ISO 13849 Performance Level: Category, MTTFd, DC and PL Calculation

A safety-rated guard door fails the way most machine safety functions fail: not in the datasheet, but in the arithmetic nobody finished. A team buys a “PLe” safety relay, wires it to two cheap interlock switches, adds a single contactor, and declares the machine PLe. It is not. The ISO 13849 performance level belongs to the whole safety function, and it is capped by the weakest combination of architecture, component reliability, diagnostics and common-cause protection in the chain.

This matters now because the fourth edition of ISO 13849-1 arrived in 2023, the free SISTEMA tool has moved to a 3.x line that follows it, and the EU Machinery Regulation is replacing the Machinery Directive. If you design, integrate or audit machine controls, you need to read a PL claim the way an assessor does.

You will leave with a working mental model: how the required level is chosen, what Categories B, 1, 2, 3 and 4 actually mean, how MTTFd and diagnostic coverage combine, and a worked, clearly illustrative calculation you can follow with a pencil.

What this covers: the standard’s structure and editions, the risk graph and PLr, the five categories, MTTFd and DC maths, common cause failure, a full guard-door example, software and systematic aspects, comparison with IEC 62061, and the failure modes that sink real projects.

Context and Background

ISO 13849-1, “Safety of machinery: Safety-related parts of control systems, Part 1: General principles for design”, is the main standard for the functional safety of machine control systems. According to its edition history, the first edition appeared in 1999, followed by 2006, 2015 and the fourth edition in 2023. Part 2 (validation) dates from 2012 and was reaffirmed, and the 2023 revision folds validation content into Part 1 as Clause 10, according to a 2023 IEEE presentation critiquing the revision.

The standard measures the ability of a safety-related part of a control system (SRP/CS) to perform a safety function under foreseeable conditions. That ability is expressed as a performance level (PL), from PLa (lowest) to PLe (highest). Each level corresponds to a band of the average probability of dangerous failure per hour, written PFHd.

The framing differs from process-industry functional safety. Machine builders in the IEC 61508 world often think in Safety Integrity Levels (SIL) and probability of failure on demand. ISO 13849 grew from the older deterministic “Categories” of EN 954-1 and added quantitative reliability on top. That heritage is why the standard talks about architecture categories first and probabilities second. If you want the process-sector view of the same ideas, our deep dive on IEC 61508 functional safety, SIL and PFD covers the other side of the fence.

Where PL sits in the safety lifecycle

Performance level calculation is one step in a longer chain. A risk assessment (traditionally guided by ISO 12100) identifies hazards. For each hazard that a control function will mitigate, you define the safety function: what it senses, what it commands, how fast it must react and what safe state it reaches. Only then do you assign a required level PLr and design an SRP/CS to meet it.

The fourth edition adds a new Clause 4 that explicitly ties the standard to the risk assessment and provides a design process flow, per the IEEE presentation cited above. It also adds Annex M for safety requirements specification and Annex O for safety-related values of components. The practical consequence is that “we just picked PLd” no longer survives scrutiny: the PLr needs a documented derivation.

Who uses which numbers

Three different parties supply inputs. The component manufacturer provides B10d or MTTFd data and, for complete safety devices, a certified PL and PFHd. The machine builder provides the architecture, the diagnostic design and the application duty cycle. The assessor checks that the claim is consistent. Mixing up whose number is whose is the single most common source of wrong PL claims, and we return to it in the failure-modes section.

The Core Model: From Risk to Attained PL

The performance level of a safety function is determined by five interacting properties: the required PLr from risk assessment, the control architecture (Category), the mean time to dangerous failure of each channel (MTTFd), the average diagnostic coverage (DCavg) and the resistance to common cause failure (CCF). Systematic failure measures and software complete the picture.

Figure 1: The design loop for an ISO 13849 performance level. If the attained PL falls below PLr, you change architecture, components or diagnostics and recalculate.

The loop in Figure 1 is iterative by design. You rarely get the architecture right on the first pass, and the standard expects you to document the iteration. Each box maps to a clause: safety function specification, category selection, MTTFd and DC estimation, CCF scoring, PL lookup, and then validation covering software and systematic faults.

