What is ISO 13849-1?
ISO 13849-1 is the first part of the ISO 13849 series and sets out the general design principles for the safety-related parts of machine control systems (SRP/CS), including the method for determining the achieved Performance Level. Its official title is Safety of machinery – Safety-related parts of control systems – Part 1: General principles for design. It covers the chain of detection, logic and output that brings a machine into a safe state: an emergency stop, a light curtain, a guard interlock, a safety relay or a safety PLC. The standard applies to every technology, from electrical and programmable to pneumatic, hydraulic and mechanical.
The current version is the fourth edition of April 2023. In Europe, EN ISO 13849-1:2023 is a harmonised standard under the Machinery Directive, and it is one of the two main standards for functional safety of machinery.
In OT environments, ISO 13849-1 is the common language in which machine builder, integrator and owner agree how reliable a safety function must be, and how they prove it through calculation, design rules and validation.
🧠 What exactly does part 1 of ISO 13849 cover?
ISO 13849-1 is step 2 in the risk reduction process of ISO 12100: reducing risk with technical protective measures once inherently safe design is not enough. It describes the whole design path of a safety function and so supports structured risk management at machine level:
- Specification - what the function must do and which required Performance Level (PLr) it must reach
- Design - architecture (category), component reliability, diagnostics and measures against common cause failures
- Software - requirements for safety-related software in a programmable controller
- Verification and validation - demonstrating that the achieved PL is at least equal to the PLr
The standard targets functions in high demand or continuous mode, which it defines as demanded more often than once a year. For low demand functions, as found in the process industry, the 2023 edition refers to IEC 61508; in practice IEC 61511 applies there. IT security is outside the scope.
| Aspect | ISO 13849-1 | ISO 13849-2 |
|---|---|---|
| Content | Design principles, categories, PL calculation, software | Validation, fault lists, well-tried safety principles |
| Current edition | 2023 (fourth edition) | 2012 (second edition) |
| Validation | Included as clause 10 since 2023 | Tables and examples per technology |
| Precedence | Takes priority while part 2 is being revised | Remains a reference for fault lists |
🗂️ How is the 2023 edition structured?
The 2015 edition brought mainly editorial improvements. The 2023 edition is a thorough revision that follows the order of the design process:
| Clause or annex | Subject |
|---|---|
| 4 | Overview and place in the risk reduction process |
| 5 | Specification of safety functions, PLr and decomposition into subsystems |
| 6 | Design: categories, MTTFd, DC, CCF, systematic failures, fault exclusion, combination of subsystems, parameterisation |
| 7 | Software requirements |
| 8 and 9 | Verification of the achieved PL and ergonomics |
| 10 | Validation, taken over from part 2 |
| 11 to 13 | Maintainability, technical documentation and information for use |
| Annex A | Risk graph for the PLr |
| Annexes C to F | MTTFd values, diagnostic coverage and the CCF scoring system |
| Annex G | Systematic failures and the functional safety plan |
| Annex L | Electromagnetic interference immunity |
| Annexes M, N and O | Typical safety functions, software measures and device types |
A notable change of name: the former PFHd is now PFH, the average frequency of a dangerous failure per hour. This aligns the standard with IEC 62061 and IEC 61508 and changes nothing technically.
📋 What must a safety function specification contain?
Since 2023, clause 5 requires a safety requirements specification (SRS) for each safety function. Among other things, it records:
- Trigger and reaction - which event demands the function and which safe state follows
- PLr and response time - the required level and the time to reach the safe state
- Operating modes and interfaces - when the function is active and how it interacts with the control system and other functions
- Energy loss and restart - behaviour on loss of power or compressed air, and the conditions for restarting
- Demand rate and priority - how often the function is demanded and which function takes precedence in a conflict
The standard also requires a manual reset to respond to a monitored signal edge, treats an operating mode selector that enables or disables safety functions as a safety function in its own right, and asks you to minimise any motivation to defeat safeguards. For OT teams, subclause 5.2.4 matters: remote access must by default be limited so that no danger arises for someone who is in the hazard zone unnoticed. The SRS is reviewed before design starts. Annex M contains tables of typical safety functions, such as:
| Safety function | Typical components |
|---|---|
| Emergency stop | Emergency stop button with positive-opening contacts and a monitored safety relay |
| Guarded access door | Door switch or guard locking device with feedback to the safety logic |
| Two-hand control | Two buttons that must be operated simultaneously within a short time |
| Safely limited speed | Encoder and drive with safe motion functions, monitored by a safety PLC |
| Light curtain trip | Light curtain that stops the hazardous movement as soon as the detection zone is interrupted |
The required PL of such a function is not fixed: it follows from the risk assessment or from a type-C standard.
