ISO 13849-1 — Performance Levels (PLa-PLe) of safety controls

The emergency-stop-categories guide and the two-hand-control guide both refer to ISO 13849-1 for the required reliability of the control circuit itself (for example "category 3 or 4 safety system"). This article covers the underlying calculation framework: how a Performance Level (PL) is determined, and why "category 3" on its own does not yet fix a PL.

Five levels: PLa to PLe

ISO 13849-1 defines five Performance Levels, from low to high risk- reducing capability: PLa, PLb, PLc, PLd, PLe. The PL required for a specific safety function follows from a risk assessment (severity of injury, exposure frequency, avoidability) — this article does not cover that risk assessment itself, but how the achieved PL of a chosen control circuit is established.

Four parameters determine the achieved PL

Category (B, 1, 2, 3 or 4) — the structure of the circuit: single- channel without redundancy (B, 1) to dual-channel with mutual monitoring (3, 4).
MTTFd — mean time to dangerous failure (low/medium/high), per channel.
DCavg — diagnostic coverage: the percentage of dangerous failures the system itself detects (none/low/medium/high).
CCF — measures against common cause failure: for a dual-channel system it must be demonstrated that a single cause (for example a current surge) cannot fail both channels simultaneously.

Category B and category 1 have no diagnostic function — DCavg and CCF therefore play no role in the PL calculation for those two categories; only category and MTTFd count.

Category → maximum achievable PL

Category	Maximum achievable PL
B	PLb
1	PLc
2	PLd (subject to high MTTFd and at least low DCavg — with a strict test-interval requirement rarely met in practice)
3	PLd
4	PLe

A higher category is a precondition, not a guarantee: a category 3 circuit with a low MTTFd or insufficient CCF measures can still end up below PLd.

Note: this article gives the conceptual framework. The exact point scoring for CCF measures and the MTTFd threshold values per category are worked out in detail in ISO 13849-1 Annex E and the core standard itself respectively — consult the standard or use validated manufacturer software for an actual PL calculation of a specific circuit.

Practical relevance

When assembling a safety function from individual components (for example an emergency-stop actuator per ISO 13850, a safety relay and a motor contactor), it is not enough for each component to be individually certified — the PL of the complete chain (sensor → logic → actuator) must be determined and checked against the PL required by the risk assessment.

Common mistakes

Treating "category" and "Performance Level" as synonyms — a category 3 setup with a low MTTFd or insufficient CCF measures does not automatically achieve PLd.
Forgetting CCF measures in a dual-channel design — two redundant channels that can both fail from the same current surge or the same incorrectly sized supply offer less protection in practice than the nominal category suggests.
Only assessing the PL of the logic component (PLC/safety relay) — the PL of the complete chain (including sensor and end switch/contactor) determines the actually achieved safety level, not that of a single link.