What is Performance Level (PL)?
Performance Level (PL) is the measure defined in NEN-EN-ISO 13849 that expresses, in five levels from PL a to PL e, how reliably a machine’s safety function performs, measured as the average probability of a dangerous failure per hour. The higher the letter, the lower that probability: PL a stands for fewer than one dangerous failure per 10,000 hours, PL e for fewer than one per 10 million hours. The concept was introduced in ISO 13849-1 in 2006 and has since become the common language in which machine builders, integrators and owners across Europe agree how good an emergency stop, a light curtain or a door interlock needs to be.
PL is not a property of a single component but of the complete safety function: sensor, logic and output together. A certified safety relay rated PL e does not deliver PL e if the door switch or the contactor cannot reach that level.
🧠 What is the difference between PLr and the achieved PL?
Everything about PL revolves around two values that you compare:
- PLr (required) - the required level, which follows from the risk assessment according to ISO 12100
- PL (achieved) - the level the design demonstrably reaches, calculated from architecture, reliability and diagnostics
The rule is simple: the achieved PL must be at least equal to the PLr. A function with PLr d may therefore be built with PL d or PL e, but not with PL c. A machine-specific type C standard can also prescribe the PLr directly; it then takes precedence over your own determination.
🔧 How do you determine the required PLr?
Annex A of ISO 13849-1 provides a risk graph with three parameters:
- S, severity of injury - S1 is slight and normally reversible, S2 is serious and normally irreversible, including death
- F, frequency and duration of exposure - F2 if someone is exposed to the hazard more often than once every 15 minutes; F1 if not, and the cumulative exposure is no more than 1/20 of the operating time
- P, possibility of avoiding the hazard - P1 if avoidance is possible under specific conditions, P2 if it is scarcely possible
| Severity | Exposure | Avoidance | PLr |
|---|---|---|---|
| S1 | F1 | P1 | a |
| S1 | F1 | P2 | b |
| S1 | F2 | P1 | b |
| S1 | F2 | P2 | c |
| S2 | F1 | P1 | c |
| S2 | F1 | P2 | d |
| S2 | F2 | P1 | d |
| S2 | F2 | P2 | e |
Each safety function gets its own PLr. A machine therefore often has several levels side by side, for example PL d for the door interlock and PL c for speed monitoring during setup.
📊 What do the levels PL a to PL e mean?
Each level is linked to a band of the average frequency of a dangerous failure per hour. In the 2023 edition this quantity is called PFH; before that it was called PFHd. This makes PL a core concept within functional safety. Through that failure frequency, PL can be compared with the Safety Integrity Level of IEC 62061.
| PL | Dangerous failures per hour (PFH) | Comparable SIL | Typical situation according to the risk graph |
|---|---|---|---|
| a | ≥ 10⁻⁵ to < 10⁻⁴ | none | Slight injury, rare exposure, easy to avoid |
| b | ≥ 3 × 10⁻⁶ to < 10⁻⁵ | SIL 1 | Slight injury with more frequent exposure or poor avoidability |
| c | ≥ 10⁻⁶ to < 3 × 10⁻⁶ | SIL 1 | Slight injury with frequent exposure; or serious injury, rare and avoidable |
| d | ≥ 10⁻⁷ to < 10⁻⁶ | SIL 2 | Serious injury with limited exposure or limited avoidability |
| e | ≥ 10⁻⁸ to < 10⁻⁷ | SIL 3 | Serious injury, frequent exposure and scarcely avoidable |
In practice, PL c is usually the lower bound for an emergency stop, and machines with a risk of serious injury often end up at PL d. PL d is common for the safety functions of robots, and a type 4 light curtain reaches up to PL e.
🏗️ What is the achieved PL calculated from?
The achieved PL follows from four quantities, with a mission time of 20 years as the basis for the calculation:
- Category - the architecture: one or two channels, with or without testing
- MTTFd - mean time to dangerous failure per channel: low 3–10 years, medium 10–30 years, high 30–100 years
- DCavg - average diagnostic coverage: low 60–90%, medium 90–99%, high from 99%
- CCF - measures against common cause failures, such as separate power supplies and cables; at least 65 points from category 2 upwards
| Category | Structure | DCavg | Maximum PL |
|---|---|---|---|
| B | Single channel, basic principles | none | b |
| 1 | Single channel with well-tried components | none | c |
| 2 | Single channel with periodic testing | low to medium | d |
| 3 | Two channels, a single fault does not cause loss of the function | low to medium | e |
| 4 | Two channels, a single fault is detected in time and an accumulation of faults does not cause loss of the function | high | e |
This corrects a frequently heard rule of thumb: fault detection is not “mandatory from PL c onwards”. PL c can be achieved with category 1 without diagnostics, provided the components are well tried and have a high MTTFd. Diagnostics and redundancy only become necessary for the higher levels: PL d is possible with a single monitored channel in category 2, while PL e requires a two-channel structure.