Step 1: Required performance level PLr

PLr is derived from a risk graph using three parameters, as described in the standard’s Annex A. S is the severity of injury: S1 is slight, normally reversible; S2 is serious, normally irreversible, including death. F is the frequency and duration of exposure: F1 is seldom to less often or short, F2 is frequent to continuous or long. P is the possibility of avoiding the hazard: P1 is possible under specific conditions, P2 is scarcely possible.

Figure 2: Risk graph logic. Severity, exposure and avoidance combine into a required PLr from a to e.

The commonly published mapping runs as follows. S1 with F1 and P1 gives PLr a. S1 with F1 and P2, or S1 with F2 and P1, gives PLr b. S1 with F2 and P2 gives PLr c. S2 with F1 and P1 gives PLr c. S2 with F1 and P2, or S2 with F2 and P1, gives PLr d. S2 with F2 and P2 gives PLr e. The standard permits a documented one-step adjustment for borderline cases. Figure 2 above shows a subset of these combinations to keep the diagram legible.

The fourth edition adds a new method for the P parameter, which the IEEE presentation notes is not itself a risk assessment method. Treat it as a way to be consistent about avoidance, not as a substitute for thinking about the real operator.

A word of caution on F. Teams routinely choose F1 for a machine that is “rarely” entered for maintenance, then discover that during commissioning and troubleshooting, access is daily. The risk graph is applied to the task and hazard, not to the average week. If a hazard is accessed during normal setup, assign exposure for setup.

Step 2: The performance level bands

Attained PL maps to PFHd, the average probability of dangerous failure per hour. The published bands from the 2015 edition, which I expect the 2023 edition to keep, are:

PL	PFHd per hour (lower bound inclusive)
a	1E-5 to below 1E-4
b	3E-6 to below 1E-5
c	1E-6 to below 3E-6
d	1E-7 to below 1E-6
e	1E-8 to below 1E-7

Each step down in PL is roughly a threefold or tenfold worse failure rate, which is why the difference between PLd and PLe is more than cosmetic: PLe requires dangerous failures below one in ten million hours of operation. Verify the exact bounds against Table 2 of your purchased copy of the standard before quoting them in a safety report; I have not been able to confirm the 2023 table text from a primary source for this article.

A PL also carries a mission-time assumption. The standard assumes a mission time of 20 years for the SRP/CS, after which components should be replaced or re-evaluated, a figure that the IEEE presentation also mentions in the context of T10D.

Step 3: Choose the architecture

Architecture is the structural half of the story. The standard defines five designated architectures: Categories B, 1, 2, 3 and 4. They differ in redundancy, diagnostics and fault tolerance. The next section covers them in detail, because the category you pick sets the ceiling on the PL you can reach regardless of component quality.

Categories B, 1, 2, 3 and 4 in Detail

The five categories are not a quality ranking of components. They are structural patterns defining how the safety function reacts to a fault. Category B and 1 are single channel with no diagnostics. Category 2 is single channel with a test channel. Categories 3 and 4 are dual channel with cross-monitoring, and Category 4 demands far better diagnostics.

Figure 3: Block-level structure of the five designated architectures. Dotted lines show diagnostic or test paths.

Figure 3 groups B and 1 together because they share a structure and differ only in the reliability evidence. The table below, summarising the architectural constraints that appear in public summaries of the standard, shows the ceilings.

Category	Structure	MTTFd per channel	DCavg	CCF score	Max PL
B	Single channel	Low to medium	None	Not relevant	b
1	Single channel, well-tried components	High	None	Not relevant	c
2	Single channel plus test equipment	Low to high	Low to medium	65 or more	d
3	Redundant, cross-monitored	Low to high	Low to medium	65 or more	d or e
4	Redundant, cross-monitored, accumulation-proof	High	High	65 or more	e

The ceilings come from the same published category summary. Category 3 reaches PLe only with high MTTFd and medium DCavg in the simplified method, as discussed below.

Category B: basic safety principles

Category B means that the components are built to the relevant standards, withstand expected stresses, and apply basic safety principles. A fault can lead to loss of the safety function. There is no diagnostic coverage. With low-to-medium MTTFd you reach at most PLb. Category B is the foundation for all the others: every higher category presupposes it.

