Machine safety circuits are rated with a letter from PL a to PL e, and that letter decides how good your interlocks, relays and contactors must be. This guide walks through the risk graph, the PFHd table, MTTFd, DC and CCF with a worked guard door example.
Performance Level tells you how reliably a machine safety function does its job. Here we decode every parameter behind it and calculate a real guard door interlock step by step.
What Is ISO 13849 Performance Level?
The ISO 13849 performance level (PL) is a five step rating, from PL a to PL e, that states how reliably a safety related part of a machine control system performs its safety function. It is expressed as the average probability of a dangerous failure per hour, called PFHd, where PL e is the most reliable band.
- PL a to PL e is set by PFHd, the average probability of dangerous failure per hour.
- PL e means PFHd from 10minus 8 up to below 10minus 7 per hour.
- The required level PLr comes from a risk graph using severity S, frequency F and avoidance P.
- Achieved PL depends on Category, MTTFd, DCavg and CCF (65 points or more).
- MTTFd of electromechanical parts = B10d ÷ (0.1 × nop).
ISO 13849 Part 1 covers the design of safety related parts of control systems on machines, from a door switch to a full safety PLC. Each safety function, such as stopping a motor when a guard opens, gets its own ISO 13849 performance level, while Part 2 covers validation.
The 2006 edition of ISO 13849 Part 1 replaced the old EN 954 approach, which only looked at circuit structure, and added MTTFd, DCavg and CCF so that reliability numbers finally became part of the rating.
How Is PLr Determined From the Risk Graph?
PLr is the required performance level that comes out of your risk assessment, before any circuit is drawn. ISO 13849 Part 1 gives a simple risk graph with three yes or no style questions, and many engineers sketch it next to the risk matrix used in hazard studies.
| Path S / F / P | PLr |
|---|---|
| S1 F1 P1 | a |
| S1 F1 P2 | b |
| S1 F2 P1 | b |
| S1 F2 P2 | c |
| S2 F1 P1 | c |
| S2 F1 P2 | d |
| S2 F2 P1 | d |
| S2 F2 P2 | e |
SICK shows a typical case in its performance level blog where slight injury, frequent exposure and scarce avoidance lead to PLr c. Pilz notes that a low probability of the hazardous event occurring can reduce PLr by one level.
Write down why you chose S, F and P for every hazard, because auditors ask for this reasoning more often than for the final ISO 13849 performance level.
ISO 13849 Performance Level PFHd Table
Every ISO 13849 performance level maps to a band of PFHd values in Table 2 of Part 1. The table below also lists the IEC 62061 SIL whose PFH limit lines up with each band, using the SIL limits quoted by Pilz.
| PL | PFHd per hour | Matching SIL (IEC 62061) |
|---|---|---|
| a | ≥ 10minus 5 to < 10minus 4 | no SIL |
| b | ≥ 3 × 10minus 6 to < 10minus 5 | SIL 1 |
| c | ≥ 10minus 6 to < 3 × 10minus 6 | SIL 1 |
| d | ≥ 10minus 7 to < 10minus 6 | SIL 2 |
| e | ≥ 10minus 8 to < 10minus 7 | SIL 3 |
What Are the Categories in ISO 13849?
A Category describes the structure of the safety circuit and how it behaves when a fault appears. It is the architecture half of the rating, while MTTFd, DCavg and CCF are the reliability half.
Single channel with basic safety principles and MTTFd low to medium.
Single channel with well tried components and MTTFd high.
Single channel plus periodic testing, DCavg low to medium.
Two channels, so a single fault does not lose the function.
Two channels with MTTFd high and DCavg of 99 % or more.
Category 3 and 4 circuits are usually built around a safety relay that monitors both channels and checks the feedback of two contactors. The idea of two channels is close to the 1oo2 logic covered in our note on voting architectures.
