Two numbers govern any machine safety circuit: the level the function needs, and the level the design delivers. Under ISO 13849-1 they are called PLr and PL. Confusing them is why a cell packed with “PL e” devices can still fall short. Here is how each number is set, and what to check on a supplier document before you buy.
What ISO 13849-1 governs
The standard covers the control side of safety. Its scope is that “ISO 13849-1:2015 provides safety requirements and guidance on the principles for the design and integration of safety-related parts of control systems” (ISO catalogue).
Two terms carry the method. A safety function is, from ISO 12100, the “Function of a machine whose failure can result in an immediate increase of the risk(s)”; the standard’s own examples include a “Safety-related Stop issued by a safeguard (e.g. safety interlock, or light curtain)”, muting, hold-to-run and prevention of unexpected start-up (WSPS seminar deck). The SRP/CS is the part of the control system providing those functions, and it “can consist of hardware and software elements” (WSPS). On the standards ladder ISO 13849 is a Type-B1 standard of “Particular Safety Aspects”, while ISO 10218 is a Type-C machine standard (WSPS).
What a performance level measures
ISO 13849-1 defines PL as a “discrete level used to specify the ability of the safety related parts” of a control system to perform its safety function (SICK). There are five levels: “Five (5) Performance Levels (PLa-PLe) can be assigned to the SRP/CS. PLa – lowest performance level, PLe – highest performance level”, and they are “defined in terms of average ‘Probability of Dangerous Failure per Hour’ (PFHD)” (WSPS).
| Performance level | Average PFHd range (per hour) |
|---|---|
| PL a | ≥ 10^-5 and < 10^-4 |
| PL b | ≥ 3 × 10^-6 and < 10^-5 |
| PL c | ≥ 10^-6 and < 3 × 10^-6 |
| PL d | ≥ 10^-7 and < 10^-6 |
| PL e | ≥ 10^-8 and < 10^-7 |
Ranges from IDEC; the PL d band is confirmed independently as “≥10-7 and <10-6” by SICK.
Each step up that table is roughly a tenfold cut in the chance of a dangerous failure per hour, and that is all PL means. The commonest misunderstanding is that PL is a device property: “The Performance Level belongs to the safety function, not to the sensor” (Wide Automation).
Where PLr comes from: the risk graph
The required level comes out of your risk assessment, not a catalogue. ISO 13849-1 “addresses the issue of risk assessment using a risk graph” and “also deals with the validation of safety functions based on structural and statistical methods”, its objective being “to establish the suitability of safety measures to reduce risks” (Pilz Safety Compendium).
Three parameters are examined. Pilz states them verbatim:
- Severity of injury (S) — “Slight (normally reversible injury) S1” or “Serious (normally irreversible injury including death) S2” (Pilz).
- Frequency and/or exposure to a hazard (F) — “Seldom to less often and/or exposure time is short F1” or “Frequent to continuous and/or exposure time is long F2” (Pilz).
- Possibility of avoiding the hazard (P) — “Possible under specific conditions P1” or “Scarcely possible P2” (Pilz).
“The required performance level PLr is calculated using the following graph and the classification of the individual parameters” (Pilz). Start at the graph’s entry point, step through S, then F, then P; where you land is PLr a, b, c, d or e.
Two points matter. The graph sits in Annex A and is a generic estimation tool, and the deck notes that “Other formal risk assessment methodologies exist – e.g. ANSI/RIA TR R15.036-2016” (WSPS); pick one method and keep it for the whole cell. And the level is set function by function, because “the risk assessment process provides the Required Performance Level (PLr) for each safety function that makes up the SRP/CS” (WSPS). A fence-door stop, a pallet-infeed muting function and unexpected-start-up prevention need three separate answers.
The pass test is short: “If the achieved PL is greater than or equal to the required PLr, the requirement for the implementation is considered to have been met” (Pilz Safety Compendium). PL d satisfies a PLr of c or d. Exceeding the requirement buys you nothing.
What sets the achieved PL
Once you know PLr, four inputs decide whether the circuit reaches it.
- Category — the architecture. “The system architecture can be divided into five different categories” (Pilz): “Category B, 1, 2, 3, 4 – Cat B is the lowest / Cat 4 is the highest” (WSPS). Raising it “improves the ability of the safety function to detect and avoid the hazardous effects of a fault” (WSPS).
- MTTFd, “the mean time it takes for a component to fail dangerously”, in years (WSPS).
- DCavg — diagnostic coverage, the “Ratio between: failure rate of ‘Detected Dangerous Failures’ and failure rate of ‘Total Dangerous Failures’” (WSPS).
