ISO 13849 performance level: how to calculate PL for a safety function
The short answer
A performance level is the ability of a safety-related part of a control system to perform a safety function, graded PL a to PL e and underpinned by an average probability of dangerous failure per hour. It is a property of one safety function, not of a machine and not of a component: the same press can have a PL d guard interlock and a PL c two-hand control at the same time. To arrive at a number you need the architecture (Category B, 1, 2, 3 or 4), the MTTFd of each channel, the average diagnostic coverage DCavg, and a common cause failure score of at least 65 out of 100. Subsystems in series are then combined, and the result is limited by the weakest one.
ISO 12100 comes first
None of this starts with a calculation. ISO 12100 sets the order: determine the limits of the machine, identify hazards across every lifecycle phase, estimate and evaluate risk, then reduce it by inherently safe design first, safeguarding second and information for use last. Only the hazards that a control system will reduce become safety functions with a performance level. See machine safety risk assessment to ISO 12100 for that stage.
Step one: write the safety function down
A safety function is a sentence, and without it nothing downstream can be verified. It states what is detected, what the machine does in response, how fast, and what happens on fault and on restart. "Opening the front guard removes power from the two main contactors feeding the spindle within 300 ms, and the spindle cannot restart until the guard is closed and the reset button is pressed and released."
Step two: the required performance level, PLr
ISO 13849-1 asks three questions about the hazard, using the risk graph in its Annex A.
- S, severity: S1 slight and normally reversible, S2 serious and normally irreversible, including death.
- F, frequency and duration of exposure: F1 seldom to less often, F2 frequent to continuous.
- P, possibility of avoiding the hazard: P1 possible under specific conditions, P2 scarcely possible.
| S | F | P | PLr |
|---|---|---|---|
| S1 | F1 | P1 | a |
| S1 | F1 | P2 | b |
| S1 | F2 | P1 | b |
| S1 | F2 | P2 | c |
| S2 | F1 | P1 | c |
| S2 | F1 | P2 | d |
| S2 | F2 | P1 | d |
| S2 | F2 | P2 | e |
The achieved PL must equal or exceed PLr. Each PL corresponds to a band of average probability of dangerous failure per hour, PFH_D, over an assumed 20-year mission time.
| PL | PFH_D per hour |
|---|---|
| a | 10 to the minus 5, up to 10 to the minus 4 |
| b | 3 x 10 to the minus 6, up to 10 to the minus 5 |
| c | 10 to the minus 6, up to 3 x 10 to the minus 6 |
| d | 10 to the minus 7, up to 10 to the minus 6 |
| e | 10 to the minus 8, up to 10 to the minus 7 |
The designated architectures
A category describes structure and behaviour on fault, nothing more.
| Category | What it does about a single fault |
|---|---|
| B | Nothing. A single fault can lose the safety function. Basic design and component selection only |
| 1 | Nothing structurally, but well-tried components and well-tried safety principles make the fault less likely |
| 2 | Single channel plus a test channel. The function is checked at intervals, conventionally at least 100 times the demand rate. A fault between tests can lose the function |
| 3 | A single fault does not lose the safety function, and is detected where reasonably practicable. Accumulated undetected faults can still lose it |
| 4 | A single fault does not lose the safety function and is detected at or before the next demand. Accumulated faults must not lose it either |
Category B and 1 reach at most PL b and PL c. Category 2 reaches PL d, Category 3 reaches PL d in the simplified evaluation and PL e only with a full calculation, and Category 4 is the route to PL e.
The three inputs to the achieved PL
MTTFd per channel, in years, banded low (3 to under 10), medium (10 to under 30) and high (30 to under 100). For components that wear, it comes from B10d, the operations at which 10 per cent have failed dangerously:
MTTFd = B10d / (0.1 x n_op), where n_op = d_op x h_op x 3600 / t_cycle
Channel components combine as reciprocals: 1 / MTTFd = sum of 1 / MTTFd_i. The widely used 2015 edition caps a channel at 100 years; the 2023 edition allows more under defined conditions, so state which edition you are working to.
Diagnostic coverage DC, banded none (under 60 per cent), low (60 to under 90), medium (90 to under 99) and high (99 and above). The average across a channel is weighted by failure rate, not by part count: DCavg = sum(DC_i / MTTFd_i) / sum(1 / MTTFd_i).
Common cause failure CCF, scored once for the whole subsystem against the Annex F table: separation and segregation 15, diversity 20, design and application experience 20, assessment and analysis 5, competence and training 5, and environmental influences 35, of which 25 is electromagnetic. A score below 65 means redundancy cannot be claimed at all, whatever the other numbers say.
The simplified evaluation then reads a PL off those three. Category 3 with MTTFd high and DCavg medium gives PL d. Category 4 requires MTTFd high and DCavg high, and gives PL e.