For wearing parts such as contactors and door switches, you calculate the MTTFd from the manufacturer’s B10d value and the number of operations per year: MTTFd = B10d / (0.1 × n_op). A door that opens frequently therefore significantly lowers the MTTFd of its switch. The free SISTEMA software from the German institute IFA performs these calculations; version 3.x follows the 2023 edition, version 2.x the 2015 edition.
🧭 How do you apply PL in a project?
Take a packaging machine with a guard door for changing format parts. A trapped hand can cause permanent injury (S2), the operator opens the door a few times per shift (F1) and cannot avoid the movement (P2). The risk graph gives PLr d.
- Specify the function - door open means: drives stop and the variable frequency drive safely removes torque; restart only after a deliberate reset.
- Choose the components - two door switches according to ISO 14119, a safety relay or safety PLC as logic, and a certified safe torque off function in the drive.
- Choose the architecture - category 3 with medium diagnostic coverage and contactor feedback reaches PL d or higher here.
- Calculate - take the PFH values of the certified parts from the datasheets, calculate the MTTFd of the switches and add up the subsystems.
- Validate and document - test every function, including with simulated faults, and record the result in the technical file for the CE marking.
The same approach applies throughout industrial automation, including control cabinets with soft starters or motor starters: it is not the product that determines the PL, but the chain it is part of.
🇪🇺 What role does PL play in Dutch and European regulation?
| Framework | Role for PL |
|---|---|
| Machinery Directive 2006/42/EC | EN ISO 13849-1 is harmonised; following the standard gives a presumption of conformity |
| Implementing Decision (EU) 2024/1329 | Lists the 2023 edition; the reference to the 2015 edition is withdrawn on 15 May 2027 |
| Machinery Regulation (EU) 2023/1230 | Replaces the directive on 20 January 2027 and also requires protection of safety software against corruption |
| Warenwetbesluit machines | Dutch transposition of the Machinery Directive; the Netherlands Labour Authority supervises machinery for professional use |
| Arbowet and Arbobesluit | The employer keeps work equipment safe, includes it in the risk inventory and evaluation and prevents safeguards from being bypassed |
ISO 13849 itself is not legally mandatory. A manufacturer may also use IEC 62061 or another demonstrably equivalent method, but must then independently demonstrate compliance with the essential requirements. An owner who substantially modifies a machine becomes a manufacturer under the Machinery Regulation and must demonstrate the PL again.
🔐 Why is PL also an OT security issue?
A PL calculation accounts for random and systematic faults, not for an attacker. A safety PLC that achieves PL e can still be altered through an unsecured engineering station or open remote access. ISO 13849-1:2023 therefore refers, among others, to IEC TS 63074 for security, which applies IEC 62443 to safety-related control systems. Safety protocols such as PROFIsafe protect against transmission errors, but do not replace access control and change management. Also embed PL in the organisation: periodic checks during an audit, alignment with Lock-out Tag-out and the work permit during maintenance, and PPE only as the last resort.
❓ Frequently asked questions
Is PL e always better than PL d?
PL e has a lower probability of a dangerous failure than PL d, but it is not always the better choice. The Performance Level must be at least equal to the required PLr from the risk assessment. A higher level than needed makes the control system more expensive and complex without making the machine demonstrably safer for the assessed risk.
How does Performance Level relate to SIL?
Performance Level from ISO 13849-1 and SIL from IEC 62061 are linked to the same dangerous failure frequency per hour. PL b and PL c correspond to SIL 1, PL d to SIL 2 and PL e to SIL 3, while PL a has no SIL equivalent. Both standards also apply to programmable and non-electrical technology.
Can a component have a Performance Level?
Manufacturers often state a maximum achievable PL and a PFH value for safety components. The Performance Level, however, applies to the complete safety function, including sensor, logic, output and wiring. A component rated PL e therefore does not guarantee PL e for the function if another part is weaker.
Is a Performance Level legally required?
Determining a Performance Level is not literally a legal requirement, but the Machinery Directive and the Machinery Regulation do require control systems to be safe and reliable. ISO 13849-1 is the harmonised way to demonstrate this. Anyone choosing another method carries the burden of proof themselves.
Which software calculates the Performance Level?
A widely used program for the Performance Level is SISTEMA from the German institute IFA, which is available free of charge, including for commercial use. Version 3.x supports ISO 13849-1:2023 and includes libraries with manufacturers’ component values. Suppliers of safety components also offer their own calculation tools.
Does the Performance Level have to be redetermined after a change?
After a change to the safety function, such as a different switch, new software or a higher cycle rate, the Performance Level must be checked again. A higher switching frequency, for example, lowers the MTTFd of wearing parts. After a substantial modification, the owner becomes the manufacturer under the Machinery Regulation.
📌 In summary
Performance Level expresses in five levels, from PL a to PL e, how reliable a safety function is, and the achieved PL must always be at least equal to the PLr from the risk assessment. The PL follows from the category, MTTFd, diagnostic coverage and CCF of the complete chain; with the Machinery Regulation applying from 20 January 2027, protection against tampering with safety software becomes part of the picture.