Category 1: well-tried components

Category 1 adds well-tried components and well-tried safety principles. A well-tried component is one widely used in comparable applications with proven results, or built to principles that demonstrably exclude relevant faults. Examples include positive-opening mechanical contacts and properly rated electromechanical elements used within their ratings. Category 1 depends on prevention, not detection. A fault can still cause loss of the function, but it is much less likely. The ceiling is PLc, and the MTTFd must be high.

An important subtlety: “well-tried” is technology- and application-specific. A component that is well-tried for a conveyor guard may not be well-tried for a high-cycle press, where mechanical wear dominates.

Category 2: periodic testing

Category 2 keeps a single functional channel but adds test equipment that checks the safety function at suitable intervals: at start-up, before the hazardous movement, or periodically. The standard requires a test rate of at least 100 times the demand rate, according to the same public implementation guide, though you should confirm that figure in the standard itself. A fault between tests can still cause loss of function, and the test equipment must itself not fail dangerously. The practical ceiling is PLd.

Category 2 is attractive for lifting equipment and slowly-demanded functions, where a start-up test is cheap. It is a poor fit where demand is continuous, because the test rate requirement becomes impractical.

Category 3: single-fault tolerance

Category 3 requires that a single fault does not lead to loss of the safety function, and wherever reasonably practicable the fault is detected. Two channels carry the function, with cross-monitoring between them and monitoring of outputs. Accumulation of undetected faults can still defeat it. Combined with high MTTFd and medium DCavg, the simplified method reaches PLe.

Category 4: single-fault tolerance with accumulation protection

Category 4 keeps the redundancy of Category 3 but demands that faults cannot accumulate undetected between diagnostic cycles, so that the safety function remains even if several faults occur. That requires high DCavg of at least 99 percent and high MTTFd per channel. This is the architecture used for the most demanding safety functions, including many emergency stops on hazardous machines.

Choosing the category: a practical heuristic

Start from PLr. For PLr a or b, Category B or 1 may suffice. For PLr c, Category 1 with well-tried components, Category 2 or Category 3 is usual. For PLr d, expect Category 2 or 3. For PLr e, Category 3 with high MTTFd and good diagnostics, or Category 4, is normal. The cost difference between Category 3 and 4 is often small once you buy certified safety relays or safety PLC modules, so the decision frequently reduces to what the certified components already provide.

Deeper Analysis: MTTFd, Diagnostic Coverage, CCF and a Worked PL Calculation

MTTFd tells you how long a channel survives before a dangerous failure; diagnostic coverage tells you what fraction of those dangerous failures the system notices; CCF scoring tells you whether two channels can be defeated by one cause. Together with the category they select a PL from a lookup table, or a PFHd from the tabulated values in the standard.

MTTFd: mean time to dangerous failure

MTTFd is the expectation of the mean time to dangerous failure of a single channel, expressed in years. It is built from component data. The classes used in the 2015 edition, and to my understanding still the basis of the simplified method, are:

Class	MTTFd per channel
Low	3 to under 10 years
Medium	10 to under 30 years
High	30 to 100 years

The 100-year ceiling on a channel is a deliberate cap: no matter how good your components, you may not claim more than 100 years per channel in the simplified method. I have confirmed the low, medium and high labels and the 10, 30 and 100 year boundaries only through secondary summaries; the 2023 edition’s treatment of the cap should be checked against the purchased standard.

For electromechanical components, manufacturers usually publish B10d, the number of operating cycles at which 10 percent of a sample fails dangerously, rather than MTTFd. You convert with the application duty cycle:

nop = dop x hop x 3600 / tcycle, where dop is operating days per year, hop is operating hours per day and tcycle is the mean time between the start of two cycles in seconds.
MTTFd = B10d / (0.1 x nop).

This is why identical contactors give very different results on a slowly-cycled guard door and a fast cycling clamp. The component did not change; the duty cycle did. Contactors and relays that cycle often will quickly fall into the low MTTFd class unless you pick high-B10d parts or reduce cycle count.