MTTFd, DCavg and CCF Bands
Once the Category is fixed, three numbers decide your final ISO 13849 performance level. Keyence publishes these bands in its safety knowledge pages.
| Parameter | Band | Value |
|---|---|---|
| MTTFd per channel | Low | 3 years ≤ MTTFd < 10 years |
| MTTFd per channel | Medium | 10 years ≤ MTTFd < 30 years |
| MTTFd per channel | High | 30 years ≤ MTTFd ≤ 100 years |
| DCavg | None | DC < 60 % |
| DCavg | Low | 60 % ≤ DC < 90 % |
| DCavg | Medium | 90 % ≤ DC < 99 % |
| DCavg | High | DC ≥ 99 % |
| CCF | Pass | 65 points or more out of 100 |
MTTFd is the mean time to dangerous failure of one channel, much like the figure you get from an MTBF calculation but counting only dangerous failures. Festo notes that values above 100 years per channel are capped at 100 years, while Pilz points out that Category 4 allows up to 2,500 years.
DC, the diagnostic coverage, is the share of dangerous failures that your diagnostics detect. Engineers usually estimate it with a short failure mode and effects analysis of each sensor and output, and it plays a similar role to the safe failure fraction in IEC 61508 work.
CCF, the common cause failure score, checks that one event such as a voltage spike cannot knock out both channels together. Festo lists the measure groups as separation 15, diversity 20, design and application 20, assessment 5, competence and training 5 and environment 35 points.
Diversity alone is worth 20 CCF points, so using one mechanical switch and one non contact coded sensor on the same door is a cheap way to strengthen a Category 3 design.
How to Calculate MTTFd From B10d?
Mechanical and electromechanical parts wear with operations rather than time, so makers quote B10d, the number of cycles until 10 % of samples fail dangerously. APEM and Festo both give the same conversion formula from the standard.
MTTFd = B10d ÷ (0.1 × nop)
dop = operating days per year
hop = operating hours per day
tcycle = seconds between operations
Festo adds that if a maker gives only B10, you may assume B10d = 2 × B10, meaning every second failure is treated as dangerous.
The standard also limits the useful life of a worn part to T10d, which is B10d divided by nop. Plan replacement of contactors and switches before that point, just like you plan a proof test.
Solved Example: Guard Door Interlock
Take a packing machine in Pune where an operator opens a hinged guard every 10 minutes to clear jams. The risk assessment says S2 (crushing of fingers), F2 (frequent access) and P1 (the motor slows before contact), so the ISO 13849 performance level needed is PLr d.
nop = 240 × 16 × 3600 ÷ 600 = 23,040 per year
Switch B10d = 2,000,000 cycles
MTTFd = 2,000,000 ÷ (0.1 × 23,040)
MTTFd = 868.1 years, use 100 years
With Category 3, MTTFd high per channel, DCavg medium and CCF of 65 points or more, the simplified bar chart of Annex K reaches PL e. Since the achieved PL e is better than PLr d, this guard door design passes, provided the contactors are checked the same way.
Repeat the check for the contactors using their own B10d at rated load, because the contactor often sets the lowest MTTFd. Our guide on failures in industrial automation shows why the output side fails first.
SISTEMA Tool for PL Calculation
SISTEMA is a free Windows tool from IFA, the safety institute of the German Social Accident Insurance, that models your blocks and channels and calculates the achieved PL. The DGUV page states that version 3.x follows ISO 13849 Part 1:2023 and that commercial use is allowed.
What Is the Difference Between PL and SIL?
PL comes from ISO 13849 and SIL for machinery comes from IEC 62061, while process plants use SIL under IEC 61511 for their safety instrumented functions. The table compares the three so you can pick the right standard.
| Point | ISO 13849 | IEC 62061 | IEC 61511 |
|---|---|---|---|
| Sector | Machinery | Machinery | Process industry |
| Rating | PL a to e | SIL 1 to 3 | SIL 1 to 4 |
| Main metric | PFHd | PFH | PFDavg or PFH |
| Technology | Any (electrical, pneumatic, hydraulic) | Electrical and programmable | Instrumented systems |
For process loops in low demand mode you calculate PFDavg instead of PFHd, which you can try with our PFDavg calculator. The broader picture of how these fit together is in process safety vs functional safety.
