What is ISO 13849?
ISO 13849 is a two-part international series of standards for the safety-related parts of machine control systems (SRP/CS), defining how you design a safety function, calculate the Performance Level it achieves and validate the result. Part 1 (ISO 13849-1) sets out the design principles and the calculation method; part 2 covers validation. The standard applies to every technology: electrical, electronic, programmable, pneumatic, hydraulic and mechanical. The series is published by ISO and is used in machine building, packaging lines, robotics and intralogistics. In Europe it is issued as EN ISO 13849 and is a harmonised standard under the Machinery Directive. In the Netherlands you will find the same standard as NEN-EN-ISO 13849, the Dutch publication of the European adoption: technically identical to the ISO text, with a NEN cover page.
🧠 What exactly does ISO 13849 cover?
ISO 13849 answers one question: is a safety function reliable enough for the risk it has to cover? A safety function is the chain of detection, logic and output that brings a machine into a safe state, for example a door switch, a safety relay and two contactors that switch off a motor.
The standard works with two levels:
- PLr (required) - the required Performance Level, derived from the risk assessment
- PL (achieved) - the level the design demonstrably reaches, based on architecture, reliability, diagnostics and protection against common cause failures
The design is acceptable once PL ≥ PLr for every safety function. Typical safety functions are the emergency stop (itself covered by ISO 13850), an interlock on a guard, a light curtain to IEC 61496, two-hand control and safely limited speed.
ISO 13849 targets functions with a high demand rate or continuous operation, which is typical for machinery. For safety functions with a low demand rate, as in the process industry, the 2023 edition refers to IEC 61508; in practice IEC 61511 applies there.
🕰️ How did the standard develop?
| Year | Document | Significance |
|---|---|---|
| 1996 | EN 954-1 | European predecessor based only on categories B and 1 to 4 |
| 1999 | ISO 13849-1, first edition | ISO adoption of EN 954-1 |
| 2003 | ISO 13849-2, first edition | Validation of safety-related parts |
| 2006 | ISO 13849-1, second edition | Introduction of Performance Levels, MTTFd, DC and CCF |
| 31 December 2011 | End of EN 954-1 | No longer gives presumption of conformity under the Machinery Directive |
| 2012 | ISO 13849-2, second edition | Still the current validation edition |
| 2015 | ISO 13849-1, third edition | Limited revision with clarifications |
| 2023 | ISO 13849-1, fourth edition | Restructured to follow the design process |
| 15 May 2024 | EN ISO 13849-1:2023 in the Official Journal | Harmonised under the Machinery Directive by Decision (EU) 2024/1329 |
The big step came in 2006: EN 954-1 only looked at architecture (the category), whereas ISO 13849-1 added a quantitative probability of failure.
🔧 How do you determine the required Performance Level?
The risk graph in Annex A of part 1 combines three parameters:
- S, severity of injury - S1 is slight and normally reversible, S2 is serious and normally irreversible, including death
- F, frequency and duration of exposure - F2 if someone is exposed to the hazard more than once every 15 minutes; F1 if not, and the cumulative exposure does not exceed 1/20 of the operating time
- P, possibility of avoiding the hazard - P1 if avoidance is possible under specific conditions, P2 if it is scarcely possible
| Severity | Frequency | Avoidance | PLr |
|---|---|---|---|
| S1 | F1 | P1 | a |
| S1 | F1 | P2 | b |
| S1 | F2 | P1 | b |
| S1 | F2 | P2 | c |
| S2 | F1 | P1 | c |
| S2 | F1 | P2 | d |
| S2 | F2 | P1 | d |
| S2 | F2 | P2 | e |
The 2023 edition adds guidance in Annex A for choosing P1 or P2. A machine-specific type-C standard may also prescribe the PLr directly, in which case it takes precedence.
📊 What makes up the achieved PL?
The achieved PL follows from four quantities:
- Category - the architecture (B, 1, 2, 3 or 4)
- MTTFd - mean time to dangerous failure per channel: low 3–10 years, medium 10–30 years, high 30–100 years
- DCavg - diagnostic coverage: none (< 60%), low (60–90%), medium (90–99%) or high (≥ 99%)
- CCF - measures against common cause failures, scored with a points system in which at least 65 points are required for categories 2, 3 and 4
| Category | Structure | Maximum PL |
|---|---|---|
| B | Single channel, basic safety principles, no diagnostics | b |
| 1 | Single channel with well-tried components and high MTTFd | c |
| 2 | Single channel with periodic testing by test equipment | d |
| 3 | Two channels; a single fault does not lead to loss of the function | e |
| 4 | Two channels with high MTTFd and DC ≥ 99%; faults are detected in time | e |
Each PL corresponds to a band of the average probability of a dangerous failure per hour (PFHd). The calculation method assumes a mission time of 20 years.
| PL | PFHd per hour | Comparable SIL (IEC 62061) |
|---|---|---|
| a | ≥ 10⁻⁵ to < 10⁻⁴ | none |
| b | ≥ 3 × 10⁻⁶ to < 10⁻⁵ | SIL 1 |
| c | ≥ 10⁻⁶ to < 3 × 10⁻⁶ | SIL 1 |
| d | ≥ 10⁻⁷ to < 10⁻⁶ | SIL 2 |
| e | ≥ 10⁻⁸ to < 10⁻⁷ | SIL 3 |
For electromechanical parts such as contactors and switches, you calculate MTTFd from the manufacturer’s B10d value and the number of operations per year (n_op): MTTFd = B10d / (0.1 × n_op). A door that is opened frequently therefore sharply reduces the MTTFd of its door switch. In addition, T10d = B10d / n_op indicates after how many years 10% of the units will have failed dangerously; if that value is shorter than the mission time, you must replace the part preventively.