Combining components in a channel

Within one channel, component failure rates add, so MTTFd values combine as reciprocals: 1 / MTTFd_channel = sum of 1 / MTTFd_i. A chain of a switch, a relay and a contactor is only as strong as the combined failure rate, dominated by the least reliable part. For a redundant pair of unequal channels, the standard supplies a symmetrisation formula, usually written MTTFd = 2/3 x (MTTFd_C1 + MTTFd_C2 minus 1 / (1/MTTFd_C1 + 1/MTTFd_C2)). Use it rather than averaging.

The “fault exclusion” mechanism lets you remove certain faults from consideration when they are demonstrably unlikely, for instance wire short circuit inside properly protected cabling. Fault exclusions must be justified and documented. They are legitimate, but they are also the most frequently abused tool in the box.

Diagnostic coverage and DCavg

Diagnostic coverage (DC) is the ratio of the failure rate of detected dangerous failures to the failure rate of all dangerous failures. The 2015-edition classes, which I treat as the working basis here, are:

Class	DC
None	below 60 percent
Low	60 percent to under 90 percent
Medium	90 percent to under 99 percent
High	99 percent or more

The average across the whole SRP/CS is computed by weighting each block’s DC by its failure rate:

DCavg = (DC1/MTTFd1 + DC2/MTTFd2 + …) / (1/MTTFd1 + 1/MTTFd2 + …)

The effect is intuitive: a poorly-diagnosed but unreliable part drags the average down hard, because it contributes the largest term in both numerator and denominator. Typical diagnostic measures include cross-monitoring of redundant inputs, feedback from mirror contacts on contactors, plausibility checks between two sensors, and watchdog-monitored logic. The standard’s Annex E lists measures with assignable DC values, for example 99 percent for direct monitoring by mirror contacts in suitable circumstances. Use those tabulated values rather than inventing your own.

Here is the connection to the secondary theme of this article, mttfd diagnostic coverage. The two numbers trade off. A high-reliability but undiagnosed channel can be Category 1; a mediocre channel with good diagnostics in a redundant structure can still reach PLd or PLe. The architecture of Category 3 is, in effect, a way of buying a high PL with average parts plus monitoring.

Common cause failure

Redundancy means little if a single event defeats both channels. CCF is assessed by a scoring table (Annex F) over measures such as separation of signal paths, diversity of technology, protection against overvoltage, use of well-tried components, and environmental testing. A score of at least 65 out of 100 is required for Categories 2, 3 and 4. A worked example in the public guide cited earlier attributes 15 points for separate routing of cables and 20 for diverse input devices; treat these as example figures and consult the standard’s table for your own scoring.

CCF is where schematics lie. Two identical safety switches mounted on the same hinge, wired in the same cable and powered from the same unfiltered 24 V rail will happily fail together. Adding diversity, say one mechanical interlock plus one coded magnetic sensor, buys score points and real robustness.

The PL lookup: simplified method

Once you know category, MTTFd class and DCavg class, the simplified method reads PL from a chart. My summary of the chart, which you must verify against the standard’s figure before relying on it:

Category	DCavg	MTTFd low	MTTFd medium	MTTFd high
B	none	a	b	b
1	none	not allowed	not allowed	c
2	low	a	b	c
2	medium	b	c	d
3	low	b	c	d
3	medium	c	d	e
4	high	not allowed	not allowed	e

The detailed approach uses Annex K, which tabulates PFHd by category, DCavg and MTTFd, and lets you add subsystems by simply summing their PFHd values. For a series chain of input, logic and output subsystems the arithmetic is: PFHd_total = PFHd_input + PFHd_logic + PFHd_output, then map the sum back through the PL bands.

Worked example: a guard door interlock (illustrative values)

Consider the architecture in Figure 4: two interlock switches on a guard door, a safety relay, and two contactors with feedback. The hazard is a moving machine behind the door that can cause serious injury (S2), the operator enters occasionally for adjustment (F1 in our example, though a real task analysis might say F2), and the machine runs down slowly enough that escape is hardly possible if it restarts (P2). The risk graph gives PLr d for S2, F1, P2.

Figure 4: Example safety function used for the PL calculation. The values below are illustrative, not from any real product datasheet.

Assumptions, all illustrative. Operating 220 days a year, 16 hours a day, with one door cycle every 120 seconds. Then nop = 220 x 16 x 3600 / 120 = 105,600 cycles per year.

