the firmware range. That is the same key printed on the nameplate.
With three new advisories in 2026 the volume is small and matching via model_numbers is clean. The real problem comes before that: in many device lists, safety controllers, operating mode selection (PITmode) and access devices (PITreader) are missing entirely, because they do not appear in the control project of the main PLC and are quiet on the network. Two of the three 2026 advisories concern exactly this periphery (PIT, PASvisu).
For the risk assessment under the Machinery Regulation, the safety controller is the central component anyway – carrying it in the plant SBOM without a firmware version is the most common error we see at acceptance tests.
Pilz does not describe any SBOM provision; for the plant you do not need one, the advisories name order number and firmware range.
What this means for installations with Pilz components
- Include safety controllers, communication modules, PIT devices and PASvisu installations with order number and firmware in the list – from the Configurator, PAS4000 and I&M0.
- Treat IndustrialPI devices as Linux systems with their own software inventory; the 2026 advisory is the only one carrying CPE at OS level.
- For discontinued products, document the spare-part status that Pilz announces in its CRA statement.
Safety controllers do not appear in the project of the main PLC, on the network only their communication module shows, and only the base module knows the expansion modules. In Werkspilot Scan, Pilz is stage 1 for communication modules and PIT devices via I&M0, ListIdentity and web identification, and stage 3 for the modules behind them via the controller. We are currently trialling the third stage with development partners on their plants.
All 13 manufacturers compared: SBOM by manufacturer →
Trial Werkspilot Scan on your own plant.
We are trialling the capture with a few plant builders on their test or reference plants, for four months, extended stage by stage around their controllers. The partner gets one plant of their choice as a plant SBOM: every reachable device with manufacturer, order number and firmware version, open items listed individually.
Ask about the development partnership →
Werkspilot keeps these devices per plant and reports when an advisory hits one of them. The figures in this article are our own measurements from 7 Oct 2026; manufacturers change feeds and pages without notice.