Worked example. Take a door switch for which the manufacturer states a B10d of 2 million operations, on a machine that runs 16 hours a day, 220 days a year:
| Scenario | n_op per year | MTTFd | T10d | Consequence |
|---|---|---|---|---|
| Door opened 6 times per hour | 21,120 | 947 years, counted as 100 years (high) | approx. 95 years | No replacement needed within 20 years |
| Door opened every 30 seconds | 422,400 | approx. 47 years (high) | approx. 4.7 years | Replace the switch after about 4.5 years |
Both scenarios give a high MTTFd, but in the second the replacement must be in the maintenance plan. If you combine such channels in a category 3 structure with medium diagnostic coverage (DCavg medium) and sufficient CCF measures, the bar chart of the simplified method gives PL e.
🆕 What changed in ISO 13849-1:2023?
The fourth edition grew from 104 to 172 pages and now follows the order of the design process. The main changes:
- Safety requirements specification - each safety function is documented with its trigger, safe state, PLr, response time, operating modes, restart conditions and behaviour on loss of energy
- Dedicated software clause - the software requirements, a subclause in 2015, now form a separate and expanded clause for safety-related embedded and application software, for example in a safety PLC
- Ergonomics - more attention to ergonomic aspects of design, because awkward operation invites people to defeat safeguards
- EMC - a new informative Annex L with four alternative routes to demonstrate sufficient immunity to electromagnetic interference
- Avoidance parameter P - Annex A gives a structured method for choosing P1 or P2
- Scope - explicitly limited to high demand and continuous mode
- IT security - outside the scope, although the standard notes that security threats can compromise safety functions
At ISO level the 2015 edition has been replaced by this one. In the EU, EN ISO 13849-1:2023 has been cited in the Official Journal since 15 May 2024; the 2015 edition was given a three-year transition period, and CEN withdrew it on 31 May 2026. For new designs the 2023 edition is the sensible choice, not least because the Machinery Directive itself will be repealed on 20 January 2027.
🔐 What does ISO 13849 mean for IT/OT and cybersecurity?
ISO 13849 deals with random hardware failures and systematic faults, not with an attacker. A safety PLC that comfortably reaches PL e can still be reprogrammed through an unprotected engineering connection. That is why complementary documents exist:
- ISO/TR 22100-4:2018 - guidance for machine builders on including IT security aspects in the risk assessment
- IEC TS 63074:2023 - applies IEC 62443 to safety-related control systems of machinery
- Machinery Regulation (EU) 2023/1230 - from 20 January 2027 makes protection against corruption and malicious interference an essential requirement
- Cyber Resilience Act - sets requirements for products with digital elements, such as safety controllers and network components
Safety communication between safety components, for example with PROFIsafe or CIP Safety, protects against transmission errors, but it is no substitute for network segmentation and access control.
🧭 How do you apply ISO 13849 step by step?
- Carry out the risk assessment according to ISO 12100 and decide which risks you will reduce with control measures. That standard uses a three-step method: inherently safe design first, then technical protective measures (including the safety functions of ISO 13849), and only last information for use such as warnings and prescribed personal protective equipment (PPE).
- Specify each safety function with trigger, reaction, response time and the PLr from the risk graph or the type-C standard.
- Choose the architecture and components: safety relays, safety PLCs, interlocking devices to ISO 14119 and safety distances to ISO 13855.
- Calculate the achieved PL per subsystem (input, logic, output), for example with the free SISTEMA software from the German institute IFA, and combine the results.
- Develop the software according to the software requirements of part 1.
- Validate according to ISO 13849-2 by analysis and testing, using the fault lists and well-tried safety principles for mechanical, pneumatic, hydraulic and electrical technology.
- Document everything in the technical file for CE marking.
In the Netherlands the Machinery Directive is transposed through the Warenwetbesluit machines (Commodities Act Decree on machinery), and the Netherlands Labour Authority carries out market surveillance of machinery. For machines already in use, the employer is bound by the Dutch Working Conditions Act and chapter 7 of the Working Conditions Decree on work equipment. Under the Machinery Regulation, anyone who substantially modifies an existing machine becomes its manufacturer and must reassess the safety functions. The electrical equipment itself falls under IEC 60204-1.
🏭 Where do you meet ISO 13849, and how do you keep safety functions effective?