Input subsystem. Assume each interlock switch has B10d of 1,000,000 cycles. MTTFd = 1,000,000 / (0.1 x 105,600) = about 94.7 years per channel, which falls in the high class. The safety relay compares the two channels, so assume DC of 99 percent through cross-monitoring, in the high class. Two-channel structure, Category 4 input if CCF is adequate.

Logic subsystem. Assume a certified safety relay with a manufacturer-stated Category 4, PLe, PFHd of 2.0E-9 per hour. For certified devices you use their stated PFHd directly; you do not recompute MTTFd for the relay’s internals.

Output subsystem. Assume each contactor has B10d of 2,000,000 cycles. MTTFd = 2,000,000 / 10,560 = about 189 years, which is capped at 100 years per channel. Mirror-contact feedback to the relay gives DC of 99 percent. Two channels with feedback form a Category 4 output.

Combining. From Annex K style tables, suppose lookups give illustrative PFHd values of 2.5E-8 for the input and 2.5E-8 for the output, both in the PLe region. The sum is 2.5E-8 + 2.0E-9 + 2.5E-8 = 5.2E-8 per hour. That falls in the PLe band (1E-8 up to 1E-7). The attained PL e exceeds the required PLr d, so the design passes with margin, subject to CCF score of at least 65 and the software and validation steps below.

Now degrade it. Replace the two contactors with a single contactor of the same B10d and drop the feedback. The output becomes Category 1 or B, single channel, no DC. Even with 100-year MTTFd, the best the structure can reach is PLc. The design now fails PLr d, whatever the logic device’s PL claim says. That is the spreadsheet lesson in one line: the weakest subsystem sets the ceiling.

SISTEMA: let software do the arithmetic

You rarely do this by hand. SISTEMA, published free of charge by the German IFA (DGUV), models the control structure and computes attained PL. Per the IFA SISTEMA page, version 3.0.4 Build 5 is listed as of 31 October 2025, and the 3.x line supports ISO 13849-1:2023; 2.x maps to 2015 and 1.x to 2008. Manufacturers distribute SISTEMA library files with B10d and PFHd data for their components. Use the vendor library where you can, because it records the data source and avoids transcription errors.

SISTEMA does not decide whether your architecture or fault exclusions are sound. It will happily compute a PL for a wiring concept that violates basic safety principles. Treat its output as arithmetic, not as certification.

Software, Systematic Failures and the Wider Standard Landscape

The PL maths covers random hardware failures. Systematic failures, from design errors and software bugs to electromagnetic interference, need separate controls, and ISO 13849-1 addresses them through process requirements rather than probabilities.

For embedded and application software, ISO 13849-1 requires a structured lifecycle: specification, modular design, coding rules, verification and validation. The level of rigour scales with the PL. The standard distinguishes safety-related embedded software (SRESW) from safety-related application software (SRASW). Application software, such as ladder logic in a safety PLC, follows the V-model with documented specification, tests and change control. The IEEE presentation notes that the fourth edition adds Annex N on avoiding systematic failures in software design and that it leaves artificial intelligence and machine learning requirements unaddressed, with AI functional safety deferred to separate work.

If you run a safety program inside a standard PLC, the standard treats this as a high-risk move. The presentation reports that Annex I and Clause 7.3.2 allow standard PLCs in Category 3 or 4 architectures, with the criticism that results can differ by about a decade in PFHd. That claim is the presenter’s opinion; I flag it as such. For deterministic behaviour of the logic itself, see our walkthrough of the PLC scan cycle and IEC 61131-3 determinism, since scan-time jitter bears on the reaction time you must demonstrate.

Electromagnetic resilience and systematic measures

The fourth edition adds Clause 6.1.7 on systematic failures and electromagnetic interference, leading to Annex L, which offers four routes (A to D) to demonstrate electromagnetic resilience. The IEEE presenter criticises Route C as unproven, again an opinion rather than a finding. In practice, most builders take the route where components carry test evidence to the relevant immunity standards.

Security is out of scope but not irrelevant

Neither ISO 13849-1 nor the machinery sector standard IEC 62061 treats cybersecurity. IEC 62061 states that security measures are outside its scope and points to IEC TR 63074, per its IEC webstore entry. But a networked safety PLC with an open engineering port can be reprogrammed by an attacker, defeating every number above. Pair the safety case with a security case; our posts on OPC UA security certificates and trust lists and the Cyber Resilience Act and SBOM obligations cover the surrounding controls.

