How do I determine the performance level (PL) of a safety function to EN ISO 13849-1?
The performance level is never determined for the machine as a whole but always per safety function. From the risk assessment, the risk graph made up of severity (S), frequency (F) and possibility of avoidance (P) gives the required PLr from a to e. The technical implementation is then considered: sensor, logic and actuator together form the safety chain, whose probabilities of failure (PFHd) are added up. The PL achieved has to be at least equal to the PLr; only validation to EN ISO 13849-2 completes the evidence.
- What is the performance level determined for?
- What belongs in the description of a safety function?
- How do I get from the hazard to the required PLr?
- Which PLr results from which combination?
- How does the achieved PL arise from components?
- What is documented as evidence?
- Which mistakes keep coming up in projects?
What is the performance level determined for?
A machine typically has several safety functions: guard door monitoring, emergency stop, muting of a light curtain, safely limited speed in setting mode. Each of these functions gets a required performance level of its own, because each covers a different risk.
That is the most common mistake in projects: a blanket claim that "the installation is PL d". That is not a statement anyone can check. What can be checked is the chain of a specific safety function, its PLr, the circuit implemented and the PL calculated from it.
The list of safety functions therefore does not arise in control system planning; it already falls out of the risk assessment. Whenever a hazard is reduced by a control measure, a safety function comes into being.
What belongs in the description of a safety function?
This description is not a formality: without it neither the PLr can be justified nor the implementation checked. It belongs in the technical documentation and is the basis for later validation.
How do I get from the hazard to the required PLr?
Which PLr results from which combination?
| Severity S | Frequency F | Avoidance P | Required PLr |
|---|---|---|---|
| S1 slight, reversible | F1 seldom | P1 possible | a |
| S1 slight, reversible | F1 seldom | P2 scarcely possible | b |
| S1 slight, reversible | F2 frequent | P1 possible | b |
| S1 slight, reversible | F2 frequent | P2 scarcely possible | c |
| S2 severe, irreversible | F1 seldom | P1 possible | c |
| S2 severe, irreversible | F1 seldom | P2 scarcely possible | d |
| S2 severe, irreversible | F2 frequent | P1 possible | d |
| S2 severe, irreversible | F2 frequent | P2 scarcely possible | e |
The risk graph is a classification tool, not a calculation method. Borderline cases are not rounded away but justified: anyone choosing between F1 and F2 records the reason, otherwise the classification will not hold up in a dispute.
How does the achieved PL arise from components?
A safety function always runs through a chain: sensor detects, logic evaluates, actuator switches off. Each of these three links is a subsystem with its own probability of failure per hour, the PFHd.
The PFHd values of the subsystems are added up. The sum determines which performance level is achieved. From this follows a rule often overlooked in practice: three subsystems each rated PL d do not necessarily add up to PL d, because the probabilities of failure accumulate. The distance to the next boundary therefore has to be checked.
For each subsystem there are two routes. Either the manufacturer supplies a certified value with PFHd and category in the data sheet, in which case that value is used. Or the subsystem is built in-house, in which case category, MTTFd, diagnostic coverage DC and the measures against common cause failures CCF have to be determined and the PFHd derived from them.
The category is not a calculation value but a structural requirement on the architecture: single channel, single channel with test, dual channel, dual channel with monitoring. Category and PFHd together give the achieved PL.
What is documented as evidence?
- A list of all safety functions with description, operating mode and PLr per function.
- Justification of the classification of S, F and P, or a reference to the type-C standard that specifies the PLr.
- Safety circuit diagram or block diagram of the sensor, logic and actuator chain for each function.
- Data sheets of the components used, with PFHd, category and, where relevant, the B10d value and the assumed number of operating cycles.
- Calculation of the PL achieved for each function, usually as a printout from the calculation tool.
- Evidence of the measures against common cause failures for multi-channel architectures.
- Validation report to EN ISO 13849-2: examination of the implementation, functional tests, fault simulation and result.
- Statements on service life and required replacement intervals, to be carried over into the instructions for use.
The calculation alone is not enough. EN ISO 13849-2 requires validation of the actual implementation, that is a comparison between paper and machine. Without documented validation the evidence is incomplete.
Which mistakes keep coming up in projects?
- The PL is stated for the installation as a whole instead of per safety function.
- The actuator is forgotten: contactors or valves are part of the chain and often contribute the largest share of the PFHd.
- The actual number of operating cycles is not taken into account for the B10d value, so the calculated service life comes out too optimistic.
- The PLr is aligned with the hardware already present instead of with the risk: first it is installed, then the numbers are made to fit.
- Dual channel structure is assumed without measures against common cause failures being implemented or demonstrated.
- The response time does not feed into the safety distances, so the light curtain ends up too close to the hazard zone.
- Validation to EN ISO 13849-2 is missing and only a calculation printout exists.
- After a conversion or software update the calculation is not brought up to date.
Sources and standards
- EN ISO 13849-1: safety-related parts of control systems, general principles for design
- EN ISO 13849-2: safety-related parts of control systems, validation
- IEC 62061: functional safety of safety-related control systems
- EN ISO 13855: positioning of safeguards with respect to approach speeds
- EN 60204-1: electrical equipment of machines, stop categories
- Machinery Regulation (EU) 2023/1230, Annex III
Editions of standards and their harmonised status change continuously. Check standard numbers and editions against the current list in the Official Journal of the EU before applying them. This article is a technical classification and does not replace legal advice.
Frequently asked questions
What is the difference between PL and SIL?
Both describe the reliability of safety-related parts of control systems but come from different standards: PL a to e from EN ISO 13849-1, SIL 1 to 3 from IEC 62061. For machine controls both routes are permitted; the values can be mapped to each other via the underlying probability of failure. What matters is working consistently within a project and documenting the method chosen.
Do I have to calculate if the manufacturer states the PL of the component?
Yes. The manufacturer's figure applies to the individual subsystem, not to the whole safety function. Only the sum of the PFHd values of sensor, logic and actuator gives the PL achieved by the function. A certified value saves you the calculation of the subsystem, not that of the chain.
What does PFHd mean?
PFHd stands for the average probability of a dangerous failure per hour. The value is the common calculation quantity for all subsystems of a safety function and assigns the result to a performance level.
Is stating "PL d, category 3" enough in the documentation?
As a result line yes, as evidence no. It only becomes traceable with the description of the safety function, the justification of the PLr, the circuit diagram, the component data, the calculation and the validation report.
Does the Machinery Regulation change anything about determining the PL?
The method of the standard remains. The Machinery Regulation requires safe control systems in Annex III and sets additional requirements for software and cybersecurity. Check the edition of the standard and the current listing of harmonised standards in the Official Journal of the EU before applying them.
Has been guiding CE projects in machinery, plant and special purpose engineering for years. That work led to Kaidoc.app, a software for standards-based CE documentation. Through Knutec.de the same work is available as a personal service.
Write me a few lines about your project. You get a first assessment back, free of charge and without obligation.
This article was produced with AI assistance and reviewed for technical accuracy before publication. Editorial responsibility within the meaning of Art. 50(4) of the AI Act (EU) 2024/1689 lies with Heinrich Knutas.
No credit card required. A complete project to try out.