🔧 How do you determine the achieved PL?
The required PLr follows from the risk graph in Annex A, using severity of injury (S), frequency and duration of exposure (F) and the possibility of avoiding the hazard (P). A type-C standard for a specific machine type may also prescribe the PLr directly. The achieved PL follows from category, MTTFd, average diagnostic coverage (DCavg) and CCF measures, with a mission time of 20 years as the calculation basis.
| Term | Meaning | Classification |
|---|---|---|
| Category | Architecture and fault behaviour of a subsystem | B, 1, 2, 3 and 4; two-channel from category 3 |
| MTTFd | Mean time to dangerous failure per channel | Low 3 to 10 years, medium 10 to 30 years, high from 30 years |
| DCavg | Share of dangerous failures detected by diagnostics | None < 60%, low 60 to 90%, medium 90 to 99%, high ≥ 99% |
| CCF | Common cause failure affecting both channels at once | At least 65 of 100 points in Annex F for categories 2, 3 and 4 |
| PL | PFH per hour | Common realisation according to the bar chart |
|---|---|---|
| a | ≥ 10⁻⁵ to < 10⁻⁴ | Category B with low MTTFd |
| b | ≥ 3 × 10⁻⁶ to < 10⁻⁵ | Category B with medium or high MTTFd |
| c | ≥ 10⁻⁶ to < 3 × 10⁻⁶ | Category 1 with well-tried components and high MTTFd |
| d | ≥ 10⁻⁷ to < 10⁻⁶ | Category 2 with medium DCavg and high MTTFd, or category 3 with medium DCavg and medium MTTFd |
| e | ≥ 10⁻⁸ to < 10⁻⁷ | Category 3 with medium DCavg and high MTTFd, or category 4 |
The 2023 edition tightens several design rules:
- Category 2 - each part (input, logic, output) needs at least low diagnostic coverage (60%). The test rate must be at least one hundred times the demand rate, or the test must take place immediately upon demand. The maximum is PL d.
- Well-tried components - complex components, such as a microcontroller, never count as well-tried.
- Fault exclusion - PL e for a subsystem may not rely solely on fault exclusion.
- Wearing parts - the MTTFd of a contactor or switch follows from its B10d and the number of operations. If the manufacturer only gives a B10, then B10d = B10 divided by the ratio of dangerous failures (50% by default). The T10d, the point of preventive replacement, remains capped at twice the T10.
- Combining subsystems - the preferred method is to add the PFH values of input, logic and output; a table method exists for subsystems without a PFH value.
Redundancy is therefore not needed for every high level: PL d is also possible with a single monitored channel in category 2. PL e requires a two-channel structure.
💻 What software requirements does ISO 13849-1 set?
Clause 7 distinguishes two kinds of software:
- SRESW (embedded software) - the firmware inside a component, usually written in a full variability language (FVL) such as C
- SRASW (application software) - the program an integrator writes in a safety PLC, often in a limited variability language (LVL)
IEC 61131-3 languages such as ladder diagram, function block diagram and SFC count as LVL. For SRASW in LVL using validated function blocks on verified hardware, the standard allows a simplified two-stage V-model. Annex N helps you select the mandatory and recommended measures per PL. Subclause 6.3 separately covers software-based parameterisation, such as an authorised person setting a safe speed limit. The standard explicitly contains no specific requirements for artificial intelligence.
🔄 How does ISO 13849-1 relate to other standards and legislation?
| Standard or law | Relation to ISO 13849-1 |
|---|---|
| IEC 62061 | Equivalent machinery standard based on SIL; subsystems from both standards can be combined |
| IEC 61508 | Basic functional safety standard; applies to low demand functions |
| ISO 12100 | Risk assessment that precedes PLr determination |
| ISO 14119 | Interlocking devices for guards and doors |
| ISO 13855 | Safety distances, including for light curtains |
| IEC 61496 | Electro-sensitive protective equipment such as light curtains |
| NEN-EN-ISO 13850 | Design principles for the emergency stop function |
| IEC 60204-1 | Electrical equipment of machines |
| Machinery Directive | Harmonised standard via the Official Journal; gives a presumption of conformity |
| Machinery Regulation | Replaces the Machinery Directive on 20 January 2027 |
The Machinery Directive itself does not name standards. EN ISO 13849-1:2023 gained its status through Implementing Decision (EU) 2024/1329, published on 15 May 2024, which removes the listing of the 2015 edition with effect from 15 May 2027. Because the Machinery Regulation applies earlier, the 2023 edition is the logical choice for new designs.