ISO 13849 versus IEC 62061

Both standards serve the same Machinery Directive and Regulation goal, but they use different languages. IEC 62061 expresses integrity as SIL and sits, by its own description, within the IEC 61508 framework as a machinery sector standard. The current consolidated edition is IEC 62061:2021+AMD1:2024, edition 2.1 (published 28 March 2024), per the IEC webstore.

Aspect	ISO 13849-1	IEC 62061
Integrity measure	PL a to e	SIL 1 to 3
Failure metric	PFHd bands	PFH bands
Architecture model	Designated Categories B to 4	Subsystem architectures with hardware fault tolerance
Typical users	Mechanical, hydraulic, pneumatic and electromechanical machinery	Complex electronic and programmable systems
Parent framework	Evolved from EN 954-1	Machinery sector within IEC 61508

The PFH bands for PLc through PLe line up with SIL 1 to SIL 3 respectively in the commonly used correspondence (PLe with SIL 3, PLd with SIL 2, PLc with SIL 1), though the two methods differ in how they reach the number, so the correspondence is a rough guide for communication rather than a conversion rule. A system built partly with each method can use the hybrid approach discussed in ISO/TR 14121-2 context, though I have not verified the details of that route for this article.

For selection: use ISO 13849-1 when your technology is hydraulics, pneumatics or conventional electromechanics and your team already speaks in Categories. Use IEC 62061 when you have programmable electronic subsystems, complex safety networks or a need for SIL language that matches suppliers from the process world. Many projects use both, with the architecture in one language and component data in the other.

Regulatory context

In the EU, the Machinery Directive 2006/42/EC is being replaced by Regulation (EU) 2023/1230, which I recall applying from 20 January 2027; confirm the date and the list of harmonised standards before relying on it. Whether a given edition gives presumption of conformity depends on its citation in the Official Journal, so check which edition your notified body expects.

Trade-offs, Gotchas, and What Goes Wrong

The arithmetic is the easy part. Most failed PL claims fail on inputs, scope or process, not on the lookup table.

Component PL is not system PL. A safety relay certified PLe and Category 4 says nothing about the switches and contactors wired to it. A subsystem’s PL feeds into the calculation; it does not replace it. Auditors routinely find a PLe logic block in a Category 1 loop.

Duty cycle surprises. B10d-derived MTTFd depends on nop. If the guard door cycles every 12 seconds instead of 120, nop grows tenfold and MTTFd falls tenfold. A contactor that was comfortably high class at 94 cycles an hour can be medium or low at 940. Always document the assumed cycle time, and revisit it when the process speeds up.

Using B10 instead of B10d. Datasheets may quote B10 (10 percent of units fail, in any mode) or B10d (dangerous failures only). Converting needs the proportion of dangerous failures. Using B10 as if it were B10d is conservative; guessing a dangerous-failure fraction without evidence is not.

Diagnostic coverage that is claimed, not designed. DC of 99 percent from mirror contacts only holds if the monitoring circuit actually reads the feedback contact on every cycle and drops the enable on mismatch. If the feedback is wired to a standard PLC input that nobody tests, you have claimed a diagnostic you do not have. Likewise, test pulses that a downstream device filters out give no coverage.

Fault exclusion creep. Excluding the mechanical failure of an interlock tongue or the shorting of conductors is allowed with justification, but each exclusion moves risk from the calculation to your assumptions. Document who accepted it and under what mounting, cabling and maintenance conditions.

Muting, bypass and defeat. The model assumes the safety function works as designed. Real plants bypass interlocks that stop production. Design to make casual defeat hard, for example coded actuators, and consider the manipulation as part of the risk assessment. The attained PL does not protect against a screwdriver and a cable tie.

Software edit after validation. A single changed rung in a safety program invalidates the validation unless change management catches it. Lock the program, record a signature or checksum, and control access.

Treating SISTEMA output as a certificate. The tool computes what you tell it. Wrong architecture selection, an incorrect cycle time or an inflated DC still produce a clean green PLe.

