Category 4 is the only architecture in ISO 13849-1 that, by the standard's own definition, reaches the maximum Performance Level e, with a required PFHd ≤ 1.0×10⁻⁸ dangerous failures per hour, matching SIL 3 on the IEC 61508 scale [S6][S7].
Performance Level e itself is a probability band, not an architecture. The PL is determined by combining Category, MTTFd of each channel (low / medium / high), and DC avg (none / low / medium / high). Category 4 fixes the upper-right corner of that design space: redundant channels, high MTTFd per channel, and high DC avg with explicit fault-accumulation coverage [S2][S4].
Structural requirements: dual channel, single-fault tolerance, fault accumulation
Category 4 inherits every requirement of Category B and the "well-tried safety principles" obligation of Category 3, then adds three quantitative obligations [S1]. The SRP/CS must keep the safety function intact when a single fault occurs in any safety-related part, and that single fault must be detected at or before the next demand on the safety function. If detection at the next demand is not feasible, an accumulation of undetected faults must still not lead to loss of the safety function, a clause that is the differentiator between Category 3 and Category 4 [S1][S3].
DC avg across the whole SRP/CS must be high, and the diagnostic coverage has to extend to accumulation of faults, not only to a single-fault snapshot. MTTFd of each of the redundant channels must be classified as "high" per ISO 13849-1 Table 4 (i.e. 30–100 years per channel), and measures against common-cause failure (CCF) per Annex F must be applied and documented [S1][S4].
Probability target: PFHd, PL e, and the SIL 3 envelope
Category 4 maps to PFHd ≤ 1.0×10⁻⁸/h, which lines up with SIL 3 on the IEC 61508/62061 scale and with the high-demand mode used in process-safety machinery risk graphs [S6][S7]. PL d sits one decade higher in failure probability (PFHd 10⁻⁷ to 10⁻⁸/h) and can be reached by Category 3 with high MTTFd, by Category 2 with DC low and MTTFd high, or by Category 3 with DC medium and MTTFd medium [S3].
Category 4 is the only category whose definition hard-codes PL e. Category 1 caps out at PL c, Category 2 caps out at PL d, and Category 3 can in principle reach PL e but is usually only documented up to PL d because of the fault-accumulation clause [S1][S5]. Specifying "PL d, Category 3" is therefore a design constraint, not a free choice, and it rules out architectures that could otherwise meet PL d more cheaply [S3].
Comparison matrix: the five categories side by side
Reading ISO 13849-1 as a single table, the five categories line up against four decision criteria: architecture, maximum PL, DC requirement, and MTTFd requirement. Category B is single-channel, max PL b, DC not applicable, MTTFd low to medium. Category 1 is single-channel with well-tried components, max PL c, DC not applicable, MTTFd high [S5]. Category 2 adds a test equipment (TE) channel with a test interval at least 100 times more frequent than the demand rate, max PL d, DC low, MTTFd low to high [S5]. Category 3 is dual-channel, single-fault tolerant, max PL d (PL e theoretically), DC at least low, MTTFd low to high [S1][S3][S5]. Category 4 is dual-channel, single-fault tolerant with fault-accumulation coverage, max PL e, DC high, MTTFd high per channel, with mandatory CCF measures [S1][S4][S6].
The decision rule is short. If the risk graph demands PL e, Category 4 is the only architecture whose definition guarantees it. If the risk graph demands only PL d, Category 2, 3, or 4 can all qualify depending on the chosen MTTFd and DC bands, and the cheapest compliant design wins. For mechanical, pneumatic, and hydraulic sub-systems where DC and reliability are typically low, redundant Category 3 or Category 4 is the practical path to PL d and above, which is why harmonized type-C standards often pin the category directly [S3].
Who Category 4 is for, and who should not specify it
Category 4 belongs on safety functions whose failure would cause serious or irreversible harm: robot cell interlocks, press safeguarding, high-energy motion stops, and similar hazards where the risk assessment under ISO 12100 lands on PL e [S2][S4]. The dual-channel structure, high DC, and CCF documentation all add component cost, panel space, and validation effort, so it is the wrong tool for a PL c or PL d function on a simple guard-door interlock [S1][S4].
For PL d, a Category 3 design with DC medium and MTTFd medium typically delivers the same probability budget with less hardware and lower CCF scoring overhead. Specifying "PL e, Category 4" on a function that only needs PL d is a frequent engineering mistake because it forces high MTTFd per channel and high DC across the entire SRP/CS when the risk graph did not require it. Conversely, omitting the fault-accumulation clause and calling a single-fault-tolerant circuit "Category 4" is a validation failure that surfaces only when DC and CCF evidence are reviewed [S1][S4].
Verification artefacts the standard expects
Category 4 cannot be claimed on a circuit diagram alone. The verification file per ISO 13849-2 has to include the SRP/CS block diagram broken into input, logic, and output (SRP/CS a/b/c), the MTTFd value for each channel from manufacturer data or ISO 13849-1 Annexes C and D, the DC calculation per ISO 13849-1 Annex E, and a CCF checklist with a minimum score of 65 from Annex F [S1][S5]. For Category 4, the DC table must also address fault accumulation, not just single-fault detection, which usually means a second diagnostic mechanism or a periodic test with a defined interval [S1][S3].
Validation under ISO 13849-2 then has to inject faults in each channel and confirm the safety function holds, with the test report cross-referenced to the PFHd calculation that justifies PL e. Skipping the fault-injection step is the most common audit finding; it is also the easiest to catch because the diagnostic test interval and the demand rate can be cross-checked numerically [S1][S4].
Common pitfalls when the spec says "PL e" without naming a category
When a type-C standard or a customer specification writes "PL e" without fixing the category, the design space opens up: Category 4 is one valid path, but a Category 3 architecture with DC high and MTTFd high per channel can theoretically clear the same bar if the fault-accumulation clause is satisfied [S1][S3]. In practice, machinery builders still reach for Category 4 because harmonized standards such as ISO 10218 (robots) and IEC 61496 (electro-sensitive protective equipment) explicitly require it, removing the design trade-off [S3].
For a process plant looking at functional safety on a packaged skid driven by a PLC and a servo motor axis, the rule of thumb is: pick the category from the type-C standard first, then verify MTTFd, DC, and CCF inside that category. If the type-C standard is silent, run the PL calculation in both Category 3 and Category 4 and choose the cheaper option that still meets PFHd ≤ 1.0×10⁻⁸/h. A safety-rated pressure sensor or pressure transmitter channel that is already rated PL d / SIL 2 cuts the diagnostic coverage burden, but the logic solver still has to clear the fault-accumulation clause on its own [S1][S6].
Track the next revision of ISO 13849-1 as the maintenance cycle on the 2015 edition closes, watch for any tightening of the DC avg threshold above 99% in Category 4, and confirm that supplier PFHd data on safety I/O modules is published per channel and not aggregated across the SRP/CS, because aggregated numbers break the per-channel MTTFd requirement that defines Category 4.
See also our earlier report, Image-Based Code Readers vs Laser Scanners for DPM Marks: Spec Decision Map.