🧭 How do you apply ISO 13849-1 in a project?
Take a robot cell with an access door. The risk assessment finds serious injury (S2), frequent access (F2) and little chance of avoiding the hazard (P2), so PLr e.
- Write the SRS - trigger: door opened; reaction: robot and conveyor stop within the permitted response time; restart only after a deliberate reset from outside the cell.
- Decompose the function - input (two door switches according to ISO 14119), logic (safety PLC or safety relay), output (two contactors or the safe torque off of a variable frequency drive).
- Choose the architecture - category 3 or 4 per subsystem, with contactor feedback and cross-monitoring of the switches.
- Calculate - take the PFH of certified components from their data sheets, calculate the MTTFd of the switches from B10d and the number of door openings, and add up. The free SISTEMA software from the German institute IFA supports the 2023 edition in version 3.x.
- Assess CCF and EMC - at least 65 points for CCF; for electromagnetic immunity you choose one of the four routes in Annex L.
- Validate - analysis plus at least a functional test of every safety function, including fault simulation, for example supported by an FMEA.
- Document - record the result in the technical file for the CE marking and pass replacement intervals on to the owner.
In the Netherlands, the standard is published as NEN-EN-ISO 13849-1 and the Netherlands Labour Authority supervises machinery. An owner who substantially modifies a machine, for example by changing the safety software in a way that creates a new hazard or a higher risk, becomes the manufacturer under the Machinery Regulation and must reassess the safety functions.
⚠️ Which mistakes are common in practice?
- No or late PLr determination - the design is chosen before the risk assessment is finished
- Mismatch between components and requirement - a PL d component in a function that requires PL e
- Overly optimistic diagnostics - claiming high DC without an FMEA or with too few tests
- Forgetting CCF - for example two channels on one shared power supply or in one cable
- Standard PLC for safety functions - an ordinary PLC without certified safety functions and without validation
- Ignoring wear - no replacement plan for switches whose T10d falls within the mission time
🔐 What does ISO 13849-1 mean for OT security?
ISO 13849-1 deals with random and systematic failures, not with an attacker. A safety PLC that reaches PL e can still be modified through an unprotected engineering connection. For security the standard therefore points to ISO/TR 22100-2 and IEC TS 63074; the latter applies IEC 62443 to safety-related control systems. From 20 January 2027 the Machinery Regulation makes protection against corruption of safety-relevant software an essential requirement. Safety protocols such as PROFIsafe protect against transmission errors, but they do not replace access control and change management.
❓ Frequently asked questions
What is the difference between ISO 13849 and ISO 13849-1?
ISO 13849 is the series of standards for safety-related parts of machine control systems. ISO 13849-1 is part 1 with the design principles, categories and PL calculation, while ISO 13849-2 describes validation. Since 2023, the validation requirements are also included in clause 10 of ISO 13849-1.
Which edition of ISO 13849-1 is current?
The current edition of ISO 13849-1 is the fourth edition of April 2023. EN ISO 13849-1:2023 has been listed in the Official Journal of the EU since 15 May 2024. The 2015 edition still gives a presumption of conformity under the Machinery Directive until 15 May 2027.
Is ISO 13849-1 mandatory?
ISO 13849-1 is not legally mandatory. A machine designed according to the harmonised EN ISO 13849-1 does, however, benefit from a presumption of conformity with the requirements for control systems. A manufacturer may also use IEC 62061 or another demonstrably equivalent method.
What does PFH mean in ISO 13849-1?
In ISO 13849-1, PFH stands for the average frequency of a dangerous failure per hour. Each Performance Level corresponds to a PFH band, from below 10⁻⁴ for PL a to below 10⁻⁷ for PL e. In the 2015 edition this quantity was still called PFHd.
Can a PLC with software comply with ISO 13849-1?
A programmable controller can comply with ISO 13849-1 if it is a safety PLC with a PL or SIL rating from the manufacturer and the application software is developed according to clause 7. A standard PLC without safety certification is generally not suitable. The software must be verified, validated and kept under change management.
Which software do you use to calculate the PL?
A widely used tool for ISO 13849-1 is SISTEMA from the German institute IFA, which is available free of charge. Version 3.x supports the 2023 edition and works with libraries of component values from manufacturers. The software does not replace knowledge of the standard, but it makes the calculation and documentation traceable.
📌 In summary
ISO 13849-1 is the base standard with which you specify, design, calculate and validate machine safety functions up to the required Performance Level. The 2023 edition follows the design process, from SRS to validation, with stricter rules for category 2, fault exclusion, software and EMC; for OT teams, security remains a complementary task through IEC TS 63074 and IEC 62443.