- Covers pneumatic and hydraulic parts, not only electronics
- Free SISTEMA tool and wide maker libraries
- Clear link between risk graph and design target
- Simplified method caps the result at PL e
- Complex programmable logic often needs IEC 62061 or IEC 61508 detail
- MTTFd figures depend heavily on assumed nop
Field Tips and Troubleshooting
| Symptom | Likely cause | Fix |
|---|---|---|
| Achieved PL one step below PLr | Low MTTFd of contactor at high nop | Use higher B10d contactor or reduce switching |
| Relay will not reset after door closes | Contactor feedback loop open or welded contact | Check mirror contacts and wiring |
| CCF score below 65 | Both channels in one cable, no diversity | Separate routing, mix sensor types |
Never treat a bypass as a quick fix, because a defeated interlock drops the real PL to zero. Our notes on force vs override and on lockout tagout explain how maintenance access should be handled instead.
- Risk assessment done and PLr recorded for every safety function
- Category chosen and block diagram drawn for each channel
- MTTFd per channel calculated from B10d with a realistic nop
- CCF checklist scored at 65 points or more
- SISTEMA report and validation per Part 2 filed with the machine
ISO 13849 Performance Level FAQ
PL e is the highest ISO 13849 performance level, with PFHd from 10 to the power minus 8 up to below 10 to the power minus 7 per hour. It is usually needed where serious injury, frequent exposure and poor avoidance all come together.
Reaching it normally needs a Category 3 or Category 4 circuit with high MTTFd. Diagnostic coverage and common cause measures must also be strong enough to support it.
PLr is read from the risk graph using severity, frequency of exposure and possibility of avoidance. Each parameter has two choices, so eight paths lead to PLr a through e.
The choice is made during risk assessment before the circuit is designed. Writing down the reasons for each choice helps reviewers and later audits understand the target you set.
PL comes from ISO 13849 and applies to any technology on machinery, including pneumatics and hydraulics. SIL comes from IEC 62061 for machinery or IEC 61511 for process plants and focuses on electrical and programmable systems.
The PFH bands line up closely, so PL d roughly matches SIL 2 and PL e roughly matches SIL 3. The methods and lifecycle documents still differ, so follow the standard your customer names.
MTTFd is the mean time to dangerous failure of one channel, expressed in years. It is graded as low from 3 to 10 years, medium from 10 to 30 years and high from 30 to 100 years.
For electromechanical parts it is calculated from B10d and the yearly number of operations. Values above 100 years are normally capped at 100 years when you work out the achieved level.
A CCF score of 65 points shows that you have enough measures against one cause failing both channels together. It is required for Categories 2, 3 and 4 in the standard.
Points come from separation, diversity, design, assessment, competence and environmental measures with a total of 100 points available. Scoring below 65 means redundancy cannot be fully credited in your calculation.
Yes, SISTEMA is offered free of charge by IFA, the safety institute of the German Social Accident Insurance. Its licence allows commercial, teaching and private use of the tool.
The tool models your channels and blocks and then calculates the achieved PL automatically. Version 3.x is aligned with the 2023 edition of ISO 13849 Part 1, so use it for new projects.
Related Articles
- What Is SIL (Safety Integrity Level)
- What Is a Safety Relay
- SIL Verification
- Voting Architectures in Safety Systems
- Emergency Stop Push Buttons
External References
- Festo: Safety@Festo Evaluating Safety Measures (PDF)
- SICK: What Are Performance Levels?
- Wikipedia: ISO 13849
What We Learn Today
- The iso 13849 performance level runs from PL a to PL e and is defined by the PFHd band of the safety function per hour.
- PLr comes from the risk graph using severity, frequency and avoidance, and the achieved PL must be equal to or better than it.
- Achieved PL depends on Category, MTTFd from B10d and nop, DCavg and a common cause failure score of at least 65 points.