Combining subsystems in series
This is where designs fail review. A safety function runs through an input subsystem, a logic subsystem and an output subsystem, and the correct combination adds their PFH_D values. The overall PL is the band the total falls into, which is always at or below the weakest subsystem. It is never an average.
The simplified route in the standard counts N_low, the number of subsystems at the lowest PL. At PL_low of e, up to three subsystems stay at e and more than three drop to d. At PL_low of d, up to three stay at d and more than three drop to c. Four PL d subsystems in series therefore produce PL c, which surprises people every time.
Worked example: an emergency stop
An E-stop device with two direct-opening NC contacts, into a dual-channel safety relay with cross monitoring, out to two contactors in series, each with mechanically linked auxiliary contacts wired back into the relay's feedback loop.
Architecture. The output subsystem is redundant, and the feedback loop proves both contactors dropped out before each start, which is diagnosis at or before the next demand: Category 4 behaviour. The logic is a certified subsystem with a declared PFH_D from the datasheet, typically in the 10 to the minus 9 to 10 to the minus 8 region for a PL e relay. The input is the limiter. Two contacts share one mechanical actuator and one terminal block, so a Category 3 or 4 claim rests on a documented fault exclusion for the mechanism, which direct opening action to IEC 60947-5-1 supports but does not grant automatically.
Numbers for the output. Take a contactor with B10d of 1,000,000 operations, a machine running 240 days a year, 16 hours a day, and one operation per hour. Then n_op = 240 x 16 x 3600 / 3600 = 3,840 operations a year, and MTTFd = 1,000,000 / (0.1 x 3,840) = 2,604 years, capped at 100. T10d = B10d / n_op = 260 years, far beyond the 20-year mission, so no forced replacement. MTTFd is high, the feedback loop gives DC of 99 per cent, and the CCF score passes at 65 or more.
The result. Input PL e, logic PL e, output PL e: three subsystems at e, so the function is PL e. Now weaken one thing. If the feedback loop only monitors one contactor, the output diagnostic coverage drops to medium, the output becomes Category 3 at PL d, and the whole function is PL d no matter how good the relay is. One wire decides the outcome.
The mistakes people make
Quoting a category as if it were a performance level. "Category 3" appears in tender documents as a specification. It is not one. Two Category 3 circuits with different components reach different performance levels.
Averaging subsystems. Two PL e subsystems and one PL c do not make PL d.
Ignoring CCF. A redundant circuit with both channels in the same cable, on the same supply, from the same batch, fails the Annex F score, and then the redundancy is not creditable.
Skipping validation. ISO 13849-2 validation includes fault injection: open a channel, short a channel, weld a contact, and confirm the machine goes to a safe state and does not restart by itself.
Counting the emergency stop as the safeguard. ISO 13850 is explicit that an emergency stop is a complementary protective measure. It does not reduce the risk of the hazard.
IEC 62061, and where the real numbers come from
IEC 62061 is the alternative route for the same problem, expressing the target as a SIL rather than a PL. The PFH bands line up: PL c against SIL 1, PL d against SIL 2, PL e against SIL 3. Either standard satisfies the same legal requirement in Europe, and the 2021 edition of IEC 62061 removed the old restriction that pushed pneumatic and hydraulic technologies towards ISO 13849 exclusively. Pick one route per function and stay in it; the two are not interchangeable partway through a calculation.
The figures in this article are illustrative. Real MTTFd, B10d, DC and PFH_D values come from manufacturers' safety data and certificates, and the arithmetic belongs in SISTEMA, the free tool from IFA that holds the manufacturer libraries and produces a report an assessor will accept. No blog, including this one, is a source for a number that goes into a safety file.
What to learn next
Read emergency stop and safety circuits for the wiring these calculations describe, and robot safety to ISO 10218 for the cell version of the same problem. For process plant rather than machinery the framework is different: see SIL and IEC 61511.
Frequently asked questions
Can a component have a performance level? A manufacturer declares what a device is suitable for, such as "suitable for use up to PL e", together with the data and conditions behind it. That is a capability, not an achieved PL. The achieved PL only exists once the function is built.
Does PL e require Category 4? In the simplified evaluation, effectively yes. A Category 3 subsystem with high MTTFd and diagnostic coverage close to 99 per cent can land in the PL e PFH band under a detailed calculation, but the structural difference remains: Category 4 must survive accumulated faults.
Is ISO 13849 law in India? Not directly. It is invoked by contract, by customer specification and by any export to Europe, where the Machinery Regulation (EU) 2023/1230 applies from January 2027 and harmonised standards are the practical route to conformity. Indian machine builders shipping abroad meet it either way.
Learn this, free
The courses that teach this
Every lesson, the written notes and the practice are free with an account. Only the certificate is optional and paid.