Edition drift. Part of the community criticised aspects of the 2023 edition, including the new no-failure-data method in Clause 6.1.9 and the treatment of standard PLCs. Those are views from one presentation, not settled facts. The practical point is that a design assessed to the 2015 edition may need re-examination if your customer or notified body expects the 2023 text.

Practical Recommendations

Treat the PL calculation as a documentation artefact generated alongside the design, not a gate at the end. Start with the hazard, write down the safety function in measurable terms (stimulus, response, safe state, response time), and derive PLr with a recorded rationale for each of S, F and P. Then pick an architecture that the available certified components can realise, rather than designing a custom circuit that you must justify from first principles.

Prefer certified safety components with published PL, category and PFHd, and import them via manufacturer SISTEMA libraries. Where you must use electromechanical parts, collect B10d from the datasheet, set the real duty cycle, and compute MTTFd explicitly. Design diagnostics into the circuit, test them in commissioning by injecting faults, and keep the evidence.

Score CCF honestly, favour diversity over duplication, and separate wiring routes and power supplies. For software, use a certified safety controller with a certified function block library, restrict changes and keep the validation record.

Finally, remember the boundaries. This article explains concepts and an illustrative calculation. It is not a substitute for assessment by a competent person or a notified body, and it is not a safety certification of any design.

Checklist before you sign off:

Hazard, safety function and safe state written down; response time specified.
PLr derived from S, F and P with rationale.
Category chosen and justified; fault exclusions listed with owners.
B10d, duty cycle, nop and MTTFd documented per component.
DCavg computed from tabulated measures that exist in the real circuit.
CCF score at least 65 with the scoring sheet attached.
SISTEMA (or equivalent) project saved, with library versions recorded.
Software lifecycle, change control and checksums in place.
Validation tests executed, including fault-injection and reaction-time measurement.
Security of programming access and networks addressed separately.

Frequently Asked Questions

What is a performance level in ISO 13849?

A performance level is the standard’s measure of how reliably a safety-related part of a control system performs its safety function. It runs from PLa to PLe, with PLe the most demanding. Each level maps to a band of average dangerous failure probability per hour (PFHd). The attained level depends on architecture category, MTTFd, diagnostic coverage and common cause failure measures, and it must meet or exceed the required level PLr from risk assessment.

How do you calculate PL for a safety function?

First derive PLr from the risk graph using severity, frequency and avoidance. Choose a category, estimate MTTFd for each channel from component data, compute average diagnostic coverage, and score common cause failure. Read the attained PL from the simplified chart or sum subsystem PFHd values from tabulated data. Confirm PL meets PLr, then validate software and systematic aspects. Tools such as SISTEMA automate the arithmetic.

What is the difference between ISO 13849 and IEC 62061?

Both address functional safety of machinery. ISO 13849-1 uses performance levels a to e and designated Categories, and suits mechanical, hydraulic and electromechanical systems. IEC 62061 uses SIL and is a machinery sector standard within the IEC 61508 framework, so it fits programmable electronic systems. PLc to PLe roughly correspond to SIL 1 to 3, but the methods differ, and many designs use both.

What do Categories B, 1, 2, 3 and 4 mean?

They are architecture patterns. Category B is a single channel built to basic principles. Category 1 adds well-tried components. Category 2 adds periodic testing of a single channel. Category 3 uses two cross-monitored channels so one fault does not lose the function. Category 4 adds accumulation protection with high diagnostic coverage. The category sets a ceiling on the PL you can attain.

Is SISTEMA free and does it support the 2023 edition?

Yes. The IFA, part of the German DGUV, offers SISTEMA free for commercial, teaching and private use. According to the IFA page, version 3.0.4 Build 5 is listed as of 31 October 2025, and the 3.x line supports ISO 13849-1:2023, while 2.x maps to the 2015 edition. It calculates the PL but does not judge whether your architecture or assumptions are sound.

Does a PLe component make my machine PLe?

No. The performance level belongs to the complete safety function, including sensors, logic and actuators. A PLe safety relay connected to a single contactor or a single-channel switch gives a lower system PL. You combine subsystem PFHd values, check each subsystem’s category and CCF, and the weakest link controls the result.