Calculate Performance Level in two separate stages: establish PLr from severity, exposure frequency, and avoidance, then calculate achieved PL from architecture, MTTFd, DCavg, and CCF [S3].
EN ISO 13849-1 defines five Performance Levels, PL a through PL e, for safety-related parts of control systems, with PL e representing the highest dangerous-failure performance [S4][S5].
Separate the required PL from the achieved PL
PLr is the output of the machine risk assessment, while the achieved PL describes the reliability of the implemented safety function. The design passes only when the achieved PL equals or exceeds PLr [S3][S2].
The distinction controls the sequence of engineering work: define the safety function, determine PLr, design and implement the architecture, calculate achieved PL, and verify compliance. Treating PLr and achieved PL as one calculation creates an unsupported claim because their inputs differ [S2].
For an emergency-stop function, for example, the risk graph determines whether PLr c, d, or e is needed. A safety relay cannot be selected before that target is fixed, because its diagnostic architecture, reliability data, and common-cause controls determine the achieved PL.
Determine PLr from the ISO 13849-1 risk graph
The risk graph evaluates three parameters: severity S, frequency and duration of exposure F, and possibility of avoidance P. S1 covers slight, normally reversible injuries, while S2 covers serious, normally irreversible injuries, including death [S3][S5].
Exposure runs from F1, seldom or short exposure, to F2, frequent or continuous exposure. Avoidance is P1 when the hazard can be avoided under specific conditions and P2 when avoidance is scarcely possible [S3][S5]. The risk-graph method is used to determine PLr [S7].
The resulting combinations typically map as follows: S1/F1 produces PLr a; S1/F2 produces PLr b to c; S2/F1 produces PLr c to d; S2/F2 with P1 produces PLr d; and S2/F2 with P2 produces PLr e [S3]. This calculation belongs to the risk assessment, not the component selection stage.
Calculate achieved PL from four design inputs
The achieved PL is calculated from category, MTTFd, DCavg, and common-cause failure, or CCF. These inputs describe the architecture, component reliability, diagnostic performance, and protection against shared faults [S3][S5].
Category B uses a single channel with basic design and no redundancy. Category 1 uses a single channel incorporating well-tried components and safety principles. Category 2 adds testing so that a fault is detected by the next test rather than immediately [S3].
Category 3 uses redundancy and diagnostics so that a single fault does not cause loss of the safety function. Category 4 extends this architecture with high diagnostic coverage and the capability to tolerate faults while maintaining the required performance [S3].
Manufacturer safety characteristics supply the component-level data for these calculations. A calculation based only on a device’s nameplate rating is incomplete because the complete safety function includes input, logic, output, wiring, diagnostics, and common-cause safeguards [S5].
Compare the main calculation routes
The central comparison is between risk selection and design verification: PLr uses S, F, and P and answers how reliable the function must be; achieved PL uses category, MTTFd, DCavg, and CCF and answers how reliable the implementation is [S3].
PL and SIL are not interchangeable labels. EN ISO 13849-1 and IEC 62061 use different classification systems and definitions, and the applicable route depends on the technology, risk classification, and architecture [S5].
Apply the method to real safety functions
A guard door with a monitored interlock is assessed against the hazard created when the guard is open, including the frequency of access and whether a person can avoid the dangerous zone. The required Performance Level (PLr) is determined from the risk assessment for each safety function, while the achieved PL is determined separately from the safety function's category, mean time to dangerous failure (MTTFd), average diagnostic coverage (DCavg), and common cause failure (CCF).
A hazardous machine-tool feed requires an emergency-stop function whose demand condition, hazard severity, and exposure duration are documented before architecture selection. For a press application with frequent exposure and scarce avoidance, S2, F2, and P2 lead to PLr e, which demands a substantially stronger evidence package than PLr d [S3].
A safety light curtain used as a protective device must be considered within the complete safety function, not as an isolated component. Its sensing performance, muting logic, stop path, reset arrangement, response time, and CCF controls all affect the achieved PL.
Identify failure modes and weak evidence
The most common calculation error is selecting components before establishing PLr. Another is claiming a high PL from architecture alone while omitting MTTFd, DCavg, or CCF. A third is inflating avoidance to move from PLr e to PLr d without evidence [S3].
Unverified assumptions also undermine the result: using generic catalogue data instead of manufacturer safety characteristics, ignoring wiring and interface contributions, treating a periodic test as equivalent to immediate fault detection, or omitting common-cause failure from a redundant architecture [S3][S5].
The final validation should preserve the risk-graph inputs, component safety data, architecture diagram, diagnostic assumptions, CCF score, test interval, and the numerical comparison of achieved PL with PLr. These records make the safety argument reviewable during commissioning and future modifications.
Maintain the PL through equipment changes
Proof-test intervals and lifecycle assumptions must be controlled because the achieved PL depends on when faults are detected and how long the safety function remains available. The proof test interval should therefore be traced to the selected architecture and diagnostic method. [S3]
Any change to input devices, control logic, contactors, output devices, wiring, or reset logic requires review against the original calculation. Replacing one component with an equivalent catalogue item does not by itself prove that category, MTTFd, DCavg, and CCF remain unchanged [S5].
For validation, record one result per safety function: PLr, category, MTTFd, DCavg, CCF, achieved PL, and the pass condition. Recheck the calculation after hardware changes, software changes, maintenance substitutions, or changes to the operating hazard.