In industrial automation, ISO 13849 is present in almost every machine with moving parts: conveyors, presses, packaging lines, robot cells and palletisers. The safety functions are physically spread across the installation. A sensor such as a door switch or light curtain forms the input, a safety relay or safety PLC in the control cabinet forms the logic, and contactors, relays or an actuator such as a safety valve form the output. Each of these three subsystems counts in the PL calculation. A standard PLC is not developed as a safety component: if you still use one in a safety function, you must substantiate its failure data, diagnostics and software quality yourself. That is why the logic is usually a certified safety relay or a safety PLC with a stated PL.
| Safety function | Typical components | Point of attention |
|---|---|---|
| Emergency stop | E-stop button, safety relay, two contactors | Complementary measure, never a substitute for guarding |
| Guard monitoring | Interlocked door switch, safety PLC | Risk of defeat, addressed by ISO 14119 |
| Access monitoring | Light curtain or light grid | Safety distance and response time to ISO 13855 |
| Two-hand control | Two push buttons with synchronism monitoring | Both hands kept outside the danger zone |
| Safely limited speed | Variable frequency drive with integrated safety | Setting and maintenance with the guard open |
Diagnostics matter a great deal in practice. Safety inputs often send short test pulses over the wiring to detect short circuits between the two channels or to the supply. For category 2, the simplified method assumes the test runs at least 100 times as often as the demand on the safety function; under conditions the standard also accepts a lower ratio of no less than 25.
A safety function only stays reliable if the user maintains it that way. Components whose T10d is shorter than the mission time must be replaced in time, and a bypassed door switch makes the whole PL worthless. Maintenance on PL-related equipment should therefore take place under Lock-out Tag-out and a work permit, with a functional test before the machine returns to production. Include the safety functions in the Dutch risk inventory and evaluation (RI&E) and in periodic inspections or an internal audit. When you replace a component, choose a type with at least the same safety characteristics (B10d, MTTFd or PL) and record the change.
🔄 How does ISO 13849 relate to other standards?
| Standard | Role alongside ISO 13849 |
|---|---|
| ISO 12100 | General risk assessment and risk reduction for machinery |
| IEC 62061 | Alternative machinery standard using SIL 1 to 3; the 2021 edition also covers non-electrical technologies |
| IEC 61508 | Basic standard for functional safety, including low demand mode |
| ISO 14119 | Interlocking devices associated with guards |
| ISO 13855 | Positioning of safeguards with respect to approach speeds |
| IEC 61496 | Electro-sensitive protective equipment such as light curtains |
For most machine builders the choice between ISO 13849 and IEC 62061 is mainly practical: ISO 13849 is common for mixed technologies and simple architectures, IEC 62061 for complex programmable systems. Both standards are harmonised and give a presumption of conformity.
❓ Frequently asked questions
What is the difference between ISO 13849-1 and ISO 13849-2?
ISO 13849-1 describes the design principles, the risk graph, the categories and the calculation of the Performance Level. ISO 13849-2 describes how you validate the design by analysis and testing, with fault lists per technology. Together they form the ISO 13849 series.
Is ISO 13849 mandatory?
ISO 13849 is not legally mandatory, because European harmonised standards are applied voluntarily. If you follow EN ISO 13849-1, however, you gain a presumption of conformity with the Machinery Directive’s safety requirements for control systems. Another route to compliance is allowed, but then you must demonstrate yourself that the machine is equally safe.
Which Performance Level does an emergency stop need?
The required Performance Level of an emergency stop follows from the risk assessment and from any type-C standard for that kind of machine. There is therefore no single level for all machines. On machines with a risk of serious injury, the emergency stop in practice often ends up at PL c or PL d.
What is the difference between PL and SIL?
The Performance Level from ISO 13849 has five levels (a to e), while the Safety Integrity Level from IEC 62061 has three levels for machinery. Both are linked to the same probability of dangerous failure per hour, so PL d roughly corresponds to SIL 2 and PL e to SIL 3. PL a has no SIL equivalent.
What is the difference between ISO 13849 and NEN-EN-ISO 13849?
NEN-EN-ISO 13849 is the Dutch publication of ISO 13849, and the technical content is the same. The EN prefix means CEN has adopted the ISO standard as a European standard, with an Annex ZA that maps it to the essential requirements of the Machinery Directive. NEN then publishes that European standard in the Netherlands, so you can refer to NEN-EN-ISO 13849-1 to claim presumption of conformity.
Does ISO 13849 cover cybersecurity?
ISO 13849 does not cover cybersecurity; the standard deals with random and systematic faults, not deliberate attacks. For the security of safety controls you use IEC TS 63074, ISO/TR 22100-4 and the IEC 62443 series. The Machinery Regulation makes protection against malicious interference mandatory from 2027.
📌 In summary
ISO 13849 is the series of standards with which you demonstrate that a safety function in a machine control system achieves the required Performance Level. You determine the PLr with the risk graph, calculate the achieved PL from category, MTTFd, DC and CCF, and validate the design according to part 2. The 2023 edition adds requirements for specification, software and EMC, but you address cybersecurity with IEC 62443 and the Machinery Regulation.