- CCF — common cause failure, “failures of different items, resulting from a single event”, such as electromagnetic disturbance. “A CCF score ≥ 65 must be achieved” (WSPS).
| Band | MTTFd (years) | Diagnostic coverage |
|---|---|---|
| None | not applicable | DC < 60 % |
| Low | 3 years ≤ MTTFd < 10 years | 60 % ≤ DC < 90 % |
| Medium | 10 years ≤ MTTFd < 30 years | 90 % ≤ DC < 99 % |
| High | 30 years ≤ MTTFd < 100 years | 99 % ≤ DC |
MTTFd bands as printed in Pilz; the same bands and DC bands (Low 60-90%, Med 90-99%, High ≥99%) are given by Keyence.
Two limits matter. “The Max. MTTFD value of a safety function for each channel is 100 years”, so a datasheet promising millions of years is capped (WSPS). And “Cat B and Cat 1, DC = 0” (WSPS): those architectures get no diagnostic credit.
The function is only as strong as its weakest element. “If the PFHD is known for each of the SRP/CS, add them together to find the total PFHD for the safety function. The overall PL for the safety function is limited by: The component with the lowest PL” (WSPS) — a PL e relay behind a PL c device is a PL c function. Our safety relay wiring guide covers the channel and reset wiring this depends on.
Worked example: a guard door on a three-shift line
The order of work for MTTFd is fixed: “Use manufacturer’s data / Use methods in Annex C and Annex D of ISO 13849-1 / Choose 10 years” (WSPS).
For an electromechanical part the supplier usually gives B10d, the “Mean number of cycles until 10% of components fail” dangerously; “if only B10 value is provided, then: B10D = 2B10” (WSPS). The two formulas, from the same deck:
nop = (dop × hop × 3600 sec/hr) / tcycleMTTFd = B10d / (0.1 × nop)
Worked for a contactor on a door that cycles every 30 minutes on a 365-day, 24-hour line: “nop = (365 days/year x 24 hrs/day x 3600 sec/h) / (1800 sec) → nop = 17,520 cycles / year” and “MTTFD = B10D / (0.1 x nop) = 2×10^7 / (0.1 x 17,520) = ~11,142 years (High)” (WSPS).
The cycle rate is what moved the answer, so a design copied from a reference with a different shift pattern can land a band short.
The deck’s full function — guard lock switch at DC 0 on the input, a Category 4 / PL e safety relay, monitored contactors — comes out at “MTTFDCH = 38.5 years (medium) DCavg = 95.7% (medium) → PLc” (WSPS). The relay was PL e; the function is PL c. That gap is why the calculation exists, and the number on the other side of it is the PLr your risk assessment should produce before any quote is requested.
Why chained interlocks miss PL e
Chaining inexpensive switches on one relay usually costs you the level you needed.
Pilz states the mechanism: a single switch pair evaluated by a safety relay “can achieve a DC = 99%”, and on that premise “in ISO/TR 24119, the maximum DC for a group of interlinked switches is stated based on the number of switches connected in series and their frequency of operation” (Pilz Safety Compendium). A fault in the first switch can hide a fault in the second, so the relay stops proving both channels.
The maximum achievable DC falls as the count rises (Pilz):
| Frequently opened guards (more than once per hour) | Additional movable guards | Max achievable DC |
|---|---|---|
| 0 | 2 to 4 | Medium |
| 0 | 5 to 30 | Low |
| 0 | more than 30 | None |
| 1 | 1 | Medium |
| 1 | 2 to 4 | Low |
| 1 | 5 or more | None |
| more than 1 | any | None |
The same source adds the hard rule: “if it is foreseeable that fault masking will occur (e.g. multiple movable guards will be open at the same time as part of normal operation or service), then the DC is limited to none”. Because DC drives PL, “lots of sensors connected in series without their own diagnostic device will lead to a reduction of the DC and thereby restrict the max. PL that can be achieved” (Pilz Safety Compendium).
The fix is specified, not suggested: “to achieve PL d or PL e you should either use two mechanical gate switches per gate, one dual-channel magnetic switch or one RFID switch with OSSD output”; only switches with internal diagnostics and an OSSD output, “as commonly found on RFID based switches”, are unaffected by masking (Pilz). Ask which of those three options is in your bill of materials.
How to read a supplier document
- Check the edition cited. The European national edition of EN ISO 13849-1:2023 “was published on 15 October 2023”, with a section map from the 2016 edition to it (IBF whitepaper). A machine-safety commentary disagrees, holding that “ISO 13849-1:2023” does not exist and the correct citation is EN ISO 13849-1:2015/AC:2016 (Machinery Safety 101). Make the integrator name the edition on the calculation sheet.
