A light curtain, an emergency stop and a door interlock are not safety functions because they are fitted. They are safety functions to the extent that the whole chain — sensor, logic and whatever removes the power — does its job often enough in relation to how badly it goes when it does not. That chain is what is called the safety-related parts of a control system, SRP/CS, and it is the chain that has to hold a performance level.
PLr comes from the risk assessment, not from the product catalogue
The required performance level is set by the severity of harm, how often someone is exposed and the possibility of avoiding it — three questions about your machine. A component datasheet can say what a product achieves, but never what you need.
How a safety function is built, in the order the work is done
- 1
Draw the safety-related boundary
Which parts of the control system belong to the safety function decides the whole calculation that follows. Draw the boundary wrongly and you calculate correctly on the wrong chain.
- 2
Determine the required performance level
PLr follows from the risk assessment using the risk graph in EN ISO 13849-1: severity, exposure and possibility of avoidance. It is the requirement everything else is measured against.
- 3
Choose category and architecture
Single or dual channel, with or without diagnostics. The architecture sets the ceiling for which PL is achievable at all.
- 4
Quantify MTTFD, DC and CCF
How long the parts last, how much of the failures are detected, and how well the channels are protected against failing from the same cause. The numbers come from the manufacturer's data, not from a feeling.
- 5
Verify and validate
Verification is showing that the achieved PL reaches PLr. Validation to EN ISO 13849-2 is testing that the function does what was intended, including under fault conditions.
- 6
Document it in the technical file
The calculation, the choices and the tests belong in the technical file. A safety function nobody can show how it was sized is undocumented in practice.
What usually goes wrong
- The category is chosen first and PLr calculated afterwards, so the calculation confirms a decision that has already been made.
- A safety component is bought certified to PL d and assumed to give PL d to the whole function — but the chain is never stronger than the sum of its parts.
- Diagnostic coverage is set high without there being any diagnostics that actually test that part.
- CCF is handled as a formality, even though two channels in the same cable tray share a cause of failure.
- Validation is skipped because the function 'obviously works' — which has been tested in normal operation, not under fault.
- Software is left out, even though a safety component can be software and an update can change the function.
Questions about control systems and Performance Level
- Who should take the course?
- Anyone who designs or reviews safety functions: machine designers, electrical and automation designers, service technicians working on safe control systems, and anyone who needs to read and challenge a PL calculation that arrives from a supplier.
- Do you need to be an engineer?
- No, but the course assumes you work with machinery. It covers how the calculation is built up and what the parts mean, not how the standard is derived.
- What is the difference between Performance Level and SIL?
- They are two ways of expressing the same thing — how much a safety function can be relied on — from two families of standards. PL comes from EN ISO 13849 and is used throughout for machinery; SIL comes from IEC 62061 and is more common in process industries. The course stays with PL, which is the route most machine designers meet.
- Does the Machinery Regulation change the requirements on control systems?
- The core requirement is much the same: safety functions have to be sized against the risk and shown to be. What is added is that software can explicitly be a safety component, that cybersecurity becomes part of the picture, and that an update changing the function may have to be assessed. The course covers both the directive and the regulation, since both are in use until the regulation applies in full.
- Is it enough that the supplier did the calculation for us?
- If you are the manufacturer of the machine, the calculation is your evidence, whoever produced it. You need to be able to read it, see that the boundary matches your machine, and put it in your own technical file. That reading is exactly what the course trains.
Training in safe control systems
An online course at your own pace, to hand out across the whole design and automation department.
See the courses