- Treat “Category” alone as a red flag. EN 954-1 “has ceased to be listed in the Official Journal of the EU and as such is no longer regarded as harmonised” since 08.05.2007, and its presumption of conformity “applied until 31.12.2011”; under ISO 13849-1 the older categories “mean something different” (Pilz Safety Compendium). An old Category 4 certificate is not a PL claim.
- Expect four numbers per component, not one badge: B10d or MTTFd, DC, the channel structure, and the PL claimed for the function. “Selection of only a small number of parameters is sufficient for the average probability of failure PFHD and the PL to be determined” (DGUV/IFA).
- Expect a tool output. Manual arithmetic is realistic only for short chains; DGUV/IFA describes dedicated software (SISTEMA) for “all aspects of the analysis procedure contained in the standard for determining the probability of failure” (DGUV/IFA), and Pilz lists a free Safety Calculator PAScal (Pilz). Make the exported report a purchase-order deliverable.
Records you should be able to produce later
The achieved PL is a claim until it is validated, and EN ISO 13849-2 “describes the validation aspect pertinent to EN ISO 13849-1” (Pilz). Keep four items per function: the risk-graph entry with its S/F/P answers and who set them; the calculation report with category, MTTFd, DCavg, CCF and the achieved PL; the stopping-time measurement behind any distance calculation, as logged in our light curtain guide and laser scanner guide; and the commissioning test record in our safety validation checklist. A layout change moves the S/F/P answers, so re-run the number before accepting new equipment.
Sources and further reading
- ISO catalogue — ISO 13849-1:2015 — establishes the title and scope of the standard on the design and integration of safety-related parts of control systems.
- Pilz Safety Compendium (2013/2014 edition, PDF) — gives the risk-graph parameters S/F/P verbatim, the MTTFd and DC bands, the PL ≥ PLr acceptance rule, the series-interlock DC limits from ISO/TR 24119, and the EN 954-1 transition dates.
- WSPS — Practical Application of ISO 13849-1 (seminar PDF, 2022) — gives the five PLs and their PFHd basis, the MTTFd priority order and 100-year cap, B10d definitions and formulas, the CCF score of 65, and the worked guard-door calculation ending at PL c.
- IDEC — Group safety standards / ISO 13849-1 — gives the PFHd range for each performance level from PL a to PL e.
- SICK — What are performance levels? — gives the definitions of PL and PLr and the PL d band independently.
- Keyence — PL Parameters (safety knowledge) — independently confirms the MTTFd year bands and the DC percentage bands.
- Wide Automation — Performance Level and ISO 13849-1 — states that the performance level belongs to the safety function, not to the sensor.
- IBF — New standard EN ISO 13849-1:2023 (whitepaper PDF) — dates the national edition of EN ISO 13849-1:2023 to 15 October 2023 and maps its sections to the 2016 edition.
- DGUV/IFA — Work 4.0: EN ISO 13849 — establishes that software tools exist for the PFHd and PL determination and that few parameters drive the result.
Frequently asked questions
What is PLr and who decides it?
PLr is the required performance level for one safety function. It comes out of the risk graph in ISO 13849-1, using three parameters: severity of injury (S), frequency or duration of exposure (F) and possibility of avoiding the hazard (P). The risk assessment sets it, function by function, before any device is chosen.
Is PL e always better than PL d?
Not automatically. The requirement is met when the achieved performance level is greater than or equal to the PLr for that function. Specifying PL e where PL c is required costs more and adds no legal safety value; specifying it where the function needs PL e is the only case that matters.
Is the performance level a property of the sensor I buy?
No. The performance level belongs to the safety function, not to the sensor. A PL e relay sitting behind a device with no diagnostics produces a lower overall function, because the result is limited by the element with the lowest performance level.
What does MTTFd mean and what counts as High?
MTTFd is the mean time to a dangerous failure, expressed in years. The bands are Low from 3 to under 10 years, Medium from 10 to under 30 years and High from 30 to under 100 years, and 100 years is the maximum value used for each channel.
Can I save money by putting many interlock switches in series on one safety relay?
That normally fails. In a serial group of interlinked switches, the maximum achievable diagnostic coverage drops as the number of guards rises, and foreseeable fault masking limits DC to none. For PL d or PL e, use two mechanical switches per gate, one dual-channel magnetic switch, or one RFID switch with an OSSD output.
A datasheet only says Category 4. Is that enough?
No. Category 4 language can come from the withdrawn EN 954-1, which lost its presumption of conformity at the end of 2011 and whose categories mean something different under ISO 13849-1. Ask for the achieved PL of the function plus MTTFd or B10d, DCavg and the CCF score.
